CVE-2021-22175Medium· 6.8▾ Midnight⚠ Exploited in the wildPoC availableWhen requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab affecting all versions starting from 10.5 was possible to exploit for an unauthenticated attacker even on a GitLab inst…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 37.4 · likelihood 10.7 · exploitation 25
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 1.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Federal remediation due Mar 11, 2026
Last analysed / modified upstream
53%
Nuclei ×1 (last check)
Added to the CISA catalog on Feb 18, 2026. Federal remediation due Mar 11, 2026. View catalog ↗
When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab affecting all versions starting from 10.5 was possible to exploit for an unauthenticated attacker even on a GitLab instance where registration is disabled
gitlab >= 10.5.0, < 13.6.7gitlab >= 13.7.0, < 13.7.7gitlab >= 13.8.0, < 13.8.4Upgrade past the affected range:
gitlab 13.8.4Connected by shared product, vendor, weakness, or advisory.
CVE-2026-85706Critical· 10.0GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 18.11.12, 19.0 before 19.0.9, 19.1 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions, an unauthenticated user c…
CVE-2026-100104Low· 3.5GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.3 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user to perform server-side req…
CVE-2021-22205Critical· 10.0An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9
CVE-2026-110264Critical· 10.0Integer Overflow or Wraparound in GitLab
CVE-2023-4379High· 8.1Incorrect Authorization in GitLab
CVE-2026-97229Critical· 10.0GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary cod…