CyberSIXT Search
GitLab product

Several products

← All GitLab products

No CISA KEV deadline is open. CISA last added a Several products CVE on 18 Feb.

Tracked since 22 Jan · latest article Mon 26 Oct · RSS

High exploit odds · current
2
EPSS top 5%, not in KEV

Exploited, by due date

CSV download
CVEProductAddedDue · federal deadline

Deadlines passed

CVE-2021-22175GitLab18 FebDeadline passed 11 Mar2 articles

Coverage

33 articles · all timeFull timeline

33 articles from 7 outlets since 22 Jan; 2 in the last 7 days.

Several products: coverage over time33 articles from 7 outlets. First report 22 Jan by SecurityWeek. Busiest week: 8 articles, week of 17 Aug. 2 in the last 7 days. Several products: coverage over time33 articles from 7 outlets. First report 22 Jan by SecurityWeek. Busiest week: 8 articles, week of 17 Aug. 2 in the last 7 days.
  • Article
  • First report
Show as table
Several products: articles
Published (UTC)OutletHeadline
Mon 26 Oct · 03:21 UTCSecurityOnlineRuby fixes regex flaws that could enable GitLab server attacks
Thu 22 Oct · 01:01 UTCSecurityOnlineGitLab Patches Critical Flaw That Could Let Attackers Run Code
Fri 16 Oct · 15:37 UTCRapid7GitLab fixes critical CI/CD flaw enabling unauthenticated remote code execution
Wed 14 Oct · 11:01 UTCSecurityOnlineCritical GitLab CI flaw enables unauthenticated remote code execution
Tue 13 Oct · 14:37 UTCSecurity AffairsGitLab patches critical flaw letting attackers run code without logging in
Tue 13 Oct · 13:28 UTCSOCRadarGitLab rushes to patch critical flaw enabling unauthenticated server takeover
Tue 13 Oct · 12:50 UTCRapid7GitLab fixes critical flaw that lets attackers execute code via CI/CD regexes
Tue 13 Oct · 09:12 UTCThe Hacker NewsGitLab Patches Critical Flaw That Could Let Attackers Run Server Code
Mon 12 Oct · 09:11 UTCSecurityOnlineCritical GitLab flaw lets unauthenticated attackers run code on servers
Thu 24 Sep · 02:30 UTCSecurityOnlineGitLab Fixes Critical CI/CD Flaws Enabling Arbitrary Code Execution
Mon 14 Sep · 11:57 UTCRapid7Critical GitLab Flaw Exploited as CISA Orders Emergency Patching
Sun 13 Sep · 12:47 UTCSecurity AffairsGitLab Zero Day Lets Attackers Steal Secrets From Public Servers
Fri 11 Sep · 17:37 UTCThe Hacker NewsGitLab Patches CVSS 10 Flaw Exploited to Steal Secrets
Fri 11 Sep · 16:30 UTCSecurityWeekAttackers Exploit Critical GitLab Flaw Within a Day of Patches
Fri 11 Sep · 01:30 UTCSecurityOnlineGitLab Fixes Critical Path Traversal Flaw Exposing Server Files
Mon 7 Sep · 04:31 UTCSecurityOnlineOpenAI Reveals AI Agents Used Public Wiki to Evade Controls
Wed 26 Aug · 14:58 UTCSecurityOnlineGitLab Updates Fix Arbitrary Command Execution Vulnerability
Sun 23 Aug · 15:08 UTCSecurityOnlineGitLab fixes CVE-2026-19478 flaw allowing attacker deletion
Fri 21 Aug · 10:40 UTCSecurity AffairsGitLab GraphQL Vulnerability CVE-2026-19478 Actively Exploited
Fri 21 Aug · 08:21 UTCThe Hacker NewsAttackers hit GitLab flaw CVE-2026-19478 hours after disclosure
Thu 20 Aug · 08:10 UTCSecurityWeekGitLab Flaw CVE-2026-19478 Exploited in Days, Urges Patch
Tue 18 Aug · 22:10 UTCDark ReadingGitLab flaw (CVE-2026-19478) lets attackers delete projects
Tue 18 Aug · 09:11 UTCSecurity AffairsGitLab Patches Critical Unauthenticated GraphQL Vulnerability
Tue 18 Aug · 09:10 UTCSecurityWeekGitLab fixes critical code injection and CSRF bugs
Tue 18 Aug · 03:01 UTCSecurityOnlineGitLab fixes CVE-2026-19478 GraphQL injection and CSRF flaw
Thu 30 Jul · 04:30 UTCSecurityOnlineGitLab patches critical flaw CVE-2026-6267 allowing data access
Thu 9 Jul · 03:20 UTCSecurityOnlineGitLab fixes critical XSS bug CVE-2026-6896 for developer roles
Thu 25 Jun · 11:20 UTCSecurityWeekGitLab fixes critical XSS flaws in Analytics dashboard
Thu 11 Jun · 04:22 UTCSecurityOnlineImportant GitLab Security Updates Address 12 Vulnerabilities
Thu 19 Feb · 15:45 UTCSecurity AffairsU.S. CISA adds Dell RecoverPoint and GitLab flaws to its Known Exploited Vulnerabilities catalog
Thu 19 Feb · 15:10 UTCThe Hacker NewsThreatsDay Bulletin: OpenSSL RCE, Foxit 0-Days, Copilot Leak, AI Password Flaws & 20+ Stories
Wed 11 Feb · 02:55 UTCSecurityOnlineGitLab Patch Alert: High-Severity Web IDE Flaw Exposes Private Repos
Thu 22 Jan · 09:45 UTCSecurityWeekAtlassian, GitLab, Zoom Release Security Patches

Who reported 7 outlets, last 12 months

  • SecurityOnline14
  • SecurityWeek5
  • Security Affairs5
  • The Hacker News4
  • Rapid73
  • Dark Reading1
  • SOCRadar1
  1. Ruby fixes regex flaws that could enable GitLab server attacksSecurityOnline
  2. GitLab Patches Critical Flaw That Could Let Attackers Run CodeSecurityOnline
  3. GitLab fixes critical CI/CD flaw enabling unauthenticated remote code executionRapid7
  4. Critical GitLab CI flaw enables unauthenticated remote code executionSecurityOnline
  5. GitLab patches critical flaw letting attackers run code without logging inSecurity Affairs
  6. GitLab rushes to patch critical flaw enabling unauthenticated server takeoverSOCRadar
  7. GitLab fixes critical flaw that lets attackers execute code via CI/CD regexesRapid7
  8. GitLab Patches Critical Flaw That Could Let Attackers Run Server CodeThe Hacker News
  9. Critical GitLab flaw lets unauthenticated attackers run code on serversSecurityOnline
  10. GitLab Fixes Critical CI/CD Flaws Enabling Arbitrary Code ExecutionSecurityOnline

All CVEs in coverage

32
CVE-2021-22175GitLab Server-Side Request Forgery (SSRF) VulnerabilityCVSS6.8MediumExploited53%EPSS2articles
CVE-2026-19478GitLab vulnerabilityCVSS9.4Critical–Not in KEV60%EPSS8articles
CVE-2026-97229Integer Overflow or Wraparound in GitLabCVSS10.0Critical–Not in KEV18%EPSS8articles
CVE-2026-0723Unchecked Return Value in GitLabCVSSUnrated–Not in KEV1.0%EPSS1article
CVE-2026-110264GitLab vulnerabilityCVSS10.0Critical–Not in KEV1.0%EPSS2articles
CVE-2025-13927Allocation of Resources Without Limits or Throttling in GitLabCVSSUnrated–Not in KEV0.8%EPSS1article
CVE-2025-13928Incorrect Authorization in GitLabCVSSUnrated–Not in KEV0.7%EPSS1article
CVE-2026-88765Improper Neutralization of Special Elements used in a Command ('Command Injection') in GitLabCVSS8.5High–Not in KEV0.7%EPSS1article
CVE-2026-12053GitLab vulnerabilityCVSS8.6High–Not in KEV0.6%EPSS1article
CVE-2026-6267GitLab vulnerabilityCVSS8.5High–Not in KEV0.6%EPSS1article
CVE-2026-93577GitLab vulnerabilityCVSS9.9Critical–Not in KEV0.6%EPSS2articles
CVE-2026-87719GitLab vulnerabilityCVSS9.9Critical–Not in KEV0.6%EPSS5articles
20 more CVEs
CVE-2026-15975GitLab vulnerabilityCVSS7.5High–Not in KEV0.5%EPSS1article
CVE-2026-89078GitLab vulnerabilityCVSS9.9Critical–Not in KEV0.5%EPSS2articles
CVE-2026-12436GitLab vulnerabilityCVSS8.4High–Not in KEV0.5%EPSS1article
CVE-2026-15723GitLab vulnerabilityCVSS8.2High–Not in KEV0.4%EPSS1article
