19
CVEs
5
Critical
6
High
1
KEV
12
PoC
2
Unpatched C/H
73.7%
Patch Rate
0.4%
Avg EPSS
Severity Breakdown
CRITICAL
5
HIGH
6
MEDIUM
7
LOW
1
Monthly CVE Trend
Affected Products (30)
Open Redirect
19
Ubuntu
13
Kubernetes
13
Linux Kernel
6
Docker
5
Node.js
5
Jwt Attack
5
Gitea
5
Mattermost
4
Debian Linux
4
Github Branch Source
3
Session Fixation
3
Gitlab Authentication
3
Java
3
Gitlab Shell
3
Gitlab Vscode Extension
2
Runner
2
Gitlab Ai Gateway
2
Gitlab Oauth
2
Gitlab Hook
2
Grafana
2
Teamcity
2
Coolify
2
Redis
2
Violation Comments To Gitlab
2
AI / ML
2
Drawio
1
Oauth2 Proxy
1
Kramdown
1
Communications Cloud Native Core Policy
1
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-85706 | Unauthenticated arbitrary file read in GitLab CE/EE lets remote attackers retrieve files from the GitLab server via the repository commits API, which fails to confine paths and does not enforce authentication. All 18.7 releases through 19.3.2 are affected across the fix lines (before 19.1.8, 19.2.6, and 19.3.2). This is confirmed actively exploited (CISA KEV) and publicly available exploit code exists, making it an emergency-patch priority for any internet-reachable GitLab instance. | CRITICAL | 10.0 | 1.1% | 141 |
KEV
PoC
|
| CVE-2026-87719 | Sensitive credential and configuration disclosure in GitLab Enterprise Edition allows an authenticated user with Duo Chat access to exfiltrate Advanced Search (Elasticsearch) instance configurations and stored credentials by supplying a specially crafted GraphQL subscription argument that bypasses serialization and forces an internal server object lookup. It affects EE 18.3 through 19.1.8, 19.2 through 19.2.6, and 19.3 through 19.3.2, was reported by GitLab, and publicly available exploit code exists (HackerOne #4012289). No CISA KEV listing at time of analysis, so this is POC-backed but not confirmed as actively exploited. | CRITICAL | 9.9 | 0.6% | 70 |
PoC
|
| CVE-2026-75871 | Server-side request forgery in the GitLab AI Gateway (Duo Agent Platform) lets an authenticated user redirect outbound model requests to an attacker-controlled endpoint by supplying a crafted inline flow configuration that overrides the HTTP Host header, exfiltrating Google Cloud Vertex service credentials and private signing keys. It affects AI Gateway 18.10 through 19.0.11, 19.1 through 19.1.6, and 19.2 through 19.2.1. Publicly available exploit code exists (HackerOne #3945100); EPSS is low at 0.19% and it is not in CISA KEV. | CRITICAL | 9.6 | 0.2% | 68 |
PoC
|
| CVE-2026-19478 | Unauthenticated data tampering in GitLab CE/EE (18.2-18.11.10, 19.0-19.0.7, 19.1-19.1.5, 19.2-19.2.3) lets a remote attacker modify or delete public projects and user data by abusing a GraphQL directive, per CVE-2026-19478 (CVSS 9.4). The flaw was self-reported by GitLab and publicly available exploit code exists via a HackerOne disclosure, though it is not listed in CISA KEV. Impact is weighted toward integrity and availability rather than data theft (CVSS C:L/I:H/A:H). | CRITICAL | 9.1 | 0.7% | 66 |
PoC
|
| CVE-2026-10053 | Remote code execution in GitLab CE/EE package registry exposes instances across three active version branches to full host compromise by an authenticated low-privilege user. Path traversal (CWE-22) in the package registry component allows directory escape and arbitrary file write under certain server-side conditions, with CVSS scope change (S:C) confirming that impact extends beyond the GitLab application to the underlying host. A publicly available exploit exists via HackerOne report 3754194, though this vulnerability is not listed in the CISA KEV catalog at time of analysis. | HIGH | 8.8 | 0.7% | 65 |
PoC
|
| CVE-2026-19889 | Server-Side Request Forgery (SSRF) in GitLab AI Gateway allows authenticated users with Duo Agent Platform access to exfiltrate Google Vertex AI or AWS Bedrock cloud service credentials by injecting a malicious endpoint into crafted model metadata, causing the gateway to proxy requests - including cloud credentials - to an attacker-controlled server. All AI Gateway releases from 18.9.0 through 19.2.2 are affected across three version branches; GitLab has confirmed remediation. A public exploit exists per the HackerOne reference, and the CVSS Scope Change metric (S:C) reflects that successful exploitation extends compromise to external cloud infrastructure beyond the GitLab instance itself. | HIGH | 8.2 | 0.2% | 61 |
PoC
|
| CVE-2026-18252 | Arbitrary CI command execution in GitLab Enterprise Edition allows an authenticated developer-role user to run unauthorized commands within a CI pipeline context across all EE versions from 18.9 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1. The root cause is CWE-829 (Inclusion of Functionality from Untrusted Control Sphere): a Claude AI agent integration within GitLab EE processes CI pipeline configuration drawn from a user-controlled source without adequate isolation, enabling instruction injection into the agent's execution context. A public proof-of-concept is confirmed via HackerOne report 3863650, though SSVC and EPSS signals indicate no observed widespread active exploitation at time of analysis. | HIGH | 8.1 | 0.3% | 61 |
PoC
|
| CVE-2026-19650 | GraphQL multiplex query handling in GitLab CE/EE improperly validates request methods, permitting unauthenticated attackers to trigger state-changing mutations via HTTP GET requests, effectively bypassing CSRF protections. All GitLab CE/EE deployments running versions 18.2 through the affected ranges across the 18.x, 19.0, 19.1, and 19.2 release lines are exposed. A publicly available exploit exists via HackerOne disclosure, and successful exploitation allows an attacker to perform arbitrary data-modifying operations on behalf of any authenticated GitLab user who can be lured to a malicious page. | HIGH | 7.1 | 0.2% | 56 |
PoC
|
| CVE-2025-10903 | GitLab Enterprise Edition's SCIM user provisioning feature allows an authenticated low-privileged user to trigger an unbounded loop via specially crafted input, causing denial of service on the affected instance. Versions spanning a wide range from 11.10 through 19.3.0 are affected, with vendor-released patches now available. A publicly available exploit is documented in HackerOne report #3292470; however, this vulnerability is not listed in CISA KEV, indicating active exploitation has not been confirmed at scale. | MEDIUM | 6.5 | 0.4% | 53 |
PoC
|
| CVE-2026-3035 | Improper authorization in GitLab Enterprise Edition allows an authenticated project Maintainer to access the interactive terminal of a protected environment they are explicitly excluded from, bypassing environment-level access controls enforced separately from project roles. Affected versions span a wide range - all EE releases from 11.3 through 19.3.0 - meaning the exposure window is substantial across the enterprise install base. A publicly available exploit exists via a disclosed HackerOne report; no active exploitation (CISA KEV) has been confirmed at time of analysis. | MEDIUM | 5.5 | 0.2% | 48 |
PoC
|
| CVE-2026-88880 | Credential exfiltration in Renovate before 44.11.3 lets a malicious or compromised GitLab server steal the authentication tokens Renovate uses to talk to it. When Renovate follows GitLab API pagination, it trusts the server-supplied Link header without validating its destination, so an attacker-controlled server can redirect the credential-bearing follow-up request to attacker infrastructure (CWE-601 open redirect). Reported by VulnCheck with a CVSS 4.0 base score of 9.2; no public exploit identified at time of analysis and no CISA KEV listing. | CRITICAL | 9.2 | 0.4% | 46 |
|
| CVE-2026-15387 | Improper job dependency handling in GitLab Enterprise Edition's Pipeline Execution Policy enforcement allows an authenticated developer-role user to influence the execution environment of policy enforcement jobs. Affected versions span the 19.1, 19.2, and 19.3 release trains prior to their respective patches. While CVSS rates this a moderate 4.3, a publicly available exploit exists via HackerOne, and the security significance is elevated because Pipeline Execution Policies are a deliberate administrative security control - undermining their enforcement environment erodes a defense-in-depth layer in CI/CD pipelines. No active exploitation has been confirmed (not in CISA KEV). | MEDIUM | 4.3 | 0.2% | 42 |
PoC
|
| CVE-2026-82289 | Server-Side Request Forgery in Gitingest through 0.3.1 allows unauthenticated attackers to redirect outbound server connections to arbitrary attacker-controlled hosts by exploiting a prefix-only hostname validation bypass in the `_validate_host` function. Because Gitingest may carry GitHub personal access tokens as HTTP basic auth credentials on outbound git requests, any host whose name begins with `git.`, `gitlab.`, or `github.` passes validation and becomes a credential harvesting endpoint. No public exploit code is confirmed at time of analysis and no CISA KEV listing exists, but the CVSS 4.0 score of 8.3 reflects the combination of low attack complexity, unauthenticated access, and high confidentiality impact. | HIGH | 8.3 | 0.2% | 42 |
No patch
|
| CVE-2026-77658 | Stack-based buffer overflow in GNOME Dia diagram editor (0.98.0 and earlier) permits stack exhaustion and potential return-address corruption when a victim opens a crafted .dia XML file containing a Bus object with an attacker-controlled bus_handles value and then moves a handle in the diagram. The root cause - an unbounded g_alloca() call driven by an unvalidated file attribute - is also present in objects/Misc/tree.c via Tree objects, widening the attack surface. No public exploit or CISA KEV listing exists at time of analysis, but the GitLab issue provides sufficient technical detail for proof-of-concept development. | HIGH | 7.8 | 0.1% | 39 |
No patch
|
| CVE-2026-7487 | Improper authorization in GitLab Enterprise Edition allows an authenticated reporter-level user who authored a merge request to reset that MR's approval rules, potentially bypassing mandatory code-review controls enforced by administrators. All GitLab EE versions from 13.1 through 19.3.0 are affected, with remediated releases published. A publicly available exploit exists via HackerOne, though the vulnerability is not listed in CISA KEV and the low CVSS score (3.5) reflects the constrained attack conditions requiring authentication and prior MR authorship. | LOW | 3.5 | 0.2% | 38 |
PoC
|