Technology · GitLab
GitLab Enterprise Edition vulnerabilities
Updated . Rebuilt every hour.
Junglewise Threat Intelligence has tracked 148 vulnerabilities in GitLab Enterprise Edition: 0 in the last 7 days and 56 in the last 90 days, 8 of them critical and 4 exploited in the wild. The most recent, CVE-2026-16255, was published on 22 October 2026. 25 vulnerabilities in the last four weeks, up 25% on the four before (20). 2 critical against 1, 1 exploited in the wild against 0.
- Last 7 days
- 0
- Last 90 days
- 56
- Critical, all time
- 8
- Exploited in the wild
- 4
About GitLab Enterprise Edition
GitLab's commercial edition providing Git repository management, CI/CD pipelines, and DevOps features with advanced security and compliance capabilities.
Latest GitLab Enterprise Edition vulnerabilities
- CVE-2026-16255: GitLab EE incomplete enforcement of SAML/LDAP membership lockmediumCVSS 5.9
- CVE-2026-15723: GitLab authentication bypass in OmniAuth SAML/LDAP auto-linkinghighCVSS 8.2
- CVE-2026-13319: GitLab authorization bypass in group milestones APImediumCVSS 4.3
- CVE-2026-112378: GitLab Enterprise Edition authorization bypass in billing validationmediumCVSS 4.3
- CVE-2026-112212: GitLab cache poisoning in OAuth/OIDC discoveryhighCVSS 7.5
- CVE-2026-110264: GitLab integer overflow in regular expression compilercriticalCVSS 10
- CVE-2026-105777: GitLab CE/EE internal credential exposure in response headersmediumCVSS 4.3
- CVE-2026-97229: GitLab CE/EE integer overflow in CI/CD regular expression compilercriticalexploited in the wildCVSS 10EPSS 18.4%
- CVE-2026-96893: GitLab EE prompt injection in AI agent instructionshighCVSS 7.3EPSS 0.5%
- CVE-2026-92883: GitLab Community Edition and Enterprise Edition cross-site scripting in syntax highlightinghighCVSS 8.7EPSS 0.3%
- CVE-2026-92528: GitLab EE incorrect authorization in merge request approval eligibilitymediumCVSS 4.2EPSS 0.1%
- CVE-2026-85529: GitLab improper authorization in GraphQL notes APImediumCVSS 5.3EPSS 0.2%
- CVE-2026-84284: GitLab incorrect authorization in work items GraphQL APImediumCVSS 5.3EPSS 0.2%
- CVE-2026-81839: GitLab EE incorrect authorization in scheduled pipeline execution policyhighCVSS 7.7EPSS 0.2%
- CVE-2026-7767: GitLab open redirect in Kubernetes proxymediumCVSS 5.8EPSS 0.2%
- CVE-2026-78335: GitLab incorrect authorization in fine-grained personal access tokensmediumCVSS 4.2EPSS 0.2%
- CVE-2026-6567: GitLab missing authorization in CI artifact reportsmediumCVSS 4.3EPSS 0.2%
- CVE-2026-5954: GitLab CE/EE improper authorization in package registrymediumCVSS 4.2EPSS 0.2%
- CVE-2026-16301: GitLab improper authorization in downstream pipeline creationhighCVSS 8.5EPSS 0.2%
- CVE-2026-16275: GitLab CE/EE incorrect authorization in notesmediumCVSS 5.3EPSS 0.2%
- CVE-2026-14210: GitLab CE/EE incorrect authorization in fine-grained personal access tokensmediumCVSS 4.3EPSS 0.2%
- CVE-2026-105458: GitLab EE governance control bypass in Duo Agent PlatformmediumCVSS 4.3EPSS 0.2%
- CVE-2026-104661: GitLab EE incorrect privilege assignment in custom rolesmediumCVSS 4.3EPSS 0.2%
- CVE-2026-101168: GitLab sensitive information exposure in Pages logsmediumCVSS 6.2EPSS 0.2%
- CVE-2026-100755: GitLab CE/EE page cache poisoning via improper cache key constructionmediumCVSS 4.6EPSS 0.1%
Most severe GitLab Enterprise Edition vulnerabilities
Exploited in the wild first, then by severity and CVSS score.
- CVE-2026-85706: GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 18.11.12, 19.0 before 19.0.9, 19.1…criticalexploited in the wildCVSS 10EPSS 91.4%
- CVE-2026-97229: GitLab CE/EE integer overflow in CI/CD regular expression compilercriticalexploited in the wildCVSS 10EPSS 18.4%
- CVE-2023-7028: GitLab Community and Enterprise Editions Improper Access Control Vulnerabilitycriticalexploited in the wildCVSS 9.8
- CVE-2021-39935: GitLab CE/EE SSRF in CI Lint APIcriticalexploited in the wildCVSS 7.5EPSS 58.4%
- CVE-2026-110264: GitLab integer overflow in regular expression compilercriticalCVSS 10
- CVE-2026-87719: GitLab EE GraphQL deserialization in Duo ChatcriticalCVSS 9.9EPSS 0.6%
- CVE-2026-89078: GitLab double free in regular expression parsercriticalCVSS 9.9EPSS 0.4%
- CVE-2026-19478: GitLab CE/EE code injection via GraphQL directivecriticalCVSS 9.4EPSS 60.2%
- CVE-2025-9222: GitLab CE/EE stored XSS in GitLab Flavored Markdown placeholdershighCVSS 8.7EPSS 0.4%
- CVE-2026-92883: GitLab Community Edition and Enterprise Edition cross-site scripting in syntax highlightinghighCVSS 8.7EPSS 0.3%
Vulnerabilities per week
25 vulnerabilities in the last four weeks, up 25% on the four before (20). 2 critical against 1, 1 exploited in the wild against 0. The last 13 weeks, by the week each vulnerability was published.
| Week of | Bar | Vulns | Critical |
|---|---|---|---|
| 17 Aug 2026 | 3 | 1 | |
| 24 Aug 2026 | 6 | 0 | |
| 31 Aug 2026 | 0 | 0 | |
| 7 Sep 2026 | 2 | 2 | |
| 14 Sep 2026 | 13 | 0 | |
| 21 Sep 2026 | 4 | 1 | |
| 28 Sep 2026 | 3 | 0 | |
| 5 Oct 2026 | 0 | 0 | |
| 12 Oct 2026 | 18 | 1 | |
| 19 Oct 2026 | 7 | 1 | |
| 26 Oct 2026 | 0 | 0 | |
| 2 Nov 2026 | 0 | 0 | |
| 9 Nov 2026 | 0 | 0 |
Embed a badge
A live badge for a README, a status page or an internal wiki: how many GitLab Enterprise Edition vulnerabilities were published in the last 7 days and how many of them are critical, refreshed hourly.
[](https://junglewise.ai/threats/technologies/gitlab-ee)<a href="https://junglewise.ai/threats/technologies/gitlab-ee"><img src="https://junglewise.ai/threats/technologies/gitlab-ee/badge.svg" alt="GitLab Enterprise Edition vulnerabilities" /></a>How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/technologies/gitlab-ee.json, and this page as text at https://junglewise.ai/threats/technologies/gitlab-ee.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "GitLab Enterprise Edition vulnerabilities", https://junglewise.ai/threats/technologies/gitlab-ee, 12 November 2026.