# GitLab.

Every CVE that names GitLab among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first

- [Integer Overflow or Wraparound in GitLab](https://agentprime.io/advisories/CVE-2026-110264.md)
  `CVE-2026-110264` · CVE record: GitLab GitLab · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Oct 2026 · Tags: Memory corruption
- [Incorrect Authorization in GitLab](https://agentprime.io/advisories/CVE-2026-12664.md)
  `CVE-2026-12664` · CVE record: GitLab GitLab · CVSS 6.8 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Broken access control
- [Authorization Bypass Through User-Controlled Key in GitLab](https://agentprime.io/advisories/CVE-2026-13319.md)
  `CVE-2026-13319` · CVE record: GitLab GitLab · CVSS 4.3 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Broken access control
- [Use of Incorrectly-Resolved Name or Reference in GitLab](https://agentprime.io/advisories/CVE-2026-14288.md)
  `CVE-2026-14288` · CVE record: GitLab GitLab · CVSS 3.1 Low · Not analysed yet · Published 21 Oct 2026 · Tags: CWE-706
- [Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') in GitLab](https://agentprime.io/advisories/CVE-2026-15723.md)
  `CVE-2026-15723` · CVE record: GitLab GitLab · CVSS 8.2 High · Not analysed yet · Published 21 Oct 2026 · Tags: Other injection
- [Incorrect Authorization in GitLab](https://agentprime.io/advisories/CVE-2026-16255.md)
  `CVE-2026-16255` · CVE record: GitLab GitLab · CVSS 5.9 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Broken access control
- [Incorrect Authorization in GitLab](https://agentprime.io/advisories/CVE-2026-103515.md)
  `CVE-2026-103515` · CVE record: GitLab GitLab · CVSS 2.7 Low · Not analysed yet · Published 21 Oct 2026 · Tags: Broken access control
- [Use of Cache Containing Sensitive Information in GitLab](https://agentprime.io/advisories/CVE-2026-105711.md)
  `CVE-2026-105711` · CVE record: GitLab GitLab · CVSS 3.5 Low · Not analysed yet · Published 21 Oct 2026 · Tags: CWE-524
- [Insertion of Sensitive Information Into Sent Data in GitLab](https://agentprime.io/advisories/CVE-2026-105777.md)
  `CVE-2026-105777` · CVE record: GitLab GitLab · CVSS 4.3 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Information disclosure
- [Use of Less Trusted Source in GitLab](https://agentprime.io/advisories/CVE-2026-112378.md)
  `CVE-2026-112378` · CVE record: GitLab GitLab · CVSS 4.3 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: CWE-348
- [Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') in GitLab](https://agentprime.io/advisories/CVE-2026-112212.md)
  `CVE-2026-112212` · CVE record: GitLab GitLab · CVSS 7.5 High · Not analysed yet · Published 21 Oct 2026 · Tags: HTTP request smuggling
- [Improper Cleanup on Thrown Exception in GitLab](https://agentprime.io/advisories/CVE-2026-112326.md)
  `CVE-2026-112326` · CVE record: GitLab GitLab · CVSS 3.1 Low · Not analysed yet · Published 21 Oct 2026 · Tags: CWE-460
- [Incorrect Authorization in GitLab](https://agentprime.io/advisories/CVE-2026-5954.md)
  `CVE-2026-5954` · CVE record: GitLab GitLab · CVSS 4.2 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [Incorrect Authorization in GitLab](https://agentprime.io/advisories/CVE-2026-6567.md)
  `CVE-2026-6567` · CVE record: GitLab GitLab · CVSS 4.3 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [URL Redirection to Untrusted Site ('Open Redirect') in GitLab](https://agentprime.io/advisories/CVE-2026-7767.md)
  `CVE-2026-7767` · CVE record: GitLab GitLab · CVSS 5.8 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Open redirect
- [Incorrect Authorization in GitLab](https://agentprime.io/advisories/CVE-2026-9268.md)
  `CVE-2026-9268` · CVE record: GitLab GitLab · CVSS 2.7 Low · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [Insufficient Granularity of Access Control in GitLab](https://agentprime.io/advisories/CVE-2026-14210.md)
  `CVE-2026-14210` · CVE record: GitLab GitLab · CVSS 4.3 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: CWE-1220
- [Incorrect Authorization in GitLab](https://agentprime.io/advisories/CVE-2026-14552.md)
  `CVE-2026-14552` · CVE record: GitLab GitLab · CVSS 4.3 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [Permissive Regular Expression in GitLab](https://agentprime.io/advisories/CVE-2026-14814.md)
  `CVE-2026-14814` · CVE record: GitLab GitLab · CVSS 8.2 High · Not analysed yet · Published 13 Oct 2026 · Tags: CWE-625
- [Incorrect Authorization in GitLab](https://agentprime.io/advisories/CVE-2026-16275.md)
  `CVE-2026-16275` · CVE record: GitLab GitLab · CVSS 5.3 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [Incorrect Authorization in GitLab](https://agentprime.io/advisories/CVE-2026-16301.md)