CVE-2025-12716GitLab vulnerabilityCVSS8.7High–Not in KEV0.4%EPSS1article
CVE-2026-10712GitLab vulnerabilityCVSS8.0High–Not in KEV0.4%EPSS1article
CVE-2026-18252GitLab vulnerabilityCVSS7.3High–Not in KEV0.4%EPSS1article
CVE-2026-6896GitLab vulnerabilityCVSS8.7High–Not in KEV0.4%EPSS1article
CVE-2026-14814GitLab vulnerabilityCVSS8.2High–Not in KEV0.4%EPSS2articles
CVE-2026-7250Allocation of Resources Without Limits or Throttling in GitLabCVSS7.5High–Not in KEV0.4%EPSS1article
CVE-2026-84739Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabCVSS8.7High–Not in KEV0.3%EPSS1article
CVE-2026-10086GitLab vulnerabilityCVSS8.7High–Not in KEV0.3%EPSS1article
CVE-2026-16301Incorrect Authorization in GitLabCVSS8.5High–Not in KEV0.3%EPSS2articles
CVE-2026-1500Allocation of Resources Without Limits or Throttling in GitLabCVSS6.5Medium–Not in KEV0.3%EPSS1article
CVE-2026-10087Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabCVSS8.7High–Not in KEV0.3%EPSS1article
CVE-2026-92883Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabCVSS8.7High–Not in KEV0.3%EPSS2articles
CVE-2026-9204Server-Side Request Forgery (SSRF) in GitLabCVSS5.3Medium–Not in KEV0.3%EPSS1article
CVE-2025-7659Origin Validation Error in GitLabCVSSUnrated–Not in KEV0.2%EPSS1article
CVE-2026-19650GitLab vulnerabilityCVSS7.1High–Not in KEV0.2%EPSS4articles
CVE-2026-112212GitLab vulnerabilityCVSS7.5High–Not in KEV0.2%EPSS1article
How these numbers are made

CISA KEV counts use the full catalogue, refreshed every 10 minutes. CVEs in coverage are those recorded by CyberSIXT. BOD 22-01 deadlines bind US federal civilian agencies.

CVEs with FIRST EPSS at or above the 95th percentile (top 5%), excluding CVEs in CISA KEV. EPSS estimates exploitation probability over the next 30 days.

Coverage is above its usual rate at three or more articles in 7 days and at least 2.5 times the weekly mean of the preceding 8 weeks.

Product names are grouped by normalised names, with version and edition tails removed.

Fix listed refers to an advisory. Unknown fix status is counted as not listed.

On this device

Following

Intel

VendorsThreat actorsResearch reports

Settings

CyberSIXT summarises security news every 30 minutes.
↑↓ move↵ open⌘C copy CVE IDEsc close

Keyboard shortcuts

Everything works with a mouse or touch. Shortcuts are a faster path.

Search ⌘K
Search /
Next item J
Previous item K
Go to Today GT
Go to News GN
Go to CVEs GC
Go to Briefing GB
Reduce motion on this device