Patchfirst: GitLab vulnerabilitieshttps://patchfirst.co/vendor/gitlab/New and newly exploited GitLab CVEs, with CISA KEV, EPSS and ATT&CK context. Newest 50 by publication or KEV listing.en-gb360Sat, 31 Oct 2026 05:11:25 GMT[KEV] CVE-2026-97229: GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerabilityhttps://patchfirst.co/cve/CVE-2026-97229/CVE-2026-97229#kevThu, 29 Oct 2026 00:00:00 GMTGitLab · Community Edition and Enterprise Edition. In CISA KEV since 2026-10-29. ENISA EUVD lists it as exploited. EPSS 26.6% (higher than 98% of CVEs). CVSS 10.0 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 79.5 of 100.kevpublic-exploitT1190T1059CVE-2026-110264: An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19.0 before 19.0.10…https://patchfirst.co/cve/CVE-2026-110264/CVE-2026-110264Thu, 22 Oct 2026 00:00:00 GMTGitLab · GitLab. Not in CISA KEV. EPSS 1.3% (higher than 70.5% of CVEs). CVSS 10.0 CRITICAL. Public exploit code exists. Priority 28.0 of 100.public-exploitCVE-2026-90970: GitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all versions of the AI Gateway from…https://patchfirst.co/cve/CVE-2026-90970/CVE-2026-90970Fri, 02 Oct 2026 00:00:00 GMTGitLab · GitLab AI Gateway. Not in CISA KEV. EPSS 17.5% (higher than 97.1% of CVEs). CVSS 9.9 CRITICAL. Public exploit code exists. Priority 33.7 of 100.public-exploitCVE-2026-85706: GitLab Community Edition and Enterprise Edition Path Traversal Vulnerabilityhttps://patchfirst.co/cve/CVE-2026-85706/CVE-2026-85706Sat, 12 Sep 2026 00:00:00 GMTGitLab · Community Edition and Enterprise Edition. In CISA KEV since 2026-09-11. ENISA EUVD lists it as exploited. EPSS 97.4% (higher than 99.9% of CVEs). CVSS 10.0 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1005 Data from Local System. Priority 80.0 of 100.kevpublic-exploitT1190T1005CVE-2026-19478: Improper Control of Generation of Code ('Code Injection') in GitLabhttps://patchfirst.co/cve/CVE-2026-19478/CVE-2026-19478Mon, 17 Aug 2026 00:00:00 GMTGitLab · GitLab. Not in CISA KEV. EPSS 2.2% (higher than 82.1% of CVEs). CVSS 9.4 CRITICAL. Public exploit code exists. Priority 75.1 of 100.public-exploit[KEV] CVE-2021-22175: GitLab Server-Side Request Forgery (SSRF) Vulnerabilityhttps://patchfirst.co/cve/CVE-2021-22175/CVE-2021-22175#kevWed, 18 Feb 2026 00:00:00 GMTGitLab · GitLab. In CISA KEV since 2026-02-18. ENISA EUVD lists it as exploited. EPSS 53.4% (higher than 99% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1090 Proxy. Priority 69.7 of 100.kevpublic-exploitT1190T1090[KEV] CVE-2021-39935: GitLab Community and Enterprise Editions Server-Side Request Forgery (SSRF) Vulnerabilityhttps://patchfirst.co/cve/CVE-2021-39935/CVE-2021-39935#kevTue, 03 Feb 2026 00:00:00 GMTGitLab · Community and Enterprise Editions. In CISA KEV since 2026-02-03. ENISA EUVD lists it as exploited. EPSS 36.1% (higher than 98.5% of CVEs). CVSS 7.5 HIGH. ATT&CK: T1190 Exploit Public-Facing Application; T1046 Network Service Discovery. Priority 62.9 of 100.kevT1190T1046[KEV] CVE-2023-7028: GitLab Community and Enterprise Editions Improper Access Control Vulnerabilityhttps://patchfirst.co/cve/CVE-2023-7028/CVE-2023-7028#kevWed, 01 May 2024 00:00:00 GMTGitLab · GitLab CE/EE. In CISA KEV since 2024-05-01. ENISA EUVD lists it as exploited. EPSS 94.5% (higher than 99.85% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1078 Valid Accounts. Priority 69.8 of 100.kevpublic-exploitT1190T1078CVE-2023-2164: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabhttps://patchfirst.co/cve/CVE-2023-2164/CVE-2023-2164Tue, 