# GitLab. Every CVE that names GitLab among its affected products, newest first. Vendors and products are as the CNA wrote them. ## Records, newest first (an older page) - [Allocation of Resources Without Limits or Throttling in GitLab](https://agentprime.io/advisories/CVE-2024-9367.md) `CVE-2024-9367` · CVE record: GitLab GitLab · CVSS 4.3 Medium · Not analysed yet · Published 12 Dec 2024 · Tags: Denial of service - [URL Redirection to Untrusted Site ('Open Redirect') in GitLab](https://agentprime.io/advisories/CVE-2024-9387.md) `CVE-2024-9387` · CVE record: GitLab GitLab · CVSS 6.4 Medium · Not analysed yet · Published 12 Dec 2024 · Tags: Open redirect - [Incorrect Authorization in GitLab](https://agentprime.io/advisories/CVE-2024-10043.md) `CVE-2024-10043` · CVE record: GitLab GitLab · CVSS 3.1 Low · Not analysed yet · Published 12 Dec 2024 · Tags: Broken access control - [URL Redirection to Untrusted Site ('Open Redirect') in GitLab](https://agentprime.io/advisories/CVE-2024-11274.md) `CVE-2024-11274` · CVE record: GitLab GitLab · CVSS 8.7 High · Not analysed yet · Published 12 Dec 2024 · Tags: Open redirect - [Privilege Context Switching Error in GitLab](https://agentprime.io/advisories/CVE-2024-12570.md) `CVE-2024-12570` · CVE record: GitLab GitLab · CVSS 6.7 Medium · Not analysed yet · Published 12 Dec 2024 · Tags: Privilege escalation - [Insertion of Sensitive Information into Log File in GitLab](https://agentprime.io/advisories/CVE-2024-12292.md) `CVE-2024-12292` · CVE record: GitLab GitLab · CVSS 4.0 Medium · Not analysed yet · Published 12 Dec 2024 · Tags: Information disclosure - [Exposure of Sensitive System Information to an Unauthorized Control Sphere in GitLab](https://agentprime.io/advisories/CVE-2024-10240.md) `CVE-2024-10240` · CVE record: GitLab GitLab · CVSS 5.3 Medium · Not analysed yet · Published 26 Nov 2024 · Tags: Information disclosure - [Inefficient Algorithmic Complexity in GitLab](https://agentprime.io/advisories/CVE-2024-11828.md) `CVE-2024-11828` · CVE record: GitLab GitLab · CVSS 4.3 Medium · Not analysed yet · Published 26 Nov 2024 · Tags: Denial of service - [Incorrect Authorization in GitLab](https://agentprime.io/advisories/CVE-2024-11669.md) `CVE-2024-11669` · CVE record: GitLab GitLab · CVSS 6.5 Medium · Not analysed yet · Published 26 Nov 2024 · Tags: Broken access control - [Missing Authorization in GitLab](https://agentprime.io/advisories/CVE-2024-8114.md) `CVE-2024-8114` · CVE record: GitLab GitLab · CVSS 8.2 High · Not analysed yet · Published 26 Nov 2024 · Tags: Broken access control - [Inefficient Algorithmic Complexity in GitLab](https://agentprime.io/advisories/CVE-2024-8177.md) `CVE-2024-8177` · CVE record: GitLab GitLab · CVSS 5.3 Medium · Not analysed yet · Published 26 Nov 2024 · Tags: Denial of service - [Inefficient Algorithmic Complexity in GitLab](https://agentprime.io/advisories/CVE-2024-8237.md) `CVE-2024-8237` · CVE record: GitLab GitLab · CVSS 6.5 Medium · Not analysed yet · Published 26 Nov 2024 · Tags: Denial of service - [Insufficient Session Expiration in GitLab](https://agentprime.io/advisories/CVE-2024-11668.md) `CVE-2024-11668` · CVE record: GitLab GitLab · CVSS 4.2 Medium · Not analysed yet · Published 26 Nov 2024 · Tags: Authentication bypass - [Incorrect Ownership Assignment in GitLab](https://agentprime.io/advisories/CVE-2024-9633.md) `CVE-2024-9633` · CVE record: GitLab GitLab · CVSS 3.1 Low · Not analysed yet · Published 14 Nov 2024 · Tags: CWE-708 - [Improper Restriction of Rendered UI Layers or Frames in GitLab](https://agentprime.io/advisories/CVE-2024-7404.md) `CVE-2024-7404` · CVE record: GitLab GitLab · CVSS 