Skip to content
BackEsc
Sign in

GitLab · product

GitLab

1,422 CVEs · 6 exploited

Every dot is a CVE in what this vendor ships; the named ones are the most at risk.

exploited in the wild
6
check available
8
likely to be exploited
32

Every one of the 1,422 is a mark on the map. Named now: 1 to 26, most at risk first.

  1. GitLab CE/EE - Remote Code ExecutionCVE-2021-22205GitLab · CVSS 10 · 100% likely
  2. GitLab CE/EE <=19.1.7/19.2.5/19.3.1 - Arbitrary File ReadCVE-2026-85706GitLab · CVSS 10 · 97% likely
  3. GitLab - Account Takeover via Password ResetCVE-2023-7028GitLab · CVSS 10 · 94% likely
  4. GitLab CE/EE < 19.2.8 / 19.3.5 / 19.4.2 - Unauthenticated RCE via Onigmo Integer OverflowCVE-2026-97229GitLab · CVSS 10 · 69% likely
  5. GitLab CI Lint API - Server-Side Request ForgeryCVE-2021-22175GitLab · CVSS 6.8 · 53% likely
  6. An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.5 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.…CVE-2021-39935GitLab · CVSS 6.8 · 36% likely
  7. GitLab GraphQL API User EnumerationCVE-2021-4191GitLab · CVSS 5.3 · 80% likely
  8. GitLab CE/EE - Remote Code ExecutionCVE-2022-2185GitLab · CVSS 9.9 · 77% likely
  9. GitLab CE/EE - Hard-Coded CredentialsCVE-2022-1162GitLab · CVSS 9.1 · 76% likely
  10. GitLab 16.0.0 - Path TraversalCVE-2023-2825GitLab · CVSS 10 · 72% likely
  11. Gitlab CE/EE 10.5 - Server-Side Request ForgeryCVE-2021-22214GitLab · CVSS 6.8 · 28% likely
  12. GitLab CE/EE - Information DisclosureCVE-2022-0735GitLab · CVSS 10 · 13% likely
  13. GitLab Enterprise Edition - Server-Side Request ForgeryCVE-2019-6793Gitlab · 3.5% likely
  14. GitLab CE/EE - GraphQL @gl_introduced Arbitrary Method InvocationCVE-2026-19478GitLab · CVSS 9.4 · 2.2% likely
  15. An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. A specially crafted merge re…CVE-2023-2442GitLab · CVSS 8.7 · 96% likely
  16. An issue has been discovered in GitLab affecting all versions starting from 13.7 before 15.7.8, all versions starting from 15.8 before 15.8.4, all versions starting from 15.9 befo…CVE-2023-0050GitLab · CVSS 8.7 · 92% likely
  17. Improper handling of user input in GitLab CE/EE versions 8.3 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allowed an attacker to exploit a stored XSS by abusing…CVE-2022-1190GitLab · CVSS 8.7 · 88% likely
  18. A cross-site scripting issue has been discovered in GitLab CE/EE affecting all versions prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2. It was possible to exploit…CVE-2022-3265GitLab · CVSS 7.3 · 87% likely
  19. A vulnerability in GitLab CE/EE affecting all versions from 11.10 prior to 15.1.6, 15.2 to 15.2.4, 15.3 to 15.3.2 allows an authenticated user to achieve remote code execution via…CVE-2022-2992GitLab · CVSS 9.9 · 86% likely
  20. Allocation of Resources Without Limits or Throttling in GitLabCVE-2023-0921GitLab · CVSS 4.3 · 84% likely
  21. Improper neutralization of user input in GitLab CE/EE versions 14.4 before 14.7.7, all versions starting from 14.8 before 14.8.5, all versions starting from 14.9 before 14.9.2 all…CVE-2022-1175GitLab · CVSS 8.7 · 82% likely
  22. A vulnerability in GitLab CE/EE affecting all versions from 11.3.4 prior to 15.1.5, 15.2 to 15.2.3, 15.3 to 15.3 to 15.3.1 allows an an authenticated user to achieve remote code e…CVE-2022-2884GitLab · CVSS 9.9 · 76% likely
  23. An issue has been discovered in GitLab affecting all versions starting with 13.3. GitLab was vulnerable to a stored XSS by using the design feature in issues.CVE-2021-22238GitLab · CVSS 6.8 · 72% likely
  24. An issue has been discovered in GitLab affecting all versions prior to 13.2.10, 13.3.7 and 13.4.2: Stored XSS in CI Job LogCVE-2020-13340GitLab · CVSS 8.7 · 67% likely
  25. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabCVE-2023-2164GitLab · CVSS 5.4 · 66% likely
  26. Insufficient input sanitization in Mermaid markdown in GitLab CE/EE version 11.4 and up allows an attacker to exploit a stored cross-site scripting vulnerability via a specially-c…CVE-2021-22242GitLab · CVSS 8.7 · 64% likely

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.

CyberSIXTSignal over noise
Updated AboutDevelopersSign in