[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fuSUTQNn9BZwo08x0mWidp5XBKSIDmDo793Tl4WXjbpY":3},{"success":4,"data":5},true,{"vendor":6,"topVulnerabilitiesByEpss":63,"kevVulnerabilities":126,"topProductsByCves":156,"seoMetadata":166,"meta":175},{"vendorId":7,"vendorName":8,"productCount":9,"cveCount":10,"kevCount":11,"versionCount":12,"lastCveUpdate":13,"firstLetter":14,"products":15,"description":62},12249,"gitlab",9,1199,4,1879,"2025-10-27","g",[16,20,27,32,38,44,49,54,58],{"id":17,"product_name":8,"version_count":18,"cve_count":19,"kev_count":11,"last_cve_update":13},50284,1288,1186,{"id":21,"product_name":22,"version_count":23,"cve_count":24,"kev_count":25,"last_cve_update":26},50286,"gitlab-shell",28,5,0,"2020-01-28",{"id":28,"product_name":29,"version_count":30,"cve_count":11,"kev_count":25,"last_cve_update":31},50282,"dynamic_application_security_testing_analyzer",150,"2023-03-27",{"id":33,"product_name":34,"version_count":35,"cve_count":36,"kev_count":25,"last_cve_update":37},50289,"runner",236,3,"2023-01-17",{"id":39,"product_name":40,"version_count":41,"cve_count":42,"kev_count":25,"last_cve_update":43},50287,"gitlab-vscode-extension",66,2,"2021-04-01",{"id":45,"product_name":46,"version_count":47,"cve_count":47,"kev_count":25,"last_cve_update":48},50285,"gitlab_runner",1,"2022-06-06",{"id":50,"product_name":51,"version_count":52,"cve_count":47,"kev_count":25,"last_cve_update":53},50283,"gitaly",108,"2020-11-17",{"id":55,"product_name":56,"version_count":42,"cve_count":47,"kev_count":25,"last_cve_update":57},50281,"dast_api_scanner","2023-02-01",{"id":59,"product_name":60,"version_count":25,"cve_count":47,"kev_count":25,"last_cve_update":61},50288,"omnibus","2019-09-16","Gitlab is a technology vendor with 9 tracked products and 1199 known security vulnerabilities. Get comprehensive security analysis, vulnerability tracking, and threat intelligence for this vendor.",[64,72,80,85,92,97,103,109,115,120],{"cveId":65,"description":66,"publishedDate":67,"cvssScore":68,"cvssVersion":69,"severity":70,"isKev":4,"epssScore":71},"CVE-2021-22205","An issue has been discovered in GitLab CE\u002FEE affecting all versions starting from 11.9. GitLab was not properly validating image files that were passed to a file parser which resulted in a remote command execution.","2021-04-23",10,"v3.1","Critical",0.99731,{"cveId":73,"description":74,"publishedDate":75,"cvssScore":76,"cvssVersion":69,"severity":77,"isKev":78,"epssScore":79},"CVE-2023-2442","An issue has been discovered in GitLab CE\u002FEE affecting all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. A specially crafted merge request could lead to a stored XSS on the client side which allows attackers to perform arbitrary actions on behalf of victims.","2023-06-07",8.7,"High",false,0.96058,{"cveId":81,"description":82,"publishedDate":83,"cvssScore":68,"cvssVersion":69,"severity":70,"isKev":4,"epssScore":84},"CVE-2023-7028","An issue has been discovered in GitLab CE\u002FEE affecting all versions from 16.1 prior to 16.1.6, 16.2 prior to 16.2.9, 16.3 prior to 16.3.7, 16.4 prior to 16.4.5, 16.5 prior to 16.5.6, 16.6 prior to 16.6.4, and 16.7 prior to 16.7.2 in which user account password reset emails could be delivered to an unverified email address.","2024-01-12",0.94647,{"cveId":86,"description":87,"publishedDate":88,"cvssScore":89,"cvssVersion":69,"severity":90,"isKev":78,"epssScore":91},"CVE-2023-0050","An issue has been discovered in GitLab affecting all versions starting from 13.7 before 15.7.8, all versions starting from 15.8 before 15.8.4, all versions starting from 15.9 before 15.9.2. A specially crafted Kroki diagram could lead to a stored