Advisories · Technology

GitLab.

Every CVE that names GitLab among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-1102 CVE record

CVSS 5.3 Medium

Allocation of Resources Without Limits or Throttling in GitLab
- GitLab
- Denial of service
Not analysed yet 22 Jan 2026
CVE-2025-13335 CVE record

CVSS 6.5 Medium

Loop with Unreachable Exit Condition ('Infinite Loop') in GitLab
- GitLab
- Denial of service
Not analysed yet 22 Jan 2026
CVE-2025-11224 CVE record

CVSS 7.7 High

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
- GitLab
- Cross-site scripting (XSS)
Not analysed yet 14 Jan 2026
CVE-2025-3950 CVE record

CVSS 3.5 Low

Exposure of Private Personal Information to an Unauthorized Actor in GitLab
- GitLab
- Information disclosure
Not analysed yet 9 Jan 2026
CVE-2025-9222 CVE record

CVSS 8.7 High

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
- GitLab
- Cross-site scripting (XSS)
Not analysed yet 9 Jan 2026
CVE-2025-10569 CVE record

CVSS 6.5 Medium

Allocation of Resources Without Limits or Throttling in GitLab
- GitLab
- Denial of service
Not analysed yet 9 Jan 2026
CVE-2025-11246 CVE record

CVSS 5.4 Medium

Insufficient Granularity of Access Control in GitLab
- GitLab
- CWE-1220
Not analysed yet 9 Jan 2026
CVE-2025-13772 CVE record

CVSS 7.1 High

Missing Authorization in GitLab
- GitLab
- Broken access control
Not analysed yet 9 Jan 2026
CVE-2025-13761 CVE record

CVSS 8.0 High

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
- GitLab
- Cross-site scripting (XSS)
Not analysed yet 9 Jan 2026
CVE-2025-13781 CVE record

CVSS 6.5 Medium

Missing Authorization in GitLab
- GitLab
- Broken access control
Not analysed yet 9 Jan 2026
CVE-2025-12029 CVE record

CVSS 8.0 High

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
- GitLab
- Cross-site scripting (XSS)
Not analysed yet 11 Dec 2025
CVE-2025-12734 CVE record

CVSS 3.5 Low

Improper Encoding or Escaping of Output in GitLab
- GitLab
- CWE-116
Not analysed yet 11 Dec 2025
CVE-2025-4097 CVE record

CVSS 6.5 Medium

Allocation of Resources Without Limits or Throttling in GitLab
- GitLab
- Denial of service
Not analysed yet 11 Dec 2025
CVE-2025-8405 CVE record

CVSS 7.7 High

Improper Encoding or Escaping of Output in GitLab
- GitLab
- CWE-116
Not analysed yet 11 Dec 2025
CVE-2025-11247 CVE record

CVSS 4.3 Medium

Authorization Bypass Through User-Controlled Key in GitLab
- GitLab
- Broken access control
Not analysed yet 11 Dec 2025
CVE-2025-11984 CVE record

CVSS 6.8 Medium

Authentication Bypass Using an Alternate Path or Channel in GitLab
- GitLab
- Authentication bypass
Not analysed yet 11 Dec 2025
CVE-2025-12562 CVE record

CVSS 7.5 High

Allocation of Resources Without Limits or Throttling in GitLab
- GitLab
- Denial of service
Not analysed yet 11 Dec 2025
CVE-2025-12716 CVE record

CVSS 8.7 High

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
- GitLab
- Cross-site scripting (XSS)
Not analysed yet 11 Dec 2025
CVE-2025-13978 CVE record

CVSS 4.3 Medium

Generation of Error Message Containing Sensitive Information in GitLab
- GitLab
- Information disclosure
Not analysed yet 11 Dec 2025
CVE-2025-14157 CVE record

CVSS 6.5 Medium

Allocation of Resources Without Limits or Throttling in GitLab
- GitLab
- Denial of service
Not analysed yet 11 Dec 2025
CVE-2024-9183 CVE record

CVSS 7.7 High

Time-of-check Time-of-use (TOCTOU) Race Condition in GitLab
- GitLab
- Race condition
Not analysed yet 5 Dec 2025
CVE-2025-6195 CVE record

CVSS 4.3 Medium

Direct Request ('Forced Browsing') in GitLab
- GitLab
- Broken access control
Not analysed yet 26 Nov 2025
CVE-2025-7449 CVE record

CVSS 6.5 Medium

Allocation of Resources Without Limits or Throttling in GitLab
- GitLab
- Denial of service
Not analysed yet 26 Nov 2025
CVE-2025-12571 CVE record

CVSS 7.5 High

Allocation of Resources Without Limits or Throttling in GitLab
- GitLab
- Denial of service
Not analysed yet 26 Nov 2025
CVE-2025-12653 CVE record

CVSS 6.5 Medium

Authentication Bypass by Spoofing in GitLab
- GitLab
- Authentication bypass
Not analysed yet 26 Nov 2025
CVE-2025-13611 CVE record

CVSS 2.0 Low

Insertion of Sensitive Information into Log File in GitLab
- GitLab
- Information disclosure
Not analysed yet 26 Nov 2025
CVE-2025-9825 CVE record

CVSS 5.0 Medium

Missing Authorization in GitLab
- GitLab
- Broken access control
Not analysed yet 21 Nov 2025
CVE-2025-12983 CVE record

CVSS 3.5 Low

Memory Allocation with Excessive Size Value in GitLab
- GitLab
- Denial of service
Not analysed yet 15 Nov 2025
CVE-2025-2615 CVE record

CVSS 4.3 Medium

Insertion of Sensitive Information Into Sent Data in GitLab
- GitLab
- Information disclosure
Not analysed yet 15 Nov 2025
CVE-2025-6945 CVE record

CVSS 3.5 Low

Improper Neutralization of Special Elements used in a Command ('Command Injection') in GitLab
- GitLab
- Command injection
Not analysed yet 15 Nov 2025
CVE-2025-6171 CVE record

CVSS 5.3 Medium

Missing Authorization in GitLab
- GitLab
- Broken access control
Not analysed yet 15 Nov 2025
CVE-2025-7000 CVE record

CVSS 4.3 Medium

Insertion of Sensitive Information Into Sent Data in GitLab
- GitLab
- Information disclosure
Not analysed yet 15 Nov 2025
CVE-2025-7736 CVE record

CVSS 3.1 Low

Incorrect Authorization in GitLab
- GitLab
- Broken access control
Not analysed yet 15 Nov 2025
CVE-2025-11865 CVE record

CVSS 4.3 Medium

Incorrect Authorization in GitLab
- GitLab
- Broken access control
Not analysed yet 15 Nov 2025
CVE-2025-11990 CVE record

CVSS 3.1 Low

Improper Handling of URL Encoding (Hex Encoding) in GitLab
- GitLab
- CWE-177
Not analysed yet 15 Nov 2025
CVE-2025-11702 CVE record

CVSS 8.5 High

Missing Authorization in GitLab
- GitLab
- Broken access control
Not analysed yet 29 Oct 2025
CVE-2025-6601 CVE record

CVSS 2.7 Low

Business Logic Errors in GitLab
- GitLab
- CWE-840
Not analysed yet 27 Oct 2025
CVE-2025-10497 CVE record

CVSS 7.5 High

Allocation of Resources Without Limits or Throttling in GitLab
- GitLab
- Denial of service
Not analysed yet 27 Oct 2025
CVE-2025-11971 CVE record

CVSS 6.5 Medium

Incorrect Authorization in GitLab
- GitLab
- Broken access control
Not analysed yet 27 Oct 2025
CVE-2025-11974 CVE record

CVSS 6.5 Medium

Allocation of Resources Without Limits or Throttling in GitLab
- GitLab
- Denial of service
Not analysed yet 27 Oct 2025
CVE-2025-11447 CVE record

