Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 1,527

Export CSV
CVE-2026-8280

Allocation of Resources Without Limits or Throttling in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 8.3 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an authenticated user to cause denial of service through excessive memory consumption due to improper input validation.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Gitlab
Products
Gitlab
CVE-2023-4018

Direct Request ('Forced Browsing') in GitLab

An issue has been discovered in GitLab affecting all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1. Due to improper permission validation it was possible to create model experiments in public projects.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Gitlab
Products
Gitlab
CVE-2023-3994

Inefficient Regular Expression Complexity in GitLab

An issue has been discovered in GitLab CE/EE affecting all versions starting from 9.3 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. A Regular Expression Denial of Service was possible via sending crafted payloads which use ProjectReferenceFilter to the preview_markdown endpoint.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Gitlab
Products
Gitlab
CVE-2024-0456

Direct Request ('Forced Browsing') in GitLab

An authorization vulnerability exists in GitLab versions 14.0 prior to 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1. An unauthorized attacker is able to assign arbitrary users to MRs that they created within the project

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Gitlab
Products
Gitlab
CVE-2023-6955

Missing Authorization in GitLab

A missing authorization check vulnerability exists in GitLab Remote Development affecting all versions prior to 16.5.6, 16.6 prior to 16.6.4 and 16.7 prior to 16.7.2. This condition allows an attacker to create a workspace in one group that is associated with an agent from another group.

CVSS 3.1 · 6.6 Medium EPSS < 1% KEV · Not listed
Vendors
Gitlab
Products
Gitlab
CVE-2023-4658

Incorrect Authorization in GitLab

An issue has been discovered in GitLab EE affecting all versions starting from 8.13 before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions starting from 16.6 before 16.6.1. It was possible for an attacker to abuse the `Allowed to merge` permission as a guest user, when granted the permission through a group.

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed
Vendors
Gitlab
Products
Gitlab
CVE-2023-4532

Incorrect Authorization in GitLab

An issue has been discovered in GitLab affecting all versions starting from 16.2 before 16.2.8, all versions starting from 16.3 before 16.3.5, all versions starting from 16.4 before 16.4.1. Users were capable of linking CI/CD jobs of private projects which they are not a member of.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Gitlab
Products
Gitlab
CVE-2023-5933

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in GitLab

An issue has been discovered in GitLab CE/EE affecting all versions after 13.7 before 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1. Improper input sanitization of user name allows arbitrary API PUT requests.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Gitlab
Products
Gitlab
CVE-2023-3922

URL Redirection to Untrusted Site ('Open Redirect') in GitLab

An issue has been discovered in GitLab affecting all versions starting from 8.15 before 16.2.8, all versions starting from 16.3 before 16.3.5, all versions starting from 16.4 before 16.4.1. It was possible to hijack some links and buttons on the GitLab UI to a malicious page.

CVSS 3.1 · 3 Low EPSS < 1% KEV · Not listed
Vendors
Gitlab
Products
Gitlab
CVE-2023-3920

Incorrect Authorization in GitLab

An issue has been discovered in GitLab affecting all versions starting from 11.2 before 16.2.8, all versions starting from 16.3 before 16.3.5, all versions starting from 16.4 before 16.4.1. It was possible that a maintainer to create a fork relationship between existing projects contrary to the documentation.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Gitlab
Products
Gitlab
CVE-2024-4024

Authentication Bypass by Assumed-Immutable Data in GitLab

An issue has been discovered in GitLab CE/EE affecting all versions starting from 7.8 before 16.9.6, all versions starting from 16.10 before 16.10.4, all versions starting from 16.11 before 16.11.1. Under certain conditions, an attacker with their Bitbucket account credentials may be able to take over a GitLab account linked to another user's Bitbucket account, if Bitbucket is used as an OAuth 2.0 provider on GitLab.

CVSS 3.1 · 7.3 High EPSS 14.9% KEV · Not listed
Vendors
Gitlab
Products
Gitlab
CVE-2024-4006

Incorrect Authorization in GitLab

An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.7 before 16.9.6, all versions starting from 16.10 before 16.10.4, all versions starting from 16.11 before 16.11.1 where personal access scopes were not honored by GraphQL subscriptions

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Gitlab
Products
Gitlab
CVE-2024-1525

Authentication Bypass Using an Alternate Path or Channel in GitLab

An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.1 before 16.7.6, all versions starting from 16.8 before 16.8.3, all versions starting from 16.9 before 16.9.1. Under some specialized conditions, an LDAP user may be able to reset their password using their verified secondary email address and sign-in using direct authentication with the reset password, bypassing LDAP.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Gitlab
Products
Gitlab
CVE-2023-6840

Missing Authorization in GitLab

An issue has been discovered in GitLab EE affecting all versions from 16.4 prior to 16.6.7, 16.7 prior to 16.7.5, and 16.8 prior to 16.8.2 which allows a maintainer to change the name of a protected branch that bypasses the security policy added to block MR.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed
Vendors
Gitlab
Products
Gitlab
CVE-2023-6736

Inefficient Regular Expression Complexity in GitLab

An issue has been discovered in GitLab EE affecting all versions starting from 11.3 before 16.7.6, all versions starting from 16.8 before 16.8.3, all versions starting from 16.9 before 16.9.1. It was possible for an attacker to cause a client-side denial of service using malicious crafted content in the CODEOWNERS file.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Gitlab
Products
Gitlab
CVE-2023-4378

Insertion of Sensitive Information Into Sent Data in GitLab

An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.8 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1. A malicious Maintainer can, under specific circumstances, leak the sentry token by changing the configured URL in the Sentry error tracking settings page. This was as a result of an incomplete fix for CVE-2022-4365.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Gitlab
Products
Gitlab
CVE-2026-4922

Cross-Site Request Forgery (CSRF) in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.0 before 18.9.6, 18.10 before 18.10.4, and 18.11 before 18.11.1 that could have allowed an unauthenticated user to execute GraphQL mutations on behalf of authenticated users due to insufficient CSRF protection.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Gitlab
Products
Gitlab
CVE-2025-0186

Allocation of Resources Without Limits or Throttling in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.6 before 18.9.6, 18.10 before 18.10.4, and 18.11 before 18.11.1 that could have allowed an authenticated user to cause denial of service under certain conditions by exhausting server resources by making crafted requests to a discussions endpoint.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Gitlab
Products
Gitlab
CVE-2025-3922

Allocation of Resources Without Limits or Throttling in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.4 before 18.9.6, 18.10 before 18.10.4, and 18.11 before 18.11.1 that could have allowed an authenticated user to cause denial of service by overwhelming system resources under certain conditions due to insufficient resource allocation limits in the GraphQL API.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Gitlab
Products
Gitlab
CVE-2025-6016

Allocation of Resources Without Limits or Throttling in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 9.2 before 18.9.6, 18.10 before 18.10.4, and 18.11 before 18.11.1 that could have allowed an authenticated user to cause denial of service due to insufficient resource allocation limits when retrieving notes under certain conditions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Gitlab
Products
Gitlab