6.8 Medium · Not analysed yet · Published 14 Nov 2024 · Tags: CWE-1021 - [Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab](https://agentprime.io/advisories/CVE-2024-8648.md) `CVE-2024-8648` · CVE record: GitLab GitLab · CVSS 6.1 Medium · Not analysed yet · Published 14 Nov 2024 · Tags: Cross-site scripting (XSS) - [Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab](https://agentprime.io/advisories/CVE-2024-8180.md) `CVE-2024-8180` · CVE record: GitLab GitLab · CVSS 5.4 Medium · Not analysed yet · Published 14 Nov 2024 · Tags: Cross-site scripting (XSS) - [Incorrect Authorization in GitLab](https://agentprime.io/advisories/CVE-2024-9693.md) `CVE-2024-9693` · CVE record: GitLab GitLab · CVSS 8.5 High · Not analysed yet · Published 14 Nov 2024 · Tags: Broken access control - [Allocation of Resources Without Limits or Throttling in GitLab](https://agentprime.io/advisories/CVE-2024-6826.md) `CVE-2024-6826` · CVE record: GitLab GitLab · CVSS 6.5 Medium · Not analysed yet · Published 24 Oct 2024 · Tags: Denial of service - [Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab](https://agentprime.io/advisories/CVE-2024-8312.md) `CVE-2024-8312` · CVE record: GitLab GitLab · CVSS 8.7 High · Not analysed yet · Published 24 Oct 2024 · Tags: Cross-site scripting (XSS) - [Incorrect Authorization in GitLab](https://agentprime.io/advisories/CVE-2024-8970.md) `CVE-2024-8970` · CVE record: GitLab GitLab · CVSS 8.2 High · Not analysed yet · Published 11 Oct 2024 · Tags: Broken access control - [Incorrect Provision of Specified Functionality in GitLab](https://agentprime.io/advisories/CVE-2024-5005.md) `CVE-2024-5005` · CVE record: GitLab GitLab · CVSS 4.3 Medium · Not analysed yet · Published 11 Oct 2024 · Tags: CWE-684 - [Missing Authentication for Critical Function in GitLab](https://agentprime.io/advisories/CVE-2024-9164.md) `CVE-2024-9164` · CVE record: GitLab GitLab · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Oct 2024 · Tags: Authentication bypass - [Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab](https://agentprime.io/advisories/CVE-2024-6530.md) `CVE-2024-6530` · CVE record: GitLab GitLab · CVSS 7.3 High · Not analysed yet · Published 10 Oct 2024 · Tags: Cross-site scripting (XSS) - [Server-Side Request Forgery (SSRF) in GitLab](https://agentprime.io/advisories/CVE-2024-8977.md) `CVE-2024-8977` · CVE record: GitLab GitLab · CVSS 8.2 High · Not analysed yet · Published 10 Oct 2024 · Tags: Server-side request forgery (SSRF) - [Inclusion of Sensitive Information in Source Code in GitLab](https://agentprime.io/advisories/CVE-2024-9596.md) `CVE-2024-9596` · CVE record: GitLab GitLab · CVSS 3.7 Low · Not analysed yet · Published 10 Oct 2024 · Tags: CWE-540 - [Incorrect Authorization in GitLab](https://agentprime.io/advisories/CVE-2024-9623.md) `CVE-2024-9623` · CVE record: GitLab GitLab · CVSS 4.9 Medium · Not analysed yet · Published 10 Oct 2024 · Tags: Broken access control - [Exposure of Sensitive Information Due to Incompatible Policies in GitLab](https://agentprime.io/advisories/CVE-2023-3441.md) `CVE-2023-3441` · CVE record: GitLab GitLab · CVSS 6.6 Medium · Not analysed yet · Published 1 Oct 2024 · Tags: CWE-213 - [Improper Encoding or Escaping of Output in GitLab](https://agentprime.io/advisories/CVE-2024-4099.md) `CVE-2024-4099` · CVE record: GitLab GitLab · CVSS 3.1 Low · Not analysed yet · Published 26 Sept 2024 · Tags: CWE-116 - [Incorrect Provision of Specified Functionality in GitLab](https://agentprime.io/advisories/CVE-2024-8974.md) `CVE-2024-8974` · CVE record: GitLab GitLab · CVSS 2.6 Low · Not analysed yet · Published 26 Sept 2024 · Tags: CWE-684 - [Incorrect Synchronization in GitLab](https://agentprime.io/advisories/CVE-2024-4278.md) `CVE-2024-4278` · CVE record: GitLab GitLab · CVSS 5.5 Medium · Not analysed yet · Published 26 Sept 2024 · Tags: CWE-821 - [URL Redirection to Untrusted Site ('Open Redirect') in GitLab](https://agentprime.io/advisories/CVE-2024-4283.md) `CVE-2024-4283` · CVE record: GitLab GitLab · CVSS 6.4 Medium · Not analysed yet · Published 16 Sept 2024 · Tags: Open redirect - [Authorization Bypass Through User-Controlled Key in GitLab](https://agentprime.io/advisories/CVE-2024-6685.md) `CVE-2024-6685` · CVE record: GitLab GitLab · CVSS 3.1 Low · Not analysed yet · Published 16 Sept 2024 · Tags: Broken access control - [Improper Protection of Alternate Path in GitLab](https://agentprime.io/advisories/CVE-2024-8311.md) `CVE-2024-8311` · CVE record: GitLab GitLab · CVSS 6.5 Medium · Not analysed yet · Published 12 Sept 2024 · Tags: CWE-424 - [Insertion of Sensitive Information into Log File in GitLab](https://agentprime.io/advisories/CVE-2024-4472.md) `CVE-2024-4472` · CVE record: GitLab GitLab · CVSS 4.0 Medium · Not analysed yet · Published 12 Sept 2024 · Tags: Information disclosure - [Authentication Bypass by Spoofing in GitLab](https://agentprime.io/advisories/CVE-2024-6678.md) `CVE-2024-6678` · CVE record: GitLab GitLab · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 Sept 2024 · Tags: Authentication bypass - [Privilege Context Switching Error in GitLab](https://agentprime.io/advisories/CVE-2024-8641.md) `CVE-2024-8641` · CVE record: GitLab GitLab · CVSS 6.7 Medium · Not analysed yet · Published 12 Sept 2024 · Tags: Privilege escalation - [Privilege Defined With Unsafe Actions in GitLab](https://agentprime.io/advisories/CVE-2024-8631.md) `CVE-2024-8631` · CVE record: GitLab GitLab · CVSS 5.5 Medium · Not analysed yet · Published 12 Sept 2024 · Tags: Privilege escalation - [External Control of Critical State Data in GitLab](https://agentprime.io/advisories/CVE-2024-8754.md) `CVE-2024-8754` · CVE record: GitLab GitLab · CVSS 6.4 Medium · Not analysed yet · Published 12 Sept 2024 · Tags: CWE-642 - [Server-Side Request Forgery (SSRF) in GitLab](https://agentprime.io/advisories/CVE-2024-8635.md) `CVE-2024-8635` · CVE record: GitLab GitLab · CVSS 7.7 High · Not analysed yet · Published 12 Sept 2024 · Tags: Server-side request forgery (SSRF) - [Incorrect Authorization in GitLab](https://agentprime.io/advisories/CVE-2024-2743.md) `CVE-2024-2743` · CVE record: GitLab GitLab · CVSS 5.3 Medium · Not analysed yet · Published 12 Sept 2024 · Tags: Broken access control - [URL Redirection to Untrusted Site ('Open Redirect') in GitLab](https://agentprime.io/advisories/CVE-2024-4612.md) `CVE-2024-4612` · CVE record: GitLab GitLab · CVSS 6.4 Medium · Not analysed yet · Published 12 Sept 2024 · Tags: Open redirect - [Missing Authorization in GitLab](https://agentprime.io/advisories/CVE-2024-4660.md) `CVE-2024-4660` · CVE record: GitLab GitLab · CVSS 6.5 Medium · Not analysed yet · Published 12 Sept 2024 · Tags: Broken access control - [Generation of Error Message Containing Sensitive Information in GitLab](https://agentprime.io/advisories/CVE-2024-5435.md) `CVE-2024-5435` · CVE record: GitLab GitLab · CVSS 4.5 Medium · Not analysed yet · Published 12 Sept 2024 · Tags: Information disclosure - [Business Logic Errors in GitLab](https://agentprime.io/advisories/CVE-2024-6446.md) `CVE-2024-6446` · CVE record: GitLab GitLab · CVSS 3.5 Low · Not analysed yet · Published 12 Sept 2024 · Tags: CWE-840 - [Exposure of Sensitive System Information to an Unauthorized Control Sphere in GitLab](https://agentprime.io/advisories/CVE-2024-6389.md) `CVE-2024-6389` · CVE