# GitLab. Every CVE that names GitLab among its affected products, newest first. Vendors and products are as the CNA wrote them. ## Records, newest first (an older page) - [Allocation of Resources Without Limits or Throttling in GitLab](https://agentprime.io/advisories/CVE-2026-1102.md) `CVE-2026-1102` · CVE record: GitLab GitLab · CVSS 5.3 Medium · Not analysed yet · Published 22 Jan 2026 · Tags: Denial of service - [Loop with Unreachable Exit Condition ('Infinite Loop') in GitLab](https://agentprime.io/advisories/CVE-2025-13335.md) `CVE-2025-13335` · CVE record: GitLab GitLab · CVSS 6.5 Medium · Not analysed yet · Published 22 Jan 2026 · Tags: Denial of service - [Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab](https://agentprime.io/advisories/CVE-2025-11224.md) `CVE-2025-11224` · CVE record: GitLab GitLab · CVSS 7.7 High · Not analysed yet · Published 14 Jan 2026 · Tags: Cross-site scripting (XSS) - [Exposure of Private Personal Information to an Unauthorized Actor in GitLab](https://agentprime.io/advisories/CVE-2025-3950.md) `CVE-2025-3950` · CVE record: GitLab GitLab · CVSS 3.5 Low · Not analysed yet · Published 9 Jan 2026 · Tags: Information disclosure - [Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab](https://agentprime.io/advisories/CVE-2025-9222.md) `CVE-2025-9222` · CVE record: GitLab GitLab · CVSS 8.7 High · Not analysed yet · Published 9 Jan 2026 · Tags: Cross-site scripting (XSS) - [Allocation of Resources Without Limits or Throttling in GitLab](https://agentprime.io/advisories/CVE-2025-10569.md) `CVE-2025-10569` · CVE record: GitLab GitLab · CVSS 6.5 Medium · Not analysed yet · Published 9 Jan 2026 · Tags: Denial of service - [Insufficient Granularity of Access Control in GitLab](https://agentprime.io/advisories/CVE-2025-11246.md) `CVE-2025-11246` · CVE record: GitLab GitLab · CVSS 5.4 Medium · Not analysed yet · Published 9 Jan 2026 · Tags: CWE-1220 - [Missing Authorization in GitLab](https://agentprime.io/advisories/CVE-2025-13772.md) `CVE-2025-13772` · CVE record: GitLab GitLab · CVSS 7.1 High · Not analysed yet · Published 9 Jan 2026 · Tags: Broken access control - [Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab](https://agentprime.io/advisories/CVE-2025-13761.md) `CVE-2025-13761` · CVE record: GitLab GitLab · CVSS 8.0 High · Not analysed yet · Published 9 Jan 2026 · Tags: Cross-site scripting (XSS) - [Missing Authorization in GitLab](https://agentprime.io/advisories/CVE-2025-13781.md) `CVE-2025-13781` · CVE record: GitLab GitLab · CVSS 6.5 Medium · Not analysed yet · Published 9 Jan 2026 · Tags: Broken access control - [Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab](https://agentprime.io/advisories/CVE-2025-12029.md) `CVE-2025-12029` · CVE record: GitLab GitLab · CVSS 8.0 High · Not analysed yet · Published 11 Dec 2025 · Tags: Cross-site scripting (XSS) - [Improper Encoding or Escaping of Output in GitLab](https://agentprime.io/advisories/CVE-2025-12734.md) `CVE-2025-12734` · CVE record: GitLab GitLab · CVSS 3.5 Low · Not analysed yet · Published 11 Dec 2025 · Tags: CWE-116 - [Allocation of Resources Without Limits or Throttling in GitLab](https://agentprime.io/advisories/CVE-2025-4097.md) `CVE-2025-4097` · CVE record: GitLab GitLab · CVSS 6.5 Medium · Not analysed yet · Published 11 Dec 2025 · Tags: Denial of service - [Improper Encoding or Escaping of Output in GitLab](https://agentprime.io/advisories/CVE-2025-8405.md) `CVE-2025-8405` · CVE record: GitLab GitLab · CVSS 7.7 High · Not analysed yet · Published 11 Dec 2025 · Tags: CWE-116 - [Authorization Bypass Through User-Controlled Key in GitLab](https://agentprime.io/advisories/CVE-2025-11247.md) `CVE-2025-11247` · CVE