{"version":"https://jsonfeed.org/version/1.1","title":"Patchfirst: GitLab vulnerabilities","home_page_url":"https://patchfirst.co/vendor/gitlab/","feed_url":"https://patchfirst.co/feed/vendor/gitlab.json","description":"New and newly exploited GitLab CVEs, with CISA KEV, EPSS and ATT&CK context. Newest 50 by publication or KEV listing.","language":"en-GB","items":[{"id":"CVE-2026-97229#kev","url":"https://patchfirst.co/cve/CVE-2026-97229/","title":"[KEV] CVE-2026-97229: GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability","content_text":"GitLab · Community Edition and Enterprise Edition. In CISA KEV since 2026-10-29. ENISA EUVD lists it as exploited. EPSS 26.6% (higher than 98% of CVEs). CVSS 10.0 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 79.5 of 100.","summary":"GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability","date_published":"2026-10-29T00:00:00.000Z","date_modified":"2026-10-31T00:16:52.000Z","tags":["kev","public-exploit","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":79.5,"kev":{"dateAdded":"2026-10-29","ransomware":false},"epss":{"score":0.26569,"percentile":0.98015},"cvss":{"score":10,"severity":"CRITICAL","version":"3.1"},"vendor":"GitLab","product":"Community Edition and Enterprise Edition","techniqueIds":["T1190","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-110264","url":"https://patchfirst.co/cve/CVE-2026-110264/","title":"CVE-2026-110264: An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19.0 before 19.0.10…","content_text":"GitLab · GitLab. Not in CISA KEV. EPSS 1.3% (higher than 70.5% of CVEs). CVSS 10.0 CRITICAL. Public exploit code exists. Priority 28.0 of 100.","summary":"An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19.0 before 19.0.10…","date_published":"2026-10-22T00:00:00.000Z","date_modified":"2026-10-31T00:16:51.000Z","tags":["public-exploit"],"_patchfirst":{"reason":"published","priority":28,"kev":null,"epss":{"score":0.01305,"percentile":0.7051},"cvss":{"score":10,"severity":"CRITICAL","version":"3.1"},"vendor":"GitLab","product":"GitLab","techniqueIds":[],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}},{"id":"CVE-2026-90970","url":"https://patchfirst.co/cve/CVE-2026-90970/","title":"CVE-2026-90970: GitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all versions of the AI Gateway from…","content_text":"GitLab · GitLab AI Gateway. Not in CISA KEV. EPSS 17.5% (higher than 97.1% of CVEs). CVSS 9.9 CRITICAL. Public exploit code exists. Priority 33.7 of 100.","summary":"GitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all versions of the AI Gateway from…","date_published":"2026-10-02T00:00:00.000Z","date_modified":"2026-10-02T18:44:11.000Z","tags":["public-exploit"],"_patchfirst":{"reason":"published","priority":33.7,"kev":null,"epss":{"score":0.17488,"percentile":0.97129},"cvss":{"score":9.9,"severity":"CRITICAL","version":"3.1"},"vendor":"GitLab","product":"GitLab AI Gateway","techniqueIds":[],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}},{"id":"CVE-2026-85706","url":"https://patchfirst.co/cve/CVE-2026-85706/","title":"CVE-2026-85706: GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability","content_text":"GitLab · Community Edition and Enterprise Edition. In CISA KEV since 2026-09-11. ENISA EUVD lists it as exploited. EPSS 97.4% (higher than 99.9% of CVEs). CVSS 10.0 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1005 Data from Local System. Priority 80.0 of 