01 Aug 2023 00:00:00 GMTGitLab · GitLab. Not in CISA KEV. EPSS 66.3% (higher than 99.28% of CVEs). CVSS 5.4 MEDIUM. Public exploit code exists. Priority 28.6 of 100.public-exploitCVE-2023-2442: An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.11 before 15.11.7, all versions…https://patchfirst.co/cve/CVE-2023-2442/CVE-2023-2442Wed, 07 Jun 2023 00:00:00 GMTGitLab · GitLab. Not in CISA KEV. EPSS 96.1% (higher than 99.88% of CVEs). CVSS 8.7 HIGH. Priority 26.1 of 100.CVE-2023-0921: Allocation of Resources Without Limits or Throttling in GitLabhttps://patchfirst.co/cve/CVE-2023-0921/CVE-2023-0921Tue, 06 Jun 2023 00:00:00 GMTGitLab · GitLab. Not in CISA KEV. EPSS 84.4% (higher than 99.7% of CVEs). CVSS 4.3 MEDIUM. Priority 23.0 of 100.CVE-2023-2825: An issue has been discovered in GitLab CE/EE affecting only version 16.0.0https://patchfirst.co/cve/CVE-2023-2825/CVE-2023-2825Fri, 26 May 2023 00:00:00 GMTGitLab · GitLab. Not in CISA KEV. EPSS 71.6% (higher than 99.42% of CVEs). CVSS 10.0 CRITICAL. Public exploit code exists. Priority 79.2 of 100.public-exploitCVE-2023-0050: An issue has been discovered in GitLab affecting all versions starting from 13.7 before 15.7.8, all versions starting…https://patchfirst.co/cve/CVE-2023-0050/CVE-2023-0050Thu, 09 Mar 2023 00:00:00 GMTGitLab · GitLab. Not in CISA KEV. EPSS 92.4% (higher than 99.82% of CVEs). CVSS 8.7 HIGH. Priority 26.1 of 100.CVE-2022-3573: An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.4 before 15.5.7, all versions…https://patchfirst.co/cve/CVE-2022-3573/CVE-2022-3573Thu, 12 Jan 2023 00:00:00 GMTGitLab · GitLab. Not in CISA KEV. EPSS 0.6% (higher than 49% of CVEs). CVSS 5.4 MEDIUM. Priority 49.7 of 100.CVE-2022-3265: A cross-site scripting issue has been discovered in GitLab CE/EE affecting all versions prior to 15.3.5, 15.4 prior to…https://patchfirst.co/cve/CVE-2022-3265/CVE-2022-3265Wed, 09 Nov 2022 00:00:00 GMTGitLab · GitLab. Not in CISA KEV. EPSS 87.0% (higher than 99.75% of CVEs). CVSS 7.3 HIGH. Priority 25.1 of 100.CVE-2022-2992: A vulnerability in GitLab CE/EE affecting all versions from 11.10 prior to 15.1.6, 15.2 to 15.2.4, 15.3 to 15.3.2…https://patchfirst.co/cve/CVE-2022-2992/CVE-2022-2992Mon, 17 Oct 2022 00:00:00 GMTGitLab · GitLab. Not in CISA KEV. EPSS 86.2% (higher than 99.73% of CVEs). CVSS 9.9 CRITICAL. Public exploit code exists. Priority 31.9 of 100.public-exploitCVE-2022-2884: A vulnerability in GitLab CE/EE affecting all versions from 11.3.4 prior to 15.1.5, 15.2 to 15.2.3, 15.3 to 15.3 to…https://patchfirst.co/cve/CVE-2022-2884/CVE-2022-2884Mon, 17 Oct 2022 00:00:00 GMTGitLab · GitLab. Not in CISA KEV. EPSS 75.7% (higher than 99.52% of CVEs). CVSS 9.9 CRITICAL. Public exploit code exists. Priority 31.8 of 100.public-exploitCVE-2022-2185: A critical issue has been discovered in GitLab affecting all versions starting from 14.0 prior to 14.10.5, 15.0 prior…https://patchfirst.co/cve/CVE-2022-2185/CVE-2022-2185Fri, 01 Jul 2022 00:00:00 GMTGitLab · GitLab. Not in CISA KEV. EPSS 76.6% (higher than 99.54% of CVEs). CVSS 9.9 CRITICAL. Public exploit code exists. Priority 31.8 of 100.public-exploitCVE-2022-2230: A Stored Cross-Site Scripting vulnerability in the project settings page in GitLab CE/EE affecting all versions from…https://patchfirst.co/cve/CVE-2022-2230/CVE-2022-2230Fri, 01 Jul 2022 00:00:00 GMTGitLab · GitLab. Not in CISA KEV. EPSS 58.2% (higher than 99.09% of CVEs). CVSS 8.1 HIGH. Priority 25.5 of 100.CVE-2022-1162: A hardcoded password was