record: GitLab GitLab · CVSS 4.3 Medium · Not analysed yet · Published 11 Dec 2025 · Tags: Broken access control - [Authentication Bypass Using an Alternate Path or Channel in GitLab](https://agentprime.io/advisories/CVE-2025-11984.md) `CVE-2025-11984` · CVE record: GitLab GitLab · CVSS 6.8 Medium · Not analysed yet · Published 11 Dec 2025 · Tags: Authentication bypass - [Allocation of Resources Without Limits or Throttling in GitLab](https://agentprime.io/advisories/CVE-2025-12562.md) `CVE-2025-12562` · CVE record: GitLab GitLab · CVSS 7.5 High · Not analysed yet · Published 11 Dec 2025 · Tags: Denial of service - [Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab](https://agentprime.io/advisories/CVE-2025-12716.md) `CVE-2025-12716` · CVE record: GitLab GitLab · CVSS 8.7 High · Not analysed yet · Published 11 Dec 2025 · Tags: Cross-site scripting (XSS) - [Generation of Error Message Containing Sensitive Information in GitLab](https://agentprime.io/advisories/CVE-2025-13978.md) `CVE-2025-13978` · CVE record: GitLab GitLab · CVSS 4.3 Medium · Not analysed yet · Published 11 Dec 2025 · Tags: Information disclosure - [Allocation of Resources Without Limits or Throttling in GitLab](https://agentprime.io/advisories/CVE-2025-14157.md) `CVE-2025-14157` · CVE record: GitLab GitLab · CVSS 6.5 Medium · Not analysed yet · Published 11 Dec 2025 · Tags: Denial of service - [Time-of-check Time-of-use (TOCTOU) Race Condition in GitLab](https://agentprime.io/advisories/CVE-2024-9183.md) `CVE-2024-9183` · CVE record: GitLab GitLab · CVSS 7.7 High · Not analysed yet · Published 5 Dec 2025 · Tags: Race condition - [Direct Request ('Forced Browsing') in GitLab](https://agentprime.io/advisories/CVE-2025-6195.md) `CVE-2025-6195` · CVE record: GitLab GitLab · CVSS 4.3 Medium · Not analysed yet · Published 26 Nov 2025 · Tags: Broken access control - [Allocation of Resources Without Limits or Throttling in GitLab](https://agentprime.io/advisories/CVE-2025-7449.md) `CVE-2025-7449` · CVE record: GitLab GitLab · CVSS 6.5 Medium · Not analysed yet · Published 26 Nov 2025 · Tags: Denial of service - [Allocation of Resources Without Limits or Throttling in GitLab](https://agentprime.io/advisories/CVE-2025-12571.md) `CVE-2025-12571` · CVE record: GitLab GitLab · CVSS 7.5 High · Not analysed yet · Published 26 Nov 2025 · Tags: Denial of service - [Authentication Bypass by Spoofing in GitLab](https://agentprime.io/advisories/CVE-2025-12653.md) `CVE-2025-12653` · CVE record: GitLab GitLab · CVSS 6.5 Medium · Not analysed yet · Published 26 Nov 2025 · Tags: Authentication bypass - [Insertion of Sensitive Information into Log File in GitLab](https://agentprime.io/advisories/CVE-2025-13611.md) `CVE-2025-13611` · CVE record: GitLab GitLab · CVSS 2.0 Low · Not analysed yet · Published 26 Nov 2025 · Tags: Information disclosure - [Missing Authorization in GitLab](https://agentprime.io/advisories/CVE-2025-9825.md) `CVE-2025-9825` · CVE record: GitLab GitLab · CVSS 5.0 Medium · Not analysed yet · Published 21 Nov 2025 · Tags: Broken access control - [Memory Allocation with Excessive Size Value in GitLab](https://agentprime.io/advisories/CVE-2025-12983.md) `CVE-2025-12983` · CVE record: GitLab GitLab · CVSS 3.5 Low · Not analysed yet · Published 15 Nov 2025 · Tags: Denial of service - [Insertion of Sensitive Information Into Sent Data in GitLab](https://agentprime.io/advisories/CVE-2025-2615.md) `CVE-2025-2615` · CVE record: GitLab GitLab · CVSS 4.3 Medium · Not analysed yet · Published 15 Nov 2025 · Tags: Information disclosure - [Improper Neutralization of Special Elements used in a Command ('Command Injection') in