CVEs
Every published CVE. Without a filter the list holds those exploited, with a public check, or likely to be exploited; pick a year and month or a vendor for the rest.
GitLab has 1,521 CVEs, 6 exploited. Pick a weakness or a product to list them.
By weakness
- Access Control371
- Denial of Service203
- Cross-site Scripting187
- Information Disclosure136
- Authentication72 · 1 exploited
- Input Validation and Logic65
- Insecure Direct Object Reference50
- Server-Side Request Forgery48 · 2 exploited
- File and Path Handling35 · 1 exploited
- Command and Code Injection33 · 1 exploited
- Injection and Smuggling26
- Cryptography25
- Cross-Site Request Forgery18
- Open Redirect18
- Race Conditions10
- Memory Corruption7 · 1 exploited
- Misconfiguration and Insecure Design6
- Deserialization and Object Injection4
- Supply Chain and Malicious Code3
- Other weaknesses2
- SQL Injection1
- No weakness recorded201
By product
- GitLab1,439 · 6 exploited
- GitLab CE/EE31
- GitLab Community and Enterprise Editions13
- GitLab EE11
- GitLab Runner6
- GitLab AI Gateway4
- DAST2
- gitlab.com2
- gitlab-vscode-extension2
- DAST API scanner1
- Gitaly1
- GitLab Community Edition1
- GitLab Community Edition and GitLab Enterprise Edition1
- GitLab Community Edition and GitLab Enterprise Edition 8.7.0 through 8.15.7, 8.…1
- GitLab Community Edition & GitLab Enterprise Edition 8.13.0, 8.13.0-ee, 8.13.1,…1
- GitLab DAST API scanner1
- GitLab Language Server1
- GitLab Pages1
- GitLab VSCode Fork1
- Omnibus1
Exploitation: exploited (CISA KEV), a public nuclei check, then EPSS: likely 10% or more, possible 1 to 10%, unlikely under 1%. Data as of 2026-11-14.