GitLab Community Edition

Search everything

Mentions · 7d9
Mentions · 30d23
All mentions28
First seenAug 21, 2026
Last mentioned11h ago

Timeline

28 articles · newest first

CISA adds exploited GitLab and Cisco firewall flaws to KEV

Federal agencies must fix unauthenticated GitLab code execution and a Cisco firewall reload bug by November 1, 2026.

Security AffairsOct 30, 20:25 UTC · 11h agoExploit / PoCExploited10 sourcesCVE-2026-97229 CVE-2026-764181

Attackers exploit max-severity GitLab flaw CVE-2026-97229

The integer overflow allows unauthenticated code execution through a crafted CI/CD regular expression; fixes are 19.4.2, 19.3.5, and 19.2.8.

BleepingComputerOct 30, 13:00 UTC · 19h agoExploit / PoCExploited7 sourcesCVE-2026-972291

CISA confirms active exploitation of GitLab CVE-2026-97229

Unauthenticated attackers can run code via a crafted CI/CD regex; federal remediation is due November 1.

GBHackersupdated Oct 30, 13:00 UTC · 19h agofirst Oct 30, 12:21 UTC · 19h agoExploit / PoCExploited7 sourcesCVE-2026-972292

CISA says GitLab integer overflow CVE-2026-97229 is exploited

Fixes cover GitLab 19.2.8, 19.3.4, and 19.4.2; federal agencies face a November 1 deadline.

Cyber Security Newsupdated Oct 30, 13:00 UTC · 19h agofirst Oct 30, 08:28 UTC · 23h agoExploit / PoCExploited7 sourcesCVE-2026-97229 CVE-2026-1102641

CISA adds exploited GitLab RCE and Cisco firewall DoS to KEV

Federal civilian agencies are told to apply fixes for both flaws by November 1, 2026.

The Hacker Newsupdated Oct 30, 20:25 UTC · 11h agofirst Oct 30, 07:27 UTC · 1d agoExploit / PoCExploited10 sourcesCVE-2026-97229 CVE-2026-764181

CISA adds exploited GitLab integer overflow CVE-2026-97229 to KEV

FCEB agencies must prioritize the GitLab flaw on exposed assets and check for compromise before patching.

CISA AdvisoriesOct 29, 12:00 UTC · 1d agoExploit / PoCExploitedCVE-2026-972291

CISA adds exploited Ivanti Connect Secure and GitLab flaws to KEV

CVE-2026-111357 is missing authentication in Ivanti Connect Secure; CVE-2026-97229 is an integer overflow in GitLab CE and EE.

CISA AdvisoriesOct 29, 12:00 UTC · 1d agoExploit / PoCExploitedCVE-2026-111357 CVE-2026-972292

CISA KEV lists GitLab unauthenticated RCE CVE-2026-97229

A crafted regular expression in CI/CD configuration can run arbitrary code; the federal due date is November 1, 2026.

CISA Known Exploited Vulnerabilitiesupdated Oct 30, 13:00 UTC · 19h agofirst Oct 29, 00:00 UTC · 2d agoExploit / PoCExploited7 sourcesCVE-2026-972291

GitLab patches max-severity regex compiler RCE (CVE-2026-110264)

Unauthenticated users can run code via integer overflow when a crafted regular expression is compiled.

DataBreaches.netupdated Oct 28, 03:56 UTC · 3d agofirst Oct 27, 18:20 UTC · 3d agoVulnerability 30 sourcesCVE-2026-1102641

GitLab patches unauthenticated RCE in CE and EE (CVE-2026-110264)

The integer overflow reaches GitLab 7.0 from June 2014; no in-the-wild exploitation is indicated yet.

The Register · SecurityOct 22, 17:36 UTC · 8d agoVulnerabilityCVE-2026-1102641 · 1 read

GitLab CE and EE affected by vulnerabilities prior to 19.5.1

GitLab Critical Patch Releases 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 and 18.11.13 address issues in Community and Enterprise Editions.

Canadian Centre for Cyber SecurityOct 22, 12:27 UTC · 8d agoVulnerability1

GitLab patches max-severity regex compiler RCE (CVE-2026-110264)

An unauthenticated integer overflow can run arbitrary code; GitLab.com is already on the patched release.

BleepingComputerOct 22, 11:41 UTC · 8d agoVulnerabilityCVE-2026-11026413 · 5 reads

GitLab patches unauthenticated regex RCE rated CVSS 10.0

CVE-2026-110264 reaches back to GitLab 7.0; self-managed admins must upgrade, and in-the-wild use is not confirmed.

GBHackersOct 22, 04:53 UTC · 9d agoVulnerabilityCVE-2026-110264 CVE-2026-15723 CVE-2026-112212+92 · 1 read

GitLab fixes unauthenticated RCE in CE and EE (CVE-2026-110264)

The integer-overflow bug scores CVSS 10.0, is fixed in seven releases, and has no confirmed attacks or public exploit.

Cyber Security NewsOct 22, 02:06 UTC · 9d agoVulnerabilityCVE-2026-110264 CVE-2026-15723 CVE-2026-1122123 · 2 reads

GitLab RCE flaw scores CVSS 10 (CVE-2026-110264)

Community and Enterprise builds from 7.0 before the listed 18.x and 19.x patches need urgent updates.

CERT-EU AdvisoriesOct 22, 00:00 UTC · 9d agoVulnerabilityCVE-2026-1102641 · 1 read

PoC Exploit Released for Critical GitLab RCE Vulnerability (CVE-2026-97229)

A public PoC shows critical GitLab CVE-2026-97229 can run commands after a project push.

Cyber Security NewsOct 16, 04:01 UTC · 15d agoExploit / PoCCVE-2026-972298 · 5 reads

GitLab Patches Max-Severity Vulnerability CVE-2026-97229

GitLab patched CVE-2026-97229, a CVSS 10.0 unauthenticated remote code execution flaw in CI/CD handling.

Security AffairsOct 13, 13:48 UTC · 17d agoVulnerabilityCVE-2026-97229 CVE-2026-92883 CVE-2026-16301+22

GitLab patches a max-severity regex flaw alongside five high-severity bugs

GitLab patched unauthenticated CI/CD regex RCE CVE-2026-97229 (CVSS 10) and five high-severity flaws.

CSO OnlineOct 13, 11:42 UTC · 17d agoVulnerability 2 sourcesCVE-2026-14814 CVE-2026-16301 CVE-2026-81839+33

CVE-2026-97229: Critical Unauthenticated Remote Code Execution in GitLab

Rapid7 reproduced unauthenticated GitLab RCE CVE-2026-97229 (CVSS 10) and urges immediate patching.

Rapid7 Blogupdated Oct 13, 11:42 UTC · 17d agofirst Oct 13, 11:29 UTC · 17d agoExploit / PoC 2 sourcesCVE-2026-972292

GitLab Patches CVSS 10.0 Flaw That Could Let Unauthenticated Users Run Server Code

GitLab patched CVE-2026-97229, a CVSS 10.0 bug letting unauthenticated users run code on CE and EE servers.

The Hacker NewsOct 13, 08:43 UTC · 17d agoVulnerabilityCVE-2026-97229 CVE-2026-92883 CVE-2026-16301+32

Critical GitLab Vulnerability Enables Arbitrary Code Execution Attacks on Servers

GitLab patched CVE-2026-97229, an unauthenticated CVSS 10.0 flaw enabling arbitrary code execution on servers.

Cyber Security NewsOct 12, 14:19 UTC · 18d agoVulnerabilityCVE-2026-972297

GitLab warns of max severity code execution vulnerability

GitLab patched maximum-severity unauthenticated RCE CVE-2026-97229 in its CI/CD regex compiler.

BleepingComputerOct 12, 13:09 UTC · 18d agoVulnerabilityCVE-2026-97229 CVE-2026-0723 CVE-2026-857064 · 2 reads

GitLab warns of critical RCE vulnerability in AI Gateway service

GitLab urges immediate patches for critical AI Gateway RCE CVE-2026-90970 on self-hosted instances.

BleepingComputerOct 2, 16:20 UTC · 28d agoVulnerabilityExploitedCVE-2026-90970 CVE-2026-857068 · 3 reads

Critical GitLab Bugs Let Attackers Execute Code Through Malicious CI/CD Regex

GitLab patched two CVSS 9.9 flaws letting authenticated users execute code via malicious CI/CD regular expressions.