XSS on the client side which allows attackers to perform arbitrary actions on behalf of victims.","2023-03-09",5.4,"Medium",0.9242,{"cveId":93,"description":94,"publishedDate":95,"cvssScore":89,"cvssVersion":69,"severity":90,"isKev":78,"epssScore":96},"CVE-2022-1190","Improper handling of user input in GitLab CE\u002FEE versions 8.3 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allowed an attacker to exploit a stored XSS by abusing multi-word milestone references in issue descriptions, comments, etc.","2022-04-04",0.87946,{"cveId":98,"description":99,"publishedDate":100,"cvssScore":101,"cvssVersion":69,"severity":77,"isKev":78,"epssScore":102},"CVE-2022-3265","A cross-site scripting issue has been discovered in GitLab CE\u002FEE affecting all versions prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2. It was possible to exploit a vulnerability in setting the labels colour feature which could lead to a stored XSS that allowed attackers to perform arbitrary actions on behalf of victims at client side.","2022-11-09",7.3,0.86982,{"cveId":104,"description":105,"publishedDate":106,"cvssScore":107,"cvssVersion":69,"severity":70,"isKev":78,"epssScore":108},"CVE-2022-2992","A vulnerability in GitLab CE\u002FEE affecting all versions from 11.10 prior to 15.1.6, 15.2 to 15.2.4, 15.3 to 15.3.2 allows an authenticated user to achieve remote code execution via the Import from GitHub API endpoint.","2022-10-17",9.9,0.86194,{"cveId":110,"description":111,"publishedDate":112,"cvssScore":113,"cvssVersion":69,"severity":90,"isKev":78,"epssScore":114},"CVE-2023-0921","A lack of length validation in GitLab CE\u002FEE affecting all versions from 8.3 before 15.10.8, 15.11 before 15.11.7, and 16.0 before 16.0.2 allows an authenticated attacker to create a large Issue description via GraphQL which, when repeatedly requested, saturates CPU usage.","2023-06-06",4.3,0.84438,{"cveId":116,"description":117,"publishedDate":95,"cvssScore":118,"cvssVersion":69,"severity":90,"isKev":78,"epssScore":119},"CVE-2022-1175","Improper neutralization of user input in GitLab CE\u002FEE versions 14.4 before 14.7.7, all versions starting from 14.8 before 14.8.5, all versions starting from 14.9 before 14.9.2 allowed an attacker to exploit XSS by injecting HTML in notes.",6.1,0.82003,{"cveId":121,"description":122,"publishedDate":123,"cvssScore":124,"cvssVersion":69,"severity":90,"isKev":78,"epssScore":125},"CVE-2021-4191","An issue has been discovered in GitLab CE\u002FEE affecting versions 13.0 to 14.6.5, 14.7 to 14.7.4, and 14.8 to 14.8.2. Private GitLab instances with restricted sign-ups may be vulnerable to user enumeration to unauthenticated users through the GraphQL API.","2022-03-28",5.3,0.80004,[127,137,146,151],{"cveId":128,"description":129,"publishedDate":130,"cvssScore":131,"cvssVersion":69,"severity":70,"isKev":4,"epssScore":132,"cisaVulnName":133,"cisaDateAdded":134,"cisaShortDescription":135,"cisaRequiredAction":136},"CVE-2021-22175","When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab affecting all versions starting from 10.5 was possible to exploit for an unauthenticated attacker even on a GitLab instance where registration is disabled","2021-06-11",9.8,0.53372,"GitLab Server-Side Request Forgery (SSRF) Vulnerability","2026-02-18","GitLab contains a server-side request forgery (SSRF) vulnerability when requests to the internal network for webhooks are enabled.","Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",{"cveId":138,"description":139,"publishedDate":140,"cvssScore":141,"cvssVersion":69,"severity":77,"isKev":4,"epssScore":142,"cisaVulnName":143,"cisaDateAdded":144,"cisaShortDescription":145,"cisaRequiredAction":136},"CVE-2021-39935","An