GitLab — Security Activity Report

GitLab platform (GitLab Security Advisories)

Generated Nov 2, 2026Cohort: 9 vendors with ≥10 CVE advisoriesMethodology ↗

CVE Disclosure Volume

Total all-time: 658 CVEs with GitLab advisories. Source: NVD CVE records joined with vendor advisory publish dates.

Severity Composition

↓ -25.4 pp

28.4% of GitLab's 658 CVEs are CRITICAL or HIGH severity. Industry median: 53.8%. Source: NVD CVSS v3.1.

CRITICAL 27 (4.1%)HIGH 160 (24.3%)MEDIUM 392 (59.6%)LOW 79 (12.0%)

CISA KEV Listings

↓ -0.1 pp

3 of 584 GitLab CVEs in the last 3 years are on CISA's Known Exploited Vulnerabilities catalog (0.5%). Industry median: 0.6%.

Source: CISA Known Exploited Vulnerabilities catalog (current snapshot). KEV listing means CISA observed active in-the-wild exploitation.

Vendor Patch Velocity

↑ +30.2 days

Median time from CVE disclosure to GitLab advisory: 41 days (p25 14 days – p75 109 days). Industry median: 11 days.

Sample size: 15 CVE→advisory pairs over the last 3 years. Source: vendor advisory published_at minus CVE published.

Top Recurring Weakness Classes

Most-frequently mapped CWEs across GitLab's last 3 years of CVE disclosures. Source: NVD — CWE mapping per MITRE taxonomy.

CWE-863Incorrect Authorization86 CVEs
CWE-770Allocation of Resources Without Limits or Throttling78 CVEs
CWE-79Cross-site Scripting (XSS)63 CVEs
CWE-862Missing Authorization55 CVEs
CWE-400Uncontrolled Resource Consumption (Denial of Service)30 CVEs

Recent Security Advisories

Latest advisories published by GitLab, straight from the vendor's own feed. Severity labels are the vendor's — scales differ across vendors.

patch-release-gitlab-19-5-3-released
Oct 29, 2026
GitLab Patch Release and Security Update: 19.5.3, 19.4.5, 19.3.7, 19.2.10, 19.1.10, 19.0.11, 18.11.14
CVE-2026-111943 vendor source ↗
patch-release-gitlab-19-5-1-released
Oct 21, 2026
GitLab Critical Patch Release: 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13
CVE-2026-14288 CVE-2026-16255 CVE-2026-105777 CVE-2026-13319 CVE-2026-105711 CVE-2026-112326+6 more CVEsvendor source ↗
patch-release-gitlab-19-4-2-released
Oct 12, 2026
GitLab Critical Patch Release: 19.4.2, 19.3.5, 19.2.8
CVE-2026-97229 CVE-2026-81839 CVE-2026-101168 CVE-2026-104661 CVE-2026-92528 CVE-2026-100104+18 more CVEsvendor source ↗
patch-release-gitlab-ai-gateway-19-4-1-released
Oct 2, 2026
GitLab AI Gateway Critical Patch Release: 19.2.4, 19.3.2, and 19.4.1
CVE-2026-90970 vendor source ↗
patch-release-gitlab-19-0-9-released
Sep 23, 2026
GitLab Critical Patch Release: 19.0.9, 18.11.12
CVE-2026-85706 CVE-2026-87719 vendor source ↗
patch-release-gitlab-19-4-1-released
Sep 23, 2026
GitLab Critical Patch Release: 19.4.1, 19.3.3, 19.2.7
CVE-2026-4523 CVE-2026-92530 CVE-2026-8937 CVE-2026-92628 CVE-2026-89078 CVE-2026-93577+5 more CVEsvendor source ↗
patch-release-gitlab-19-3-2-released
Sep 10, 2026
GitLab Critical Patch Release: 19.3.2, 19.2.6, 19.1.8
CVE-2026-78252 CVE-2025-14871 CVE-2024-11222 CVE-2026-82837 CVE-2026-19619 CVE-2026-8030+12 more CVEsvendor source ↗
patch-release-gitlab-19-3-1-released
Aug 26, 2026
GitLab Patch Release: 19.3.1, 19.2.5, 19.1.7
CVE-2026-18252 CVE-2026-77801 CVE-2025-10903 CVE-2026-3035 CVE-2026-4398 CVE-2026-15387+1 more CVEsvendor source ↗

Full advisory archive: /pulse/vendor-advisories →

Data sources & corrections

NVD National Vulnerability Database (nvd.nist.gov) — CVE records + CVSS v3.1 severity
MITRE cvelistV5 (github.com/CVEProject/cvelistV5) — CNA-published CVE timestamps
CISA Known Exploited Vulnerabilities catalog (cisa.gov/known-exploited-vulnerabilities-catalog)
Vendor security advisories (Red Hat RHSA, Ubuntu USN, Microsoft MSRC, Cisco PSIRT and other per-vendor feeds; the GitHub and OSV advisory databases are not used) — published_at timestamps
MITRE CWE taxonomy (cwe.mitre.org) — weakness class mappings

Snapshot generated Nov 2, 2026: when these counts and industry medians were computed. Vendors in the index are recomputed every 6 hours.

Spot a factual error in this report?

Email support@echelongraph.io with the specific number you're disputing and a link to the authoritative source. We review every report and publish corrections on the methodology page.