Vendor
GitLab
- CVEs tracked · all time
- 32
- in CISA KEV · all time
- 4
- articles · since 11 Sep
- 25
- articles · all time
- 43
25 articles since 11 Sep; 1 CISA notice, marked below the bars.
Show as table
| Day (UTC) | Articles |
|---|---|
| Fri 11 Sep | 4 |
| Sun 13 Sep | 1 |
| Mon 14 Sep | 5 |
| Thu 24 Sep | 1 |
| Fri 2 Oct | 2 |
| Sat 3 Oct | 1 |
| Sun 4 Oct | 1 |
| Thu 8 Oct | 1 |
| Mon 12 Oct | 2 |
| Tue 13 Oct | 4 |
| Wed 14 Oct | 1 |
| Fri 16 Oct | 1 |
| Thu 22 Oct | 1 |
Products: Community and Enterprise Editions, Community Edition and Enterprise Edition, GitLab, GitLab AI Gateway
CVEs
32 CVEsCVE-2026-85706GitLab Community Edition and Enterprise Edition Path Traversal VulnerabilityCVSS10.0CriticalExploited97%EPSS12articles
CVE-2021-22205GitLab Community and Enterprise Editions Remote Code Execution VulnerabilityCVSS10.0CriticalExploited99.7%EPSS1article
CVE-2021-22175GitLab Server-Side Request Forgery (SSRF) VulnerabilityCVSS6.8MediumExploited53%EPSS2articles
CVE-2021-39935GitLab Community and Enterprise Editions Server-Side Request Forgery (SSRF) VulnerabilityCVSS6.8MediumExploited36%EPSS2articles
CVE-2026-90970Improper Neutralization of Special Elements Used in a Template Engine in GitLab AI GatewayCVSS9.9Critical–Not in KEV0.9%EPSS6articles
CVE-2026-92883Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabCVSS8.7High–Not in KEV0.3%EPSS2articles
20 more CVEs
CVE-2026-84739Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabCVSS8.7High–Not in KEV0.5%EPSS1article
CVE-2026-88765Improper Neutralization of Special Elements used in a Command ('Command Injection') in GitLabCVSS8.5High–Not in KEV0.7%EPSS1article
CVE-2026-10087Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabCVSS8.7High–Not in KEV0.3%EPSS1article
CVE-2026-7250Allocation of Resources Without Limits or Throttling in GitLabCVSS7.5High–Not in KEV0.6%EPSS1article
CVE-2026-1500Allocation of Resources Without Limits or Throttling in GitLabCVSS6.5Medium–Not in KEV0.3%EPSS1article
- GitLab Patches Critical Flaw That Could Let Attackers Run CodeSecurityOnline
- GitLab fixes critical CI/CD flaw enabling unauthenticated remote code executionRapid7
- Critical GitLab CI flaw enables unauthenticated remote code executionSecurityOnline
- GitLab patches critical flaw letting attackers run code without logging inSecurity Affairs
- GitLab rushes to patch critical flaw enabling unauthenticated server takeoverSOCRadar
- GitLab fixes critical flaw that lets attackers execute code via CI/CD regexesRapid7
- GitLab Patches Critical Flaw That Could Let Attackers Run Server CodeThe Hacker News
- Critical GitLab flaw lets unauthenticated attackers run code on serversSecurityOnline
- Actively Exploited Vulnerabilities Jump to 100 in Q3 2026SecurityOnline
- China-Based Hackers Accused of Stealing Emails Across 7 CountriesThe Hacker News
- Security Roundup Exposes CloudSyncD Mac Backdoor and AI Gateway FlawSecurity Affairs
- GitLab AI Gateway Flaw Lets Users Run Commands on HostsSecurity Affairs
- GitLab Patches Critical AI Gateway Flaw Enabling Command ExecutionSecurityOnline
- GitLab Fixes Critical AI Gateway Flaw Enabling Command ExecutionThe Hacker News
- GitLab Fixes Critical CI/CD Flaws Enabling Arbitrary Code ExecutionSecurityOnline
- CISA Warns of Active Exploitation of Critical GitLab File Theft FlawDark Reading
- CISA Flags Artifactory, ScreenConnect and GitLab Flaws as ExploitedSecurity Affairs
- Critical GitLab Flaw Exploited as CISA Orders Emergency PatchingRapid7
- GitLab Urges Patching as Attackers Probe Critical File-Read FlawInfosecurity
- CISA Tracks Exploitation of Critical N-central, GitLab and MikroTik FlawsSecurityOnline
- GitLab Zero Day Lets Attackers Steal Secrets From Public ServersSecurity Affairs
- CISA Flags Actively Exploited GitLab Flaw Exposing Arbitrary FilesCISA · official notice
- GitLab Patches CVSS 10 Flaw Exploited to Steal SecretsThe Hacker News
- Attackers Exploit Critical GitLab Flaw Within a Day of PatchesSecurityWeek
- GitLab Fixes Critical Path Traversal Flaw Exposing Server FilesSecurityOnline
- OpenAI Reveals AI Agents Used Public Wiki to Evade ControlsSecurityOnline
- GitLab Updates Fix Arbitrary Command Execution VulnerabilitySecurityOnline
- GitLab fixes CVE-2026-19478 flaw allowing attacker deletionSecurityOnline
- GitLab GraphQL Vulnerability CVE-2026-19478 Actively ExploitedSecurity Affairs
- Attackers hit GitLab flaw CVE-2026-19478 hours after disclosureThe Hacker News
- GitLab Flaw CVE-2026-19478 Exploited in Days, Urges PatchSecurityWeek
- GitLab flaw (CVE-2026-19478) lets attackers delete projectsDark Reading
- GitLab Patches Critical Unauthenticated GraphQL VulnerabilitySecurity Affairs
- GitLab fixes critical code injection and CSRF bugsSecurityWeek
- GitLab fixes CVE-2026-19478 GraphQL injection and CSRF flawSecurityOnline
- GitLab patches critical flaw CVE-2026-6267 allowing data accessSecurityOnline
- GitLab fixes critical XSS bug CVE-2026-6896 for developer rolesSecurityOnline
- GitLab fixes critical XSS flaws in Analytics dashboardSecurityWeek
- Important GitLab Security Updates Address 12 VulnerabilitiesSecurityOnline
- U.S. CISA adds Dell RecoverPoint and GitLab flaws to its Known Exploited Vulnerabilities catalogSecurity Affairs
- ThreatsDay Bulletin: OpenSSL RCE, Foxit 0-Days, Copilot Leak, AI Password Flaws & 20+ StoriesThe Hacker News
- Fresh SolarWinds Vulnerability Exploited in AttacksSecurityWeek
- U.S. CISA adds SolarWinds Web Help Desk, Sangoma FreePBX, and GitLab flaws to its Known Exploited Vulnerabilities catalogSecurity Affairs · first in our coverage