Vendor

    GitLab

    1,516 known vulnerabilities in products by GitLab, 5 of them actively exploited (CISA KEV).

    Key figures

    1,516

    Vulnerabilities

    5

    Actively exploited (KEV)

    1

    Used by ransomware

    85

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority.

    Vulnerabilities in GitLab
    SeverityCVETitleCVSSPublished
    CriticalCVE-2026-85706

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab

    In CISA KEV

    		10.0
    CriticalCVE-2021-22205

    GitLab Community and Enterprise Editions Remote Code Execution Vulnerability

    In CISA KEVRansomware

    		10.0
    CriticalCVE-2023-7028

    Weak Password Recovery Mechanism for Forgotten Password in GitLab

    In CISA KEV

    		10.0
    CriticalCVE-2021-39935

    GitLab Community and Enterprise Editions Server-Side Request Forgery (SSRF) Vulnerability

    In CISA KEV

    		6.8
    CriticalCVE-2021-22175

    GitLab Server-Side Request Forgery (SSRF) Vulnerability

    In CISA KEV

    		6.8
    CriticalCVE-2026-19478

    Improper Control of Generation of Code ('Code Injection') in GitLab

    		9.4
    CriticalCVE-2025-5121

    Missing Authorization in GitLab

    		8.5
    CriticalCVE-2023-2825

    GitLab: Path Traversal

    		10.0
    CriticalCVE-2022-2992

    GitLab: Remote Code Execution

    		9.9
    CriticalCVE-2022-2884

    GitLab: Remote Code Execution

    		9.9
    CriticalCVE-2022-2185

    GitLab: Remote Code Execution

    		9.9
    CriticalCVE-2024-45409

    The Ruby SAML library vulnerable to a SAML authentication bypass via Incorrect XPath selector

    		10.0
    CriticalCVE-2018-14364

    GitLab: Path Traversal

    		9.8
    HighCVE-2025-4278

    Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in GitLab

    		8.7
    HighCVE-2024-4901

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

    		8.7
    HighCVE-2024-1451

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

    		8.7
    HighCVE-2023-2442

    GitLab: Cross-Site Scripting (XSS)

    		8.7
    CriticalCVE-2024-6385

    Improper Access Control in GitLab

    		9.6
    HighCVE-2023-0050

    GitLab: Cross-Site Scripting (XSS)

    		8.7
    CriticalCVE-2022-1680

    GitLab: security vulnerability

    		9.9
    CriticalCVE-2022-1162

    GitLab: Hard-coded Credentials

    		9.1
    CriticalCVE-2023-5009

    Incorrect Authorization in GitLab

    		9.6
    CriticalCVE-2024-5655

    Improper Access Control in GitLab

    		9.6
    CriticalCVE-2022-0735

    GitLab: Information Disclosure

    		10.0
    HighCVE-2024-2434

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab

    		8.5

    All vulnerabilities in search

    News

    Products

    Products by GitLab
    ProductCVEsActively exploited
    GitLab1,5115
    Gitlab Ce/ee220
    Gitlab Community And Enterprise Editions130
    Gitlab Ee100
    Gitlab Runner70
    gitlab gitlab-shell50
    Dynamic Application Security Testing Analyzer40
    Gitlab AI Gateway40
    Runner30