GitLab CVEs
680 vulnerabilities mapped to GitLab’s software or packages, 6 of them in CISA’s Known Exploited Vulnerabilities catalog, newest first. Not a statement that the hosted service was exposed.
CVEs mapped to a company Rewindex tracks (by CVE affected-product data, NVD CPE, vendor advisories and package feeds), every entry in CISA’s Known Exploited Vulnerabilities catalog, and CVEs named in a tracked status incident. Other CVEs are not listed. Same list on the all-vendor CVE index.
Each column is one week (Monday start, UTC), stacked by CVSS severity, by published date or the KEV date added. Dots mark entries added to CISA KEV that week. The last week is still in progress.
CVE-2025-2045 Incorrect Authorization in GitLab
CVSS 4.3 mediumEPSS 0.28%
CVE-2025-1540 Incorrect Authorization in GitLab
CVSS 3.1 lowEPSS 0.24%
CVE-2024-10925 Authorization Bypass Through User-Controlled Key in GitLab
CVSS 5.3 mediumEPSS 0.34%
CVE-2024-3303 Improper Neutralization of Input Used for LLM Prompting in GitLab
CVSS 6.4 mediumEPSS 0.40%
CVE-2025-1198 Insufficient Session Expiration in GitLab
CVSS 4.2 mediumEPSS 0.25%
CVE-2024-7102 Execution with Unnecessary Privileges in GitLab
CVSS 9.6 criticalEPSS 0.51%
CVE-2024-8266 Execution with Unnecessary Privileges in GitLab
CVSS 4.4 mediumEPSS 0.44%
CVE-2024-9870 Unintended Proxy or Intermediary ('Confused Deputy') in GitLab
CVSS 4.3 mediumEPSS 0.39%
CVE-2025-0516 Incorrect Authorization in GitLab
CVSS 4.3 mediumEPSS 0.30%
CVE-2024-12379 Allocation of Resources Without Limits or Throttling in GitLab
CVSS 6.5 mediumEPSS 0.51%
CVE-2025-1212 Exposure of Sensitive System Information to an Unauthorized Control Sphere in GitLab
CVSS 4.3 mediumEPSS 0.40%
CVE-2025-1042 Files or Directories Accessible to External Parties in GitLab
CVSS 4.9 mediumEPSS 0.43%
CVE-2025-1072 Allocation of Resources Without Limits or Throttling in GitLab
CVSS 6.5 mediumEPSS 0.54%
CVE-2024-2878 Allocation of Resources Without Limits or Throttling in GitLab
CVSS 7.5 highEPSS 19.7%
CVE-2024-3976 Missing Authorization in GitLab
CVSS 6.5 mediumEPSS 0.62%
CVE-2024-5528 Incomplete Comparison with Missing Factors in GitLab
CVSS 3.5 lowEPSS 0.41%
CVE-2024-9631 Inefficient Algorithmic Complexity in GitLab
CVSS 7.5 highEPSS 0.73%
CVE-2024-6356 Incorrect User Management in GitLab
CVSS 4.4 mediumEPSS 0.19%
CVE-2024-1539 Missing Authorization in GitLab
CVSS 4.3 mediumEPSS 0.35%
CVE-2023-6386 Allocation of Resources Without Limits or Throttling in GitLab
CVSS 6.5 mediumEPSS 0.53%
CVE-2023-6195 Server-Side Request Forgery (SSRF) in GitLab
CVSS 2.6 lowEPSS 0.32%
CVE-2024-1211 Cross-Site Request Forgery (CSRF) in GitLab
CVSS 6.4 mediumEPSS 0.30%
CVE-2025-0290 Loop with Unreachable Exit Condition ('Infinite Loop') in GitLab
CVSS 4.3 mediumEPSS 0.37%
CVE-2024-11931 Insufficient Granularity of Access Control in GitLab
CVSS 6.4 mediumEPSS 0.32%
CVE-2024-12084 Rsync: heap buffer overflow in rsync due to improper checksum length handling
CVSS 9.8 criticalEPSS 72.5%
CVE-2024-12088 Rsync: --safe-links option bypass leads to path traversal
CVSS 6.5 mediumEPSS 4.6%
CVE-2024-13041 Incorrect User Management in GitLab
CVSS 4.2 mediumEPSS 0.30%
CVE-2024-6324 Inefficient Algorithmic Complexity in GitLab
CVSS 4.3 mediumEPSS 0.71%
CVE-2024-12431 Missing Authorization in GitLab
CVSS 4.3 mediumEPSS 0.44%
CVE-2025-0194 Insertion of Sensitive Information into Externally-Accessible File or Directory in GitLab
CVSS 6.5 mediumEPSS 0.49%
CVE-2023-5117 Exposure of Sensitive Information Due to Incompatible Policies in GitLab
CVSS 3.7 lowEPSS 0.32%
CVE-2024-8116 Incorrect Authorization in GitLab
CVSS 5.3 mediumEPSS 0.47%
CVE-2024-8650 Incorrect Authorization in GitLab
CVSS 5.3 mediumEPSS 0.48%
CVE-2024-8233 Inefficient Algorithmic Complexity in GitLab
CVSS 7.5 highEPSS 0.76%
CVE-2024-8647 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab
CVSS 5.4 mediumEPSS 0.43%
CVE-2024-9367 Allocation of Resources Without Limits or Throttling in GitLab
CVSS 4.3 mediumEPSS 0.49%
CVE-2024-9387 URL Redirection to Untrusted Site ('Open Redirect') in GitLab
CVSS 6.4 mediumEPSS 0.38%
CVE-2024-10043 Incorrect Authorization in GitLab
CVSS 3.1 lowEPSS 0.46%
CVE-2024-11274 URL Redirection to Untrusted Site ('Open Redirect') in GitLab
CVSS 8.7 highEPSS 0.46%
CVE-2024-12570 Privilege Context Switching Error in GitLab
CVSS 6.7 mediumEPSS 0.45%
CVE-2024-12292 Insertion of Sensitive Information into Log File in GitLab
CVSS 4.0 mediumEPSS 0.23%
CVE-2024-10240 Exposure of Sensitive System Information to an Unauthorized Control Sphere in GitLab
CVSS 5.3 mediumEPSS 0.56%
CVE-2024-11828 Inefficient Algorithmic Complexity in GitLab
CVSS 4.3 mediumEPSS 0.61%
All vendors’ CVEs · JSON · Markdown
- CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (opens in new tab)
- This product uses data from the NVD API but is not endorsed or certified by the NVD. (opens in new tab)
- Known Exploited Vulnerabilities catalog from CISA. (opens in new tab)
- EPSS scores from FIRST (Exploit Prediction Scoring System). (opens in new tab)