LIVE · cybersecurity feed
Live wire
ASOS Breach Reveals the Risks in Customer-Facing SaaSUnpatched AhsayCBS flaws exploited to deploy webshells, mine cryptoAI Training Critical as Governance Challenges GrowUS Disrupts Chinese State-Sponsored Hacking ToolsCitrix warns admins to patch new NetScaler RCE flaw immediatelyCisco Patches a Dozen Critical VulnerabilitiesCisco warns of critical flaws allowing Nexus switch takeoverCVE-2026-21589 · Exploitation attempts against critical Atlassian flaw have begun (CVE-2026-21589)Cyber experts call on CISA to create mandatory federal OT rulesGremlin Foresight AI finds system weaknesses and verifies the fixes
vendor

Gitlab

44 CVEs published in the last four months and 12 stories. Exploited flaws first.

Critical1
High32
Medium9
Exploited (KEV)0

All recent CVEs

CVECVSSSeverityProductSummaryPublished
CVE-2026-194789.4criticalgitlabGitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.11, 19.0 before 19.0.64d ago
CVE-2026-152178.7highgitlabGitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 19.0.6, 19.1 before 19.1.4,69d ago
CVE-2026-152168.7highgitlabGitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 19.0.6, 19.1 before 19.1.4,69d ago
CVE-2026-68968.7highgitlabGitLab has remediated an issue in GitLab EE affecting all versions from 13.11 before 18.11.7, 19.0 before 19.0.4, a104d ago
CVE-2026-10908.7highgitlabGitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.6 before 18.7.6, 18.8 before 18.8.6, 223d ago
CVE-2026-73778.7highgitlabGitLab has remediated an issue in GitLab EE affecting all versions from 18.7 before 18.9.7, 18.10 before 18.10.6, a160d ago
CVE-2026-60738.7highgitlabGitLab has remediated an issue in GitLab EE affecting all versions from 18.7 before 18.9.7, 18.10 before 18.10.6, a160d ago
CVE-2026-100868.7highgitlabGitLab has remediated an issue in GitLab EE affecting all versions from 16.4 before 18.11.6, 19.0 before 19.0.3, a118d ago
CVE-2026-100878.7highgitlabGitLab has remediated an issue in GitLab EE affecting all versions from 17.1 before 18.10.8, 18.11 before 18.11.5,131d ago
CVE-2026-74818.7highgitlabGitLab has remediated an issue in GitLab EE affecting all versions from 16.4 before 18.9.7, 18.10 before 18.10.6, a160d ago
CVE-2026-120538.6highgitlabGitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.1 that under certain cond118d ago
CVE-2026-154238.5highgitlabGitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.0 before 19.0.6, 19.1 before 19.1.4,69d ago
CVE-2026-62678.5highgitlabGitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.1.0 before 19.0.5, 19.1 before 19.1.383d ago
CVE-2026-192288.5highgitlabGitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.4 and 19.2 before 19.2.2 69d ago
CVE-2026-100538.5highgitlabGitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.8 before 19.0.6, 19.1 before 19.1.4,58d ago
CVE-2026-124368.4highgitlabGitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.0 before 19.0.5, 19.1 before 19.1.3,83d ago
CVE-2026-758718.2highgitlabGitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all versions of the AI Gateway 54d ago
CVE-2026-48688.2highgitlabGitLab has remediated an issue in GitLab EE affecting all versions from 18.8 before 18.10.7, 18.11 before 18.11.4, 146d ago
CVE-2026-107128highgitlabGitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.10 before 18.11.6, 19.0 before 19.0.118d ago
CVE-2026-166277.7highgitlabGitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.2 that under certain c69d ago
CVE-2025-139297.5highgitlabGitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.0 before 18.7.6, 18.8 before 18.8.6,223d ago
CVE-2025-148707.5highgitlabGitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.5 before 18.9.7, 18.10 before 18.10.160d ago
CVE-2025-148697.5highgitlabGitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.5 before 18.9.7, 18.10 before 18.10.160d ago
CVE-2026-72507.5highgitlabGitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.10 before 18.10.8, 18.11 before 18.11131d ago
