2026 (4)
| N° | CVE | Severity | Description | Links |
|---|---|---|---|---|
| 39 | CVE-2026-16301 |  |
Improper Authorization issue in downstream pipeline creation service impacts GitLab CE/EE | GitLab Patch Release 19.4.2 · NVD |
| 38 | CVE-2026-15423 | |
Improper Authorization issue in CI/CD pipeline API impacts GitLab CE/EE | GitLab Patch Release 19.2.2 · NVD |
| 37 | CVE-2026-1101 |  |
Denial of Service issue in GitLab EE GraphQL SBOM API | GitLab Patch Release 18.10.3 · Advisory GHSA-ffch-rw3v-4mvx · NVD |
| 36 | CVE-2026-1388 | |
Regular Expression Denial of Service issue in GitLab merge requests | GitLab Patch Release 18.9.1 · Advisory GHSA-35pf-5r93-c5jc · NVD |
2025 (7)
| N° | CVE | Severity | Description | Links |
|---|---|---|---|---|
| 35 | CVE-2025-12576 | |
Denial of Service issue in GitLab EE webhook endpoint | GitLab Patch Release 18.9.2 · NVD |
| 34 | CVE-2025-13690 | |
Denial of Service issue in GitLab EE webhook custom headers | GitLab Patch Release 18.9.2 · Advisory GHSA-mgcq-rqq2-gc5f · NVD |
| 33 | CVE-2025-13335 | |
Crafted wiki file may lead to endless server-side redirections in GitLab EE | BleepingComputer · GitLab Patch Release 18.8.2 |
| 32 | CVE-2025-0673 | |
An attacker can trigger an infinite redirect loop, leading to a denial of service condition in GitLab EE | BleepingComputer · GitLab Patch Release 18.0.2 |
| 31 | GHSA-6p2v-wcv8-8j6w |  |
Arbitrary File Read by Copy as a Curl command in Caido Plugin Exploit Generator | Advisory GHSA-6p2v-wcv8-8j6w |
| 30 | CVE-2025-0549 | |
Partial Bypass for Device OAuth flow using Cross Window Forgery in GitLab EE | GitLab Patch Release 17.11.2 |
| 29 | CVE-2025-31116 | |
SSRF on assetlinks_check with DNS Rebinding in MobSF | Advisory GHSA-fcfq-m8p6-gw56 · GitLab · NVD |
2024 (13)
| N° | CVE | Severity | Description | Links |
|---|---|---|---|---|
| 28 | CVE-2024-13054 | |
Denial of Service Due to Inefficient Processing of Untrusted Input in GitLab EE | GitLab Patch Release 17.9.2 · NVD |
| 27 | CVE-2024-12379 | |
Denial of Service due to Unbounded Symbol Creation via the scopes parameter in a Personal Access Token in GitLab EE | GitLab Patch Release 17.8.2 · NVD |
| 26 | CVE-2024-47830 | |
Server side request forgery via /_next/image endpoint in Plane | Advisory GHSA-39gx-38xf-c348 · NVD · Anquanke (Chinese) |
| 25 | CVE-2024-8124 | |
Denial of Service via sending a large glm_source parameter in GitLab EE | GitLab Critical Patch Release 17.3.2 · NVD · GitLab Issue 480533 |
| 24 | CVE-2024-45412 | |
Potential Denial of Service due to the One Million Unicode Characters attack in Yeti Platform | Advisory GHSA-cwwm-pq9x-2cxv · NVD |
| 23 | CVE-2024-35231 | |
Denial of Service due to the unconstrained value of the incoming "profiler_runs" parameter in Rack::Contrib | Advisory GHSA-8c8q-2xw3-j869 · NVD |
| 22 | CVE-2024-1211 | |
Require confirmation before linking JWT identity in GitLab EE | GitLab Patch Release 16.11.2 · NVD |
| 21 | GHSA-9gw7-hxgx-f6rv | |
Malicious Long Unicode filenames may cause an Application-level Denial of Service in FAME (Cert SG) | Advisory GHSA-9gw7-hxgx-f6rv |
| 20 | CVE-2024-32874 | |