Cyber Security NewsSep 25, 09:51 UTC · Sep 25, 2026VulnerabilityCVE-2026-89078 CVE-2026-93577 CVE-2026-84739+16 · 4 reads

CISA Warns of Critical GitLab Vulnerability Exploited in Attacks

CISA added actively exploited GitLab path traversal flaw CVE-2026-85706 to its KEV catalog, warning unauthenticated attackers can read arbitrary files including secrets.

GBHackersSep 12, 05:17 UTC · Sep 12, 2026Exploit / PoCExploitedCVE-2026-857063 · 1 read

CISA Warns of GitLab Path Traversal Vulnerability Exploited in Attacks

CISA added actively exploited GitLab path traversal flaw CVE-2026-85706 (CVSS 10.0) to its KEV catalog, setting a September 14 federal patch deadline.

Cyber Security NewsSep 12, 04:32 UTC · Sep 12, 2026Exploit / PoCExploitedCVE-2026-857064 · 2 reads

CISA Adds One Known Exploited Vulnerability to Catalog

CISA added CVE-2026-85706, an actively exploited GitLab path traversal flaw, to its KEV Catalog, requiring federal agencies to prioritize patching.

CISA AdvisoriesSep 11, 12:00 UTC · Sep 11, 2026Exploit / PoCExploitedCVE-2026-857062

GitLab CVE-2026-19478 Comes Under Active Exploitation Within Days of Disclosure

Unauthenticated attackers are actively exploiting GitLab CVE-2026-19478 (CVSS 9.4) to modify or delete public projects days after disclosure.

The Hacker NewsAug 21, 07:04 UTC · Aug 21, 2026Exploit / PoCExploitedCVE-2026-194783

Related CVEs

by mentions

CVE-2026-9722918%10.0
Unauthenticated RCE in GitLab CE/EE via CI/CD regex
published 18d agoGitLab CE/EEKEVPoC ×5
CVE-2026-1102641%10.0
Unauthenticated RCE in GitLab CE/EE via regex integer overflow
published 9d agoGitLab CE/EEPoC ×8
CVE-2026-8570697%10.0
Unauthenticated Path Traversal Arbitrary File Read in GitLab CE/EE
published Sep 12, 2026GitLab Community EditionKEVPoC ×13
CVE-2026-9097017%9.9
Prompt sandbox escape to RCE in GitLab AI Gateway
published 28d agoGitLab AI GatewayPoC
CVE-2026-928838.7
Stored XSS in GitLab CE/EE via syntax highlighting
published 18d agoGitLab CE/EE
CVE-2026-163018.5
Improper Authorization in GitLab CE/EE Pipeline Creation
published 18d agoGitLab CE/EE
CVE-2026-148148.2
Cache poisoning in GitLab CE/EE can leak CI/CD secrets
published 18d agoGitLab CE/EE
CVE-2026-76418<1%8.6
Unauthenticated DoS in Cisco ASA and FTD SSL VPN with secondary auth
published 2d agoCisco Secure Firewall Adaptive Security Appliance (ASA) SoftwareKEV
CVE-2026-157238.2
LDAP account takeover in GitLab when SAML and LDAP auto-link are on
published 9d agoGitLab CE/EE
CVE-2026-1122127.5
Unauthenticated OAuth/OIDC cache poisoning in GitLab CE/EE
published 9d agoGitLab CE/EE

Appears with

GitLabvendor · 28
GitLab Enterprise Editionproduct · 28
CISAorganization · 13
GitLaborganization · 9
HackerOneorganization · 7
GitLab Duoproduct · 4
GitLab AI Gatewayproduct · 3
Shadowserverorganization · 2
GitLab Dedicatedproduct · 2
GitLab.comproduct · 2
Alpine Linuxvictim · 2
Ciscovendor · 2
CISAvendor · 1
Rapid7organization · 1
watchTowrvendor · 1
Canadian Centre for Cyber Securityorganization · 1

Entities are extracted by the model from each article. First seen Aug 21, 2026, last mentioned 11h ago. Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.