GitLab](https://agentprime.io/advisories/CVE-2025-6945.md) `CVE-2025-6945` · CVE record: GitLab GitLab · CVSS 3.5 Low · Not analysed yet · Published 15 Nov 2025 · Tags: Command injection - [Missing Authorization in GitLab](https://agentprime.io/advisories/CVE-2025-6171.md) `CVE-2025-6171` · CVE record: GitLab GitLab · CVSS 5.3 Medium · Not analysed yet · Published 15 Nov 2025 · Tags: Broken access control - [Insertion of Sensitive Information Into Sent Data in GitLab](https://agentprime.io/advisories/CVE-2025-7000.md) `CVE-2025-7000` · CVE record: GitLab GitLab · CVSS 4.3 Medium · Not analysed yet · Published 15 Nov 2025 · Tags: Information disclosure - [Incorrect Authorization in GitLab](https://agentprime.io/advisories/CVE-2025-7736.md) `CVE-2025-7736` · CVE record: GitLab GitLab · CVSS 3.1 Low · Not analysed yet · Published 15 Nov 2025 · Tags: Broken access control - [Incorrect Authorization in GitLab](https://agentprime.io/advisories/CVE-2025-11865.md) `CVE-2025-11865` · CVE record: GitLab GitLab · CVSS 4.3 Medium · Not analysed yet · Published 15 Nov 2025 · Tags: Broken access control - [Improper Handling of URL Encoding (Hex Encoding) in GitLab](https://agentprime.io/advisories/CVE-2025-11990.md) `CVE-2025-11990` · CVE record: GitLab GitLab · CVSS 3.1 Low · Not analysed yet · Published 15 Nov 2025 · Tags: CWE-177 - [Missing Authorization in GitLab](https://agentprime.io/advisories/CVE-2025-11702.md) `CVE-2025-11702` · CVE record: GitLab GitLab · CVSS 8.5 High · Not analysed yet · Published 29 Oct 2025 · Tags: Broken access control - [Business Logic Errors in GitLab](https://agentprime.io/advisories/CVE-2025-6601.md) `CVE-2025-6601` · CVE record: GitLab GitLab · CVSS 2.7 Low · Not analysed yet · Published 27 Oct 2025 · Tags: CWE-840 - [Allocation of Resources Without Limits or Throttling in GitLab](https://agentprime.io/advisories/CVE-2025-10497.md) `CVE-2025-10497` · CVE record: GitLab GitLab · CVSS 7.5 High · Not analysed yet · Published 27 Oct 2025 · Tags: Denial of service - [Incorrect Authorization in GitLab](https://agentprime.io/advisories/CVE-2025-11971.md) `CVE-2025-11971` · CVE record: GitLab GitLab · CVSS 6.5 Medium · Not analysed yet · Published 27 Oct 2025 · Tags: Broken access control - [Allocation of Resources Without Limits or Throttling in GitLab](https://agentprime.io/advisories/CVE-2025-11974.md) `CVE-2025-11974` · CVE record: GitLab GitLab · CVSS 6.5 Medium · Not analysed yet · Published 27 Oct 2025 · Tags: Denial of service - [Allocation of Resources Without Limits or Throttling in GitLab](https://agentprime.io/advisories/CVE-2025-11447.md) `CVE-2025-11447` · CVE record: GitLab GitLab · CVSS 7.5 High · Not analysed yet · Published 27 Oct 2025 · Tags: Denial of service - [Missing Authorization in GitLab](https://agentprime.io/advisories/CVE-2025-11989.md) `CVE-2025-11989` · CVE record: GitLab GitLab · CVSS 3.7 Low · Not analysed yet · Published 26 Oct 2025 · Tags: Broken access control - [Allocation of Resources Without Limits or Throttling in GitLab](https://agentprime.io/advisories/CVE-2025-10004.md) `CVE-2025-10004` · CVE record: GitLab GitLab · CVSS 7.5 High · Not analysed yet · Published 9 Oct 2025 · Tags: Denial of service - [Incorrect Authorization in GitLab](https://agentprime.io/advisories/CVE-2025-11340.md) `CVE-2025-11340` · CVE record: GitLab GitLab · CVSS 7.7 High · Not analysed yet · Published 9 Oct 2025 · Tags: Broken access control - [Allocation of Resources Without Limits or Throttling in GitLab](https://agentprime.io/advisories/CVE-2025-2934.md) `CVE-2025-2934` · CVE record: GitLab GitLab · CVSS 4.3 Medium · Not analysed yet · Published 9 Oct 2025 · Tags: Denial of service - [Allocation