100.","summary":"GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability","date_published":"2026-09-12T00:00:00.000Z","date_modified":"2026-09-24T12:52:28.000Z","tags":["kev","public-exploit","T1190","T1005"],"_patchfirst":{"reason":"published","priority":80,"kev":{"dateAdded":"2026-09-11","ransomware":false},"epss":{"score":0.97355,"percentile":0.99898},"cvss":{"score":10,"severity":"CRITICAL","version":"3.1"},"vendor":"GitLab","product":"Community Edition and Enterprise Edition","techniqueIds":["T1190","T1005"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-19478","url":"https://patchfirst.co/cve/CVE-2026-19478/","title":"CVE-2026-19478: Improper Control of Generation of Code ('Code Injection') in GitLab","content_text":"GitLab · GitLab. Not in CISA KEV. EPSS 2.2% (higher than 82.1% of CVEs). CVSS 9.4 CRITICAL. Public exploit code exists. Priority 75.1 of 100.","summary":"Improper Control of Generation of Code ('Code Injection') in GitLab","date_published":"2026-08-17T00:00:00.000Z","date_modified":"2026-08-17T20:44:03.000Z","tags":["public-exploit"],"_patchfirst":{"reason":"published","priority":75.1,"kev":null,"epss":{"score":0.02155,"percentile":0.82147},"cvss":{"score":9.4,"severity":"CRITICAL","version":"3.1"},"vendor":"GitLab","product":"GitLab","techniqueIds":[],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}},{"id":"CVE-2021-22175#kev","url":"https://patchfirst.co/cve/CVE-2021-22175/","title":"[KEV] CVE-2021-22175: GitLab Server-Side Request Forgery (SSRF) Vulnerability","content_text":"GitLab · GitLab. In CISA KEV since 2026-02-18. ENISA EUVD lists it as exploited. EPSS 53.4% (higher than 99% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1090 Proxy. Priority 69.7 of 100.","summary":"GitLab Server-Side Request Forgery (SSRF) Vulnerability","date_published":"2026-02-18T00:00:00.000Z","date_modified":"2026-10-01T19:17:14.000Z","tags":["kev","public-exploit","T1190","T1090"],"_patchfirst":{"reason":"kev","priority":69.7,"kev":{"dateAdded":"2026-02-18","ransomware":false},"epss":{"score":0.53372,"percentile":0.98986},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"GitLab","product":"GitLab","techniqueIds":["T1190","T1090"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2021-39935#kev","url":"https://patchfirst.co/cve/CVE-2021-39935/","title":"[KEV] CVE-2021-39935: GitLab Community and Enterprise Editions Server-Side Request Forgery (SSRF) Vulnerability","content_text":"GitLab · Community and Enterprise Editions. In CISA KEV since 2026-02-03. ENISA EUVD lists it as exploited. EPSS 36.1% (higher than 98.5% of CVEs). CVSS 7.5 HIGH. ATT&CK: T1190 Exploit Public-Facing Application; T1046 Network Service Discovery. Priority 62.9 of 100.","summary":"GitLab Community and Enterprise Editions Server-Side Request Forgery (SSRF) Vulnerability","date_published":"2026-02-03T00:00:00.000Z","date_modified":"2026-06-17T04:04:27.000Z","tags":["kev","T1190","T1046"],"_patchfirst":{"reason":"kev","priority":62.9,"kev":{"dateAdded":"2026-02-03","ransomware":false},"epss":{"score":0.3614,"percentile":0.98473},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1"},"vendor":"GitLab","product":"Community and Enterprise Editions","techniqueIds":["T1190","T1046"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2023-7028#kev","url":"https://patchfirst.co/cve/CVE-2023-7028/","title":"[KEV] CVE-2023-7028: GitLab Community and Enterprise Editions Improper Access Control Vulnerability","content_text":"GitLab · GitLab CE/EE. In CISA KEV since 2024-05-01. ENISA EUVD lists it as exploited. EPSS 94.5% (higher than 99.85% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1078 Valid Accounts. Priority 69.8 of 100.","summary":"GitLab Community and Enterprise Editions