CVE-2026-110264Critical· 10.0▾ AbyssalPoC availableAn issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain…
▾ Abyssal zone — Critical with a public exploit or in-the-wild use
impact 55 · likelihood 0.2 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Oct 23.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
12 GitHub repos
0.5%
0.5% → 1.0%
An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server due to integer overflow when compiling a specially crafted regular expression.
GitLab >= 7.0 < 18.11.13GitLab >= 19.0 < 19.0.10GitLab >= 19.1 < 19.1.9GitLab >= 19.2 < 19.2.9GitLab >= 19.3 < 19.3.6GitLab >= 19.4 < 19.4.3GitLab >= 19.5 < 19.5.1Upgrade to versions 18.11.13, 19.0.10, 19.1.9, 19.2.9, 19.3.6, 19.4.3, 19.5.1, or later.
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-97229Critical· 10.0GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary cod…
CVE-2026-105777Medium· 4.3Insertion of Sensitive Information Into Sent Data in GitLab
CVE-2026-112326Low· 3.1Improper Cleanup on Thrown Exception in GitLab
CVE-2026-15723High· 8.2Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') in GitLab
CVE-2026-112378Medium· 4.3Use of Less Trusted Source in GitLab
CVE-2026-103515Low· 2.7Incorrect Authorization in GitLab