Advisories · Technology

GitLab.

Every CVE that names GitLab among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-110264 CVE record

CVSS 10.0 CriticalCritical · CVSS 9+

Integer Overflow or Wraparound in GitLab
- GitLab
- Memory corruption
Not analysed yet 22 Oct 2026
CVE-2026-12664 CVE record

CVSS 6.8 Medium

Incorrect Authorization in GitLab
- GitLab
- Broken access control
Not analysed yet 21 Oct 2026
CVE-2026-13319 CVE record

CVSS 4.3 Medium

Authorization Bypass Through User-Controlled Key in GitLab
- GitLab
- Broken access control
Not analysed yet 21 Oct 2026
CVE-2026-14288 CVE record

CVSS 3.1 Low

Use of Incorrectly-Resolved Name or Reference in GitLab
- GitLab
- CWE-706
Not analysed yet 21 Oct 2026
CVE-2026-15723 CVE record

CVSS 8.2 High

Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') in GitLab
- GitLab
- Other injection
Not analysed yet 21 Oct 2026
CVE-2026-16255 CVE record

CVSS 5.9 Medium

Incorrect Authorization in GitLab
- GitLab
- Broken access control
Not analysed yet 21 Oct 2026
CVE-2026-103515 CVE record

CVSS 2.7 Low

Incorrect Authorization in GitLab
- GitLab
- Broken access control
Not analysed yet 21 Oct 2026
CVE-2026-105711 CVE record

CVSS 3.5 Low

Use of Cache Containing Sensitive Information in GitLab
- GitLab
- CWE-524
Not analysed yet 21 Oct 2026
CVE-2026-105777 CVE record

CVSS 4.3 Medium

Insertion of Sensitive Information Into Sent Data in GitLab
- GitLab
- Information disclosure
Not analysed yet 21 Oct 2026
CVE-2026-112378 CVE record

CVSS 4.3 Medium

Use of Less Trusted Source in GitLab
- GitLab
- CWE-348
Not analysed yet 21 Oct 2026
CVE-2026-112212 CVE record

CVSS 7.5 High

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') in GitLab
- GitLab
- HTTP request smuggling
Not analysed yet 21 Oct 2026
CVE-2026-112326 CVE record

CVSS 3.1 Low

Improper Cleanup on Thrown Exception in GitLab
- GitLab
- CWE-460
Not analysed yet 21 Oct 2026
CVE-2026-5954 CVE record

CVSS 4.2 Medium

Incorrect Authorization in GitLab
- GitLab
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-6567 CVE record

CVSS 4.3 Medium

Incorrect Authorization in GitLab
- GitLab
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-7767 CVE record

CVSS 5.8 Medium

URL Redirection to Untrusted Site ('Open Redirect') in GitLab
- GitLab
- Open redirect
Not analysed yet 13 Oct 2026
CVE-2026-9268 CVE record

CVSS 2.7 Low

Incorrect Authorization in GitLab
- GitLab
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-14210 CVE record

CVSS 4.3 Medium

Insufficient Granularity of Access Control in GitLab
- GitLab
- CWE-1220
Not analysed yet 13 Oct 2026
CVE-2026-14552 CVE record

CVSS 4.3 Medium

Incorrect Authorization in GitLab
- GitLab
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-14814 CVE record

CVSS 8.2 High

Permissive Regular Expression in GitLab
- GitLab
- CWE-625
Not analysed yet 13 Oct 2026
CVE-2026-16275 CVE record

CVSS 5.3 Medium

Incorrect Authorization in GitLab
- GitLab
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-16301 CVE record

CVSS 8.5 High

Incorrect Authorization in GitLab
- GitLab
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-78335 CVE record

CVSS 4.2 Medium

Incorrect Authorization in GitLab
- GitLab
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-81839 CVE record

CVSS 7.7 High

Incorrect Authorization in GitLab
- GitLab
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-82632 CVE record

CVSS 3.1 Low

Incorrect Authorization in GitLab
- GitLab
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-84284 CVE record

CVSS 5.3 Medium

Incorrect Authorization in GitLab
- GitLab
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-85529 CVE record

CVSS 5.3 Medium

Incorrect Authorization in GitLab
- GitLab
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-92528 CVE record

CVSS 4.2 Medium

Incorrect Authorization in GitLab
- GitLab
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-92883 CVE record

CVSS 8.7 High

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
- GitLab
- Cross-site scripting (XSS)
Not analysed yet 13 Oct 2026
CVE-2026-97229 CVE record

CVSS 10.0 CriticalCritical · KEV, CVSS 9+, CVSS 7+ and EPSSKEV

Integer Overflow or Wraparound in GitLab
- GitLab
- Memory corruption
Not analysed yet 13 Oct 2026
CVE-2026-96893 CVE record

CVSS 7.3 High

Improper Neutralization of Input Used for LLM Prompting in GitLab
- GitLab
- CWE-1427
Not analysed yet 13 Oct 2026
CVE-2026-100104 CVE record

CVSS 3.5 Low

Server-Side Request Forgery (SSRF) in GitLab
- GitLab
- Server-side request forgery (SSRF)
Not analysed yet 13 Oct 2026
CVE-2026-100755 CVE record

CVSS 4.6 Medium

Acceptance of Extraneous Untrusted Data With Trusted Data in GitLab
- GitLab
- CWE-349
Not analysed yet 13 Oct 2026
CVE-2026-101168 CVE record

CVSS 6.2 Medium

Insertion of Sensitive Information into Log File in GitLab
- GitLab
- Information disclosure
Not analysed yet 13 Oct 2026
CVE-2026-103549 CVE record

CVSS 2.7 Low

Incorrect Authorization in GitLab
- GitLab
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-104661 CVE record

CVSS 4.3 Medium

Incorrect Privilege Assignment in GitLab
- GitLab
- Privilege escalation
Not analysed yet 13 Oct 2026
CVE-2026-105458 CVE record

CVSS 4.3 Medium

Reliance on Untrusted Inputs in a Security Decision in GitLab
- GitLab
- CWE-807
Not analysed yet 13 Oct 2026
CVE-2026-1403 CVE record

CVSS 6.5 Medium

Allocation of Resources Without Limits or Throttling in GitLab
- GitLab
- Denial of service
Not analysed yet 7 Oct 2026
CVE-2026-4523 CVE record

CVSS 3.7 Low

Missing Authorization in GitLab
- GitLab
- Broken access control
Not analysed yet 29 Sept 2026
CVE-2026-8937 CVE record

CVSS 4.3 Medium

Missing Authorization in GitLab
- GitLab
- Broken access control
Not analysed yet 29 Sept 2026
CVE-2026-10518 CVE record

CVSS 4.3 Medium

Incorrect Authorization in GitLab
- GitLab
- Broken access control
Not analysed yet 29 Sept 2026
CVE-2026-84739 CVE record

CVSS 8.7 High

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
- GitLab
- Cross-site scripting (XSS)
Not analysed yet 29 Sept 2026
CVE-2026-89078 CVE record

CVSS 9.9 CriticalCritical · CVSS 9+

Double Free in GitLab
- GitLab
- Memory corruption
Not analysed yet 23 Sept 2026
CVE-2026-92530 CVE record

CVSS 4.3 Medium

Use of Less Trusted Source in GitLab
- GitLab
- CWE-348
Not analysed yet 23 Sept 2026
CVE-2026-92470 CVE record

CVSS 7.7 High

Missing Authorization in GitLab
- GitLab
- Broken access control
Not analysed yet 23 Sept 2026
CVE-2026-92529 CVE record

CVSS 4.3 Medium

Incorrect Authorization in GitLab
- GitLab
- Broken access control
Not analysed yet 23 Sept 2026
CVE-2026-92874 CVE record

CVSS 5.4 Medium

Incorrect Authorization in GitLab
- GitLab
- Broken access control
Not analysed yet 23 Sept 2026
CVE-2026-92628 CVE record

CVSS 3.1 Low

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') in GitLab
- GitLab
- Race condition
Not analysed yet 23 Sept 2026
CVE-2026-93577 CVE record

CVSS 9.9 CriticalCritical · CVSS 9+

Integer Overflow or Wraparound in GitLab
- GitLab
- Memory corruption
Not analysed yet 23 Sept 2026
CVE-2026-86341 CVE record

CVSS 4.4 Medium

Access Control Check Implemented After Asset is Accessed in GitLab
- GitLab
- CWE-1280
Not analysed yet 16 Sept 2026
CVE-2024-11222 CVE record

CVSS 6.4 Medium

Time-of-check Time-of-use (TOCTOU) Race Condition in GitLab
- GitLab
- Race condition
Not analysed yet 16 Sept 2026
CVE-2025-14871 CVE record

CVSS 7.5 High

Allocation of Resources Without Limits or Throttling in GitLab
- GitLab
- Denial of service
Not analysed yet 16 Sept 2026
CVE-2026-1168 CVE record

CVSS 7.5 High

Allocation of Resources Without Limits or Throttling in GitLab
- GitLab
- Denial of service
Not analysed yet 16 Sept 2026
CVE-2026-3855 CVE record

CVSS 3.1 Low

Improper Control of Resource Identifiers ('Resource Injection') in GitLab
- GitLab
- CWE-99
Not analysed yet 16 Sept 2026
CVE-2026-7514 CVE record

CVSS 4.3 Medium

Missing Authorization in GitLab
- GitLab
- Broken access control
Not analysed yet 16 Sept 2026
CVE-2026-8030 CVE record

CVSS 4.3 Medium

Missing Authorization in GitLab
- GitLab
- Broken access control
Not analysed yet 16 Sept 2026
CVE-2026-16794 CVE record

CVSS 4.3 Medium

Missing Authorization in GitLab
- GitLab
- Broken access control
Not analysed yet 16 Sept 2026
CVE-2026-19619 CVE record

CVSS 4.7 Medium

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
- GitLab
- Cross-site scripting (XSS)
Not analysed yet 16 Sept 2026
CVE-2026-78252 CVE record

CVSS 8.2 High

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
- GitLab
- Cross-site scripting (XSS)
Not analysed yet 16 Sept 2026
CVE-2026-79708 CVE record

CVSS 8.5 High

Incorrect Authorization in GitLab
- GitLab
- Broken access control
Not analysed yet 16 Sept 2026
CVE-2026-12910 CVE record

CVSS 5.4 Medium

Missing Authentication for Critical Function in GitLab
- GitLab
- Authentication bypass
Not analysed yet 15 Sept 2026