Improper Access Control Vulnerability","date_published":"2024-05-01T00:00:00.000Z","date_modified":"2026-06-17T06:51:54.000Z","tags":["kev","public-exploit","T1190","T1078"],"_patchfirst":{"reason":"kev","priority":69.8,"kev":{"dateAdded":"2024-05-01","ransomware":false},"epss":{"score":0.94458,"percentile":0.99852},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"GitLab","product":"GitLab CE/EE","techniqueIds":["T1190","T1078"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2023-2164","url":"https://patchfirst.co/cve/CVE-2023-2164/","title":"CVE-2023-2164: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab","content_text":"GitLab · GitLab. Not in CISA KEV. EPSS 66.3% (higher than 99.28% of CVEs). CVSS 5.4 MEDIUM. Public exploit code exists. Priority 28.6 of 100.","summary":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab","date_published":"2023-08-01T00:00:00.000Z","date_modified":"2026-08-14T04:10:24.000Z","tags":["public-exploit"],"_patchfirst":{"reason":"published","priority":28.6,"kev":null,"epss":{"score":0.66337,"percentile":0.99279},"cvss":{"score":5.4,"severity":"MEDIUM","version":"3.1"},"vendor":"GitLab","product":"GitLab","techniqueIds":[],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}},{"id":"CVE-2023-2442","url":"https://patchfirst.co/cve/CVE-2023-2442/","title":"CVE-2023-2442: An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.11 before 15.11.7, all versions…","content_text":"GitLab · GitLab. Not in CISA KEV. EPSS 96.1% (higher than 99.88% of CVEs). CVSS 8.7 HIGH. Priority 26.1 of 100.","summary":"An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.11 before 15.11.7, all versions…","date_published":"2023-06-07T00:00:00.000Z","date_modified":"2025-01-07T16:29:51.000Z","tags":[],"_patchfirst":{"reason":"published","priority":26.1,"kev":null,"epss":{"score":0.96058,"percentile":0.99876},"cvss":{"score":8.7,"severity":"HIGH","version":"3.1"},"vendor":"GitLab","product":"GitLab","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2023-0921","url":"https://patchfirst.co/cve/CVE-2023-0921/","title":"CVE-2023-0921: Allocation of Resources Without Limits or Throttling in GitLab","content_text":"GitLab · GitLab. Not in CISA KEV. EPSS 84.4% (higher than 99.7% of CVEs). CVSS 4.3 MEDIUM. Priority 23.0 of 100.","summary":"Allocation of Resources Without Limits or Throttling in GitLab","date_published":"2023-06-06T00:00:00.000Z","date_modified":"2025-01-07T21:51:37.000Z","tags":[],"_patchfirst":{"reason":"published","priority":23,"kev":null,"epss":{"score":0.84438,"percentile":0.997},"cvss":{"score":4.3,"severity":"MEDIUM","version":"3.1"},"vendor":"GitLab","product":"GitLab","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2023-2825","url":"https://patchfirst.co/cve/CVE-2023-2825/","title":"CVE-2023-2825: An issue has been discovered in GitLab CE/EE affecting only version 16.0.0","content_text":"GitLab · GitLab. Not in CISA KEV. EPSS 71.6% (higher than 99.42% of CVEs). CVSS 10.0 CRITICAL. Public exploit code exists. Priority 79.2 of 100.","summary":"An issue has been discovered in GitLab CE/EE affecting only version 16.0.0","date_published":"2023-05-26T00:00:00.000Z","date_modified":"2025-01-15T15:45:18.000Z","tags":["public-exploit"],"_patchfirst":{"reason":"published","priority":79.2,"kev":null,"epss":{"score":0.71641,"percentile":0.99419},"cvss":{"score":10,"severity":"CRITICAL","version":"3.1"},"vendor":"GitLab","product":"GitLab","techniqueIds":[],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}},{"id":"CVE-2023-0050","url":"https://patchfirst.co/cve/CVE-2023-0050/","title":"CVE-2023-0050: An issue has been discovered in GitLab affecting all versions starting from 13.7 before 15.7.8, all versions starting…","content_text":"GitLab · GitLab. Not in CISA KEV. EPSS 92.4% (higher than 99.82% of CVEs). CVSS 8.7 HIGH. Priority 26.1 of 100.","summary":"An issue has been discovered in GitLab affecting all versions starting from 13.7 before 15.7.8, all versions starting…","date_published":"2023-03-09T00:00:00.000Z","date_modified":"2025-02-28T21:28:39.000Z","tags":[],"_patchfirst":{"reason":"published","priority":26.1,"kev":null,"epss":{"score":0.9242,"percentile":0.99824},"cvss":{"score":8.7,"severity":"HIGH","version":"3.1"},"vendor":"GitLab","product":"GitLab","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2022-3573","url":"https://patchfirst.co/cve/CVE-2022-3573/","title":"CVE-2022-3573: An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.4 before 15.5.7, all versions…","content_text":"GitLab · GitLab. Not in CISA KEV. EPSS 0.6% (higher than 49% of CVEs). CVSS 5.4 MEDIUM. Priority 49.7 of 100.","summary":"An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.4 before 15.5.7, all versions…","date_published":"2023-01-12T00:00:00.000Z","date_modified":"2025-04-08T15:15:38.000Z","tags":[],"_patchfirst":{"reason":"published","priority":49.7,"kev":null,"epss":{"score":0.00606,"percentile":0.48975},"cvss":{"score":5.4,"severity":"MEDIUM","version":"3.1"},"vendor":"GitLab","product":"GitLab","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2022-3265","url":"https://patchfirst.co/cve/CVE-2022-3265/","title":"CVE-2022-3265: A cross-site scripting issue has been discovered in GitLab CE/EE affecting all versions prior to 15.3.5, 15.4 prior to…","content_text":"GitLab · GitLab. Not in CISA KEV. EPSS 87.0% (higher than 99.75% of CVEs). CVSS 7.3 HIGH. Priority 25.1 of 100.","summary":"A cross-site scripting issue has been discovered in GitLab CE/EE affecting all versions prior to 15.3.5, 15.4 prior to…","date_published":"2022-11-09T00:00:00.000Z","date_modified":"2025-05-01T19:26:11.000Z","tags":[],"_patchfirst":{"reason":"published","priority":25.1,"kev":null,"epss":{"score":0.86982,"percentile":0.99746},"cvss":{"score":7.3,"severity":"HIGH","version":"3.1"},"vendor":"GitLab","product":"GitLab","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2022-2992","url":"https://patchfirst.co/cve/CVE-2022-2992/","title":"CVE-2022-2992: A vulnerability in GitLab CE/EE affecting all versions from 11.10 prior to 15.1.6, 15.2 to 15.2.4, 15.3 to 15.3.2…","content_text":"GitLab · GitLab. Not in CISA KEV. EPSS 86.2% (higher than 99.73% of CVEs). CVSS 9.9 CRITICAL. Public exploit code exists. Priority 31.9 of 100.","summary":"A vulnerability in GitLab CE/EE affecting all versions from 11.10 prior to 15.1.6, 15.2 to 15.2.4, 15.3 to 15.3.2…","date_published":"2022-10-17T00:00:00.000Z","date_modified":"2025-05-14T14:27:30.000Z","tags":["public-exploit"],"_patchfirst":{"reason":"published","priority":31.9,"kev":null,"epss":{"score":0.86194,"percentile":0.99732},"cvss":{"score":9.9,"severity":"CRITICAL","version":"3.1"},"vendor":"GitLab","product":"GitLab","techniqueIds":[],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}},{"id":"CVE-2022-2884","url":"https://patchfirst.co/cve/CVE-2022-2884/","title":"CVE-2022-2884: A vulnerability in GitLab CE/EE affecting all versions from 11.3.4 prior to 15.1.5, 15.2 to 15.2.3, 15.3 to 15.3 to…","content_text":"GitLab · GitLab. Not in CISA KEV. EPSS 75.7% (higher than 99.52% of CVEs). CVSS 9.9 CRITICAL. Public exploit code exists. Priority 31.8 of 100.","summary":"A vulnerability in