Skip to content

GitLab · weakness class

Race Conditions

10 CVEs

Every dot is a CVE in what this vendor ships; the named ones are the most at risk.

Every one of the 10 is a mark on the map. Named now: 1 to 10, most at risk first.

  1. GitLab CE 8.17 and later and EE 8.3 and later have a symlink time-of-check-to-time-of-use race condition that would allow unauthorized access to files in the GitLab Pages chroot e…CVE-2018-19572Gitlab · 0.9% likely

    CWE-362

  2. An issue has been discovered in GitLab affecting all versions starting from 15.7 before 15.8.5, from 15.9 before 15.9.4, and from 15.10 before 15.10.1 that allows for crafted, una…CVE-2022-4143GitLab · CVSS 6.4 · 0.8% likely

    CWE-367

  3. An issue has been discovered in GitLab CE/EE affecting all versions before 15.5.7, all versions starting from 15.6 before 15.6.4, all versions starting from 15.7 before 15.7.2. A…CVE-2022-4037GitLab · CVSS 6.4 · 0.7% likely

    CWE-362

  4. An issue was discovered in GitLab Community and Enterprise Edition before 11.8.9, 11.9.x before 11.9.10, and 11.10.x before 11.10.2. It has a Race Condition which could allow user…CVE-2019-11546Gitlab · 0.6% likely

    CWE-362

  5. Time-of-check Time-of-use (TOCTOU) Race Condition in GitLabCVE-2024-11222GitLab · CVSS 6.4 · 0.4% likely

    CWE-367

  6. Time-of-check Time-of-use (TOCTOU) Race Condition in GitLabCVE-2026-13113GitLab · CVSS 6.5 · 0.3% likely

    CWE-367

  7. Time-of-check Time-of-use (TOCTOU) Race Condition in GitLabCVE-2024-9512GitLab · CVSS 5.3 · 0.3% likely

    CWE-367

  8. Time-of-check Time-of-use (TOCTOU) Race Condition in GitLabCVE-2024-9183GitLab · CVSS 7.7 · 0.3% likely

    CWE-367

  9. Incorrect Synchronization in GitLabCVE-2024-4278GitLab · CVSS 5.5 · 0.2% likely

    CWE-821

  10. Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') in GitLabCVE-2026-92628GitLab · CVSS 3.1 · 0.1% likely

    CWE-362

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.