Read the docs

GitLab

Records1525All Threatist records
Exploited (KEV)6In CISA KEV
CVSS critical86CVSS 9.0–10.0
CVSS high437CVSS 7.0–8.9

Exploited now

GitLab records in CISA KEV
TI-2026-71508 GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability Priority CRITICAL 100KEV 2026-10-29TI-2026-58817 GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability Priority CRITICAL 100KEV 2026-09-11TI-2021-05161 GitLab Server-Side Request Forgery (SSRF) Vulnerability Priority CRITICAL 100KEV 2026-02-18TI-2021-17165 GitLab Community and Enterprise Editions Server-Side Request Forgery (SSRF) Vulnerability Priority CRITICAL 90KEV 2026-02-03TI-2023-06425 GitLab Community and Enterprise Editions Improper Access Control Vulnerability Priority CRITICAL 100KEV 2024-05-01TI-2021-05191 GitLab Community and Enterprise Editions Remote Code Execution Vulnerability Priority CRITICAL 100KEV 2021-11-03

Components

Products in the NVD configurations · select one to filter the records
Gitlab 1507 records CRITICAL Gitlab-shell 5 records MEDIUM Dynamic Application Security Testing Analyzer 4 records MEDIUM Runner 3 records MEDIUM Gitlab-vscode-extension 2 records MEDIUM Dast Api Scanner 1 record MEDIUM Gitaly 1 record LOW Gitlab Runner 1 record LOW

Records

4 records in Dynamic Application Security Testing Analyzer · all components

TI-2022-03953 CVE-2022-4315 · GHSA-342h-3rmj-qwv4

Incorrect authorization in GitLab

Priority MEDIUM 62

An issue has been discovered in GitLab DAST analyzer affecting all versions starting from 2.0 before 3.0.55, which sends custom request headers with every request on the authentication page.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00805 Published 2023-03-08 Fixed in 3.0.55 CWE-863
TI-2022-03954 CVE-2022-4317 · GHSA-4mvf-qm8g-c6mp

Open redirect in GitLab DAST

Priority MEDIUM 60

An issue has been discovered in GitLab DAST analyzer affecting all versions starting from 1.47 before 3.0.51, which sends custom request headers in redirects.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00541 Published 2023-03-09 Fixed in 3.0.51 CWE-601
TI-2022-03458 CVE-2022-3767 · GHSA-5xvv-4r9w-mw22

Improper input validation in GitLab DAST

Priority LOW 35

Missing validation in DAST analyzer affecting all versions from 1.11.0 prior to 3.0.32, allows custom request headers to be sent with every request, regardless of the host.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.00752 Published 2023-03-09 Fixed in 3.0.32 CWE-20
Open these records in search →