By year
14
16
17
18
19
20
21
22
23
24
25
26
Bars are flaws published each year; the red part is the share attackers have used.
Exploited GitLab flaws
These are on CISA’s Known Exploited Vulnerabilities list, newest first. If you run any of these products, these come before everything else.
- CVE-2026-85706 GitLab Community Edition and Enterprise Edition Path TraversalExploited since Sep 11, 2026 · CVSS 10
- CVE-2021-22175 GitLab Server-Side Request Forgery (SSRF)Exploited since Feb 18, 2026 · CVSS 6.8
- CVE-2021-39935 GitLab Community and Enterprise Editions Server-Side Request Forgery (SSRF)Exploited since Feb 3, 2026 · CVSS 6.8
- CVE-2023-7028 GitLab Community and Enterprise Editions Improper Access ControlExploited since May 1, 2024 · CVSS 10
- CVE-2021-22205 GitLab Community and Enterprise Editions Remote Code ExecutionExploited since Nov 3, 2021 · ransomware · CVSS 10
Latest high and critical flaws
- CVE-2026-15723 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.1 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, when OmniAuth SAHigh 8.2 · Oct 21, 2026
- CVE-2026-112212 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain coHigh 7.5 · Oct 21, 2026
- CVE-2026-110264 An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 Critical 10 · Oct 21, 2026
- CVE-2026-97229 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain coCritical 10 · Oct 12, 2026
- CVE-2026-96893 GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain condiHigh 7.3 · Oct 12, 2026
- CVE-2026-92883 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain cHigh 8.7 · Oct 12, 2026
- CVE-2026-81839 GitLab has remediated an issue in GitLab EE affecting all versions from 18.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain condiHigh 7.7 · Oct 12, 2026
- CVE-2026-16301 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain coHigh 8.5 · Oct 12, 2026
- CVE-2026-14814 GitLab has remediated an issue in GitLab CE/EE affecting all versions before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, High 8.2 · Oct 12, 2026
- CVE-2026-90970 GitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all versions of the AI Gateway from 18.1.6 before 19.2.4, 19.3 before 19.3.2,Critical 9.9 · Oct 2, 2026
- CVE-2026-84739 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.11 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain coHigh 8.7 · Sep 29, 2026
- CVE-2026-93577 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conCritical 9.9 · Sep 23, 2026
- CVE-2026-92470 GitLab has remediated an issue in GitLab EE affecting all versions from 18.7 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditHigh 7.7 · Sep 23, 2026
- CVE-2026-89078 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conCritical 9.9 · Sep 23, 2026
- CVE-2026-79708 GitLab has remediated an issue in GitLab EE affecting all versions from 19.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain condiHigh 8.5 · Sep 16, 2026
- CVE-2026-78252 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.3 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain coHigh 8.2 · Sep 16, 2026
- CVE-2026-1168 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.4.6 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain cHigh 7.5 · Sep 16, 2026
- CVE-2025-14871 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.4.6 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain cHigh 7.5 · Sep 16, 2026
- CVE-2026-88765 GitLab has remediated an issue in GitLab EE affecting all versions from 12.3 to 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 under certain conditions coulHigh 8.5 · Sep 15, 2026
- CVE-2026-13210 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conHigh 7.7 · Sep 15, 2026
- CVE-2026-87719 GitLab has remediated an issue in GitLab EE affecting all versions from 18.3 before 18.11.12, 19.0 before 19.0.9, 19.1 before 19.1.8, 19.2 before 19.2.6, and 19Critical 9.9 · Sep 11, 2026
- CVE-2026-85706 GitLab Community Edition and Enterprise Edition Path TraversalExploited · Critical 10 · Sep 11, 2026
- CVE-2026-75871 GitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all versions of the AI Gateway from 18.10 to 19.0.12, 19.1 to 19.1.7, and 19.High 8.2 · Aug 27, 2026
- CVE-2026-19889 GitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all versions of the AI Gateway from 18.9.0 to 19.0.12, 19.1 to 19.1.7, and 19High 8.2 · Aug 27, 2026
- CVE-2026-18252 GitLab has remediated an issue in GitLab EE affecting all versions from 18.9 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain condiHigh 7.3 · Aug 26, 2026
Part of our vulnerability database: the whole National Vulnerability Database plus CISA’s exploited list, refreshed twice a day. This is general guidance, not a review of your systems.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.