Known vulnerabilities in Gitlab Community Edition

Software CPE: cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*
Total vulnerabilities: 1134
Public exploits: 22
Known exploited (KEV): 5
Highest CVSSv4 Score: 9.3

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Gitlab Community Edition Gitlab Community Edition is affected by 1134 known vulnerabilities: 1 critical, 93 high, 514 medium, 526 low Critical High Medium Low

Vulnerabilities (1134)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU151883 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVE-2026-92628
CWE-362 Low
No
No
19.2.7, 19.3.3, 19.4.1 23.09.2026 SB2026092388
#VU151877 - Incorrect Authorization
CVE-2026-92874
CWE-863 Low
No
No
19.2.7, 19.3.3, 19.4.1 23.09.2026 SB2026092388
#VU151878 - Use of Less Trusted Source
CVE-2026-92530
CWE-348 Low
No
No
19.2.7, 19.3.3, 19.4.1 23.09.2026 SB2026092388
#VU151879 - Missing Authorization
CVE-2026-8937
CWE-862 Low
No
No
19.2.7, 19.3.3, 19.4.1 23.09.2026 SB2026092388
#VU151882 - Missing Authorization
CVE-2026-4523
CWE-862 Low
No
No
19.2.7, 19.3.3, 19.4.1 23.09.2026 SB2026092388
#VU151873 - Double Free
CVE-2026-89078
CWE-415 Medium
No
No
19.2.7, 19.3.3, 19.4.1 23.09.2026 SB2026092388
#VU151874 - Integer overflow
CVE-2026-93577
CWE-190 Medium
No
No
19.2.7, 19.3.3, 19.4.1 23.09.2026 SB2026092388
#VU151875 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-84739
CWE-79 Low
No
No
19.2.7, 19.3.3, 19.4.1 23.09.2026 SB2026092388
#VU149013 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVE-2024-11222
CWE-362 Low
No
No
19.1.8, 19.2.6, 19.3.2 11.09.2026 SB2026091149
#VU149014 - Improper Authentication
CVE-2026-12910
CWE-287 Low
No
No
19.1.8, 19.2.6, 19.3.2 11.09.2026 SB2026091149
#VU149015 - Incorrect Authorization
CVE-2026-82837
CWE-863 Medium
No
No
19.1.8, 19.2.6, 19.3.2 11.09.2026 SB2026091149
#VU149016 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-19619
CWE-79 Medium
No
No
19.1.8, 19.2.6, 19.3.2 11.09.2026 SB2026091149
#VU149019 - Missing Authorization
CVE-2026-7514
CWE-862 Low
No
No
19.1.8, 19.2.6, 19.3.2 11.09.2026 SB2026091149
#VU149020 - Improper input validation
CVE-2026-8030
CWE-20 Low
No
No
19.1.8, 19.2.6, 19.3.2 11.09.2026 SB2026091149
#VU149022 - Improper input validation
CVE-2026-3855
CWE-20 Low
No
No
19.1.8, 19.2.6, 19.3.2 11.09.2026 SB2026091149
#VU148997 - Allocation of Resources Without Limits or Throttling
CVE-2026-1168
CWE-770 Medium
No
No
19.1.8, 19.2.6, 19.3.2 11.09.2026 SB2026091149
#VU148996 - Resource exhaustion
CVE-2025-14871
CWE-400 Medium
No
No
19.1.8, 19.2.6, 19.3.2 11.09.2026 SB2026091149
#VU148995 - Incorrect Authorization
CVE-2026-13210
CWE-863 Medium
No
No
19.1.8, 19.2.6, 19.3.2 11.09.2026 SB2026091149
#VU148986 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-78252
CWE-79 Low
No
No
19.1.8, 19.2.6, 19.3.2 11.09.2026 SB2026091149
#VU148974 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2026-85706
CWE-22 High
Available
Exploited
18.11.12, 19.0.9, 19.1.8, 19.2.6, 19.3.2 11.09.2026 SB2026091149


Showing elements 1 - 20 out of 1134