# GitLab.

Every CVE that names GitLab among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first (an older page)

- [Missing Authorization in GitLab](https://agentprime.io/advisories/CVE-2024-12244.md)
  `CVE-2024-12244` · CVE record: GitLab GitLab · CVSS 4.3 Medium · Not analysed yet · Published 24 Apr 2025 · Tags: Broken access control
- [Allocation of Resources Without Limits or Throttling in GitLab](https://agentprime.io/advisories/CVE-2025-0639.md)
  `CVE-2025-0639` · CVE record: GitLab GitLab · CVSS 6.5 Medium · Not analysed yet · Published 24 Apr 2025 · Tags: Denial of service
- [Business Logic Errors in GitLab](https://agentprime.io/advisories/CVE-2025-1908.md)
  `CVE-2025-1908` · CVE record: GitLab GitLab · CVSS 7.7 High · Not analysed yet · Published 24 Apr 2025 · Tags: CWE-840
- [Improper Restriction of Rendered UI Layers or Frames in GitLab](https://agentprime.io/advisories/CVE-2025-0362.md)
  `CVE-2025-0362` · CVE record: GitLab GitLab · CVSS 6.4 Medium · Not analysed yet · Published 10 Apr 2025 · Tags: CWE-1021
- [Debug Messages Revealing Unnecessary Information in GitLab](https://agentprime.io/advisories/CVE-2025-2469.md)
  `CVE-2025-2469` · CVE record: GitLab GitLab · CVSS 3.7 Low · Not analysed yet · Published 10 Apr 2025 · Tags: CWE-1295
- [Generation of Error Message Containing Sensitive Information in GitLab](https://agentprime.io/advisories/CVE-2024-11129.md)
  `CVE-2024-11129` · CVE record: GitLab GitLab · CVSS 6.3 Medium · Not analysed yet · Published 10 Apr 2025 · Tags: Information disclosure
- [Allocation of Resources Without Limits or Throttling in GitLab](https://agentprime.io/advisories/CVE-2025-1677.md)
  `CVE-2025-1677` · CVE record: GitLab GitLab · CVSS 6.5 Medium · Not analysed yet · Published 10 Apr 2025 · Tags: Denial of service
- [Insufficient Granularity of Access Control in GitLab](https://agentprime.io/advisories/CVE-2025-2408.md)
  `CVE-2025-2408` · CVE record: GitLab GitLab · CVSS 5.3 Medium · Not analysed yet · Published 10 Apr 2025 · Tags: CWE-1220
- [Allocation of Resources Without Limits or Throttling in GitLab](https://agentprime.io/advisories/CVE-2024-10307.md)
  `CVE-2024-10307` · CVE record: GitLab GitLab · CVSS 4.3 Medium · Not analysed yet · Published 28 Mar 2025 · Tags: Denial of service
- [Insufficient Granularity of Access Control in GitLab](https://agentprime.io/advisories/CVE-2024-12619.md)
  `CVE-2024-12619` · CVE record: GitLab GitLab · CVSS 5.2 Medium · Not analysed yet · Published 28 Mar 2025 · Tags: CWE-1220
- [Improper Control of Generation of Code ('Code Injection') in GitLab](https://agentprime.io/advisories/CVE-2025-2867.md)
  `CVE-2025-2867` · CVE record: GitLab GitLab · CVSS 4.4 Medium · Not analysed yet · Published 27 Mar 2025 · Tags: Code injection
- [Improper Neutralization of Special Elements used in a Command ('Command Injection') in GitLab](https://agentprime.io/advisories/CVE-2024-9773.md)
  `CVE-2024-9773` · CVE record: GitLab GitLab · CVSS 3.7 Low · Not analysed yet · Published 27 Mar 2025 · Tags: Command injection
- [Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab](https://agentprime.io/advisories/CVE-2025-0811.md)
  `CVE-2025-0811` · CVE record: GitLab GitLab · CVSS 8.7 High · Not analysed yet · Published 27 Mar 2025 · Tags: Cross-site scripting (XSS)
- [Incorrect Authorization in GitLab](https://agentprime.io/advisories/CVE-2025-2242.md)
  `CVE-2025-2242` · CVE record: GitLab GitLab · CVSS 7.5 High · Not analysed yet · Published 27 Mar 2025 · Tags: Broken access control
- [Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab](https://agentprime.io/advisories/CVE-2025-2255.md)
  `CVE-2025-2255` · CVE record: GitLab GitLab · CVSS 8.7 High · Not analysed yet · Published 27 Mar 2025 · Tags: Cross-site scripting (XSS)
- [Incorrect Authorization in GitLab](https://agentprime.io/advisories/CVE-2024-7296.md)
  `CVE-2024-7296` · CVE record: GitLab GitLab · CVSS 2.7 Low · Not analysed yet · Published 13 Mar 2025 · Tags: Broken access control
- [Allocation of Resources Without Limits or Throttling in GitLab](https://agentprime.io/advisories/CVE-2025-1257.md)
  `CVE-2025-1257` · CVE record: GitLab GitLab · CVSS 6.5 Medium · Not analysed yet · Published 13 Mar 2025 · Tags: Denial of service
- [Improper Neutralization of Special Elements used in a Command ('Command Injection') in GitLab](https://agentprime.io/advisories/CVE-2024-8402.md)
  `CVE-2024-8402` · CVE record: GitLab GitLab · CVSS 3.7 Low · Not analysed yet · Published 13 Mar 2025 · Tags: Command injection
- [Generation of Error Message Containing Sensitive Information in GitLab](https://agentprime.io/advisories/CVE-2024-12380.md)
  `CVE-2024-12380` · CVE record: GitLab GitLab · CVSS 4.4 Medium · Not analysed yet · Published 13 Mar 2025 · Tags: Information disclosure
- [Allocation of Resources Without Limits or Throttling in GitLab](https://agentprime.io/advisories/CVE-2024-13054.md)
  `CVE-2024-13054` · CVE record: GitLab GitLab · CVSS 6.5 Medium · Not analysed yet · Published 13 Mar 2025 · Tags: Denial of service
- [Incorrect Authorization in GitLab](https://agentprime.io/advisories/CVE-2025-0652.md)
  `CVE-2025-0652` · CVE record: GitLab GitLab · CVSS 4.3 Medium · Not analysed yet · Published 13 Mar 2025 · Tags: Broken access control
- [Incorrect Authorization in GitLab](https://agentprime.io/advisories/CVE-2025-2045.md)
  `CVE-2025-2045` · CVE record: GitLab GitLab · CVSS 4.3 Medium · Not analysed yet · Published 6 Mar 2025 · Tags: Broken access control
- [Incorrect Authorization in GitLab](https://agentprime.io/advisories/CVE-2025-1540.md)
  `CVE-2025-1540` · CVE record: GitLab GitLab · CVSS 3.1 Low · Not analysed yet · Published 6 Mar 2025 · Tags: Broken access control
- [Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab](https://agentprime.io/advisories/CVE-2025-0555.md)
  `CVE-2025-0555` · CVE record: GitLab GitLab · CVSS 7.7 High · Not analysed yet · Published 3 Mar 2025 · Tags: Cross-site scripting (XSS)
- [Authorization Bypass Through User-Controlled Key in GitLab](https://agentprime.io/advisories/CVE-2024-10925.md)
  `CVE-2024-10925` · CVE record: GitLab GitLab · CVSS 5.3 Medium · Not analysed yet · Published 3 Mar 2025 · Tags: Broken access control
- [Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab](https://agentprime.io/advisories/CVE-2025-0475.md)
  `CVE-2025-0475` · CVE record: GitLab GitLab · CVSS 8.7 High · Not analysed yet · Published 3 Mar 2025 · Tags: Cross-site scripting (XSS)
- [Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab](https://agentprime.io/advisories/CVE-2024-8186.md)
  `CVE-2024-8186` · CVE record: GitLab GitLab · CVSS 5.4 Medium · Not analysed yet · Published 3 Mar 2025 · Tags: Cross-site scripting (XSS)
- [Improper Neutralization of Input Used for LLM Prompting in GitLab](https://agentprime.io/advisories/CVE-2024-3303.md)
  `CVE-2024-3303` · CVE record: GitLab GitLab · CVSS 6.4 Medium · Not analysed yet · Published 13 Feb 2025 · Tags: CWE-1427
- [Insufficient Session Expiration in GitLab](https://agentprime.io/advisories/CVE-2025-1198.md)
  `CVE-2025-1198` · CVE record: GitLab GitLab · CVSS 4.2 Medium · Not analysed yet · Published 13 Feb 2025 · Tags: Authentication bypass
- [Execution with Unnecessary Privileges in GitLab](https://agentprime.io/advisories/CVE-2024-7102.md)
  `CVE-2024-7102` · CVE record: GitLab GitLab · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Feb 2025 · Tags: Privilege escalation
- [Execution with Unnecessary Privileges in GitLab](https://agentprime.io/advisories/CVE-2024-8266.md)
  `CVE-2024-8266` · CVE record: GitLab GitLab · CVSS 4.4 Medium · Not analysed yet · Published 13 Feb 2025 · Tags: Privilege escalation
- [Unintended Proxy or Intermediary ('Confused Deputy') in GitLab](https://agentprime.io/advisories/CVE-2024-9870.md)
  `CVE-2024-9870` · CVE record: GitLab GitLab · CVSS 4.3 Medium · Not analysed yet · Published 12 Feb 2025 · Tags: CWE-441
- [Incorrect Authorization in GitLab](https://agentprime.io/advisories/CVE-2025-0516.md)
  `CVE-2025-0516` · CVE record: GitLab GitLab · CVSS 4.3 Medium · Not analysed yet · Published 12 Feb 2025 · Tags: Broken access control
- [Allocation of Resources Without Limits or Throttling in GitLab](https://agentprime.io/advisories/CVE-2024-12379.md)
  `CVE-2024-12379` · CVE record: GitLab GitLab · CVSS 6.5 Medium · Not analysed yet · Published 12 Feb 2025 · Tags: Denial of service
- [Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab](https://agentprime.io/advisories/CVE-2025-0376.md)
  `CVE-2025-0376` · CVE record: GitLab GitLab · CVSS 8.7 High · Not analysed yet · Published 12 Feb 2025 · Tags: Cross-site scripting (XSS)
- [Exposure of Sensitive System Information to an Unauthorized Control Sphere in GitLab](https://agentprime.io/advisories/CVE-2025-1212.md)
  `CVE-2025-1212` · CVE record: GitLab GitLab · CVSS 4.3 Medium · Not analysed yet · Published 12 Feb 2025 · Tags: Information disclosure
- [Files or Directories Accessible to External Parties in GitLab](https://agentprime.io/advisories/CVE-2025-1042.md)
  `CVE-2025-1042` · CVE record: GitLab GitLab · CVSS 4.9 Medium · Not analysed yet · Published 12 Feb 2025 · Tags: Information disclosure
- [Allocation of Resources Without Limits or Throttling in GitLab](https://agentprime.io/advisories/CVE-2025-1072.md)
  `CVE-2025-1072` · CVE record: GitLab GitLab · CVSS 6.5 Medium · Not analysed yet · Published 7 Feb 2025 · Tags: Denial of service
- [Allocation of Resources Without Limits or Throttling in GitLab](https://agentprime.io/advisories/CVE-2024-2878.md)
  `CVE-2024-2878` · CVE record: GitLab GitLab · CVSS 7.5 High · Critical (CVSS 7+ and EPSS) · EPSS 0.20 · Not analysed yet · Published 5 Feb 2025 · Tags: Denial of service
- [Missing Authorization in GitLab](https://agentprime.io/advisories/CVE-2024-3976.md)
  `CVE-2024-3976` · CVE record: GitLab GitLab · CVSS 6.5 Medium · Not analysed yet · Published 5 Feb 2025 · Tags: Broken access control
- [Incomplete Comparison with Missing Factors in GitLab](https://agentprime.io/advisories/CVE-2024-5528.md)
  `CVE-2024-5528` · CVE record: GitLab GitLab · CVSS 3.5 Low · Not analysed yet · Published 5 Feb 2025 · Tags: CWE-1023
- [Inefficient Algorithmic Complexity in GitLab](https://agentprime.io/advisories/CVE-2024-9631.md)
  `CVE-2024-9631` · CVE record: GitLab GitLab · CVSS 7.5 High · Not analysed yet · Published 5 Feb 2025 · Tags: Denial of service
- [Incorrect User Management in GitLab](https://agentprime.io/advisories/CVE-2024-6356.md)
  `CVE-2024-6356` · CVE record: GitLab GitLab · CVSS 4.4 Medium · Not analysed yet · Published 5 Feb 2025 · Tags: CWE-286
- [Missing Authorization in GitLab](https://agentprime.io/advisories/CVE-2024-1539.md)
  `CVE-2024-1539` · CVE record: GitLab GitLab · CVSS 4.3 Medium · Not analysed yet · Published 5 Feb 2025 · Tags: Broken access control
- [Allocation of Resources Without Limits or Throttling in GitLab](https://agentprime.io/advisories/CVE-2023-6386.md)
  `CVE-2023-6386` · CVE record: GitLab GitLab · CVSS 6.5 Medium · Not analysed yet · Published 5 Feb 2025 · Tags: Denial of service
- [Server-Side Request Forgery (SSRF) in GitLab](https://agentprime.io/advisories/CVE-2023-6195.md)
  `CVE-2023-6195` · CVE record: GitLab GitLab · CVSS 2.6 Low · Not analysed yet · Published 30 Jan 2025 · Tags: Server-side request forgery (SSRF)
- [Cross-Site Request Forgery (CSRF) in GitLab](https://agentprime.io/advisories/CVE-2024-1211.md)
  `CVE-2024-1211` · CVE record: GitLab GitLab · CVSS 6.4 Medium · Not analysed yet · Published 30 Jan 2025 · Tags: Cross-site request forgery (CSRF)
- [Loop with Unreachable Exit Condition ('Infinite Loop') in GitLab](https://agentprime.io/advisories/CVE-2025-0290.md)
  `CVE-2025-0290` · CVE record: GitLab GitLab · CVSS 4.3 Medium · Not analysed yet · Published 28 Jan 2025 · Tags: Denial of service
- [Insufficient Granularity of Access Control in GitLab](https://agentprime.io/advisories/CVE-2024-11931.md)
  `CVE-2024-11931` · CVE record: GitLab GitLab · CVSS 6.4 Medium · Not analysed yet · Published 24 Jan 2025 · Tags: CWE-1220
- [Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab](https://agentprime.io/advisories/CVE-2025-0314.md)
  `CVE-2025-0314` · CVE record: GitLab GitLab · CVSS 8.7 High · Not analysed yet · Published 24 Jan 2025 · Tags: Cross-site scripting (XSS)
- [Incorrect User Management in GitLab](https://agentprime.io/advisories/CVE-2024-13041.md)
  `CVE-2024-13041` · CVE record: GitLab GitLab · CVSS 4.2 Medium · Not analysed yet · Published 9 Jan 2025 · Tags: CWE-286
- [Inefficient Algorithmic Complexity in GitLab](https://agentprime.io/advisories/CVE-2024-6324.md)
  `CVE-2024-6324` · CVE record: GitLab GitLab · CVSS 4.3 Medium · Not analysed yet · Published 9 Jan 2025 · Tags: Denial of service
- [Missing Authorization in GitLab](https://agentprime.io/advisories/CVE-2024-12431.md)
  `CVE-2024-12431` · CVE record: GitLab GitLab · CVSS 4.3 Medium · Not analysed yet · Published 8 Jan 2025 · Tags: Broken access control
- [Insertion of Sensitive Information into Externally-Accessible File or Directory in GitLab](https://agentprime.io/advisories/CVE-2025-0194.md)
  `CVE-2025-0194` · CVE record: GitLab GitLab · CVSS 6.5 Medium · Not analysed yet · Published 8 Jan 2025 · Tags: Information disclosure
- [Exposure of Sensitive Information Due to Incompatible Policies in GitLab](https://agentprime.io/advisories/CVE-2023-5117.md)
  `CVE-2023-5117` · CVE record: GitLab GitLab · CVSS 3.7 Low · Not analysed yet · Published 25 Dec 2024 · Tags: CWE-213
- [Incorrect Authorization in GitLab](https://agentprime.io/advisories/CVE-2024-8116.md)
  `CVE-2024-8116` · CVE record: GitLab GitLab · CVSS 5.3 Medium · Not analysed yet · Published 16 Dec 2024 · Tags: Broken access control
- [Incorrect Authorization in GitLab](https://agentprime.io/advisories/CVE-2024-8650.md)
  `CVE-2024-8650` · CVE record: GitLab GitLab · CVSS 5.3 Medium · Not analysed yet · Published 16 Dec 2024 · Tags: Broken access control
- [Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab](https://agentprime.io/advisories/CVE-2024-8179.md)
  `CVE-2024-8179` · CVE record: GitLab GitLab · CVSS 5.4 Medium · Not analysed yet · Published 12 Dec 2024 · Tags: Cross-site scripting (XSS)
- [Inefficient Algorithmic Complexity in GitLab](https://agentprime.io/advisories/CVE-2024-8233.md)
  `CVE-2024-8233` · CVE record: GitLab GitLab · CVSS 7.5 High · Not analysed yet · Published 12 Dec 2024 · Tags: Denial of service
- [Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab](https://agentprime.io/advisories/CVE-2024-8647.md)
  `CVE-2024-8647` · CVE record: GitLab GitLab · CVSS 5.4 Medium · Not analysed yet · Published 12 Dec 2024 · Tags: Path traversal

Newest: <https://agentprime.io/advisories/technology/gitlab.md>
Older: <https://agentprime.io/advisories/technology/gitlab.md?cursor=WyIyMDI0LTEyLTEyVDEyOjAyOjU0Ljg4ODAwMFoiLCJDVkUtMjAyNC04NjQ3Il0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=gitlab&cursor=WyIyMDI1LTA1LTA5VDE2OjEzOjE0LjA0ODAwMFoiLCJDVkUtMjAyNS0xMjc4Il0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/gitlab/?cursor=WyIyMDI1LTA1LTA5VDE2OjEzOjE0LjA0ODAwMFoiLCJDVkUtMjAyNS0xMjc4Il0>. Everything for agents: <https://agentprime.io/llms.txt>.