Vendor
GitLab vulnerabilities
Updated . Rebuilt every hour.
Junglewise Threat Intelligence has tracked 207 vulnerabilities in GitLab: 0 in the last 7 days and 68 in the last 90 days, 12 of them critical and 6 exploited in the wild. The most recent, CVE-2026-16255, was published on 22 October 2026. 32 vulnerabilities in the last four weeks, up 28% on the four before (25). 2 critical against 3, 1 exploited in the wild against 0. 4 technologies have a page of their own.
- Last 7 days
- 0
- Last 90 days
- 68
- Critical, all time
- 12
- Exploited in the wild
- 6
About GitLab
DevOps platform providing git repository management, CI/CD pipelines, and related development tools.
GitLab technologies
Latest GitLab vulnerabilities
- CVE-2026-16255: GitLab EE incomplete enforcement of SAML/LDAP membership lockmediumCVSS 5.9
- CVE-2026-15723: GitLab authentication bypass in OmniAuth SAML/LDAP auto-linkinghighCVSS 8.2
- CVE-2026-13319: GitLab authorization bypass in group milestones APImediumCVSS 4.3
- CVE-2026-12664: GitLab CE/EE improper access control in GraphQL work item email fieldmediumCVSS 6.8
- CVE-2026-112378: GitLab Enterprise Edition authorization bypass in billing validationmediumCVSS 4.3
- CVE-2026-112212: GitLab cache poisoning in OAuth/OIDC discoveryhighCVSS 7.5
- CVE-2026-110264: GitLab integer overflow in regular expression compilercriticalCVSS 10
- CVE-2026-105777: GitLab CE/EE internal credential exposure in response headersmediumCVSS 4.3
- CVE-2026-9268: GitLab has remediated an issue in GitLab EE affecting all versions from 13.6 before 19.2.8, 19.3 before 19.3.5, and…lowCVSS 2.7EPSS 0.2%
- CVE-2026-97229: GitLab CE/EE integer overflow in CI/CD regular expression compilercriticalexploited in the wildCVSS 10EPSS 18.4%
- CVE-2026-96893: GitLab EE prompt injection in AI agent instructionshighCVSS 7.3EPSS 0.5%
- CVE-2026-92883: GitLab Community Edition and Enterprise Edition cross-site scripting in syntax highlightinghighCVSS 8.7EPSS 0.3%
- CVE-2026-92528: GitLab EE incorrect authorization in merge request approval eligibilitymediumCVSS 4.2EPSS 0.1%
- CVE-2026-85529: GitLab improper authorization in GraphQL notes APImediumCVSS 5.3EPSS 0.2%
- CVE-2026-84284: GitLab incorrect authorization in work items GraphQL APImediumCVSS 5.3EPSS 0.2%
- CVE-2026-82632: GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.9 before 19.2.8, 19.3 before 19.3.5, and…lowCVSS 3.1EPSS 0.2%
- CVE-2026-81839: GitLab EE incorrect authorization in scheduled pipeline execution policyhighCVSS 7.7EPSS 0.2%
- CVE-2026-7767: GitLab open redirect in Kubernetes proxymediumCVSS 5.8EPSS 0.2%
- CVE-2026-78335: GitLab incorrect authorization in fine-grained personal access tokensmediumCVSS 4.2EPSS 0.2%
- CVE-2026-6567: GitLab missing authorization in CI artifact reportsmediumCVSS 4.3EPSS 0.2%
- CVE-2026-5954: GitLab CE/EE improper authorization in package registrymediumCVSS 4.2EPSS 0.2%
- CVE-2026-16301: GitLab improper authorization in downstream pipeline creationhighCVSS 8.5EPSS 0.2%
- CVE-2026-16275: GitLab CE/EE incorrect authorization in notesmediumCVSS 5.3EPSS 0.2%
- CVE-2026-14814: GitLab cache poisoning via improper repository reference validationhighCVSS 8.2EPSS 0.3%
- CVE-2026-14552: GitLab incorrect authorization in epic content accessmediumCVSS 4.3EPSS 0.2%
Most severe GitLab vulnerabilities
Exploited in the wild first, then by severity and CVSS score.
- CVE-2026-85706: GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 18.11.12, 19.0 before 19.0.9, 19.1…criticalexploited in the wildCVSS 10EPSS 91.4%
- CVE-2026-97229: GitLab CE/EE integer overflow in CI/CD regular expression compilercriticalexploited in the wildCVSS 10EPSS 18.4%
- CVE-2021-22205: GitLab Community and Enterprise Editions Remote Code Execution Vulnerabilitycriticalexploited in the wildCVSS 10
- CVE-2021-22175: GitLab SSRF in internal network webhookscriticalexploited in the wildCVSS 9.8EPSS 69.7%
- CVE-2023-7028: GitLab Community and Enterprise Editions Improper Access Control Vulnerabilitycriticalexploited in the wildCVSS 9.8
- CVE-2021-39935: GitLab CE/EE SSRF in CI Lint APIcriticalexploited in the wildCVSS 7.5EPSS 58.4%
- CVE-2026-110264: GitLab integer overflow in regular expression compilercriticalCVSS 10
- CVE-2026-90970: GitLab AI Gateway prompt sandbox escape in Duo Agent PlatformcriticalCVSS 9.9EPSS 0.9%
- CVE-2026-87719: GitLab EE GraphQL deserialization in Duo ChatcriticalCVSS 9.9EPSS 0.6%
- CVE-2026-93577: GitLab integer overflow in regular expression compilercriticalCVSS 9.9EPSS 0.4%
Vulnerabilities per week
32 vulnerabilities in the last four weeks, up 28% on the four before (25). 2 critical against 3, 1 exploited in the wild against 0. The last 13 weeks, by the week each vulnerability was published.
| Week of | Bar | Vulns | Critical |
|---|---|---|---|
| 17 Aug 2026 | 3 | 1 | |
| 24 Aug 2026 | 6 | 0 | |
| 31 Aug 2026 | 0 | 0 | |
| 7 Sep 2026 | 2 | 2 | |
| 14 Sep 2026 | 15 | 0 | |
| 21 Sep 2026 | 6 | 2 | |
| 28 Sep 2026 | 4 | 1 | |
| 5 Oct 2026 | 0 | 0 | |
| 12 Oct 2026 | 24 | 1 | |
| 19 Oct 2026 | 8 | 1 | |
| 26 Oct 2026 | 0 | 0 | |
| 2 Nov 2026 | 0 | 0 | |
| 9 Nov 2026 | 0 | 0 |
Embed a badge
A live badge for a README, a status page or an internal wiki: how many GitLab vulnerabilities were published in the last 7 days and how many of them are critical, refreshed hourly.
[](https://junglewise.ai/threats/vendors/gitlab)<a href="https://junglewise.ai/threats/vendors/gitlab"><img src="https://junglewise.ai/threats/vendors/gitlab/badge.svg" alt="GitLab vulnerabilities" /></a>How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/vendors/gitlab.json, and this page as text at https://junglewise.ai/threats/vendors/gitlab.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "GitLab vulnerabilities", https://junglewise.ai/threats/vendors/gitlab, 12 November 2026.