MSRXGitLab vulnerabilities being exploited
4 GitLab flaws were confirmed exploited in the wild in the past 365 days, across 3 products: Community Edition and Enterprise Edition, Community and Enterprise Editions, GitLab. If you run any of them, patch these first.
| Added | Exploited vulnerability | Fix by |
|---|---|---|
| 2026-10-29 | CVE-2026-97229 Community Edition and Enterprise Edition GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability GitLab Community Edition and Enterprise Edition contain a integer overflow or wraparound vulnerability that could allow an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation. | 2026-11-01 |
| 2026-09-11 | CVE-2026-85706 Community Edition and Enterprise Edition GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability GitLab Community Edition and Enterprise Edition contains a path traversal vulnerability that allows an unauthenticated user to read arbitrary files due to an improper path confinement and missing authentication enforcement in the repository commits API. | 2026-09-14 |
| 2026-02-18 | CVE-2021-22175 GitLab GitLab Server-Side Request Forgery (SSRF) Vulnerability GitLab contains a server-side request forgery (SSRF) vulnerability when requests to the internal network for webhooks are enabled. | 2026-03-11 |
| 2026-02-03 | CVE-2021-39935 Community and Enterprise Editions GitLab Community and Enterprise Editions Server-Side Request Forgery (SSRF) Vulnerability GitLab Community and Enterprise Editions contain a server-side request forgery vulnerability which could allow unauthorized external users to perform Server Side Requests via the CI Lint API. | 2026-02-24 |
Source: CISA Known Exploited Vulnerabilities catalog 2026.10.29 (live). A listing means some versions are affected: check yours in the advisory. Guidance only.