GitLab — Security Activity Report

GitLab platform (GitLab Security Advisories)

Generated Jul 22, 2026Cohort: 9 vendors with ≥10 CVE advisoriesMethodology ↗

CVE Disclosure Volume

Total all-time: 485 CVEs with GitLab advisories. Source: NVD CVE records joined with vendor advisory publish dates.

Severity Composition

↓ -24.6 pp

27.6% of GitLab's 485 CVEs are CRITICAL or HIGH severity. Industry median: 52.2%. Source: NVD CVSS v3.1.

CRITICAL 17 (3.5%)HIGH 117 (24.1%)MEDIUM 282 (58.1%)LOW 69 (14.2%)

CISA KEV Listings

↓ -0.5 pp

2 of 456 GitLab CVEs in the last 3 years are on CISA's Known Exploited Vulnerabilities catalog (0.4%). Industry median: 1.0%.

Source: CISA Known Exploited Vulnerabilities catalog (current snapshot). KEV listing means CISA observed active in-the-wild exploitation.

Vendor Patch Velocity

↑ +26.8 days

Median time from CVE disclosure to GitLab advisory: 41 days (p25 16 days – p75 110 days). Industry median: 15 days.

Sample size: 18 CVE→advisory pairs over the last 3 years. Source: vendor advisory published_at minus CVE published.

Top Recurring Weakness Classes

Most-frequently mapped CWEs across GitLab's last 3 years of CVE disclosures. Source: NVD — CWE mapping per MITRE taxonomy.

CWE-770Allocation of Resources Without Limits or Throttling63 CVEs
CWE-863Incorrect Authorization55 CVEs
CWE-79Cross-site Scripting (XSS)47 CVEs
CWE-284Improper Access Control39 CVEs
CWE-400Uncontrolled Resource Consumption (Denial of Service)37 CVEs

Recent Security Advisories

Latest advisories published by GitLab, straight from the vendor's own feed. Severity labels are the vendor's — scales differ across vendors.

patch-release-gitlab-18-11-3-released
May 13, 2026
GitLab Patch Release: 18.11.3, 18.10.6, 18.9.7
CVE-2026-7481 CVE-2026-6073 CVE-2026-1659 CVE-2026-8280 CVE-2026-3607 CVE-2026-3074+19 more CVEsvendor source ↗
patch-release-gitlab-18-11-2-released
Apr 29, 2026
GitLab Patch Release: 18.11.2, 18.10.5
vendor source ↗
patch-release-gitlab-18-11-1-released
Apr 22, 2026
GitLab Patch Release: 18.11.1, 18.10.4, 18.9.6
CVE-2026-4922 CVE-2026-5816 CVE-2026-5262 CVE-2026-1660 CVE-2025-6016 CVE-2025-3922+5 more CVEsvendor source ↗
patch-release-gitlab-18-10-3-released
Apr 8, 2026
GitLab Patch Release: 18.10.3, 18.9.5, 18.8.9
CVE-2026-5173 CVE-2026-1092 CVE-2026-1101 CVE-2026-1516 CVE-2026-4332 CVE-2025-9484+6 more CVEsvendor source ↗
patch-release-gitlab-18-10-1-released
Mar 25, 2026
GitLab Patch Release: 18.10.1, 18.9.3, 18.8.7
CVE-2025-14595 CVE-2026-4363 CVE-2026-2995 CVE-2026-3988 CVE-2026-2745 CVE-2025-13436+6 more CVEsvendor source ↗
patch-release-gitlab-18-9-2-released
Mar 11, 2026
GitLab Patch Release: 18.9.2, 18.8.6, 18.7.6
CVE-2026-0602 CVE-2026-1732 CVE-2026-1182 CVE-2026-1090 CVE-2025-13929 CVE-2025-12576+9 more CVEsvendor source ↗
patch-release-gitlab-18-9-1-released
Feb 25, 2026
GitLab Patch Release: 18.9.1, 18.8.5, 18.7.5
CVE-2025-14511 CVE-2026-1662 CVE-2026-1388 CVE-2026-2845 CVE-2025-3525 CVE-2025-14103+3 more CVEsvendor source ↗
patch-release-gitlab-18-8-4-released
Feb 10, 2026
GitLab Patch Release: 18.8.4, 18.7.4, 18.6.6
CVE-2025-8099 CVE-2025-14560 CVE-2026-1458 CVE-2025-12575 CVE-2025-12073 CVE-2025-7659+9 more CVEsvendor source ↗

Full advisory archive: /pulse/vendor-advisories →

Data sources & corrections

NVD National Vulnerability Database (nvd.nist.gov) — CVE records + CVSS v3.1 severity
MITRE cvelistV5 (github.com/CVEProject/cvelistV5) — CNA-published CVE timestamps
CISA Known Exploited Vulnerabilities catalog (cisa.gov/known-exploited-vulnerabilities-catalog)
Vendor security advisories (RHSA, USN, MSRC, GHSA, etc.) — published_at timestamps
MITRE CWE taxonomy (cwe.mitre.org) — weakness class mappings

Snapshot generated Jul 22, 2026. Industry medians refresh every 6 hours; raw vendor counts are queried live on each request.

Spot a factual error in this report?

Email support@echelongraph.io with the specific number you're disputing and a link to the authoritative source. We review every report and publish corrections on the methodology page.