Gitlab
1,451 known vulnerabilities
Top Products
A vulnerability was discovered in GitLab starting with version 12. GitLab was vulnerable to a blind SSRF attack since re
A vulnerability was discovered in GitLab versions 10.5 to 14.5.4, 14.6 to 14.6.4, and 14.7 to 14.7.1. GitLab was vulnera
An issue has been discovered affecting GitLab versions prior to 14.4.5, between 14.5.0 and 14.5.3, and between 14.6.0 an
An issue has been discovered in GitLab CE/EE affecting versions 13.0 to 14.6.5, 14.7 to 14.7.4, and 14.8 to 14.8.2. Priv
In all versions of GitLab CE/EE since version 11.3, the endpoint for auto-completing Assignee discloses the members of p
An authorization logic error in the External Status Check API in GitLab EE affecting all versions starting from 14.1 bef
An issue has been discovered in GitLab CE/EE affecting all versions starting with 14.5. Arbitrary file read was possible
An issue has been discovered in GitLab CE/EE affecting all versions starting with 12.3. Under certain conditions it was
An issue has been discovered in GitLab affecting all versions starting from 7.7 before 14.4.5, all versions starting fro
An issue has been discovered in GitLab affecting all versions starting from 13.10 before 14.4.5, all versions starting f
An issue has been discovered in GitLab affecting all versions starting from 12.10 before 14.4.5, all versions starting f
An issue has been discovered in GitLab affecting all versions starting from 12.0 before 14.4.5, all versions starting fr
An issue has been discovered affecting GitLab versions prior to 14.4.5, between 14.5.0 and 14.5.3, and between 14.6.0 an
An issue has been discovered affecting GitLab versions prior to 14.4.5, between 14.5.0 and 14.5.3, and between 14.6.0 an
An issue has been discovered affecting GitLab versions prior to 14.4.5, between 14.5.0 and 14.5.3, and between 14.6.0 an
Improper neutralization of user input in GitLab CE/EE versions 14.3 to 14.3.6, 14.4 to 14.4.4, and 14.5 to 14.5.2 allowe
A denial of service vulnerability in GitLab CE/EE affecting all versions starting from 12.0 before 14.3.6, all versions
Server side request forgery protections in GitLab CE/EE versions between 8.4 and 14.4.4, between 14.5.0 and 14.5.2, and
In all versions of GitLab CE/EE since version 12.0, a lower privileged user can import users from projects that they don
Improper access control in the GitLab CE/EE API affecting all versions starting from 9.4 before 14.3.6, all versions sta
An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.0 before 14.3.6, all versions start
An information disclosure vulnerability in GitLab CE/EE versions 12.0 to 14.3.6, 14.4 to 14.4.4, and 14.5 to 14.5.2 allo
An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.2 before 14.3.6, all versions start
An uncontrolled resource consumption vulnerability in GitLab Runner affecting all versions starting from 13.7 before 14.
A vulnerable regular expression pattern in GitLab CE/EE since version 8.15 before 14.3.6, all versions starting from 14.
A collision in access memoization logic in all versions of GitLab CE/EE before 14.3.6, all versions starting from 14.4 b
Improper access control in GitLab CE/EE affecting all versions starting from 10.7 before 14.3.6, all versions starting f
An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.5 before 14.3.6, all versions start
Improper access control allows any project member to retrieve the service desk email address in GitLab CE/EE versions st
An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.10 before 14.3.6, all versions star
An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.0 before 14.3.6, all versions start
An issue has been discovered in GitLab CE/EE affecting all versions starting from 8.11 before 14.3.6, all versions start
Missing authorization in GitLab EE versions between 12.4 and 14.3.6, between 14.4.0 and 14.4.4, and between 14.5.0 and 1
In all versions of GitLab CE/EE starting version 14.0 before 14.3.6, all versions starting from 14.4 before 14.4.4, all
Incorrect Authorization in GitLab EE affecting all versions starting from 11.1 before 14.3.6, all versions starting from
An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.9 before 14.3.6, all versions start
Lack of an access control check in the External Status Check feature allowed any authenticated user to retrieve the conf
Improper access control in the GraphQL API in GitLab CE/EE affecting all versions starting from 13.0 before 14.3.6, all
An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.6 before 14.3.6, all versions start
It was possible to bypass 2FA for LDAP users and access some specific pages with Basic Authentication in GitLab 14.1.1 a
Assuming a database breach, nonce reuse issues in GitLab 11.6+ allows an attacker to decrypt some of the database's encr
Accidental logging of system root password in the migration log in all versions of GitLab CE/EE before 14.2.6, all versi
A potential DoS vulnerability was discovered in GitLab CE/EE starting with version 13.7. Using a malformed TIFF images w
An improper access control flaw in all versions of GitLab CE/EE starting from 13.9 before 14.2.6, all versions starting
Lack of email address ownership verification in the CODEOWNERS feature in all versions of GitLab EE starting from 11.3 b
A potential DOS vulnerability was discovered in GitLab CE/EE starting with version 13.7. The stripping of EXIF data from
Improper validation of ipynb files in GitLab CE/EE version 13.5 and above allows an attacker to execute arbitrary JavaSc
An information disclosure vulnerability in the GitLab CE/EE API since version 8.9.6 allows a user to see basic informati
An Improper Access Control vulnerability in the GraphQL API in all versions of GitLab CE/EE starting from 13.1 before 14
In all versions of GitLab CE/EE since version 11.10, an admin of a group can see the SCIM token of that group by visitin
Frequently Asked Questions
How many CVEs affect Gitlab?
Gitlab has 1,451 CVE records in our database, including 57 critical and 304 high severity vulnerabilities. 4 of these are listed in CISA's Known Exploited Vulnerabilities catalog.
What are the most severe Gitlab vulnerabilities?
Gitlab has 57 critical severity (CVSS 9.0+) and 304 high severity (CVSS 7.0-8.9) vulnerabilities. 4 vulnerabilities are confirmed as actively exploited in the wild.
How can I scan for Gitlab vulnerabilities?
CyberStrike's AI-powered security agents automatically detect vulnerabilities in Gitlab products across your infrastructure. The platform provides continuous pentesting, DAST scanning, and real-time vulnerability monitoring with actionable remediation guidance.
Detect Gitlab Vulnerabilities
CyberStrike scans your infrastructure for Gitlab vulnerabilities and provides real-time remediation guidance.
Get Started