GitLab CE/EE affecting all versions from 11.3.4 prior to 15.1.5, 15.2 to 15.2.3, 15.3 to 15.3 to…","date_published":"2022-10-17T00:00:00.000Z","date_modified":"2025-05-14T14:24:19.000Z","tags":["public-exploit"],"_patchfirst":{"reason":"published","priority":31.8,"kev":null,"epss":{"score":0.75718,"percentile":0.99522},"cvss":{"score":9.9,"severity":"CRITICAL","version":"3.1"},"vendor":"GitLab","product":"GitLab","techniqueIds":[],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}},{"id":"CVE-2022-2185","url":"https://patchfirst.co/cve/CVE-2022-2185/","title":"CVE-2022-2185: A critical issue has been discovered in GitLab affecting all versions starting from 14.0 prior to 14.10.5, 15.0 prior…","content_text":"GitLab · GitLab. Not in CISA KEV. EPSS 76.6% (higher than 99.54% of CVEs). CVSS 9.9 CRITICAL. Public exploit code exists. Priority 31.8 of 100.","summary":"A critical issue has been discovered in GitLab affecting all versions starting from 14.0 prior to 14.10.5, 15.0 prior…","date_published":"2022-07-01T00:00:00.000Z","date_modified":"2024-08-03T00:32:08.000Z","tags":["public-exploit"],"_patchfirst":{"reason":"published","priority":31.8,"kev":null,"epss":{"score":0.7665,"percentile":0.99544},"cvss":{"score":9.9,"severity":"CRITICAL","version":"3.1"},"vendor":"GitLab","product":"GitLab","techniqueIds":[],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}},{"id":"CVE-2022-2230","url":"https://patchfirst.co/cve/CVE-2022-2230/","title":"CVE-2022-2230: A Stored Cross-Site Scripting vulnerability in the project settings page in GitLab CE/EE affecting all versions from…","content_text":"GitLab · GitLab. Not in CISA KEV. EPSS 58.2% (higher than 99.09% of CVEs). CVSS 8.1 HIGH. Priority 25.5 of 100.","summary":"A Stored Cross-Site Scripting vulnerability in the project settings page in GitLab CE/EE affecting all versions from…","date_published":"2022-07-01T00:00:00.000Z","date_modified":"2024-08-03T00:32:09.000Z","tags":[],"_patchfirst":{"reason":"published","priority":25.5,"kev":null,"epss":{"score":0.58219,"percentile":0.99092},"cvss":{"score":8.1,"severity":"HIGH","version":"3.1"},"vendor":"GitLab","product":"GitLab","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2022-1162","url":"https://patchfirst.co/cve/CVE-2022-1162/","title":"CVE-2022-1162: A hardcoded password was set for accounts registered using an OmniAuth provider (e.g. OAuth, LDAP, SAML) in GitLab…","content_text":"GitLab · GitLab. Not in CISA KEV. EPSS 75.6% (higher than 99.52% of CVEs). CVSS 9.1 CRITICAL. Public exploit code exists. Priority 32.4 of 100.","summary":"A hardcoded password was set for accounts registered using an OmniAuth provider (e.g. OAuth, LDAP, SAML) in GitLab…","date_published":"2022-04-04T00:00:00.000Z","date_modified":"2024-08-02T23:55:24.000Z","tags":["public-exploit"],"_patchfirst":{"reason":"published","priority":32.4,"kev":null,"epss":{"score":0.75637,"percentile":0.9952},"cvss":{"score":9.1,"severity":"CRITICAL","version":"3.1"},"vendor":"GitLab","product":"GitLab","techniqueIds":[],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}},{"id":"CVE-2022-1175","url":"https://patchfirst.co/cve/CVE-2022-1175/","title":"CVE-2022-1175: Improper neutralization of user input in GitLab CE/EE versions 14.4 before 14.7.7, all versions starting from 14.8…","content_text":"GitLab · GitLab. Not in CISA KEV. EPSS 82.0% (higher than 99.65% of CVEs). CVSS 8.7 HIGH. Public exploit code exists. Priority 31.7 of 100.","summary":"Improper neutralization of user input in GitLab CE/EE versions 14.4 before 14.7.7, all versions starting from 