issue has been discovered in GitLab CE\u002FEE affecting all versions starting from 10.5 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2. Unauthorized external users could perform Server Side Requests via the CI Lint API","2021-12-13",7.5,0.3614,"GitLab Community and Enterprise Editions Server-Side Request Forgery (SSRF) Vulnerability","2026-02-03","GitLab Community and Enterprise Editions contain a server-side request forgery vulnerability which could allow unauthorized external users to perform Server Side Requests via the CI Lint API.",{"cveId":81,"description":82,"publishedDate":83,"cvssScore":68,"cvssVersion":69,"severity":70,"isKev":4,"epssScore":84,"cisaVulnName":147,"cisaDateAdded":148,"cisaShortDescription":149,"cisaRequiredAction":150},"GitLab Community and Enterprise Editions Improper Access Control Vulnerability","2024-05-01","GitLab Community and Enterprise Editions contain an improper access control vulnerability. This allows an attacker to trigger password reset emails to be sent to an unverified email address to ultimately facilitate an account takeover.","Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.",{"cveId":65,"description":66,"publishedDate":67,"cvssScore":68,"cvssVersion":69,"severity":70,"isKev":4,"epssScore":71,"cisaVulnName":152,"cisaDateAdded":153,"cisaShortDescription":154,"cisaRequiredAction":155},"GitLab Community and Enterprise Editions Remote Code Execution Vulnerability","2021-11-03","GitHub Community and Enterprise Editions that utilize the ability to upload images through GitLab Workhorse are vulnerable to remote code execution. Workhorse passes image file extensions through ExifTool, which improperly validates the image files.","Apply updates per vendor instructions.",[157,158,159,160,161,162,163,164,165],{"id":17,"product_name":8,"version_count":18,"cve_count":19,"kev_count":11,"last_cve_update":13},{"id":21,"product_name":22,"version_count":23,"cve_count":24,"kev_count":25,"last_cve_update":26},{"id":28,"product_name":29,"version_count":30,"cve_count":11,"kev_count":25,"last_cve_update":31},{"id":33,"product_name":34,"version_count":35,"cve_count":36,"kev_count":25,"last_cve_update":37},{"id":39,"product_name":40,"version_count":41,"cve_count":42,"kev_count":25,"last_cve_update":43},{"id":45,"product_name":46,"version_count":47,"cve_count":47,"kev_count":25,"last_cve_update":48},{"id":50,"product_name":51,"version_count":52,"cve_count":47,"kev_count":25,"last_cve_update":53},{"id":55,"product_name":56,"version_count":42,"cve_count":47,"kev_count":25,"last_cve_update":57},{"id":59,"product_name":60,"version_count":25,"cve_count":47,"kev_count":25,"last_cve_update":61},{"title":167,"metaDescription":168,"keywords":169,"structuredData":170},"Gitlab - Security Vulnerabilities & Analysis | Precursor Intelligence","Comprehensive security analysis for Gitlab covering 9 products with 1199 tracked vulnerabilities including 3 critical and 1 high-severity issues and 4 CISA KEV vulnerabilities. Real-time threat intelligence, CVE tracking, and security recommendations.","Gitlab vulnerabilities, Gitlab security, Gitlab CVE, Gitlab threat intelligence, vendor security analysis, cybersecurity threats, vulnerability management, CVE tracking, Gitlab KEV, Gitlab exploited vulnerabilities",{"@context":171,"@type":172,"name":173,"description":168,"url":174},"https:\u002F\u002Fschema.org","Organization","Gitlab","https:\u002F\u002Fprecursorintelligence.com\u002Fvendors\u002Fgitlab",{"totalProducts":9,"totalVulnerabilities":10,"kevVulnerabilities":11,"lastUpdated":13,"generatedAt":176,"apiVersion":177},"2026-10-17T00:19:50.000Z","3.0"]