Injection and Smuggling

Every one of the 26 is a mark on the map. Named now: 1 to 26, most at risk first.

1. A vulnerability in GitLab CE/EE affecting all versions from 11.10 prior to 15.1.6, 15.2 to 15.2.4, 15.3 to 15.3.2 allows an authenticated user to achieve remote code execution via…CVE-2022-2992GitLab · CVSS 9.9 · 86% likely

   CWE-74

2. GitLab CE/EE versions 8.18 up to 11.x before 11.3.11, 11.4.x before 11.4.8, and 11.5.x before 11.5.1 have CRLF Injection in Project Mirroring when using the Git protocol.CVE-2018-19585Gitlab · 15% likely

   CWE-93

3. Improper input validation in all versions of GitLab CE/EE using sendmail to send emails allowed an attacker to steal environment variables via specially crafted email addresses.CVE-2022-0741GitLab · CVSS 5.8 · 1.5% likely

   CWE-116

4. An issue was discovered in GitLab 10.7.0 and later through 12.9.2. A Workhorse bypass could lead to job artifact uploads and file disclosure (Exposure of Sensitive Information) vi…CVE-2020-11506Gitlab · 1.2% likely

   CWE-444

5. An issue was discovered in GitLab Community Edition (CE) and Enterprise Edition (EE) before 12.7.9, 12.8.x before 12.8.9, and 12.9.x before 12.9.3. A Workhorse bypass could lead t…CVE-2020-11505Gitlab · 1.2% likely

   CWE-444

6. An issue has been discovered affecting GitLab versions prior to 14.4.5, between 14.5.0 and 14.5.3, and between 14.6.0 and 14.6.1. Gitlab's Slack integration is incorrectly validat…CVE-2022-0124GitLab · CVSS 4.3 · 1.0% likely

   CWE-116

7. Client-Side code injection through Mermaid markup in GitLab CE/EE 12.9 and later through 13.0.1 allows a specially crafted Mermaid payload to PUT requests on behalf of other users…CVE-2020-13262GitLab · CVSS 6.1 · 0.9% likely

   CWE-74

8. Under very specific conditions a user could be impersonated using Gitlab shell. This vulnerability affects GitLab CE/EE 13.1 and later through 14.1.2, 14.0.7 and 13.12.9.CVE-2021-22254GitLab · CVSS 3.1 · 0.9% likely

   CWE-116

9. Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') in GitLabCVE-2023-0508GitLab · CVSS 3.1 · 0.8% likely

   CWE-113

10. HTML injection was possible via the full name field before versions 13.11.6, 13.12.6, and 14.0.2 in GitLab CECVE-2021-22232GitLab · CVSS 3.5 · 0.7% likely

    CWE-74

11. Improper Neutralization of Input Used for LLM Prompting in GitLabCVE-2026-96893GitLab · CVSS 7.3 · 0.6% likely

    CWE-1427

12. Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') in GitLabCVE-2026-15723GitLab · CVSS 8.2 · 0.5% likelycovered by CyberSIXT

    CWE-901 article

13. Improper Encoding or Escaping of Output in GitLabCVE-2025-8405GitLab · CVSS 7.7 · 0.5% likely

    CWE-116

14. Improper Encoding or Escaping of Output in GitLabCVE-2023-2200GitLab · CVSS 4.1 · 0.5% likely

    CWE-116

15. Improper Encoding or Escaping of Output in GitLabCVE-2024-6329GitLab · CVSS 5.7 · 0.5% likely

    CWE-116

16. Improper Neutralization of Input Used for LLM Prompting in GitLabCVE-2024-3303GitLab · CVSS 6.4 · 0.4% likely

    CWE-1427

17. Improper Control of Resource Identifiers ('Resource Injection') in GitLabCVE-2026-3855GitLab · CVSS 3.1 · 0.3% likely

    CWE-99

18. Improper Encoding or Escaping of Output in GitLabCVE-2025-12697GitLab · CVSS 2.2 · 0.3% likely

    CWE-116

19. Improper Control of Resource Identifiers ('Resource Injection') in GitLabCVE-2024-0231GitLab · CVSS 2.7 · 0.3% likely

    CWE-99

20. Improper Handling of URL Encoding (Hex Encoding) in GitLabCVE-2025-11990GitLab · CVSS 3.1 · 0.3% likely

    CWE-177

21. Improper Neutralization of Input Used for LLM Prompting in GitLabCVE-2026-15077GitLab · CVSS 4.3 · 0.3% likely

    CWE-1427

22. Improper Encoding or Escaping of Output in GitLabCVE-2024-4099GitLab · CVSS 3.1 · 0.3% likely

    CWE-116

23. Improper Encoding or Escaping of Output in GitLabCVE-2025-12734GitLab · CVSS 3.5 · 0.3% likely

    CWE-116

24. Improper Neutralization of CRLF Sequences ('CRLF Injection') in GitLabCVE-2026-3848GitLab · CVSS 5 · 0.2% likely

    CWE-93

25. Improper Neutralization of Substitution Characters in GitLabCVE-2026-9694GitLab · CVSS 2.6 · 0.2% likely

    CWE-153

26. Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') in GitLabCVE-2026-112212GitLab · CVSS 7.5 · 0.2% likelycovered by CyberSIXT

    CWE-4441 article

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.