# GitLab vulnerabilities Source: https://junglewise.ai/threats/technologies/gitlab Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 12 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/gitlab.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 71 vulnerabilities in GitLab: 0 in the last 7 days and 24 in the last 90 days, 2 of them critical and 2 exploited in the wild. The most recent, CVE-2026-9268, was published on 13 October 2026. 24 vulnerabilities in the last four weeks, up from none in the four before. 1 critical against 0, 1 exploited in the wild against 0. ## Counts - Last 7 days: 0 - Last 30 days: 0 - Last 90 days: 24 - All time: 71 (2 critical, 2 exploited in the wild) ## About GitLab Web-based platform providing version control, continuous integration, and deployment capabilities. ## Latest GitLab vulnerabilities - [CVE-2026-9268: GitLab has remediated an issue in GitLab EE affecting all versions from 13.6 before 19.2.8, 19.3 before 19.3.5, and…](https://junglewise.ai/threats/cve-2026-9268-gitlab-has-remediated-an-issue-in-gitlab-ee-affecting-all-versions) (low, CVSS 2.7, published 13 Oct 2026) - [CVE-2026-97229: GitLab CE/EE integer overflow in CI/CD regular expression compiler](https://junglewise.ai/threats/cve-2026-97229-gitlab-has-remediated-an-issue-in-gitlab-ce-ee-affecting-all) (critical, exploited in the wild, CVSS 10, published 13 Oct 2026) - [CVE-2026-96893: GitLab EE prompt injection in AI agent instructions](https://junglewise.ai/threats/cve-2026-96893-gitlab-has-remediated-an-issue-in-gitlab-ee-affecting-all) (high, CVSS 7.3, published 13 Oct 2026) - [CVE-2026-92883: GitLab Community Edition and Enterprise Edition cross-site scripting in syntax highlighting](https://junglewise.ai/threats/cve-2026-92883-gitlab-has-remediated-an-issue-in-gitlab-ce-ee-affecting-all) (high, CVSS 8.7, published 13 Oct 2026) - [CVE-2026-92528: GitLab EE incorrect authorization in merge request approval eligibility](https://junglewise.ai/threats/cve-2026-92528-gitlab-has-remediated-an-issue-in-gitlab-ee-affecting-all) (medium, CVSS 4.2, published 13 Oct 2026) - [CVE-2026-85529: GitLab improper authorization in GraphQL notes API](https://junglewise.ai/threats/cve-2026-85529-gitlab-has-remediated-an-issue-in-gitlab-ce-ee-affecting-all) (medium, CVSS 5.3, published 13 Oct 2026) - [CVE-2026-84284: GitLab incorrect authorization in work items GraphQL API](https://junglewise.ai/threats/cve-2026-84284-gitlab-has-remediated-an-issue-in-gitlab-ce-ee-affecting-all) (medium, CVSS 5.3, published 13 Oct 2026) - [CVE-2026-82632: GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.9 before 19.2.8, 19.3 before 19.3.5, and…](https://junglewise.ai/threats/cve-2026-82632-gitlab-has-remediated-an-issue-in-gitlab-ce-ee-affecting-all) (low, CVSS 3.1, published 13 Oct 2026) - [CVE-2026-81839: GitLab EE incorrect authorization in scheduled pipeline execution policy](https://junglewise.ai/threats/cve-2026-81839-gitlab-has-remediated-an-issue-in-gitlab-ee-affecting-all) (high, CVSS 7.7, published 13 Oct 2026) - [CVE-2026-7767: GitLab open redirect in Kubernetes proxy](https://junglewise.ai/threats/cve-2026-7767-gitlab-has-remediated-an-issue-in-gitlab-ce-ee-affecting-all) (medium, CVSS 5.8, published 13 Oct 2026) - [CVE-2026-78335: GitLab incorrect authorization in fine-grained personal