GitLab — Security Activity Report

GitLab platform (GitLab Security Advisories)

Generated Jul 29, 2026Cohort: 9 vendors with ≥10 CVE advisoriesMethodology ↗

CVE Disclosure Volume

Total all-time: 558 CVEs with GitLab advisories. Source: NVD CVE records joined with vendor advisory publish dates.

Severity Composition

↓ -25.5 pp

27.1% of GitLab's 558 CVEs are CRITICAL or HIGH severity. Industry median: 52.6%. Source: NVD CVSS v3.1.

CRITICAL 18 (3.2%)HIGH 133 (23.8%)MEDIUM 333 (59.7%)LOW 74 (13.3%)

CISA KEV Listings

↓ -0.6 pp

2 of 529 GitLab CVEs in the last 3 years are on CISA's Known Exploited Vulnerabilities catalog (0.4%). Industry median: 1.0%.

Source: CISA Known Exploited Vulnerabilities catalog (current snapshot). KEV listing means CISA observed active in-the-wild exploitation.

Vendor Patch Velocity

↑ +30.7 days

Median time from CVE disclosure to GitLab advisory: 41 days (p25 16 days – p75 110 days). Industry median: 11 days.

Sample size: 18 CVE→advisory pairs over the last 3 years. Source: vendor advisory published_at minus CVE published.

Top Recurring Weakness Classes

Most-frequently mapped CWEs across GitLab's last 3 years of CVE disclosures. Source: NVD — CWE mapping per MITRE taxonomy.

CWE-770Allocation of Resources Without Limits or Throttling74 CVEs
CWE-863Incorrect Authorization68 CVEs
CWE-79Cross-site Scripting (XSS)57 CVEs
CWE-862Missing Authorization46 CVEs
CWE-284Improper Access Control39 CVEs

Recent Security Advisories

Latest advisories published by GitLab, straight from the vendor's own feed. Severity labels are the vendor's — scales differ across vendors.

patch-release-gitlab-19-1-2-released
Jul 8, 2026
GitLab Patch Release: 19.1.2, 19.0.4, 18.11.7
CVE-2026-8472 CVE-2026-13151 CVE-2026-6352 CVE-2026-6896 CVE-2026-13320 CVE-2026-11827+2 more CVEsvendor source ↗
patch-release-gitlab-18-8-11-released
Jul 1, 2026
GitLab Patch Release: 18.8.11
vendor source ↗
patch-release-gitlab-19-1-1-released
Jun 24, 2026
GitLab Patch Release: 19.1.1, 19.0.3, 18.11.6
CVE-2026-8330 CVE-2026-5796 CVE-2026-12635 CVE-2026-10712 CVE-2026-12053 CVE-2026-2238+7 more CVEsvendor source ↗
patch-release-gitlab-19-0-2-released
Jun 10, 2026
GitLab Patch Release: 19.0.2, 18.11.5, 18.10.8
CVE-2026-10733 CVE-2026-9694 CVE-2026-6552 CVE-2026-8589 CVE-2026-9204 CVE-2026-6277+6 more CVEsvendor source ↗
patch-release-gitlab-18-9-8-released
May 27, 2026
GitLab Patch Release: 18.9.8, 18.8.10, 18.7.7, 18.6.8, 18.5.7
vendor source ↗
patch-release-gitlab-19-0-1-released
May 27, 2026
GitLab Patch Release: 19.0.1, 18.11.4, 18.10.7
CVE-2026-1402 CVE-2026-6713 CVE-2026-5296 CVE-2026-2601 CVE-2026-8716 CVE-2026-2710+1 more CVEsvendor source ↗
patch-release-gitlab-18-11-3-released
May 13, 2026
GitLab Patch Release: 18.11.3, 18.10.6, 18.9.7
CVE-2026-7481 CVE-2026-6073 CVE-2026-1659 CVE-2026-8280 CVE-2026-3607 CVE-2026-3074+19 more CVEsvendor source ↗
patch-release-gitlab-18-11-2-released
Apr 29, 2026
GitLab Patch Release: 18.11.2, 18.10.5
vendor source ↗

Full advisory archive: /pulse/vendor-advisories →

Data sources & corrections

NVD National Vulnerability Database (nvd.nist.gov) — CVE records + CVSS v3.1 severity
MITRE cvelistV5 (github.com/CVEProject/cvelistV5) — CNA-published CVE timestamps
CISA Known Exploited Vulnerabilities catalog (cisa.gov/known-exploited-vulnerabilities-catalog)
Vendor security advisories (RHSA, USN, MSRC, GHSA, etc.) — published_at timestamps
MITRE CWE taxonomy (cwe.mitre.org) — weakness class mappings

Snapshot generated Jul 29, 2026. Industry medians refresh every 6 hours; raw vendor counts are queried live on each request.

Spot a factual error in this report?

Email [email protected] with the specific number you're disputing and a link to the authoritative source. We review every report and publish corrections on the methodology page.