14.8…","date_published":"2022-04-04T00:00:00.000Z","date_modified":"2024-08-02T23:55:24.000Z","tags":["public-exploit"],"_patchfirst":{"reason":"published","priority":31.7,"kev":null,"epss":{"score":0.82003,"percentile":0.99651},"cvss":{"score":8.7,"severity":"HIGH","version":"3.1"},"vendor":"GitLab","product":"GitLab","techniqueIds":[],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}},{"id":"CVE-2022-1190","url":"https://patchfirst.co/cve/CVE-2022-1190/","title":"CVE-2022-1190: Improper handling of user input in GitLab CE/EE versions 8.3 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to…","content_text":"GitLab · GitLab. Not in CISA KEV. EPSS 87.9% (higher than 99.76% of CVEs). CVSS 8.7 HIGH. Priority 26.7 of 100.","summary":"Improper handling of user input in GitLab CE/EE versions 8.3 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to…","date_published":"2022-04-04T00:00:00.000Z","date_modified":"2024-08-02T23:55:24.000Z","tags":[],"_patchfirst":{"reason":"published","priority":26.7,"kev":null,"epss":{"score":0.87946,"percentile":0.99763},"cvss":{"score":8.7,"severity":"HIGH","version":"3.1"},"vendor":"GitLab","product":"GitLab","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2021-4191","url":"https://patchfirst.co/cve/CVE-2021-4191/","title":"CVE-2021-4191: An issue has been discovered in GitLab CE/EE affecting versions 13.0 to 14.6.5, 14.7 to 14.7.4, and 14.8 to 14.8.2","content_text":"GitLab · GitLab. Not in CISA KEV. EPSS 80.0% (higher than 99.61% of CVEs). CVSS 5.3 MEDIUM. Public exploit code exists. Priority 65.0 of 100.","summary":"An issue has been discovered in GitLab CE/EE affecting versions 13.0 to 14.6.5, 14.7 to 14.7.4, and 14.8 to 14.8.2","date_published":"2022-03-28T00:00:00.000Z","date_modified":"2024-08-03T17:16:04.000Z","tags":["public-exploit"],"_patchfirst":{"reason":"published","priority":65,"kev":null,"epss":{"score":0.80004,"percentile":0.99613},"cvss":{"score":5.3,"severity":"MEDIUM","version":"3.1"},"vendor":"GitLab","product":"GitLab","techniqueIds":[],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}},{"id":"CVE-2021-39906","url":"https://patchfirst.co/cve/CVE-2021-39906/","title":"CVE-2021-39906: Improper validation of ipynb files in GitLab CE/EE version 13.5 and above allows an attacker to execute arbitrary…","content_text":"GitLab · GitLab. Not in CISA KEV. EPSS 60.7% (higher than 99.15% of CVEs). CVSS 8.7 HIGH. Priority 25.9 of 100.","summary":"Improper validation of ipynb files in GitLab CE/EE version 13.5 and above allows an attacker to execute arbitrary…","date_published":"2021-11-04T00:00:00.000Z","date_modified":"2024-08-04T02:20:33.000Z","tags":[],"_patchfirst":{"reason":"published","priority":25.9,"kev":null,"epss":{"score":0.60729,"percentile":0.99147},"cvss":{"score":8.7,"severity":"HIGH","version":"3.1"},"vendor":"GitLab","product":"GitLab","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2021-22205#kev","url":"https://patchfirst.co/cve/CVE-2021-22205/","title":"[KEV] CVE-2021-22205: GitLab Community and Enterprise Editions Remote Code Execution Vulnerability","content_text":"GitLab · Community and Enterprise Editions. In CISA KEV since 2021-11-03, known ransomware use. ENISA EUVD lists it as exploited. EPSS 99.7% (higher than 99.95% of CVEs). CVSS 10.0 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter; T1498 Network Denial of Service; T1496 Resource Hijacking. Priority 80.0 of 100.","summary":"GitLab Community and Enterprise Editions Remote Code Execution