Advisories · Technology

GitLab.

Every CVE that names GitLab among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-13210 CVE record

CVSS 7.7 High

Incorrect Authorization in GitLab
- GitLab
- Broken access control
Not analysed yet 15 Sept 2026
CVE-2026-82837 CVE record

CVSS 5.3 Medium

Insertion of Sensitive Information Into Sent Data in GitLab
- GitLab
- Information disclosure
Not analysed yet 15 Sept 2026
CVE-2026-88765 CVE record

CVSS 8.5 High

Improper Neutralization of Special Elements used in a Command ('Command Injection') in GitLab
- GitLab
- Command injection
Not analysed yet 15 Sept 2026
CVE-2026-85706 CVE record

CVSS 10.0 CriticalCritical · KEV, CVSS 9+, CVSS 7+ and EPSSKEV

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab
- GitLab
- Path traversal
Not analysed yet 12 Sept 2026
CVE-2026-87719 CVE record

CVSS 9.9 CriticalCritical · CVSS 9+

Deserialization of Untrusted Data in GitLab
- GitLab
- Insecure deserialization
Not analysed yet 12 Sept 2026
CVE-2026-4398 CVE record

CVSS 5.4 Medium

Authorization Bypass Through User-Controlled Key in GitLab
- GitLab
- Broken access control
Not analysed yet 27 Aug 2026
CVE-2025-10903 CVE record

CVSS 6.5 Medium

Loop with Unreachable Exit Condition ('Infinite Loop') in GitLab
- GitLab
- Denial of service
Not analysed yet 26 Aug 2026
CVE-2026-3035 CVE record

CVSS 5.5 Medium

Authentication Bypass Using an Alternate Path or Channel in GitLab
- GitLab
- Authentication bypass
Not analysed yet 26 Aug 2026
CVE-2026-7487 CVE record

CVSS 3.5 Low

Access Control Check Implemented After Asset is Accessed in GitLab
- GitLab
- CWE-1280
Not analysed yet 26 Aug 2026
CVE-2026-15387 CVE record

CVSS 4.3 Medium

Acceptance of Extraneous Untrusted Data With Trusted Data in GitLab
- GitLab
- CWE-349
Not analysed yet 26 Aug 2026
CVE-2026-18252 CVE record

CVSS 7.3 High

Inclusion of Functionality from Untrusted Control Sphere in GitLab
- GitLab
- CWE-829
Not analysed yet 26 Aug 2026
CVE-2026-77801 CVE record

CVSS 6.5 Medium

Allocation of Resources Without Limits or Throttling in GitLab
- GitLab
- Denial of service
Not analysed yet 26 Aug 2026
CVE-2026-10053 CVE record

CVSS 8.5 High

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab
- GitLab
- Path traversal
Not analysed yet 23 Aug 2026
CVE-2026-19650 CVE record

CVSS 7.1 High

Cross-Site Request Forgery (CSRF) in GitLab
- GitLab
- Cross-site request forgery (CSRF)
Not analysed yet 17 Aug 2026
CVE-2026-19478 CVE record

CVSS 9.4 CriticalCritical · CVSS 9+

Improper Control of Generation of Code ('Code Injection') in GitLab
- GitLab
- Code injection
Not analysed yet 17 Aug 2026
CVE-2025-9486 CVE record

CVSS 3.3 Low

Incorrect Privilege Assignment in GitLab
- GitLab
- Privilege escalation
Not analysed yet 12 Aug 2026
CVE-2026-4879 CVE record

CVSS 4.3 Medium

Missing Authorization in GitLab
- GitLab
- Broken access control
Not analysed yet 12 Aug 2026
CVE-2026-6821 CVE record

CVSS 4.3 Medium

Missing Authorization in GitLab
- GitLab
- Broken access control
Not analysed yet 12 Aug 2026
CVE-2026-15217 CVE record

CVSS 8.7 High

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
- GitLab
- Cross-site scripting (XSS)
Not analysed yet 12 Aug 2026
CVE-2026-15216 CVE record

CVSS 8.7 High

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
- GitLab
- Cross-site scripting (XSS)
Not analysed yet 12 Aug 2026
CVE-2026-16494 CVE record

CVSS 7.1 High

Missing Authorization in GitLab
- GitLab
- Broken access control
Not analysed yet 12 Aug 2026
CVE-2026-18433 CVE record

CVSS 4.3 Medium

Incorrect Authorization in GitLab
- GitLab
- Broken access control
Not analysed yet 12 Aug 2026
CVE-2026-19228 CVE record

CVSS 8.5 High

Authorization Bypass Through User-Controlled Key in GitLab
- GitLab
- Broken access control
Not analysed yet 12 Aug 2026
CVE-2026-7427 CVE record

CVSS 5.3 Medium

Allocation of Resources Without Limits or Throttling in GitLab
- GitLab
- Denial of service
Not analysed yet 12 Aug 2026
CVE-2026-8667 CVE record

CVSS 4.3 Medium

Incorrect Authorization in GitLab
- GitLab
- Broken access control
Not analysed yet 12 Aug 2026
CVE-2026-15423 CVE record

CVSS 8.5 High

Incorrect Authorization in GitLab
- GitLab
- Broken access control
Not analysed yet 12 Aug 2026
CVE-2026-16627 CVE record

CVSS 7.7 High

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
- GitLab
- Cross-site scripting (XSS)
Not analysed yet 12 Aug 2026
CVE-2026-18244 CVE record

CVSS 4.3 Medium

Missing Authorization in GitLab
- GitLab
- Broken access control
Not analysed yet 12 Aug 2026
CVE-2025-14562 CVE record

CVSS 3.1 Low

Incorrect Authorization in GitLab
- GitLab
- Broken access control
Not analysed yet 29 Jul 2026
CVE-2026-3093 CVE record

CVSS 4.7 Medium

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
- GitLab
- Cross-site scripting (XSS)
Not analysed yet 29 Jul 2026
CVE-2026-4672 CVE record

CVSS 4.3 Medium

Missing Authorization in GitLab
- GitLab
- Broken access control
Not analysed yet 29 Jul 2026
CVE-2026-6267 CVE record

CVSS 8.5 High

Insertion of Sensitive Information Into Sent Data in GitLab
- GitLab
- Information disclosure
Not analysed yet 29 Jul 2026
CVE-2026-6336 CVE record

CVSS 5.3 Medium

Incorrect Authorization in GitLab
- GitLab
- Broken access control
Not analysed yet 29 Jul 2026
CVE-2026-12436 CVE record

CVSS 8.4 High

Improperly Controlled Modification of Dynamically-Determined Object Attributes in GitLab
- GitLab
- Broken access control
Not analysed yet 29 Jul 2026
CVE-2026-13113 CVE record

CVSS 6.5 Medium

Time-of-check Time-of-use (TOCTOU) Race Condition in GitLab
- GitLab
- Race condition
Not analysed yet 29 Jul 2026
CVE-2026-14341 CVE record

CVSS 4.9 Medium

Missing Authorization in GitLab
- GitLab
- Broken access control
Not analysed yet 29 Jul 2026
CVE-2026-14351 CVE record

CVSS 4.3 Medium

Exposure of Sensitive Information Through Metadata in GitLab
- GitLab
- CWE-1230
Not analysed yet 29 Jul 2026
CVE-2026-15077 CVE record

CVSS 4.3 Medium

Improper Neutralization of Input Used for LLM Prompting in GitLab
- GitLab
- CWE-1427
Not analysed yet 29 Jul 2026
CVE-2026-15831 CVE record

CVSS 4.3 Medium

Generation of Incorrect Security Tokens in GitLab
- GitLab
- CWE-1270
Not analysed yet 29 Jul 2026
CVE-2026-15975 CVE record

CVSS 7.5 High

Allocation of Resources Without Limits or Throttling in GitLab
- GitLab
- Denial of service
Not analysed yet 29 Jul 2026
CVE-2026-16553 CVE record

CVSS 5.4 Medium

Insufficiently Protected Credentials in GitLab
- GitLab
- Hard-coded credentials
Not analysed yet 29 Jul 2026
CVE-2025-12506 CVE record

CVSS 3.5 Low

Use of Incorrectly-Resolved Name or Reference in GitLab
- GitLab
- CWE-706
Not analysed yet 8 Jul 2026
CVE-2026-6352 CVE record

CVSS 2.7 Low

Incorrect Authorization in GitLab
- GitLab
- Broken access control
Not analysed yet 8 Jul 2026
CVE-2026-6896 CVE record

CVSS 8.7 High

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
- GitLab
- Cross-site scripting (XSS)
Not analysed yet 8 Jul 2026
CVE-2026-7492 CVE record

CVSS 4.3 Medium

Missing Authorization in GitLab
- GitLab
- Broken access control
Not analysed yet 8 Jul 2026
CVE-2026-8472 CVE record

CVSS 4.3 Medium

Missing Authorization in GitLab
- GitLab
- Broken access control
Not analysed yet 8 Jul 2026
CVE-2026-11827 CVE record

CVSS 4.9 Medium

Insufficiently Protected Credentials in GitLab
- GitLab
- Hard-coded credentials
Not analysed yet 8 Jul 2026
CVE-2026-13320 CVE record

CVSS 7.3 High

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
- GitLab
- Cross-site scripting (XSS)
Not analysed yet 8 Jul 2026
CVE-2026-10086 CVE record

CVSS 8.7 High

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
- GitLab
- Cross-site scripting (XSS)
Not analysed yet 25 Jun 2026
CVE-2026-0934 CVE record

CVSS 3.8 Low

Incorrect Authorization in GitLab
- GitLab
- Broken access control
Not analysed yet 25 Jun 2026
CVE-2026-1606 CVE record

CVSS 4.3 Medium

Improper Control of Generation of Code ('Code Injection') in GitLab
- GitLab
- Code injection
Not analysed yet 25 Jun 2026
CVE-2026-2238 CVE record

CVSS 5.3 Medium

Missing Authorization in GitLab
- GitLab
- Broken access control
Not analysed yet 25 Jun 2026
CVE-2026-3176 CVE record

CVSS 3.1 Low

Missing Authorization in GitLab
- GitLab
- Broken access control
Not analysed yet 25 Jun 2026
CVE-2026-5309 CVE record

CVSS 5.4 Medium

Authorization Bypass Through User-Controlled Key in GitLab
- GitLab
- Broken access control
Not analysed yet 25 Jun 2026
CVE-2026-5796 CVE record

CVSS 4.3 Medium

Incorrect Authorization in GitLab
- GitLab
- Broken access control
Not analysed yet 25 Jun 2026
CVE-2026-5952 CVE record

CVSS 4.3 Medium

Incorrect Authorization in GitLab
- GitLab
- Broken access control
Not analysed yet 25 Jun 2026
CVE-2026-8330 CVE record

CVSS 4.4 Medium

Insertion of Sensitive Information into Log File in GitLab
- GitLab
- Information disclosure
Not analysed yet 25 Jun 2026
CVE-2026-10712 CVE record

CVSS 8.0 High

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
- GitLab
- Cross-site scripting (XSS)
Not analysed yet 25 Jun 2026
CVE-2026-11379 CVE record

CVSS 5.3 Medium

Incorrect Authorization in GitLab
- GitLab
- Broken access control
Not analysed yet 25 Jun 2026
CVE-2026-12053 CVE record

CVSS 8.6 High

Insertion of Sensitive Information into Log File in GitLab
- GitLab
- Information disclosure
Not analysed yet 25 Jun 2026