CVSS 7.5 High

Allocation of Resources Without Limits or Throttling in GitLab
- GitLab
- Denial of service
Not analysed yet 27 Oct 2025
CVE-2025-11989 CVE record

CVSS 3.7 Low

Missing Authorization in GitLab
- GitLab
- Broken access control
Not analysed yet 26 Oct 2025
CVE-2025-10004 CVE record

CVSS 7.5 High

Allocation of Resources Without Limits or Throttling in GitLab
- GitLab
- Denial of service
Not analysed yet 9 Oct 2025
CVE-2025-11340 CVE record

CVSS 7.7 High

Incorrect Authorization in GitLab
- GitLab
- Broken access control
Not analysed yet 9 Oct 2025
CVE-2025-2934 CVE record

CVSS 4.3 Medium

Allocation of Resources Without Limits or Throttling in GitLab
- GitLab
- Denial of service
Not analysed yet 9 Oct 2025
CVE-2025-8014 CVE record

CVSS 7.5 High

Allocation of Resources Without Limits or Throttling in GitLab
- GitLab
- Denial of service
Not analysed yet 27 Sept 2025
CVE-2025-11042 CVE record

CVSS 4.3 Medium

Allocation of Resources Without Limits or Throttling in GitLab
- GitLab
- Denial of service
Not analysed yet 26 Sept 2025
CVE-2025-5069 CVE record

CVSS 3.5 Low

Incorrect Ownership Assignment in GitLab
- GitLab
- CWE-708
Not analysed yet 26 Sept 2025
CVE-2025-10868 CVE record

CVSS 3.5 Low

Business Logic Errors in GitLab
- GitLab
- CWE-840
Not analysed yet 26 Sept 2025
CVE-2025-7691 CVE record

CVSS 6.5 Medium

Privilege Defined With Unsafe Actions in GitLab
- GitLab
- Privilege escalation
Not analysed yet 26 Sept 2025
CVE-2025-9642 CVE record

CVSS 8.7 High

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
- GitLab
- Cross-site scripting (XSS)
Not analysed yet 26 Sept 2025
CVE-2025-9958 CVE record

CVSS 7.7 High

Insertion of Sensitive Information Into Sent Data in GitLab
- GitLab
- Information disclosure
Not analysed yet 26 Sept 2025
CVE-2025-10858 CVE record

CVSS 7.5 High

Allocation of Resources Without Limits or Throttling in GitLab
- GitLab
- Denial of service
Not analysed yet 26 Sept 2025
CVE-2025-10867 CVE record

CVSS 3.5 Low

Allocation of Resources Without Limits or Throttling in GitLab
- GitLab
- Denial of service
Not analysed yet 26 Sept 2025
CVE-2025-10871 CVE record

CVSS 3.8 Low

Missing Authorization in GitLab
- GitLab
- Broken access control
Not analysed yet 26 Sept 2025
CVE-2025-1250 CVE record

CVSS 6.5 Medium

Allocation of Resources Without Limits or Throttling in GitLab
- GitLab
- Denial of service
Not analysed yet 12 Sept 2025
CVE-2025-2256 CVE record

CVSS 7.5 High

Improper Validation of Specified Quantity in Input in GitLab
- GitLab
- CWE-1284
Not analysed yet 12 Sept 2025
CVE-2025-6454 CVE record

CVSS 8.5 High

Server-Side Request Forgery (SSRF) in GitLab
- GitLab
- Server-side request forgery (SSRF)
Not analysed yet 12 Sept 2025
CVE-2025-6769 CVE record

CVSS 4.3 Medium

Exposure of Sensitive System Information to an Unauthorized Control Sphere in GitLab
- GitLab
- Information disclosure
Not analysed yet 12 Sept 2025
CVE-2025-7337 CVE record

CVSS 6.5 Medium

Allocation of Resources Without Limits or Throttling in GitLab
- GitLab
- Denial of service
Not analysed yet 12 Sept 2025