  `CVE-2026-16301` · CVE record: GitLab GitLab · CVSS 8.5 High · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [Incorrect Authorization in GitLab](https://agentprime.io/advisories/CVE-2026-78335.md)
  `CVE-2026-78335` · CVE record: GitLab GitLab · CVSS 4.2 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [Incorrect Authorization in GitLab](https://agentprime.io/advisories/CVE-2026-81839.md)
  `CVE-2026-81839` · CVE record: GitLab GitLab · CVSS 7.7 High · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [Incorrect Authorization in GitLab](https://agentprime.io/advisories/CVE-2026-82632.md)
  `CVE-2026-82632` · CVE record: GitLab GitLab · CVSS 3.1 Low · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [Incorrect Authorization in GitLab](https://agentprime.io/advisories/CVE-2026-84284.md)
  `CVE-2026-84284` · CVE record: GitLab GitLab · CVSS 5.3 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [Incorrect Authorization in GitLab](https://agentprime.io/advisories/CVE-2026-85529.md)
  `CVE-2026-85529` · CVE record: GitLab GitLab · CVSS 5.3 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [Incorrect Authorization in GitLab](https://agentprime.io/advisories/CVE-2026-92528.md)
  `CVE-2026-92528` · CVE record: GitLab GitLab · CVSS 4.2 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab](https://agentprime.io/advisories/CVE-2026-92883.md)
  `CVE-2026-92883` · CVE record: GitLab GitLab · CVSS 8.7 High · Not analysed yet · Published 13 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Integer Overflow or Wraparound in GitLab](https://agentprime.io/advisories/CVE-2026-97229.md)
  `CVE-2026-97229` · CVE record: GitLab GitLab · CVSS 10.0 Critical · Critical (KEV, CVSS 9+, CVSS 7+ and EPSS) · In CISA KEV · EPSS 0.65 · Not analysed yet · Published 13 Oct 2026 · Tags: Memory corruption
- [Improper Neutralization of Input Used for LLM Prompting in GitLab](https://agentprime.io/advisories/CVE-2026-96893.md)
  `CVE-2026-96893` · CVE record: GitLab GitLab · CVSS 7.3 High · Not analysed yet · Published 13 Oct 2026 · Tags: CWE-1427
- [Server-Side Request Forgery (SSRF) in GitLab](https://agentprime.io/advisories/CVE-2026-100104.md)
  `CVE-2026-100104` · CVE record: GitLab GitLab · CVSS 3.5 Low · Not analysed yet · Published 13 Oct 2026 · Tags: Server-side request forgery (SSRF)
- [Acceptance of Extraneous Untrusted Data With Trusted Data in GitLab](https://agentprime.io/advisories/CVE-2026-100755.md)
  `CVE-2026-100755` · CVE record: GitLab GitLab · CVSS 4.6 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: CWE-349
- [Insertion of Sensitive Information into Log File in GitLab](https://agentprime.io/advisories/CVE-2026-101168.md)
  `CVE-2026-101168` · CVE record: GitLab GitLab · CVSS 6.2 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Information disclosure
- [Incorrect Authorization in GitLab](https://agentprime.io/advisories/CVE-2026-103549.md)
  `CVE-2026-103549` · CVE record: GitLab GitLab · CVSS 2.7 Low · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [Incorrect Privilege Assignment in GitLab](https://agentprime.io/advisories/CVE-2026-104661.md)
  `CVE-2026-104661` · CVE record: GitLab GitLab · CVSS 4.3 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Privilege escalation
- [Reliance on Untrusted Inputs in a Security Decision in GitLab](https://agentprime.io/advisories/CVE-2026-105458.md)
  `CVE-2026-105458` · CVE record: GitLab GitLab · CVSS 4.3 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: CWE-807
- [Allocation of Resources Without Limits or Throttling in GitLab](https://agentprime.io/advisories/CVE-2026-1403.md)
  `CVE-2026-1403` · CVE record: GitLab GitLab · CVSS 6.5 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Denial of service
- [Missing Authorization in GitLab](https://agentprime.io/advisories/CVE-2026-4523.md)
  `CVE-2026-4523` · CVE record: GitLab GitLab · CVSS 3.7 Low · Not analysed yet · Published 29 Sept 2026 · Tags: Broken access control
- [Missing Authorization in GitLab](https://agentprime.io/advisories/CVE-2026-8937.md)
  `CVE-2026-8937` · CVE record: GitLab GitLab · CVSS 4.3 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: Broken access control
- [Incorrect Authorization in GitLab](https://agentprime.io/advisories/CVE-2026-10518.md)
  `CVE-2026-10518` · CVE record: GitLab GitLab · CVSS 4.3 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: Broken access control
- [Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab](https://agentprime.io/advisories/CVE-2026-84739.md)
  `CVE-2026-84739` · CVE record: GitLab GitLab · CVSS 8.7 High · Not analysed yet · Published 29 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Double Free in GitLab](https://agentprime.io/advisories/CVE-2026-89078.md)
  `CVE-2026-89078` · CVE record: GitLab GitLab · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Sept 2026 · Tags: Memory corruption
- [Use of Less Trusted Source in GitLab](https://agentprime.io/advisories/CVE-2026-92530.md)
  `CVE-2026-92530` · CVE record: GitLab GitLab · CVSS 4.3 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: CWE-348
- [Missing Authorization in GitLab](https://agentprime.io/advisories/CVE-2026-92470.md)
  `CVE-2026-92470` · CVE record: GitLab GitLab · CVSS 7.7 High · Not analysed yet · Published 23 Sept 2026 · Tags: Broken access control
- [Incorrect Authorization in GitLab](https://agentprime.io/advisories/CVE-2026-92529.md)
  `CVE-2026-92529` · CVE record: GitLab GitLab · CVSS 4.3 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: Broken access control
- [Incorrect Authorization in GitLab](https://agentprime.io/advisories/CVE-2026-92874.md)
  `CVE-2026-92874` · CVE record: GitLab GitLab · CVSS 5.4 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: Broken access control
- [Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') in GitLab](https://agentprime.io/advisories/CVE-2026-92628.md)
  `CVE-2026-92628` · CVE record: GitLab GitLab · CVSS 3.1 Low · Not analysed yet · Published 23 Sept 2026 · Tags: Race condition
- [Integer Overflow or Wraparound in GitLab](https://agentprime.io/advisories/CVE-2026-93577.md)
  `CVE-2026-93577` · CVE record: GitLab GitLab · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Sept 2026 · Tags: Memory corruption
- [Access Control Check Implemented After Asset is Accessed in GitLab](https://agentprime.io/advisories/CVE-2026-86341.md)
  `CVE-2026-86341` · CVE record: GitLab GitLab · CVSS 4.4 Medium · Not analysed yet · Published 16 Sept 2026 · Tags: CWE-1280
- [Time-of-check Time-of-use (TOCTOU) Race Condition in GitLab](https://agentprime.io/advisories/CVE-2024-11222.md)
  `CVE-2024-11222` · CVE record: GitLab GitLab · CVSS 6.4 Medium · Not analysed yet · Published 16 Sept 2026 · Tags: Race condition
- [Allocation of Resources Without Limits or Throttling in GitLab](https://agentprime.io/advisories/CVE-2025-14871.md)
  `CVE-2025-14871` · CVE record: GitLab GitLab · CVSS 7.5 High · Not analysed yet · Published 16 Sept 2026 · Tags: Denial of service
- [Allocation of Resources Without Limits or Throttling in GitLab](https://agentprime.io/advisories/CVE-2026-1168.md)
  `CVE-2026-1168` · CVE record: GitLab GitLab · CVSS 7.5 High · Not analysed yet · Published 16 Sept 2026 · Tags: Denial of service
- [Improper Control of Resource Identifiers ('Resource Injection') in GitLab](https://agentprime.io/advisories/CVE-2026-3855.md)
  `CVE-2026-3855` · CVE record: GitLab GitLab · CVSS 3.1 Low · Not analysed yet · Published 16 Sept 2026 · Tags: CWE-99
- [Missing Authorization in GitLab](https://agentprime.io/advisories/CVE-2026-7514.md)
  `CVE-2026-7514` · CVE record: GitLab GitLab · CVSS 4.3 Medium · Not analysed yet · Published 16 Sept 2026 · Tags: Broken access control
- [Missing Authorization in GitLab](https://agentprime.io/advisories/CVE-2026-8030.md)
  `CVE-2026-8030` · CVE record: GitLab GitLab · CVSS 4.3 Medium · Not analysed yet · Published 16 Sept 2026 · Tags: Broken access control
- [Missing Authorization in GitLab](https://agentprime.io/advisories/CVE-2026-16794.md)
  `CVE-2026-16794` · CVE record: GitLab GitLab · CVSS 4.3 Medium · Not analysed yet · Published 16 Sept 2026 · Tags: Broken access control
- [Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab](https://agentprime.io/advisories/CVE-2026-19619.md)
  `CVE-2026-19619` · CVE record: GitLab GitLab · CVSS 4.7 Medium · Not analysed yet · Published 16 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab](https://agentprime.io/advisories/CVE-2026-78252.md)
  `CVE-2026-78252` · CVE record: GitLab GitLab · CVSS 8.2 High · Not analysed yet · Published 16 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Incorrect Authorization in GitLab](https://agentprime.io/advisories/CVE-2026-79708.md)
  `CVE-2026-79708` · CVE record: GitLab GitLab · CVSS 8.5 High · Not analysed yet · Published 16 Sept 2026 · Tags: Broken access control
- [Missing Authentication for Critical Function in GitLab](https://agentprime.io/advisories/CVE-2026-12910.md)
  `CVE-2026-12910` · CVE record: GitLab GitLab · CVSS 5.4 Medium · Not analysed yet · Published 15 Sept 2026 · Tags: Authentication bypass

Older: <https://agentprime.io/advisories/technology/gitlab.md?cursor=WyIyMDI2LTA5LTE1VDE3OjM2OjA2LjU5NDAwMFoiLCJDVkUtMjAyNi0xMjkxMCJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=gitlab>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/gitlab/>. Everything for agents: <https://agentprime.io/llms.txt>.