record: GitLab GitLab · CVSS 4.3 Medium · Not analysed yet · Published 12 Sept 2024 · Tags: Information disclosure - [Inefficient Regular Expression Complexity in GitLab](https://agentprime.io/advisories/CVE-2024-8124.md) `CVE-2024-8124` · CVE record: GitLab GitLab · CVSS 7.5 High · Critical (CVSS 7+ and EPSS) · EPSS 0.40 · Not analysed yet · Published 12 Sept 2024 · Tags: Denial of service - [Improper Neutralization of Special Elements used in a Command ('Command Injection') in GitLab](https://agentprime.io/advisories/CVE-2024-8640.md) `CVE-2024-8640` · CVE record: GitLab GitLab · CVSS 8.5 High · Not analysed yet · Published 12 Sept 2024 · Tags: Command injection - [Improper Access Control in GitLab](https://agentprime.io/advisories/CVE-2024-3127.md) `CVE-2024-3127` · CVE record: GitLab GitLab · CVSS 4.3 Medium · Not analysed yet · Published 22 Aug 2024 · Tags: Broken access control - [Incorrect Provision of Specified Functionality in GitLab](https://agentprime.io/advisories/CVE-2024-6502.md) `CVE-2024-6502` · CVE record: GitLab GitLab · CVSS 5.7 Medium · Not analysed yet · Published 22 Aug 2024 · Tags: CWE-684 - [Improper Neutralization of Special Elements used in a Command ('Command Injection') in GitLab](https://agentprime.io/advisories/CVE-2024-7110.md) `CVE-2024-7110` · CVE record: GitLab GitLab · CVSS 6.4 Medium · Not analysed yet · Published 22 Aug 2024 · Tags: Command injection - [Uncontrolled Resource Consumption in GitLab](https://agentprime.io/advisories/CVE-2024-8041.md) `CVE-2024-8041` · CVE record: GitLab GitLab · CVSS 6.5 Medium · Not analysed yet · Published 22 Aug 2024 · Tags: Denial of service - [Uncontrolled Resource Consumption in GitLab](https://agentprime.io/advisories/CVE-2024-2800.md) `CVE-2024-2800` · CVE record: GitLab GitLab · CVSS 6.5 Medium · Not analysed yet · Published 8 Aug 2024 · Tags: Denial of service - [Authorization Bypass Through User-Controlled Key in GitLab](https://agentprime.io/advisories/CVE-2024-3035.md) `CVE-2024-3035` · CVE record: GitLab GitLab · CVSS 6.8 Medium · Not analysed yet · Published 8 Aug 2024 · Tags: Broken access control - [Uncontrolled Resource Consumption in GitLab](https://agentprime.io/advisories/CVE-2024-3114.md) `CVE-2024-3114` · CVE record: GitLab GitLab · CVSS 4.3 Medium · Not analysed yet · Published 8 Aug 2024 · Tags: Denial of service - [Improper Control of Generation of Code ('Code Injection') in GitLab](https://agentprime.io/advisories/CVE-2024-3958.md) `CVE-2024-3958` · CVE record: GitLab GitLab · CVSS 5.3 Medium · Not analysed yet · Published 8 Aug 2024 · Tags: Code injection - [Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab](https://agentprime.io/advisories/CVE-2024-4207.md) `CVE-2024-4207` · CVE record: GitLab GitLab · CVSS 4.4 Medium · Not analysed yet · Published 8 Aug 2024 · Tags: Cross-site scripting (XSS) - [Uncontrolled Resource Consumption in GitLab](https://agentprime.io/advisories/CVE-2024-5423.md) `CVE-2024-5423` · CVE record: GitLab GitLab · CVSS 6.5 Medium · Not analysed yet · Published 8 Aug 2024 · Tags: Denial of service - [Exposure of Sensitive Information to an Unauthorized Actor in GitLab](https://agentprime.io/advisories/CVE-2024-7554.md) `CVE-2024-7554` · CVE record: GitLab GitLab · CVSS 4.9 Medium · Not analysed yet · Published 8 Aug 2024 · Tags: Information disclosure - [Uncontrolled Resource Consumption in GitLab](https://agentprime.io/advisories/CVE-2024-7610.md) `CVE-2024-7610` · CVE record: GitLab GitLab · CVSS 4.3 Medium · Not analysed yet · Published 8 Aug 2024 · Tags: Denial of service Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .