GitLab Security Advisories & CVEs

81 advisories tracked · GitLab (cve@gitlab.com CNA) via NVD · direct feeds checked every minute; rate-limited backstops use a safe source cadence

Android app · Google Play

Monitor GitLab CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.

Get CVE alerts See app features

Check if your GitLab device is affected

Pick your product and enter the exact software release it runs. We match it against the affected/fixed versions in GitLab's recent advisories.

Official source

GitLab (cve@gitlab.com CNA) via NVD

GitLab is its own CVE Numbering Authority and publishes prolifically — it ships coordinated security releases roughly every month, so VulniPulse ingests GitLab's CVEs from the NVD CNA feed (cve@gitlab.com), a high-volume, authoritative source where each record names the affected CE/EE version range. Covers GitLab Community Edition and Enterprise Edition (self-managed), plus GitLab Runner and Pages — self-hosted DevOps platforms that are a repeated RCE / auth-bypass target, so a patch-now audience.

Visit GitLab security advisories GitLab RSS feed GitLab end-of-life dates(1 product family)

Latest GitLab advisories

All severities critical high medium low

All platforms GitLab CE / EE GitLab Runner GitLab Pages

Medium5.4GitLab

Medium [CVE-2023-2164] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

An issue has been discovered in GitLab affecting all versions starting from 15.9 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. It was possible for an attacker to trigger a stored XSS vulnerability via user interaction with a crafted URL in the WebIDE beta.