Technology · GitLab
GitLab Community Edition vulnerabilities
Updated . Rebuilt every hour.
Junglewise Threat Intelligence has tracked 97 vulnerabilities in GitLab Community Edition: 0 in the last 7 days and 42 in the last 90 days, 8 of them critical and 4 exploited in the wild. The most recent, CVE-2026-15723, was published on 22 October 2026. 21 vulnerabilities in the last four weeks, up 40% on the four before (15). 2 critical against 2, 1 exploited in the wild against 0.
- Last 7 days
- 0
- Last 90 days
- 42
- Critical, all time
- 8
- Exploited in the wild
- 4
About GitLab Community Edition
Community edition of GitLab, a web-based DevOps platform for version control, CI/CD, and project management.
Latest GitLab Community Edition vulnerabilities
- CVE-2026-15723: GitLab authentication bypass in OmniAuth SAML/LDAP auto-linkinghighCVSS 8.2
- CVE-2026-13319: GitLab authorization bypass in group milestones APImediumCVSS 4.3
- CVE-2026-12664: GitLab CE/EE improper access control in GraphQL work item email fieldmediumCVSS 6.8
- CVE-2026-112212: GitLab cache poisoning in OAuth/OIDC discoveryhighCVSS 7.5
- CVE-2026-110264: GitLab integer overflow in regular expression compilercriticalCVSS 10
- CVE-2026-105777: GitLab CE/EE internal credential exposure in response headersmediumCVSS 4.3
- CVE-2026-97229: GitLab CE/EE integer overflow in CI/CD regular expression compilercriticalexploited in the wildCVSS 10EPSS 18.4%
- CVE-2026-92883: GitLab Community Edition and Enterprise Edition cross-site scripting in syntax highlightinghighCVSS 8.7EPSS 0.3%
- CVE-2026-85529: GitLab improper authorization in GraphQL notes APImediumCVSS 5.3EPSS 0.2%
- CVE-2026-84284: GitLab incorrect authorization in work items GraphQL APImediumCVSS 5.3EPSS 0.2%
- CVE-2026-7767: GitLab open redirect in Kubernetes proxymediumCVSS 5.8EPSS 0.2%
- CVE-2026-78335: GitLab incorrect authorization in fine-grained personal access tokensmediumCVSS 4.2EPSS 0.2%
- CVE-2026-6567: GitLab missing authorization in CI artifact reportsmediumCVSS 4.3EPSS 0.2%
- CVE-2026-5954: GitLab CE/EE improper authorization in package registrymediumCVSS 4.2EPSS 0.2%
- CVE-2026-16301: GitLab improper authorization in downstream pipeline creationhighCVSS 8.5EPSS 0.2%
- CVE-2026-16275: GitLab CE/EE incorrect authorization in notesmediumCVSS 5.3EPSS 0.2%
- CVE-2026-14814: GitLab cache poisoning via improper repository reference validationhighCVSS 8.2EPSS 0.3%
- CVE-2026-14552: GitLab incorrect authorization in epic content accessmediumCVSS 4.3EPSS 0.2%
- CVE-2026-14210: GitLab CE/EE incorrect authorization in fine-grained personal access tokensmediumCVSS 4.3EPSS 0.2%
- CVE-2026-101168: GitLab sensitive information exposure in Pages logsmediumCVSS 6.2EPSS 0.2%
- CVE-2026-100755: GitLab CE/EE page cache poisoning via improper cache key constructionmediumCVSS 4.6EPSS 0.1%
- CVE-2026-8937: GitLab missing authorization in Epic Issues REST APImediumCVSS 4.3
- CVE-2026-84739: GitLab cross-site scripting in merge request diff viewerhighCVSS 8.7
- CVE-2026-93577: GitLab integer overflow in regular expression compilercriticalCVSS 9.9EPSS 0.4%
- CVE-2026-92874: GitLab CE/EE incorrect authorization in MCP API scope enforcementmediumCVSS 5.4EPSS 0.1%
Most severe GitLab Community Edition vulnerabilities
Exploited in the wild first, then by severity and CVSS score.
- CVE-2026-85706: GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 18.11.12, 19.0 before 19.0.9, 19.1…criticalexploited in the wildCVSS 10EPSS 91.4%
- CVE-2026-97229: GitLab CE/EE integer overflow in CI/CD regular expression compilercriticalexploited in the wildCVSS 10EPSS 18.4%
- CVE-2023-7028: GitLab Community and Enterprise Editions Improper Access Control Vulnerabilitycriticalexploited in the wildCVSS 9.8
- CVE-2021-39935: GitLab CE/EE SSRF in CI Lint APIcriticalexploited in the wildCVSS 7.5EPSS 58.4%
- CVE-2026-110264: GitLab integer overflow in regular expression compilercriticalCVSS 10
- CVE-2026-93577: GitLab integer overflow in regular expression compilercriticalCVSS 9.9EPSS 0.4%
- CVE-2026-89078: GitLab double free in regular expression parsercriticalCVSS 9.9EPSS 0.4%
- CVE-2026-19478: GitLab CE/EE code injection via GraphQL directivecriticalCVSS 9.4EPSS 60.2%
- CVE-2025-9222: GitLab CE/EE stored XSS in GitLab Flavored Markdown placeholdershighCVSS 8.7EPSS 0.4%
- CVE-2026-92883: GitLab Community Edition and Enterprise Edition cross-site scripting in syntax highlightinghighCVSS 8.7EPSS 0.3%
Vulnerabilities per week
21 vulnerabilities in the last four weeks, up 40% on the four before (15). 2 critical against 2, 1 exploited in the wild against 0. The last 13 weeks, by the week each vulnerability was published.
| Week of | Bar | Vulns | Critical |
|---|---|---|---|
| 17 Aug 2026 | 3 | 1 | |
| 24 Aug 2026 | 2 | 0 | |
| 31 Aug 2026 | 0 | 0 | |
| 7 Sep 2026 | 1 | 1 | |
| 14 Sep 2026 | 9 | 0 | |
| 21 Sep 2026 | 4 | 2 | |
| 28 Sep 2026 | 2 | 0 | |
| 5 Oct 2026 | 0 | 0 | |
| 12 Oct 2026 | 15 | 1 | |
| 19 Oct 2026 | 6 | 1 | |
| 26 Oct 2026 | 0 | 0 | |
| 2 Nov 2026 | 0 | 0 | |
| 9 Nov 2026 | 0 | 0 |
Embed a badge
A live badge for a README, a status page or an internal wiki: how many GitLab Community Edition vulnerabilities were published in the last 7 days and how many of them are critical, refreshed hourly.
[](https://junglewise.ai/threats/technologies/gitlab-ce)<a href="https://junglewise.ai/threats/technologies/gitlab-ce"><img src="https://junglewise.ai/threats/technologies/gitlab-ce/badge.svg" alt="GitLab Community Edition vulnerabilities" /></a>How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/technologies/gitlab-ce.json, and this page as text at https://junglewise.ai/threats/technologies/gitlab-ce.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "GitLab Community Edition vulnerabilities", https://junglewise.ai/threats/technologies/gitlab-ce, 12 November 2026.