access tokens](https://junglewise.ai/threats/cve-2026-78335-gitlab-has-remediated-an-issue-in-gitlab-ce-ee-affecting-all) (medium, CVSS 4.2, published 13 Oct 2026) - [CVE-2026-6567: GitLab missing authorization in CI artifact reports](https://junglewise.ai/threats/cve-2026-6567-gitlab-has-remediated-an-issue-in-gitlab-ce-ee-affecting-all) (medium, CVSS 4.3, published 13 Oct 2026) - [CVE-2026-5954: GitLab CE/EE improper authorization in package registry](https://junglewise.ai/threats/cve-2026-5954-gitlab-has-remediated-an-issue-in-gitlab-ce-ee-affecting-all) (medium, CVSS 4.2, published 13 Oct 2026) - [CVE-2026-16301: GitLab improper authorization in downstream pipeline creation](https://junglewise.ai/threats/cve-2026-16301-gitlab-has-remediated-an-issue-in-gitlab-ce-ee-affecting-all) (high, CVSS 8.5, published 13 Oct 2026) - [CVE-2026-16275: GitLab CE/EE incorrect authorization in notes](https://junglewise.ai/threats/cve-2026-16275-gitlab-has-remediated-an-issue-in-gitlab-ce-ee-affecting-all) (medium, CVSS 5.3, published 13 Oct 2026) - [CVE-2026-14814: GitLab cache poisoning via improper repository reference validation](https://junglewise.ai/threats/cve-2026-14814-gitlab-has-remediated-an-issue-in-gitlab-ce-ee-affecting-all) (high, CVSS 8.2, published 13 Oct 2026) - [CVE-2026-14552: GitLab incorrect authorization in epic content access](https://junglewise.ai/threats/cve-2026-14552-gitlab-has-remediated-an-issue-in-gitlab-ce-ee-affecting-all) (medium, CVSS 4.3, published 13 Oct 2026) - [CVE-2026-14210: GitLab CE/EE incorrect authorization in fine-grained personal access tokens](https://junglewise.ai/threats/cve-2026-14210-gitlab-has-remediated-an-issue-in-gitlab-ce-ee-affecting-all) (medium, CVSS 4.3, published 13 Oct 2026) - [CVE-2026-105458: GitLab EE governance control bypass in Duo Agent Platform](https://junglewise.ai/threats/cve-2026-105458-gitlab-has-remediated-an-issue-in-gitlab-ee-affecting-all) (medium, CVSS 4.3, published 13 Oct 2026) - [CVE-2026-104661: GitLab EE incorrect privilege assignment in custom roles](https://junglewise.ai/threats/cve-2026-104661-gitlab-has-remediated-an-issue-in-gitlab-ee-affecting-all) (medium, CVSS 4.3, published 13 Oct 2026) - [CVE-2026-103549: GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.6 before 19.2.8, 19.3 before 19.3.5, and…](https://junglewise.ai/threats/cve-2026-103549-gitlab-has-remediated-an-issue-in-gitlab-ce-ee-affecting-all) (low, CVSS 2.7, published 13 Oct 2026) - [CVE-2026-101168: GitLab sensitive information exposure in Pages logs](https://junglewise.ai/threats/cve-2026-101168-gitlab-has-remediated-an-issue-in-gitlab-ce-ee-affecting-all) (medium, CVSS 6.2, published 13 Oct 2026) - [CVE-2026-100755: GitLab CE/EE page cache poisoning via improper cache key construction](https://junglewise.ai/threats/cve-2026-100755-gitlab-has-remediated-an-issue-in-gitlab-ce-ee-affecting-all) (medium, CVSS 4.6, published 13 Oct 2026) - [CVE-2026-100104: GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.3 before 19.2.8, 19.3 before 19.3.5, and…](https://junglewise.ai/threats/cve-2026-100104-gitlab-has-remediated-an-issue-in-gitlab-ce-ee-affecting-all) (low, CVSS 3.5, published 13 Oct 2026) - [CVE-2026-6336: GitLab CE/EE incorrect authorization in project import