CVE-2023-3932High· 8.2▾ MidnightPoC availableAn issue has been discovered in GitLab EE affecting all versions starting from 13.12 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. It was possible for an attacker to run pipe…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 45.1 · likelihood 0.2 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.9%
An issue has been discovered in GitLab EE affecting all versions starting from 13.12 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. It was possible for an attacker to run pipeline jobs as an arbitrary user via scheduled security scan policies.
GitLab >= 13.12 < 16.0.8GitLab >= 16.1.0 < 16.1.3GitLab >= 16.2.0 < 16.2.2Upgrade to versions 16.2.2, 16.1.3, 16.0.8 or above.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-110264Critical· 10.0Integer Overflow or Wraparound in GitLab
CVE-2023-4379High· 8.1Incorrect Authorization in GitLab
CVE-2026-97229Critical· 10.0GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary cod…
CVE-2021-22175Medium· 6.8When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab affecting all versions starting from 10.5 was possible to exploit for an unauthenticated attacker even on a GitLab inst…
CVE-2026-85706Critical· 10.0GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 18.11.12, 19.0 before 19.0.9, 19.1 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions, an unauthenticated user c…
CVE-2026-105777Medium· 4.3Insertion of Sensitive Information Into Sent Data in GitLab