Advisories · Technology

GitLab.

Every CVE that names GitLab among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-2104 CVE record

CVSS 4.3 Medium

Authorization Bypass Through User-Controlled Key in GitLab
- GitLab
- Broken access control
Not analysed yet 8 Apr 2026
CVE-2026-2619 CVE record

CVSS 4.3 Medium

Incorrect Authorization in GitLab
- GitLab
- Broken access control
Not analysed yet 8 Apr 2026
CVE-2026-4332 CVE record

CVSS 5.4 Medium

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
- GitLab
- Cross-site scripting (XSS)
Not analysed yet 8 Apr 2026
CVE-2026-4916 CVE record

CVSS 2.7 Low

Missing Authorization in GitLab
- GitLab
- Broken access control
Not analysed yet 8 Apr 2026
CVE-2026-5173 CVE record

CVSS 8.5 High

Exposed Dangerous Method or Function in GitLab
- GitLab
- CWE-749
Not analysed yet 8 Apr 2026
CVE-2026-2370 CVE record

CVSS 8.1 High

Improper Handling of Parameters in GitLab
- GitLab
- CWE-233
Not analysed yet 29 Mar 2026
CVE-2025-13078 CVE record

CVSS 6.5 Medium

Improper Validation of Specified Quantity in Input in GitLab
- GitLab
- CWE-1284
Not analysed yet 25 Mar 2026
CVE-2025-13436 CVE record

CVSS 6.5 Medium

Allocation of Resources Without Limits or Throttling in GitLab
- GitLab
- Denial of service
Not analysed yet 25 Mar 2026
CVE-2025-14595 CVE record

CVSS 4.3 Medium

Missing Authorization in GitLab
- GitLab
- Broken access control
Not analysed yet 25 Mar 2026
CVE-2026-1724 CVE record

CVSS 6.8 Medium

Missing Authentication for Critical Function in GitLab
- GitLab
- Authentication bypass
Not analysed yet 25 Mar 2026
CVE-2026-2745 CVE record

CVSS 6.8 Medium

Authentication Bypass Using an Alternate Path or Channel in GitLab
- GitLab
- Authentication bypass
Not analysed yet 25 Mar 2026
CVE-2026-2726 CVE record

CVSS 4.3 Medium

Incorrect Authorization in GitLab
- GitLab
- Broken access control
Not analysed yet 25 Mar 2026
CVE-2026-2973 CVE record

CVSS 5.4 Medium

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
- GitLab
- Cross-site scripting (XSS)
Not analysed yet 25 Mar 2026
CVE-2026-2995 CVE record

CVSS 7.7 High

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in GitLab
- GitLab
- Cross-site scripting (XSS)
Not analysed yet 25 Mar 2026
CVE-2026-3857 CVE record

CVSS 8.1 High

Cross-Site Request Forgery (CSRF) in GitLab
- GitLab
- Cross-site request forgery (CSRF)
Not analysed yet 25 Mar 2026
CVE-2026-3988 CVE record

CVSS 7.5 High

Inefficient Algorithmic Complexity in GitLab
- GitLab
- Denial of service
Not analysed yet 25 Mar 2026
CVE-2026-4363 CVE record

CVSS 3.7 Low

Incorrect Authorization in GitLab
- GitLab
- Broken access control
Not analysed yet 25 Mar 2026
CVE-2026-1182 CVE record

CVSS 4.3 Medium

Improper Removal of Sensitive Information Before Storage or Transfer in GitLab
- GitLab
- CWE-212
Not analysed yet 12 Mar 2026
CVE-2025-12555 CVE record

CVSS 4.3 Medium

Incorrect Authorization in GitLab
- GitLab
- Broken access control
Not analysed yet 11 Mar 2026
CVE-2025-12576 CVE record

CVSS 6.5 Medium

Allocation of Resources Without Limits or Throttling in GitLab
- GitLab
- Denial of service
Not analysed yet 11 Mar 2026
CVE-2025-12697 CVE record

CVSS 2.2 Low

Improper Encoding or Escaping of Output in GitLab
- GitLab
- CWE-116
Not analysed yet 11 Mar 2026
CVE-2025-12704 CVE record

CVSS 3.5 Low

Missing Authorization in GitLab
- GitLab
- Broken access control
Not analysed yet 11 Mar 2026
CVE-2025-13690 CVE record

CVSS 6.5 Medium

Allocation of Resources Without Limits or Throttling in GitLab
- GitLab
- Denial of service
Not analysed yet 11 Mar 2026
CVE-2025-13929 CVE record

CVSS 7.5 High

Allocation of Resources Without Limits or Throttling in GitLab
- GitLab
- Denial of service
Not analysed yet 11 Mar 2026
CVE-2025-14513 CVE record

CVSS 7.5 High

Improper Validation of Specified Quantity in Input in GitLab
- GitLab
- CWE-1284
Not analysed yet 11 Mar 2026
CVE-2026-0602 CVE record

CVSS 4.3 Medium

Authentication Bypass Using an Alternate Path or Channel in GitLab
- GitLab
- Authentication bypass
Not analysed yet 11 Mar 2026
CVE-2026-1069 CVE record

CVSS 7.5 High

Uncontrolled Recursion in GitLab
- GitLab
- Denial of service
Not analysed yet 11 Mar 2026
CVE-2026-1090 CVE record

CVSS 8.7 High

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
- GitLab
- Cross-site scripting (XSS)
Not analysed yet 11 Mar 2026
CVE-2026-1230 CVE record

CVSS 4.1 Medium

Use of Incorrectly-Resolved Name or Reference in GitLab
- GitLab
- CWE-706
Not analysed yet 11 Mar 2026
CVE-2026-1663 CVE record

CVSS 4.3 Medium

Missing Authorization in GitLab
- GitLab
- Broken access control
Not analysed yet 11 Mar 2026
CVE-2026-1732 CVE record

CVSS 4.3 Medium

Improper Removal of Sensitive Information Before Storage or Transfer in GitLab
- GitLab
- CWE-212
Not analysed yet 11 Mar 2026
CVE-2026-3848 CVE record

CVSS 5.0 Medium

Improper Neutralization of CRLF Sequences ('CRLF Injection') in GitLab
- GitLab
- Other injection
Not analysed yet 11 Mar 2026
CVE-2025-14511 CVE record

CVSS 7.5 High

Improper Validation of Specified Quantity in Input in GitLab
- GitLab
- CWE-1284
Not analysed yet 25 Feb 2026
CVE-2026-0752 CVE record

CVSS 8.0 High

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
- GitLab
- Cross-site scripting (XSS)
Not analysed yet 25 Feb 2026
CVE-2026-1388 CVE record

CVSS 7.5 High

Inefficient Regular Expression Complexity in GitLab
- GitLab
- Denial of service
Not analysed yet 25 Feb 2026
CVE-2026-1662 CVE record

CVSS 7.5 High

Allocation of Resources Without Limits or Throttling in GitLab
- GitLab
- Denial of service
Not analysed yet 25 Feb 2026
CVE-2026-1747 CVE record

CVSS 4.3 Medium

Authentication Bypass Using an Alternate Path or Channel in GitLab
- GitLab
- Authentication bypass
Not analysed yet 25 Feb 2026
CVE-2026-1725 CVE record

CVSS 5.3 Medium

Allocation of Resources Without Limits or Throttling in GitLab
- GitLab
- Denial of service
Not analysed yet 25 Feb 2026
CVE-2026-2845 CVE record

CVSS 6.5 Medium

Allocation of Resources Without Limits or Throttling in GitLab
- GitLab
- Denial of service
Not analysed yet 25 Feb 2026
CVE-2025-3525 CVE record