Vulnerability","date_published":"2021-11-03T00:00:00.000Z","date_modified":"2026-08-06T05:16:35.000Z","tags":["kev","ransomware","public-exploit","T1190","T1059","T1498","T1496"],"_patchfirst":{"reason":"kev","priority":80,"kev":{"dateAdded":"2021-11-03","ransomware":true},"epss":{"score":0.99731,"percentile":0.99953},"cvss":{"score":10,"severity":"CRITICAL","version":"3.1"},"vendor":"GitLab","product":"Community and Enterprise Editions","techniqueIds":["T1190","T1059","T1498","T1496"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2021-22242","url":"https://patchfirst.co/cve/CVE-2021-22242/","title":"CVE-2021-22242: Insufficient input sanitization in Mermaid markdown in GitLab CE/EE version 11.4 and up allows an attacker to exploit…","content_text":"GitLab · GitLab. Not in CISA KEV. EPSS 63.6% (higher than 99.21% of CVEs). CVSS 8.7 HIGH. Priority 25.9 of 100.","summary":"Insufficient input sanitization in Mermaid markdown in GitLab CE/EE version 11.4 and up allows an attacker to exploit…","date_published":"2021-08-25T00:00:00.000Z","date_modified":"2024-08-03T18:37:18.000Z","tags":[],"_patchfirst":{"reason":"published","priority":25.9,"kev":null,"epss":{"score":0.63555,"percentile":0.99211},"cvss":{"score":8.7,"severity":"HIGH","version":"3.1"},"vendor":"GitLab","product":"GitLab","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2021-22238","url":"https://patchfirst.co/cve/CVE-2021-22238/","title":"CVE-2021-22238: An issue has been discovered in GitLab affecting all versions starting with 13.3","content_text":"GitLab · GitLab. Not in CISA KEV. EPSS 71.8% (higher than 99.42% of CVEs). CVSS 6.8 MEDIUM. Priority 24.6 of 100.","summary":"An issue has been discovered in GitLab affecting all versions starting with 13.3","date_published":"2021-08-20T00:00:00.000Z","date_modified":"2024-08-03T18:37:18.000Z","tags":[],"_patchfirst":{"reason":"published","priority":24.6,"kev":null,"epss":{"score":0.71787,"percentile":0.99424},"cvss":{"score":6.8,"severity":"MEDIUM","version":"3.1"},"vendor":"GitLab","product":"GitLab","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2021-22214","url":"https://patchfirst.co/cve/CVE-2021-22214/","title":"CVE-2021-22214: When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab…","content_text":"GitLab · GitLab. Not in CISA KEV. EPSS 27.8% (higher than 98.1% of CVEs). CVSS 6.8 MEDIUM. Public exploit code exists. Priority 64.4 of 100.","summary":"When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab…","date_published":"2021-06-08T00:00:00.000Z","date_modified":"2024-08-03T18:37:18.000Z","tags":["public-exploit"],"_patchfirst":{"reason":"published","priority":64.4,"kev":null,"epss":{"score":0.27806,"percentile":0.98091},"cvss":{"score":6.8,"severity":"MEDIUM","version":"3.1"},"vendor":"GitLab","product":"GitLab","techniqueIds":[],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}},{"id":"CVE-2020-13340","url":"https://patchfirst.co/cve/CVE-2020-13340/","title":"CVE-2020-13340: An issue has been discovered in GitLab affecting all versions prior to 13.2.10, 13.3.7 and 13.4.2: Stored XSS in CI…","content_text":"GitLab · GitLab. Not in CISA KEV. EPSS 66.7% (higher than 99.29% of CVEs). CVSS 8.7 HIGH. Priority 25.9 of 100.","summary":"An issue has been discovered in GitLab affecting all versions prior to 13.2.10, 13.3.7 and 13.4.2: Stored XSS in CI…","date_published":"2020-10-08T00:00:00.000Z","date_modified":"2024-08-04T12:18:17.000Z","tags":[],"_patchfirst":{"reason":"published","priority":25.9,"kev":null,"epss":{"score":0.66748,"percentile":0.99289},"cvss":{"score":8.7,"severity":"HIGH","version":"3.1"},"vendor":"GitLab","product":"GitLab","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}}]}