status](https://junglewise.ai/threats/cve-2026-6336-gitlab-ce-ee-incorrect-authorization-in-project-import-status) (medium, CVSS 5.3, published 29 Jul 2026) ## Most severe GitLab vulnerabilities - [CVE-2026-97229: GitLab CE/EE integer overflow in CI/CD regular expression compiler](https://junglewise.ai/threats/cve-2026-97229-gitlab-has-remediated-an-issue-in-gitlab-ce-ee-affecting-all) (critical, exploited in the wild, CVSS 10, published 13 Oct 2026) - [CVE-2021-22175: GitLab SSRF in internal network webhooks](https://junglewise.ai/threats/cve-2021-22175-gitlab-ssrf-in-internal-network-webhooks) (critical, exploited in the wild, CVSS 9.8, published 18 Feb 2026) - [CVE-2016-4340: GitLab privilege escalation in impersonate feature](https://junglewise.ai/threats/cve-2016-4340-gitlab-privilege-escalation-in-impersonate-feature) (high, CVSS 8.8, published 23 Jan 2017) - [CVE-2025-12716: GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.4 before 18.4.6, 18.5 before 18.5.4, and…](https://junglewise.ai/threats/cve-2025-12716-gitlab-has-remediated-an-issue-in-gitlab-ce-ee-affecting-all) (high, CVSS 8.7, published 11 Dec 2025) - [CVE-2026-92883: GitLab Community Edition and Enterprise Edition cross-site scripting in syntax highlighting](https://junglewise.ai/threats/cve-2026-92883-gitlab-has-remediated-an-issue-in-gitlab-ce-ee-affecting-all) (high, CVSS 8.7, published 13 Oct 2026) - [CVE-2025-11702: GitLab has remediated an issue in EE affecting all versions from 17.1 before 18.3.5, 18.4 before 18.4.3, and 18.5…](https://junglewise.ai/threats/cve-2025-11702-gitlab-has-remediated-an-issue-in-ee-affecting-all-versions-from) (high, CVSS 8.5, published 29 Oct 2025) - [CVE-2026-16301: GitLab improper authorization in downstream pipeline creation](https://junglewise.ai/threats/cve-2026-16301-gitlab-has-remediated-an-issue-in-gitlab-ce-ee-affecting-all) (high, CVSS 8.5, published 13 Oct 2026) - [CVE-2026-14814: GitLab cache poisoning via improper repository reference validation](https://junglewise.ai/threats/cve-2026-14814-gitlab-has-remediated-an-issue-in-gitlab-ce-ee-affecting-all) (high, CVSS 8.2, published 13 Oct 2026) - [CVE-2026-4922: GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.0 before 18.9.6, 18.10 before 18.10.4, and…](https://junglewise.ai/threats/cve-2026-4922-gitlab-has-remediated-an-issue-in-gitlab-ce-ee-affecting-all) (high, CVSS 8.1, published 22 Apr 2026) - [CVE-2025-12029: GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.11 before 18.4.6, 18.5 before 18.5.4…](https://junglewise.ai/threats/cve-2025-12029-gitlab-has-remediated-an-issue-in-gitlab-ce-ee-affecting-all) (high, CVSS 8, published 11 Dec 2025) ## Vulnerabilities per week 24 vulnerabilities in the last four weeks, up from none in the four before. 1 critical against 0, 1 exploited in the wild against 0. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 24 | 1 | 1 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other GitLab technologies - [GitLab Enterprise Edition](https://junglewise.ai/threats/technologies/gitlab-ee): 148 vulnerabilities - [GitLab Community Edition](https://junglewise.ai/threats/technologies/gitlab-ce): 97 vulnerabilities - [GitLab EE](https://junglewise.ai/threats/technologies/ee): 6 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "GitLab vulnerabilities", https://junglewise.ai/threats/technologies/gitlab, 12 November 2026.