GitLab CVEs
680 vulnerabilities mapped to GitLab’s software or packages, 6 of them in CISA’s Known Exploited Vulnerabilities catalog, newest first. Not a statement that the hosted service was exposed.
CVEs mapped to a company Rewindex tracks (by CVE affected-product data, NVD CPE, vendor advisories and package feeds), every entry in CISA’s Known Exploited Vulnerabilities catalog, and CVEs named in a tracked status incident. Other CVEs are not listed. Same list on the all-vendor CVE index.
Each column is one week (Monday start, UTC), stacked by CVSS severity, by published date or the KEV date added. Dots mark entries added to CISA KEV that week. The last week is still in progress.
CVE-2025-9958 Insertion of Sensitive Information Into Sent Data in GitLab
CVSS 7.7 highEPSS 0.51%
CVE-2025-10858 Allocation of Resources Without Limits or Throttling in GitLab
CVSS 7.5 highEPSS 0.58%
CVE-2025-10867 Allocation of Resources Without Limits or Throttling in GitLab
CVSS 3.5 lowEPSS 0.33%
CVE-2025-10871 Missing Authorization in GitLab
CVSS 3.8 lowEPSS 0.38%
CVE-2025-1250 Allocation of Resources Without Limits or Throttling in GitLab
CVSS 6.5 mediumEPSS 0.49%
CVE-2025-2256 Improper Validation of Specified Quantity in Input in GitLab
CVSS 7.5 highEPSS 0.53%
CVE-2025-6454 Server-Side Request Forgery (SSRF) in GitLab
CVSS 8.5 highEPSS 0.73%
CVE-2025-6769 Exposure of Sensitive System Information to an Unauthorized Control Sphere in GitLab
CVSS 4.3 mediumEPSS 0.33%
CVE-2025-7337 Allocation of Resources Without Limits or Throttling in GitLab
CVSS 6.5 mediumEPSS 0.49%
CVE-2025-10094 Improper Validation of Specified Quantity in Input in GitLab
CVSS 6.5 mediumEPSS 0.49%
CVE-2025-2246 Missing Authorization in GitLab
CVSS 5.8 mediumEPSS 0.28%
CVE-2025-3601 Allocation of Resources Without Limits or Throttling in GitLab
CVSS 6.5 mediumEPSS 0.32%
CVE-2025-4225 Allocation of Resources Without Limits or Throttling in GitLab
CVSS 5.3 mediumEPSS 0.37%
CVE-2025-5101 Improper Control of Generation of Code ('Code Injection') in GitLab
CVSS 5.0 mediumEPSS 0.13%
CVE-2024-10219 Incorrect Authorization in GitLab
CVSS 6.5 mediumEPSS 0.45%
CVE-2024-12303 Incorrect Privilege Assignment in GitLab
CVSS 6.7 mediumEPSS 0.42%
CVE-2025-1477 Allocation of Resources Without Limits or Throttling in GitLab
CVSS 6.5 mediumEPSS 0.49%
CVE-2025-2498 Insufficient Granularity of Access Control in GitLab
CVSS 3.1 lowEPSS 0.26%
CVE-2025-2614 Allocation of Resources Without Limits or Throttling in GitLab
CVSS 6.5 mediumEPSS 0.39%
CVE-2025-2937 Inefficient Regular Expression Complexity in GitLab
CVSS 6.5 mediumEPSS 0.39%
CVE-2025-5819 Incorrect Permission Assignment for Critical Resource in GitLab
CVSS 5.0 mediumEPSS 0.27%
CVE-2025-8770 Authorization Bypass Through User-Controlled Key in GitLab
CVSS 6.5 mediumEPSS 0.34%
CVE-2025-8279 Missing Authentication for Critical Function in GitLab Language Server
CVSS 8.7 highEPSS 0.46%
CVE-2025-0765 Incorrect Authorization in GitLab
CVSS 4.3 mediumEPSS 0.46%
CVE-2025-1299 Missing Authorization in GitLab
CVSS 4.3 mediumEPSS 0.38%
CVE-2025-4976 Exposure of Sensitive Information Due to Incompatible Policies in GitLab
CVSS 4.3 mediumEPSS 0.50%
CVE-2025-7001 Insufficient Granularity of Access Control in GitLab
CVSS 4.3 mediumEPSS 0.44%
CVE-2025-3396 Incorrect Authorization in GitLab
CVSS 4.3 mediumEPSS 0.35%
CVE-2025-4972 Incorrect Authorization in GitLab
CVSS 2.7 lowEPSS 0.37%
CVE-2025-6168 Incorrect Authorization in GitLab
CVSS 2.7 lowEPSS 0.36%
CVE-2025-1754 Missing Authentication for Critical Function in GitLab
CVSS 5.3 mediumEPSS 0.30%
CVE-2025-2938 Business Logic Errors in GitLab
CVSS 3.1 lowEPSS 0.31%
CVE-2025-3279 Allocation of Resources Without Limits or Throttling in GitLab
CVSS 6.5 mediumEPSS 0.37%
CVE-2025-5315 Missing Authorization in GitLab
CVSS 4.3 mediumEPSS 0.26%
CVE-2025-5846 Missing Authorization in GitLab
CVSS 2.7 lowEPSS 0.27%
CVE-2023-5600 Missing Authorization in GitLab
CVSS 3.1 lowEPSS 0.27%
CVE-2024-4994 Cross-Site Request Forgery (CSRF) in GitLab
CVSS 8.1 highEPSS 0.39%
CVE-2024-4025 Inefficient Regular Expression Complexity in GitLab
CVSS 6.5 mediumEPSS 0.55%
CVE-2025-5121 Missing Authorization in GitLab
CVSS 8.5 highEPSS 12.4%
All vendors’ CVEs · JSON · Markdown
- CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (opens in new tab)
- This product uses data from the NVD API but is not endorsed or certified by the NVD. (opens in new tab)
- Known Exploited Vulnerabilities catalog from CISA. (opens in new tab)
- EPSS scores from FIRST (Exploit Prediction Scoring System). (opens in new tab)