of Resources Without Limits or Throttling in GitLab](https://agentprime.io/advisories/CVE-2025-8014.md) `CVE-2025-8014` · CVE record: GitLab GitLab · CVSS 7.5 High · Not analysed yet · Published 27 Sept 2025 · Tags: Denial of service - [Allocation of Resources Without Limits or Throttling in GitLab](https://agentprime.io/advisories/CVE-2025-11042.md) `CVE-2025-11042` · CVE record: GitLab GitLab · CVSS 4.3 Medium · Not analysed yet · Published 26 Sept 2025 · Tags: Denial of service - [Incorrect Ownership Assignment in GitLab](https://agentprime.io/advisories/CVE-2025-5069.md) `CVE-2025-5069` · CVE record: GitLab GitLab · CVSS 3.5 Low · Not analysed yet · Published 26 Sept 2025 · Tags: CWE-708 - [Business Logic Errors in GitLab](https://agentprime.io/advisories/CVE-2025-10868.md) `CVE-2025-10868` · CVE record: GitLab GitLab · CVSS 3.5 Low · Not analysed yet · Published 26 Sept 2025 · Tags: CWE-840 - [Privilege Defined With Unsafe Actions in GitLab](https://agentprime.io/advisories/CVE-2025-7691.md) `CVE-2025-7691` · CVE record: GitLab GitLab · CVSS 6.5 Medium · Not analysed yet · Published 26 Sept 2025 · Tags: Privilege escalation - [Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab](https://agentprime.io/advisories/CVE-2025-9642.md) `CVE-2025-9642` · CVE record: GitLab GitLab · CVSS 8.7 High · Not analysed yet · Published 26 Sept 2025 · Tags: Cross-site scripting (XSS) - [Insertion of Sensitive Information Into Sent Data in GitLab](https://agentprime.io/advisories/CVE-2025-9958.md) `CVE-2025-9958` · CVE record: GitLab GitLab · CVSS 7.7 High · Not analysed yet · Published 26 Sept 2025 · Tags: Information disclosure - [Allocation of Resources Without Limits or Throttling in GitLab](https://agentprime.io/advisories/CVE-2025-10858.md) `CVE-2025-10858` · CVE record: GitLab GitLab · CVSS 7.5 High · Not analysed yet · Published 26 Sept 2025 · Tags: Denial of service - [Allocation of Resources Without Limits or Throttling in GitLab](https://agentprime.io/advisories/CVE-2025-10867.md) `CVE-2025-10867` · CVE record: GitLab GitLab · CVSS 3.5 Low · Not analysed yet · Published 26 Sept 2025 · Tags: Denial of service - [Missing Authorization in GitLab](https://agentprime.io/advisories/CVE-2025-10871.md) `CVE-2025-10871` · CVE record: GitLab GitLab · CVSS 3.8 Low · Not analysed yet · Published 26 Sept 2025 · Tags: Broken access control - [Allocation of Resources Without Limits or Throttling in GitLab](https://agentprime.io/advisories/CVE-2025-1250.md) `CVE-2025-1250` · CVE record: GitLab GitLab · CVSS 6.5 Medium · Not analysed yet · Published 12 Sept 2025 · Tags: Denial of service - [Improper Validation of Specified Quantity in Input in GitLab](https://agentprime.io/advisories/CVE-2025-2256.md) `CVE-2025-2256` · CVE record: GitLab GitLab · CVSS 7.5 High · Not analysed yet · Published 12 Sept 2025 · Tags: CWE-1284 - [Server-Side Request Forgery (SSRF) in GitLab](https://agentprime.io/advisories/CVE-2025-6454.md) `CVE-2025-6454` · CVE record: GitLab GitLab · CVSS 8.5 High · Not analysed yet · Published 12 Sept 2025 · Tags: Server-side request forgery (SSRF) - [Exposure of Sensitive System Information to an Unauthorized Control Sphere in GitLab](https://agentprime.io/advisories/CVE-2025-6769.md) `CVE-2025-6769` · CVE record: GitLab GitLab · CVSS 4.3 Medium · Not analysed yet · Published 12 Sept 2025 · Tags: Information disclosure - [Allocation of Resources Without Limits or Throttling in GitLab](https://agentprime.io/advisories/CVE-2025-7337.md) `CVE-2025-7337` · CVE record: GitLab GitLab · CVSS 6.5 Medium · Not analysed yet · Published 12 Sept 2025 · Tags: Denial of service Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .