GitLab — Security Activity Report

GitLab platform (GitLab Security Advisories)

Generated Sep 19, 2026Cohort: 9 vendors with ≥10 CVE advisoriesMethodology ↗

CVE Disclosure Volume

Total all-time: 608 CVEs with GitLab advisories. Source: NVD CVE records joined with vendor advisory publish dates.

Severity Composition

↓ -24.9 pp

28.1% of GitLab's 608 CVEs are CRITICAL or HIGH severity. Industry median: 53.1%. Source: NVD CVSS v3.1.

CRITICAL 22 (3.6%)HIGH 149 (24.5%)MEDIUM 359 (59.0%)LOW 78 (12.8%)

CISA KEV Listings

↓ -0.3 pp

3 of 552 GitLab CVEs in the last 3 years are on CISA's Known Exploited Vulnerabilities catalog (0.5%). Industry median: 0.8%.

Source: CISA Known Exploited Vulnerabilities catalog (current snapshot). KEV listing means CISA observed active in-the-wild exploitation.

Vendor Patch Velocity

↑ +32.8 days

Median time from CVE disclosure to GitLab advisory: 41 days (p25 14 days – p75 110 days). Industry median: 9 days.

Sample size: 17 CVE→advisory pairs over the last 3 years. Source: vendor advisory published_at minus CVE published.

Top Recurring Weakness Classes

Most-frequently mapped CWEs across GitLab's last 3 years of CVE disclosures. Source: NVD — CWE mapping per MITRE taxonomy.

CWE-770Allocation of Resources Without Limits or Throttling77 CVEs
CWE-863Incorrect Authorization73 CVEs
CWE-79Cross-site Scripting (XSS)61 CVEs
CWE-862Missing Authorization53 CVEs
CWE-284Improper Access Control34 CVEs

Recent Security Advisories

Latest advisories published by GitLab, straight from the vendor's own feed. Severity labels are the vendor's — scales differ across vendors.

patch-release-gitlab-19-3-2-released
Sep 10, 2026
GitLab Critical Patch Release: 19.3.2, 19.2.6, 19.1.8
CVE-2026-86340 CVE-2026-7514 CVE-2026-88765 CVE-2026-78252 CVE-2026-82837 CVE-2026-19619+12 more CVEsvendor source ↗
patch-release-gitlab-19-3-1-released
Aug 26, 2026
GitLab Patch Release: 19.3.1, 19.2.5, 19.1.7
CVE-2025-10903 CVE-2026-3035 CVE-2026-4398 CVE-2026-15387 CVE-2026-7487 CVE-2026-18252+1 more CVEsvendor source ↗
patch-release-gitlab-19-2-4-released
Aug 17, 2026
GitLab Critical Patch Release: 19.2.4, 19.1.6, 19.0.8, 18.11.11
CVE-2026-19478 CVE-2026-19650 vendor source ↗
patch-release-gitlab-19-2-2-released
Aug 12, 2026
GitLab Patch Release: 19.2.2, 19.1.4, 19.0.6
CVE-2026-4879 CVE-2026-18433 CVE-2025-9486 CVE-2026-15217 CVE-2026-15216 CVE-2026-10053+8 more CVEsvendor source ↗
patch-release-gitlab-18-11-9-released
Aug 6, 2026
GitLab Patch Release: 18.11.9
vendor source ↗
patch-release-gitlab-18-11-8-released
Aug 5, 2026
GitLab Patch Release: 18.11.8
vendor source ↗
patch-release-gitlab-19-2-1-released
Jul 29, 2026
GitLab Patch Release: 19.2.1, 19.1.3, 19.0.5
CVE-2026-12436 CVE-2026-15975 CVE-2026-16553 CVE-2026-14341 CVE-2026-3093 CVE-2026-15831+7 more CVEsvendor source ↗
patch-release-gitlab-19-1-2-released
Jul 8, 2026
GitLab Patch Release: 19.1.2, 19.0.4, 18.11.7
CVE-2026-11827 CVE-2026-8472 CVE-2025-12506 CVE-2026-13151 CVE-2026-6352 CVE-2026-6896+2 more CVEsvendor source ↗

Full advisory archive: /pulse/vendor-advisories →

Data sources & corrections

NVD National Vulnerability Database (nvd.nist.gov) — CVE records + CVSS v3.1 severity
MITRE cvelistV5 (github.com/CVEProject/cvelistV5) — CNA-published CVE timestamps
CISA Known Exploited Vulnerabilities catalog (cisa.gov/known-exploited-vulnerabilities-catalog)
Vendor security advisories (RHSA, USN, MSRC, GHSA, etc.) — published_at timestamps
MITRE CWE taxonomy (cwe.mitre.org) — weakness class mappings

Snapshot generated Sep 19, 2026. Industry medians refresh every 6 hours; raw vendor counts are queried live on each request.

Spot a factual error in this report?

Email [email protected] with the specific number you're disputing and a link to the authoritative source. We review every report and publish corrections on the methodology page.