CVE-2026-10697.5highgitlabGitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.9 before 18.9.2 that could have allow223d ago
CVE-2026-159757.5highgitlabGitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.8 before 19.0.5, 19.1 before 19.1.3,83d ago
CVE-2026-16597.5highgitlabGitLab has remediated an issue in GitLab CE/EE affecting all versions from 9.0 before 18.9.7, 18.10 before 18.10.6,160d ago
CVE-2025-145137.5highgitlabGitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.11 before 18.7.6, 18.8 before 18.8.6223d ago
CVE-2026-133207.3highgitlabGitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.7 before 18.11.7, 19.0 before 19.0.4104d ago
CVE-2026-182527.3highgitlabGitLab has remediated an issue in GitLab EE affecting all versions from 18.9 before 19.1.7, 19.2 before 19.2.5, an55d ago
CVE-2026-85897.3highgitlabGitLab has remediated an issue in GitLab EE affecting all versions from 13.1.4 before 18.10.8, 18.11 before 18.11.5131d ago
CVE-2026-164947.1highgitlabGitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.4 and 19.2 before 19.2.2 69d ago
CVE-2026-196507.1highgitlabGitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.11, 19.0 before 19.0.64d ago
CVE-2025-136906.5mediumgitlabGitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.11 before 18.7.6, 18.8 before 18.8.6223d ago
CVE-2025-125766.5mediumgitlabGitLab has remediated an issue in GitLab CE/EE affecting all versions from 9.3 before 18.7.6, 18.8 before 18.8.6, 223d ago
CVE-2026-38485mediumgitlabGitLab has remediated an issue in GitLab CE/EE affecting all versions from 8.11 before 18.7.6, 18.8 before 18.8.6, 223d ago
CVE-2026-06024.3mediumgitlabGitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.6 before 18.7.6, 18.8 before 18.8.6, 223d ago
CVE-2026-11824.3mediumgitlabGitLab has remediated an issue in GitLab CE/EE affecting all versions from 8.14 before 18.7.6, 18.8 before 18.8.6, 223d ago
CVE-2026-17324.3mediumgitlabGitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.6 before 18.7.6, 18.8 before 18.8.6, 223d ago
CVE-2025-125554.3mediumgitlabGitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.1 before 18.7.6, 18.8 before 18.8.6,223d ago
CVE-2026-16634.3mediumgitlabGitLab has remediated an issue in GitLab CE/EE affecting all versions from 14.4 before 18.7.6, 18.8 before 18.8.6, 223d ago
CVE-2026-12304.1mediumgitlabGitLab has remediated an issue in GitLab CE/EE affecting all versions from 1.0 before 18.7.6, 18.8 before 18.8.6, a223d ago
CVE-2025-127043.5lowgitlabGitLab has remediated an issue in GitLab EE affecting all versions from 18.2 before 18.7.6, 18.8 before 18.8.6, an223d ago
CVE-2025-126972.2lowgitlabGitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.5 before 18.7.6, 18.8 before 18.8.6,223d ago

Filter the full tracker by Gitlab →

Our coverage of Gitlab

CVE-2026-90970critical

CVE-2026-90970: Critical GitLab AI Gateway Flaw Fixed

GitLab has released patches for a critical vulnerability in its AI Gateway, identified as CVE-2026-90970, which could enable an authenticated user to execute arbitrary commands on self-hosted gateway instances. The flaw, which carries a CVSS score of 9.9, was publicly disclosed by GitLab on October 2, 2026.

vulnerabilitycritical

GitLab Patches Critical 9.9 AI Gateway Flaw Allowing Command Execution on Self-Hosted Servers

GitLab has issued a patch for a critical vulnerability in its AI Gateway, which could allow a logged-in user to execute arbitrary commands on self-hosted gateway instances. The flaw, rated 9.9 on the CVSS scale, specifically affects organizations that host their own AI Gateway and have configured it to use Duo Agent Platform access.

vulnerabilitycritical

GitLab warns of critical RCE vulnerability in AI Gateway service

GitLab has issued an urgent warning to customers regarding a critical remote code execution (RCE) vulnerability, identified as CVE-2026-90970, affecting its AI Gateway service. The flaw could allow attackers to execute arbitrary commands on vulnerable self-hosted instances.

CVE-2026-85706

Maximum Severity GitLab Flaw Puts Supply Chains at Risk

A critical path traversal vulnerability, identified as CVE-2026-85706, has been reported in GitLab, impacting both its Community Edition (CE) and Enterprise Edition (EE) instances. The flaw carries a maximum CVSS score of 10.0, indicating its severe potential for exploitation and the significant risk it poses.

vulnerability

Hackers Exploit Maximum Severity Flaw in GitLab

GitLab has urged users to patch a critical vulnerability, identified as CVE-2026-85706, following reports of active exploitation. The flaw, described as an "improper limitation of a pathname to a restricted directory" or "path traversal," affects all versions of GitLab CE/EE from 18.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2.

CVE-2026-85706

GitLab CVE-2026-85706: One HTTP Request, No Authentication, Full File Read – Exploited Within 24 Hours

GitLab has confirmed that a critical path traversal vulnerability, identified as CVE-2026-85706, is being actively exploited in the wild, with initial probes detected within 24 hours of its public disclosure. The flaw, which carries a CVSS score of 10.0, affects the repository commits API in GitLab Community Edition and Enterprise Edition.

CVE-2026-85706critical

Critical GitLab Vulnerability Exploited in Internet-Wide Probes

GitLab has released emergency patches for two high-severity vulnerabilities in its software development platform, one of which carries the maximum possible severity score and is already being actively probed by attackers across the internet. The company urged operators of self-managed installations to upgrade immediately, while confirming its own hosted service and single-tenant Dedicated…

CVE-2026-19478high

⚡ Weekly Recap: AI-Powered PLC Attacks, GitLab Attacks, Stripe Key Leaks and More

This week's cybersecurity reporting highlights several significant threats, including the emergence of AI-powered attacks against industrial control systems (ICS), active exploitation of a critical vulnerability in GitLab, and the discovery of trojanized npm packages distributing a sophisticated Linux backdoor. Further reports detailed a novel method for exploiting expired credit cards in…

CVE-2026-19478critical

GitLab Critical GraphQL Flaw Actively Exploited

GitLab has confirmed that a critical vulnerability in its GraphQL API, identified as CVE-2026-19478, is being actively exploited in the wild. The flaw, which carries a CVSS score of 9.4, allows unauthenticated attackers to remotely modify or delete public projects and associated user data on self-managed GitLab instances.

gitlab

GitLab 19.3 helps enterprises scale agentic development securely

GitLab has released version 19.3 of its platform, introducing updates designed to enhance control and security for enterprises adopting agentic software development. Key features include the integration of the GitLab Duo Agent Platform into GitLab Dedicated environments, a new Secrets Manager, and tools for bulk SAST vulnerability remediation.

CVE-2026-19478critical

GitLab Code Injection Vulnerability Actively Exploited

A critical code injection vulnerability in GitLab, tracked as CVE-2026-19478, is reportedly being actively exploited in the wild. The flaw was publicly disclosed recently, and exploitation attempts have been observed shortly thereafter. This vulnerability allows unauthenticated attackers to manipulate or remove public projects and their associated data, though specific conditions must be met…

CVE-2026-19478critical

Critical GitLab Flaw Exploited Shortly After Disclosure

A critical vulnerability in GitLab, identified as CVE-2026-19478, has reportedly been exploited in the wild shortly after its public disclosure. This flaw is particularly severe as it allows unauthenticated attackers to modify or delete public projects and associated user data within affected GitLab instances. The rapid exploitation highlights the urgency for organizations to address this…