Malicious Long Unicode filenames may cause Multiple Application-level Denial of Service in Frigate | Advisory GHSA-w4h6-9wrp-v5jq · NVD |
| 19 | CVE-2024-0081 | |
Unicode use in a user-controlled filename may cause a server-side DoS in NVIDIA NeMo | Advisory GHSA-x392-p65g-4rxx · NVD · NVIDIA Acknowledgements |
| 18 | CVE-2024-24759 | |
Bypass SSRF Protection with DNS Rebinding in MindsDB | Advisory GHSA-4jcv-vp96-94xr · GitLab · NVD |
| 17 | CVE-2024-23826 | |
Uploading an image with a specific filename causes a server-side DoS in SPbU SE Site | Advisory GHSA-5vfc-v7hg-pvwm · NVD |
| 16 | CVE-2024-21623 | |
Arbitrary Expression Injection in GitHub workflow leads to Command execution & leaking secrets in OTClient | Advisory GHSA-q6gr-wc79-v589 · NVD · Offensive360 |
2023 (11)
| N° | CVE | Severity | Description | Links |
|---|---|---|---|---|
| 15 | CVE-2023-52081 |  |
Late-Unicode normalization vulnerability in ffcss | Advisory GHSA-wpmx-564x-h2mh · NVD |
| 14 | CVE-2023-41889 | |
Late-Unicode normalization vulnerability in Shirasagi | Advisory GHSA-xr45-c2jv-2v9r · NVD |
| 13 | CVE-2023-42183 | |
A Post-Unicode Normalization Vulnerability in LOCKSS | Advisory GHSA-mgqj-hphf-9588 · NVD · CVE.org |
| 12 | GHSA-373w-rj84-pv6x | |
Hostname blocklist does not block FQDNs in safeurl-python | Advisory GHSA-373w-rj84-pv6x · GitLab |
| 11 | CVE-2023-35932 | |
Configuration Injection due to unsanitized user input in jcvi | Advisory GHSA-x49m-3cw7-gq5q · NVD · CVE.org |
| 10 | CVE-2023-31131 | |
Arbitrary File Write (path traversal) when extracting tar files within GPPKGs in Greenplum DB | Advisory GHSA-hgm9-2q42-c7f3 · NVD |
| 9 | CVE-2023-30620 | |
Arbitrary File Write when Extracting a Remotely retrieved Tarball using Tarfile.extractall() in MindsDB |
Advisory GHSA-2g5w-29q9-w6hx · NVD · Snyk |
| 8 | CVE-2022-23522 | |
Arbitrary File Write when Extracting Tarballs using shutil.unpack_archive() in MindsDB |
Advisory GHSA-7x45-phmr-9wqp · NVD · CVE.org |
| 7 | CVE-2023-25803 | |
Directory Traversal vulnerability leading to inclusion of server-side files in Roxy-WI | Advisory GHSA-cv9w-j9gh-5j3w · NVD · CVE.org |
| 6 | CVE-2023-25802 | |
Path Traversal via unneutralized dir/../filename sequences in Roxy-WI |
Advisory GHSA-qcmp-q5h3-784m · NVD |
| 5 | CVE-2023-25804 | |
Limited Path Traversal in name parameter in Roxy-WI | Advisory GHSA-69j6-crq8-rrhv · NVD · CVE.org |
2022 (4)
| N° | CVE | Severity | Description | Links |
|---|---|---|---|---|
| 4 | huntr-309725a2 | |
Potential TarSlip (CWE-59 Link Following) when extracting a remote archive without checksum verification in scikit-learn | SecurityLab |
| 3 | CVE-2022-23530 | |
GuardDog vulnerable to arbitrary file write when scanning a specially-crafted remote PyPI package | Advisory GHSA-78m5-jpmf-ch7v · SecurityLab · GitLab · NVD · Snyk · PyPI |
| 2 | CVE-2022-3607 | |
ZipSlip Symlink variant allows to read any file within OctoPrint Box | Advisory GHSA-rj5f-vm79-5j84 · NVD |
| 1 | CVE-2022-1993 | |
Path Traversal vulnerability on the endpoint '/info/refs' in Gogs | Advisory GHSA-6vcc-v9vw-g2x5 · Gogs Changelog · NVD |
Reach out for a security code review — DM me on X (Twitter).