Advisories · Technology

GitLab.

Every CVE that names GitLab among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-12635 CVE record

CVSS 0.0 None

Reliance on Reverse DNS Resolution for a Security-Critical Action in GitLab
- GitLab
- CWE-350
Not analysed yet 25 Jun 2026
CVE-2026-1500 CVE record

CVSS 6.5 Medium

Allocation of Resources Without Limits or Throttling in GitLab
- GitLab
- Denial of service
Not analysed yet 11 Jun 2026
CVE-2026-3553 CVE record

CVSS 3.1 Low

Incorrect Authorization in GitLab
- GitLab
- Broken access control
Not analysed yet 11 Jun 2026
CVE-2026-6269 CVE record

CVSS 5.4 Medium

Incorrect Authorization in GitLab
- GitLab
- Broken access control
Not analysed yet 11 Jun 2026
CVE-2026-6277 CVE record

CVSS 4.3 Medium

Incorrect Authorization in GitLab
- GitLab
- Broken access control
Not analysed yet 11 Jun 2026
CVE-2026-6976 CVE record

CVSS 3.7 Low

Authorization Bypass Through User-Controlled Key in GitLab
- GitLab
- Broken access control
Not analysed yet 11 Jun 2026
CVE-2026-7250 CVE record

CVSS 7.5 High

Allocation of Resources Without Limits or Throttling in GitLab
- GitLab
- Denial of service
Not analysed yet 11 Jun 2026
CVE-2026-8589 CVE record

CVSS 7.3 High

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
- GitLab
- Cross-site scripting (XSS)
Not analysed yet 11 Jun 2026
CVE-2026-9204 CVE record

CVSS 5.3 Medium

Server-Side Request Forgery (SSRF) in GitLab
- GitLab
- Server-side request forgery (SSRF)
Not analysed yet 11 Jun 2026
CVE-2026-9694 CVE record

CVSS 2.6 Low

Improper Neutralization of Substitution Characters in GitLab
- GitLab
- CWE-153
Not analysed yet 11 Jun 2026
CVE-2026-10087 CVE record

CVSS 8.7 High

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
- GitLab
- Cross-site scripting (XSS)
Not analysed yet 11 Jun 2026
CVE-2026-10733 CVE record

CVSS 4.3 Medium

Improper Restriction of Rendered UI Layers or Frames in GitLab
- GitLab
- CWE-1021
Not analysed yet 11 Jun 2026
CVE-2026-9807 CVE record

CVSS 4.3 Medium

Incorrect Authorization in GitLab
- GitLab
- Broken access control
Not analysed yet 28 May 2026
CVE-2026-1402 CVE record

CVSS 6.5 Medium

Allocation of Resources Without Limits or Throttling in GitLab
- GitLab
- Denial of service
Not analysed yet 27 May 2026
CVE-2026-2601 CVE record

CVSS 4.3 Medium

Missing Authorization in GitLab
- GitLab
- Broken access control
Not analysed yet 27 May 2026
CVE-2026-4868 CVE record

CVSS 8.2 High

Authorization Bypass Through User-Controlled Key in GitLab
- GitLab
- Broken access control
Not analysed yet 27 May 2026
CVE-2026-5296 CVE record

CVSS 4.3 Medium

Missing Authorization in GitLab
- GitLab
- Broken access control
Not analysed yet 27 May 2026
CVE-2026-6713 CVE record

CVSS 5.3 Medium

Incorrect Authorization in GitLab
- GitLab
- Broken access control
Not analysed yet 27 May 2026
CVE-2026-8716 CVE record

CVSS 4.3 Medium

Use of Incorrectly-Resolved Name or Reference in GitLab
- GitLab
- CWE-706
Not analysed yet 27 May 2026
CVE-2025-12669 CVE record

CVSS 5.4 Medium

Improper Control of Generation of Code ('Code Injection') in GitLab
- GitLab
- Code injection
Not analysed yet 14 May 2026
CVE-2025-13874 CVE record

CVSS 4.3 Medium

Authorization Bypass Through User-Controlled Key in GitLab
- GitLab
- Broken access control
Not analysed yet 14 May 2026
CVE-2025-14869 CVE record

CVSS 7.5 High

Improper Validation of Specified Quantity in Input in GitLab
- GitLab
- CWE-1284
Not analysed yet 14 May 2026
CVE-2025-14870 CVE record

CVSS 7.5 High

Allocation of Resources Without Limits or Throttling in GitLab
- GitLab
- Denial of service
Not analysed yet 14 May 2026
CVE-2026-1184 CVE record

CVSS 6.5 Medium

Deserialization of Untrusted Data in GitLab
- GitLab
- Insecure deserialization
Not analysed yet 14 May 2026
CVE-2026-1322 CVE record

CVSS 6.8 Medium

Business Logic Errors in GitLab
- GitLab
- CWE-840
Not analysed yet 14 May 2026
CVE-2026-1338 CVE record

CVSS 4.3 Medium

Authorization Bypass Through User-Controlled Key in GitLab
- GitLab
- Broken access control
Not analysed yet 14 May 2026
CVE-2026-1659 CVE record

CVSS 7.5 High

Allocation of Resources Without Limits or Throttling in GitLab
- GitLab
- Denial of service
Not analysed yet 14 May 2026
CVE-2026-2900 CVE record

CVSS 2.7 Low

Missing Authorization in GitLab
- GitLab
- Broken access control
Not analysed yet 14 May 2026
CVE-2026-3073 CVE record

CVSS 4.3 Medium

Authorization Bypass Through User-Controlled Key in GitLab
- GitLab
- Broken access control
Not analysed yet 14 May 2026
CVE-2026-3074 CVE record

CVSS 4.3 Medium

Authorization Bypass Through User-Controlled Key in GitLab
- GitLab
- Broken access control
Not analysed yet 14 May 2026
CVE-2026-3160 CVE record

CVSS 5.8 Medium

Unintended Proxy or Intermediary ('Confused Deputy') in GitLab
- GitLab
- CWE-441
Not analysed yet 14 May 2026
CVE-2026-3607 CVE record

CVSS 4.3 Medium

Access Control Check Implemented After Asset is Accessed in GitLab
- GitLab
- CWE-1280
Not analysed yet 14 May 2026
CVE-2026-4524 CVE record

CVSS 6.5 Medium

Authentication Bypass Using an Alternate Path or Channel in GitLab
- GitLab
- Authentication bypass
Not analysed yet 14 May 2026
CVE-2026-4527 CVE record

CVSS 6.5 Medium

Cross-Site Request Forgery (CSRF) in GitLab
- GitLab
- Cross-site request forgery (CSRF)
Not analysed yet 14 May 2026
CVE-2026-6063 CVE record

CVSS 4.3 Medium

Authorization Bypass Through User-Controlled Key in GitLab
- GitLab
- Broken access control
Not analysed yet 14 May 2026
CVE-2026-6073 CVE record

CVSS 8.7 High

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
- GitLab
- Cross-site scripting (XSS)
Not analysed yet 14 May 2026
CVE-2026-6335 CVE record

CVSS 5.4 Medium

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
- GitLab
- Cross-site scripting (XSS)
Not analysed yet 14 May 2026
CVE-2026-6883 CVE record

CVSS 2.6 Low

Missing Authorization in GitLab
- GitLab
- Broken access control
Not analysed yet 14 May 2026
CVE-2026-7377 CVE record

CVSS 8.7 High

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
- GitLab
- Cross-site scripting (XSS)
Not analysed yet 14 May 2026
CVE-2026-7471 CVE record

CVSS 3.5 Low

Server-Side Request Forgery (SSRF) in GitLab
- GitLab
- Server-side request forgery (SSRF)
Not analysed yet 14 May 2026
CVE-2026-7481 CVE record

CVSS 8.7 High

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
- GitLab
- Cross-site scripting (XSS)
Not analysed yet 14 May 2026
CVE-2026-8280 CVE record

CVSS 6.5 Medium

Allocation of Resources Without Limits or Throttling in GitLab
- GitLab
- Denial of service
Not analysed yet 14 May 2026
CVE-2026-8144 CVE record

CVSS 4.3 Medium

Missing Authorization in GitLab
- GitLab
- Broken access control
Not analysed yet 14 May 2026
CVE-2026-3254 CVE record

CVSS 3.5 Low

Improper Restriction of Rendered UI Layers or Frames in GitLab
- GitLab
- CWE-1021
Not analysed yet 22 Apr 2026
CVE-2026-4922 CVE record

CVSS 8.1 High

Cross-Site Request Forgery (CSRF) in GitLab
- GitLab
- Cross-site request forgery (CSRF)
Not analysed yet 22 Apr 2026
CVE-2025-0186 CVE record

CVSS 6.5 Medium

Allocation of Resources Without Limits or Throttling in GitLab
- GitLab
- Denial of service
Not analysed yet 22 Apr 2026
CVE-2025-3922 CVE record

CVSS 6.5 Medium

Allocation of Resources Without Limits or Throttling in GitLab
- GitLab
- Denial of service
Not analysed yet 22 Apr 2026
CVE-2025-6016 CVE record

CVSS 6.5 Medium

Allocation of Resources Without Limits or Throttling in GitLab
- GitLab
- Denial of service
Not analysed yet 22 Apr 2026
CVE-2025-9957 CVE record

CVSS 2.7 Low

Incorrect Authorization in GitLab
- GitLab
- Broken access control
Not analysed yet 22 Apr 2026
CVE-2026-1660 CVE record

CVSS 6.5 Medium

Allocation of Resources Without Limits or Throttling in GitLab
- GitLab
- Denial of service
Not analysed yet 22 Apr 2026
CVE-2026-5262 CVE record

CVSS 8.0 High

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
- GitLab
- Cross-site scripting (XSS)
Not analysed yet 22 Apr 2026
CVE-2026-5377 CVE record

CVSS 4.3 Medium

Incorrect Authorization in GitLab
- GitLab
- Broken access control
Not analysed yet 22 Apr 2026
CVE-2026-5816 CVE record

CVSS 8.0 High

Improper Resolution of Path Equivalence in GitLab
- GitLab
- CWE-41
Not analysed yet 22 Apr 2026
CVE-2026-6515 CVE record

CVSS 5.4 Medium

Insufficient Session Expiration in GitLab
- GitLab
- Authentication bypass
Not analysed yet 22 Apr 2026
CVE-2025-9484 CVE record

CVSS 4.3 Medium

Missing Authorization in GitLab
- GitLab
- Broken access control
Not analysed yet 8 Apr 2026
CVE-2025-12664 CVE record

CVSS 7.5 High

Improper Validation of Specified Quantity in Input in GitLab
- GitLab
- CWE-1284
Not analysed yet 8 Apr 2026
CVE-2026-1092 CVE record

CVSS 7.5 High

Improper Validation of Specified Quantity in Input in GitLab
- GitLab
- CWE-1284
Not analysed yet 8 Apr 2026
CVE-2026-1101 CVE record

CVSS 6.5 Medium

Improper Validation of Specified Quantity in Input in GitLab
- GitLab
- CWE-1284
Not analysed yet 8 Apr 2026
CVE-2026-1516 CVE record

CVSS 5.7 Medium

Improper Control of Generation of Code ('Code Injection') in GitLab
- GitLab
- Code injection
Not analysed yet 8 Apr 2026
CVE-2026-1752 CVE record

CVSS 4.3 Medium

Incorrect Authorization in GitLab
- GitLab
- Broken access control
Not analysed yet 8 Apr 2026