set for accounts registered using an OmniAuth provider (e.g. OAuth, LDAP, SAML) in GitLab…https://patchfirst.co/cve/CVE-2022-1162/CVE-2022-1162Mon, 04 Apr 2022 00:00:00 GMTGitLab · GitLab. Not in CISA KEV. EPSS 75.6% (higher than 99.52% of CVEs). CVSS 9.1 CRITICAL. Public exploit code exists. Priority 32.4 of 100.public-exploitCVE-2022-1175: Improper neutralization of user input in GitLab CE/EE versions 14.4 before 14.7.7, all versions starting from 14.8…https://patchfirst.co/cve/CVE-2022-1175/CVE-2022-1175Mon, 04 Apr 2022 00:00:00 GMTGitLab · GitLab. Not in CISA KEV. EPSS 82.0% (higher than 99.65% of CVEs). CVSS 8.7 HIGH. Public exploit code exists. Priority 31.7 of 100.public-exploitCVE-2022-1190: Improper handling of user input in GitLab CE/EE versions 8.3 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to…https://patchfirst.co/cve/CVE-2022-1190/CVE-2022-1190Mon, 04 Apr 2022 00:00:00 GMTGitLab · GitLab. Not in CISA KEV. EPSS 87.9% (higher than 99.76% of CVEs). CVSS 8.7 HIGH. Priority 26.7 of 100.CVE-2021-4191: An issue has been discovered in GitLab CE/EE affecting versions 13.0 to 14.6.5, 14.7 to 14.7.4, and 14.8 to 14.8.2https://patchfirst.co/cve/CVE-2021-4191/CVE-2021-4191Mon, 28 Mar 2022 00:00:00 GMTGitLab · GitLab. Not in CISA KEV. EPSS 80.0% (higher than 99.61% of CVEs). CVSS 5.3 MEDIUM. Public exploit code exists. Priority 65.0 of 100.public-exploitCVE-2021-39906: Improper validation of ipynb files in GitLab CE/EE version 13.5 and above allows an attacker to execute arbitrary…https://patchfirst.co/cve/CVE-2021-39906/CVE-2021-39906Thu, 04 Nov 2021 00:00:00 GMTGitLab · GitLab. Not in CISA KEV. EPSS 60.7% (higher than 99.15% of CVEs). CVSS 8.7 HIGH. Priority 25.9 of 100.[KEV] CVE-2021-22205: GitLab Community and Enterprise Editions Remote Code Execution Vulnerabilityhttps://patchfirst.co/cve/CVE-2021-22205/CVE-2021-22205#kevWed, 03 Nov 2021 00:00:00 GMTGitLab · Community and Enterprise Editions. In CISA KEV since 2021-11-03, known ransomware use. ENISA EUVD lists it as exploited. EPSS 99.7% (higher than 99.95% of CVEs). CVSS 10.0 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter; T1498 Network Denial of Service; T1496 Resource Hijacking. Priority 80.0 of 100.kevransomwarepublic-exploitT1190T1059T1498T1496CVE-2021-22242: Insufficient input sanitization in Mermaid markdown in GitLab CE/EE version 11.4 and up allows an attacker to exploit…https://patchfirst.co/cve/CVE-2021-22242/CVE-2021-22242Wed, 25 Aug 2021 00:00:00 GMTGitLab · GitLab. Not in CISA KEV. EPSS 63.6% (higher than 99.21% of CVEs). CVSS 8.7 HIGH. Priority 25.9 of 100.CVE-2021-22238: An issue has been discovered in GitLab affecting all versions starting with 13.3https://patchfirst.co/cve/CVE-2021-22238/CVE-2021-22238Fri, 20 Aug 2021 00:00:00 GMTGitLab · GitLab. Not in CISA KEV. EPSS 71.8% (higher than 99.42% of CVEs). CVSS 6.8 MEDIUM. Priority 24.6 of 100.CVE-2021-22214: When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab…https://patchfirst.co/cve/CVE-2021-22214/CVE-2021-22214Tue, 08 Jun 2021 00:00:00 GMTGitLab · GitLab. Not in CISA KEV. EPSS 27.8% (higher than 98.1% of CVEs). CVSS 6.8 MEDIUM. Public exploit code exists. Priority 64.4 of 100.public-exploitCVE-2020-13340: An issue has been discovered in GitLab affecting all versions prior to 13.2.10, 13.3.7 and 13.4.2: Stored XSS in CI…https://patchfirst.co/cve/CVE-2020-13340/CVE-2020-13340Thu, 08 Oct 2020 00:00:00 GMTGitLab · GitLab. Not in CISA KEV. EPSS 66.7% (higher than 99.29% of CVEs). CVSS 8.7 HIGH. Priority 25.9 of 100.