CVSS 6.5 Medium

Allocation of Resources Without Limits or Throttling in GitLab
- GitLab
- Denial of service
Not analysed yet 25 Feb 2026
CVE-2025-14103 CVE record

CVSS 4.3 Medium

Missing Authorization in GitLab
- GitLab
- Broken access control
Not analysed yet 25 Feb 2026
CVE-2025-7659 CVE record

CVSS 8.0 High

Origin Validation Error in GitLab
- GitLab
- CWE-346
Not analysed yet 11 Feb 2026
CVE-2025-8099 CVE record

CVSS 7.5 High

Allocation of Resources Without Limits or Throttling in GitLab
- GitLab
- Denial of service
Not analysed yet 11 Feb 2026
CVE-2025-12073 CVE record

CVSS 4.3 Medium

Server-Side Request Forgery (SSRF) in GitLab
- GitLab
- Server-side request forgery (SSRF)
Not analysed yet 11 Feb 2026
CVE-2025-12575 CVE record

CVSS 5.4 Medium

Server-Side Request Forgery (SSRF) in GitLab
- GitLab
- Server-side request forgery (SSRF)
Not analysed yet 11 Feb 2026
CVE-2025-14560 CVE record

CVSS 7.3 High

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
- GitLab
- Cross-site scripting (XSS)
Not analysed yet 11 Feb 2026
CVE-2025-14594 CVE record

CVSS 3.5 Low

Authorization Bypass Through User-Controlled Key in GitLab
- GitLab
- Broken access control
Not analysed yet 11 Feb 2026
CVE-2025-14592 CVE record

CVSS 3.7 Low

Missing Authorization in GitLab
- GitLab
- Broken access control
Not analysed yet 11 Feb 2026
CVE-2026-0595 CVE record

CVSS 7.3 High

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
- GitLab
- Cross-site scripting (XSS)
Not analysed yet 11 Feb 2026
CVE-2026-0958 CVE record

CVSS 7.5 High

Interpretation Conflict in GitLab
- GitLab
- CWE-436
Not analysed yet 11 Feb 2026
CVE-2026-1080 CVE record

CVSS 4.3 Medium

Authorization Bypass Through User-Controlled Key in GitLab
- GitLab
- Broken access control
Not analysed yet 11 Feb 2026
CVE-2026-1094 CVE record

CVSS 4.6 Medium

Improper Validation of Unsafe Equivalence in Input in GitLab
- GitLab
- CWE-1289
Not analysed yet 11 Feb 2026
CVE-2026-1282 CVE record

CVSS 3.5 Low

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in GitLab
- GitLab
- Cross-site scripting (XSS)
Not analysed yet 11 Feb 2026
CVE-2026-1387 CVE record

CVSS 6.5 Medium

Allocation of Resources Without Limits or Throttling in GitLab
- GitLab
- Denial of service
Not analysed yet 11 Feb 2026
CVE-2026-1456 CVE record

CVSS 6.5 Medium

Allocation of Resources Without Limits or Throttling in GitLab
- GitLab
- Denial of service
Not analysed yet 11 Feb 2026
CVE-2026-1458 CVE record

CVSS 6.5 Medium

Allocation of Resources Without Limits or Throttling in GitLab
- GitLab
- Denial of service
Not analysed yet 11 Feb 2026
CVE-2026-1751 CVE record

CVSS 3.1 Low

Missing Authorization in GitLab
- GitLab
- Broken access control
Not analysed yet 2 Feb 2026
CVE-2025-13928 CVE record

CVSS 7.5 High

Incorrect Authorization in GitLab
- GitLab
- Broken access control
Not analysed yet 22 Jan 2026
CVE-2025-13927 CVE record

CVSS 7.5 High

Allocation of Resources Without Limits or Throttling in GitLab
- GitLab
- Denial of service
Not analysed yet 22 Jan 2026
CVE-2026-0723 CVE record

CVSS 7.4 High

Unchecked Return Value in GitLab
- GitLab
- CWE-252
Not analysed yet 22 Jan 2026