GitLab
Number 22 by total vulnerabilities in the catalog.
Computed from the whole catalog when the site is built.
Total vulnerabilities
1,178
Critical
31
High
227
Known Exploited
6
Exploit available
523
Network, no login needed
18.5%
Of 1,149 scored records
- Critical
- High
- Medium
- Low
- None or not scored
Show as table
| Period | Total | Critical | High | Medium | Low | None or not scored |
|---|---|---|---|---|---|---|
| 2026 (incomplete) | 254 | 9 | 74 | 135 | 35 | 1 |
| 2025 | 166 | 1 | 43 | 94 | 28 | 0 |
| 2024 | 145 | 6 | 26 | 96 | 17 | 0 |
| 2023 | 169 | 3 | 18 | 122 | 26 | 0 |
| 2022 | 151 | 6 | 20 | 91 | 34 | 0 |
| 2021 | 156 | 4 | 19 | 102 | 31 | 0 |
| 2020 | 124 | 2 | 27 | 64 | 15 | 16 |
| 2019 | 0 | 0 | 0 | 0 | 0 | 0 |
| 2018 | 13 | 0 | 0 | 0 | 0 | 13 |
Top products
| Product | Total | Critical/High |
|---|---|---|
| GitLab | 1,112 | 244 |
| GitLab CE/EE | 18 | 4 |
| GitLab Community and Enterprise Editions | 13 | 0 |
| GitLab EE | 10 | 0 |
| GitLab Runner | 6 | 1 |
| GitLab AI Gateway | 4 | 4 |
| Gitlab CE/EE | 4 | 0 |
| DAST | 2 | 1 |
| gitlab-vscode-extension | 2 | 2 |
| DAST API scanner | 1 | 0 |
Top bug types
| Bug type | Total | Critical/High |
|---|---|---|
| Incorrect Authorization | 95 | 18 |
| Allocation of Resources Without Limits or Throttling | 83 | 19 |
| Cross-Site Scripting | 81 | 58 |
| Missing Authorization | 61 | 6 |
| Inefficient Regular Expression Complexity | 32 | 9 |
| Insecure Direct Object Reference | 29 | 2 |
| Information Disclosure | 28 | 1 |
| Improper Access Control | 19 | 2 |
| Denial of Service | 18 | 1 |
| Insertion of Sensitive Information Into Sent Data | 16 | 3 |
Known to be attacked
| CVE | Title | Published | Severity | EPSS |
|---|---|---|---|---|
| CVE-2026-97229 | Integer Overflow or Wraparound in GitLab | Critical | 65.2% | |
| CVE-2026-85706 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab | Critical | 97.4% | |
| CVE-2023-7028 | Weak Password Recovery Mechanism for Forgotten Password in GitLab | Critical | 94.5% | |
| CVE-2021-39935 | GitLab: Server-Side Request Forgery | Medium | 36.1% | |
| CVE-2021-22175 | GitLab: Server-Side Request Forgery | Medium | 53.4% | |
| CVE-2021-22205 | GitLab: Code Injection | Critical | 99.7% |
Newest vulnerabilities
| CVE | Title | Published | Severity | EPSS |
|---|---|---|---|---|
| CVE-2026-110264 | Integer Overflow or Wraparound in GitLab | Critical | 1.3% | |
| CVE-2026-16255 | Incorrect Authorization in GitLab | Medium | 0.3% | |
| CVE-2026-15723 | Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') in GitLab | High | 0.5% | |
| CVE-2026-14288 | Use of Incorrectly-Resolved Name or Reference in GitLab | Low | 0.3% | |
| CVE-2026-13319 | Authorization Bypass Through User-Controlled Key in GitLab | Medium | 0.2% | |
| CVE-2026-12664 | Incorrect Authorization in GitLab | Medium | 0.4% | |
| CVE-2026-112378 | Use of Less Trusted Source in GitLab | Medium | 0.1% | |
| CVE-2026-112326 | Improper Cleanup on Thrown Exception in GitLab | Low | 0.2% | |
| CVE-2026-112212 | Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') in GitLab | High | 0.2% | |
| CVE-2026-105777 | Insertion of Sensitive Information Into Sent Data in GitLab | Medium | 0.3% |