GitLab vulnerabilities: known CVEs & security history
GitLab · Infrastructure · 194 tracked CVEs · 3 actively exploited · updated October 2026 · what is a CVE? →
This is the full list of known vulnerabilities (CVEs) across all GitLab release lines — 194 in total, with 3 actively exploited in the wild. A CVE here doesn't mean your version is affected — check GitLab's current status and the safe version to run.
Known GitLab CVEs
Actively-exploited and most-severe first. Showing the top 80 of 194. Open any CVE for full details.
| CVE | Severity | CVSS | EPSS | Year |
|---|---|---|---|---|
| CVE-2026-85706⚡ exploited | critical | 10 | 9% | 2026 |
| CVE-2021-22205⚡ exploited | critical | 10 | 100% | 2021 |
| CVE-2021-22175⚡ exploited | medium | 6.8 | 53% | 2021 |
| CVE-2026-97229 | critical | 10 | 1% | 2026 |
| CVE-2026-93577 | critical | 9.9 | — | 2026 |
| CVE-2026-89078 | critical | 9.9 | — | 2026 |
| CVE-2026-87719 | critical | 9.9 | — | 2026 |
| CVE-2026-19478 | critical | 9.4 | 6% | 2026 |
| CVE-2026-92883 | high | 8.7 | 0% | 2026 |
| CVE-2026-84739 | high | 8.7 | 0% | 2026 |
| CVE-2026-15217 | high | 8.7 | 0% | 2026 |
| CVE-2026-15216 | high | 8.7 | 0% | 2026 |
| CVE-2026-6896 | high | 8.7 | 0% | 2026 |
| CVE-2026-10086 | high | 8.7 | 0% | 2026 |
| CVE-2025-9222 | high | 8.7 | 0% | 2026 |
| CVE-2025-12716 | high | 8.7 | 0% | 2025 |
| CVE-2025-9642 | high | 8.7 | 1% | 2025 |
| CVE-2026-12053 | high | 8.6 | 0% | 2026 |
| CVE-2026-16301 | high | 8.5 | 0% | 2026 |
| CVE-2026-79708 | high | 8.5 | — | 2026 |
| CVE-2026-88765 | high | 8.5 | — | 2026 |
| CVE-2026-10053 | high | 8.5 | 1% | 2026 |
| CVE-2026-19228 | high | 8.5 | 0% | 2026 |
| CVE-2026-15423 | high | 8.5 | 0% | 2026 |
| CVE-2026-6267 | high | 8.5 | 0% | 2026 |
| CVE-2026-5173 | high | 8.5 | 0% | 2026 |
| CVE-2025-11702 | high | 8.5 | 1% | 2025 |
| CVE-2025-6454 | high | 8.5 | 1% | 2025 |
| CVE-2026-12436 | high | 8.4 | 0% | 2026 |
| CVE-2026-14814 | high | 8.2 | 0% | 2026 |
| CVE-2026-78252 | high | 8.2 | — | 2026 |
| CVE-2026-75871 | high | 8.2 | 0% | 2026 |
| CVE-2026-4868 | high | 8.2 | 0% | 2026 |
| CVE-2026-2370 | high | 8.1 | 0% | 2026 |
| CVE-2026-10712 | high | 8 | 0% | 2026 |
| CVE-2025-13761 | high | 8 | 1% | 2026 |
| CVE-2025-12029 | high | 8 | 1% | 2025 |
| CVE-2026-81839 | high | 7.7 | 0% | 2026 |
| CVE-2026-92470 | high | 7.7 | — | 2026 |
| CVE-2026-13210 | high | 7.7 | — | 2026 |
| CVE-2026-16627 | high | 7.7 | 0% | 2026 |
| CVE-2025-8405 | high | 7.7 | 1% | 2025 |
| CVE-2024-9183 | high | 7.7 | 0% | 2025 |
| CVE-2025-11340 | high | 7.7 | 0% | 2025 |
| CVE-2025-9958 | high | 7.7 | 1% | 2025 |
| CVE-2026-1168 | high | 7.5 | — | 2026 |
| CVE-2025-14871 | high | 7.5 | 1% | 2026 |
| CVE-2026-15975 | high | 7.5 | 0% | 2026 |
| CVE-2025-14870 | high | 7.5 | 0% | 2026 |
| CVE-2025-14869 | high | 7.5 | 0% | 2026 |
| CVE-2026-1092 | high | 7.5 | 1% | 2026 |
| CVE-2025-12664 | high | 7.5 | 1% | 2026 |
| CVE-2025-12562 | high | 7.5 | 1% | 2025 |
| CVE-2025-12571 | high | 7.5 | 1% | 2025 |
| CVE-2025-11447 | high | 7.5 | 1% | 2025 |
| CVE-2025-10497 | high | 7.5 | 1% | 2025 |
| CVE-2025-10004 | high | 7.5 | 1% | 2025 |
| CVE-2025-8014 | high | 7.5 | 1% | 2025 |
| CVE-2025-10858 | high | 7.5 | 1% | 2025 |
| CVE-2025-2256 | high | 7.5 | 1% | 2025 |
| CVE-2026-96893 | high | 7.3 | 1% | 2026 |
| CVE-2026-18252 | high | 7.3 | 0% | 2026 |
| CVE-2026-13320 | high | 7.3 | 0% | 2026 |
| CVE-2026-19650 | high | 7.1 | 0% | 2026 |
| CVE-2026-16494 | high | 7.1 | 0% | 2026 |
| CVE-2025-13772 | high | 7.1 | 0% | 2026 |
| CVE-2025-11984 | medium | 6.8 | 0% | 2025 |
| CVE-2026-77801 | medium | 6.5 | 0% | 2026 |
| CVE-2025-10903 | medium | 6.5 | 0% | 2026 |
| CVE-2026-13113 | medium | 6.5 | 0% | 2026 |
| CVE-2026-1402 | medium | 6.5 | 0% | 2026 |
| CVE-2025-6016 | medium | 6.5 | 0% | 2026 |
| CVE-2025-3922 | medium | 6.5 | 0% | 2026 |
| CVE-2025-0186 | medium | 6.5 | 0% | 2026 |
| CVE-2026-1101 | medium | 6.5 | 0% | 2026 |
| CVE-2025-4097 | medium | 6.5 | 0% | 2025 |
| CVE-2025-14157 | medium | 6.5 | 0% | 2025 |
| CVE-2025-7449 | medium | 6.5 | 0% | 2025 |
| CVE-2025-12653 | medium | 6.5 | 0% | 2025 |
| CVE-2025-11974 | medium | 6.5 | 0% | 2025 |
114 older / lower-severity CVEs not shown — see GitLab's full record.
Is my GitLab version affected?
The list above spans every release. To know whether your version is affected — and the minimum safe version to upgrade to — check it directly.
Check your GitLab version → · Monitor GitLab for new CVEs →
GitLab vulnerabilities — frequently asked
How many known vulnerabilities does GitLab have?
IsItPatched tracks 194 CVEs for GitLab, 3 of which are actively exploited (CISA KEV). 7 are critical-severity and 58 high-severity. These span every release line — what matters is whether the version you run is affected.
Does GitLab have any actively-exploited vulnerabilities?
Yes — 3 GitLab CVEs are in CISA's Known Exploited Vulnerabilities catalog, meaning they are confirmed exploited in the wild (1 linked to ransomware). Patch these as a priority.
What is the most severe GitLab vulnerability?
Among tracked issues, CVE-2026-85706 (CRITICAL, CVSS 10), which is actively exploited, ranks highest — a Path traversal weakness.
Is GitLab safe to use?
It depends on the version. The latest supported GitLab release (19.5.1) clears the known issues; older versions may still be affected. Check the exact version you run for a verdict.
CVE data aggregated from NVD, CISA KEV and EPSS (FIRST.org). Related: GitLab security status · GitLab end-of-life · actively-exploited CVEs. Always verify against GitLab's advisories — see our disclaimer.