Skip to content
Noroxi

GitLab records

1,521 published records for vendor GitLab. 6 of them have been exploited in the wild (listed in CISA KEV) and 12 have a ready-made attack tool.

Filter by product ↓

Researcher profile

Entered KEV
6 · 0.4%
Weaponized
12 · 0.8%
Pre-auth RCE
28
With a fix record
43.5%
Median publish → KEV
152 days

Pre-auth RCE: flaws that let an attacker run code over the network without an account. Median publish → KEV: the typical time between a record being published and CISA listing it as exploited.

Records by year

  1. 17
  2. 18
  3. 19
  4. 20
  5. 21
  6. 22
  7. 23
  8. 24
  9. 25
  10. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

Bug bounty scope

The product’s vendor appears in a public program. Matched by name; verify the scope text in the program.

All records

1,521 records
  • CVE-2021-22205
    100Now

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9.

    CriticalCVSS 10.0KEVWeaponizedEPSS 99%

    gitlab · gitlabApr 23, 2021

  • CVE-2026-85706
    99Now

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab

    CriticalCVSS 10.0KEVWeaponizedEPSS 97%

    gitlab · gitlabSep 11, 2026

  • CVE-2023-7028
    97Now

    Weak Password Recovery Mechanism for Forgotten Password in GitLab

    CriticalCVSS 9.8KEVWeaponizedEPSS 94%

    gitlab · gitlabJan 12, 2024

  • CVE-2026-97229
    91Now

    Integer Overflow or Wraparound in GitLab

    CriticalCVSS 10.0KEVWeaponizedEPSS 69%

    gitlab · gitlabOct 13, 2026

  • CVE-2021-22175
    85Now

    When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab affecting all versions

    CriticalCVSS 9.8KEVWeaponizedEPSS 53%

    gitlab · gitlabJun 11, 2021

  • CVE-2021-39935
    71This week

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.5 before 14.3.6, all versions starting from 14.4 before

    HighCVSS 7.5KEVWeaponizedEPSS 36%

    gitlab · gitlabDec 13, 2021

  • CVE-2022-2992
    65This week

    A vulnerability in GitLab CE/EE affecting all versions from 11.10 prior to 15.1.6, 15.2 to 15.2.4, 15.3 to 15.3.2 allows an authenticated us

    CriticalCVSS 9.9WeaponizedEPSS 86%

    gitlab · gitlabOct 17, 2022

  • CVE-2022-2884
    62This week

    A vulnerability in GitLab CE/EE affecting all versions from 11.3.4 prior to 15.1.5, 15.2 to 15.2.3, 15.3 to 15.3 to 15.3.1 allows an an auth

    CriticalCVSS 9.9Proof of conceptEPSS 76%

    gitlab · gitlabOct 17, 2022

  • CVE-2022-1162
    62This week

    A hardcoded password was set for accounts registered using an OmniAuth provider (e.g.

    CriticalCVSS 9.8Proof of conceptEPSS 75%

    gitlab · gitlabApr 4, 2022

  • CVE-2021-4191
    60This week

    An issue has been discovered in GitLab CE/EE affecting versions 13.0 to 14.6.5, 14.7 to 14.7.4, and 14.8 to 14.8.2.

    MediumCVSS 5.3WeaponizedEPSS 80%

    gitlab · gitlabMar 28, 2022

  • CVE-2023-2825
    60This week

    An issue has been discovered in GitLab CE/EE affecting only version 16.0.0.

    HighCVSS 7.5WeaponizedEPSS 71%

    gitlab · gitlabMay 26, 2023

  • CVE-2023-5612
    60This week

    Missing Authorization in GitLab

    MediumCVSS 5.3WeaponizedEPSS 4%

    gitlab · gitlabJan 25, 2024

  • CVE-2022-2185
    58Plan

    A critical issue has been discovered in GitLab affecting all versions starting from 14.0 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 pr

    HighCVSS 8.8Proof of conceptEPSS 76%

    gitlab · gitlabJul 1, 2022

  • CVE-2020-13340
    54Plan

    An issue has been discovered in GitLab affecting all versions prior to 13.2.10, 13.3.7 and 13.4.2: Stored XSS in CI Job Log

    HighCVSS 8.7No exploitEPSS 66%

    gitlab · gitlabOct 8, 2020

  • CVE-2018-14364
    53Plan

    GitLab Community and Enterprise Edition before 10.7.7, 10.8.x before 10.8.6, and 11.x before 11.0.4 allows Directory Traversal with write ac

    CriticalCVSS 9.8No exploitEPSS 47%

    gitlab · gitlabJul 18, 2018

  • CVE-2023-2442
    50Plan

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 befo

    MediumCVSS 5.4No exploitEPSS 96%

    gitlab · gitlabJun 7, 2023

  • CVE-2023-0050
    49Plan

    An issue has been discovered in GitLab affecting all versions starting from 13.7 before 15.7.8, all versions starting from 15.8 before 15.8.

    MediumCVSS 5.4No exploitEPSS 92%

    gitlab · gitlabMar 9, 2023

  • CVE-2022-1175
    49Plan

    Improper neutralization of user input in GitLab CE/EE versions 14.4 before 14.7.7, all versions starting from 14.8 before 14.8.5, all versio

    MediumCVSS 6.1Proof of conceptEPSS 82%

    gitlab · gitlabApr 4, 2022

  • CVE-2024-1451
    49Plan

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

    HighCVSS 8.7No exploitEPSS 51%

    gitlab · gitlabFeb 21, 2024

  • CVE-2022-1190
    47Plan

    Improper handling of user input in GitLab CE/EE versions 8.3 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allowed an atta

    MediumCVSS 5.4No exploitEPSS 87%

    gitlab · gitlabApr 4, 2022

  • CVE-2022-3265
    47Plan

    A cross-site scripting issue has been discovered in GitLab CE/EE affecting all versions prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prio

    MediumCVSS 5.4No exploitEPSS 86%

    gitlab · gitlabNov 9, 2022

  • CVE-2021-22238
    43Plan

    An issue has been discovered in GitLab affecting all versions starting with 13.3.

    MediumCVSS 5.4No exploitEPSS 71%

    gitlab · gitlabAug 20, 2021

  • CVE-2023-3364
    43Plan

    Inefficient Regular Expression Complexity in GitLab

    HighCVSS 7.5No exploitEPSS 44%

    gitlab · gitlabAug 1, 2023

  • CVE-2022-0735
    43Plan

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.10 before 14.6.5, all versions starting from 14.7 befor

    CriticalCVSS 9.8Proof of conceptEPSS 13%

    gitlab · gitlabMar 28, 2022

  • CVE-2024-45409
    43Plan

    The Ruby SAML library vulnerable to a SAML authentication bypass via Incorrect XPath selector

    CriticalCVSS 9.8Proof of conceptEPSS 12%

    onelogin · ruby-samlSep 10, 2024