Vulnerabilidades en GitLab

1068 resultados
Análisis Vexday

Com 1.068 CVEs catalogadas e 78 novas surgidas nos últimos 90 dias, o GitLab apresenta um volume de vulnerabilidades que exige monitoramento contínuo. A taxa de exploração ativa está abaixo da média geral do catálogo KEV, com 4 CVEs confirmadas em uso por agentes de ameaça, mas a presença de 83 vulnerabilidades com prova de conceito pública e 24 de severidade crítica amplia consideravelmente a superfície de risco. O destaque mais preocupante é CVE-2021-22205, atualmente a CVE mais perigosa em exploração ativa, com EPSS de 0,9973 — valor que indica probabilidade altíssima de exploração —, e cuja falha de tipo mais recorrente na plataforma, CWE-770 (alocação de recursos sem limites adequados), sugere atenção redobrada a controles de validação de entrada e gestão de recursos. Equipes de segurança devem priorizar a remediação das CVEs com PoC disponível e manter rastreamento próximo das novas emissões, dado o ritmo relevante de descobertas recentes.

CVE-2024-8754MEDIUMExternal Control of Critical State Data in GitLabEPSS 0.4%CVE-2023-1071LOWAn issue has been discovered in GitLab affecting all versions from 15.5 before 15.8.5, all versions starting from 15.9 before 15.9.4, all veEPSS 0.4%CVE-2026-5816HIGHImproper Resolution of Path Equivalence in GitLabEPSS 0.4%CVE-2025-13781MEDIUMMissing Authorization in GitLabEPSS 0.4%CVE-2025-1042MEDIUMFiles or Directories Accessible to External Parties in GitLabEPSS 0.4%CVE-2024-0861MEDIUMDirect Request ('Forced Browsing') in GitLabEPSS 0.4%CVE-2024-7554MEDIUMExposure of Sensitive Information to an Unauthorized Actor in GitLabEPSS 0.4%CVE-2024-2743MEDIUMIncorrect Authorization in GitLabEPSS 0.4%CVE-2025-12716HIGHImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabEPSS 0.4%CVE-2023-0042MEDIUMAn issue has been discovered in GitLab CE/EE affecting all versions starting from 11.4 prior to 15.5.7, 15.6 prior to 15.6.4, and 15.7 priorEPSS 0.4%CVE-2025-3922MEDIUMAllocation of Resources Without Limits or Throttling in GitLabEPSS 0.4%CVE-2026-1660MEDIUMAllocation of Resources Without Limits or Throttling in GitLabEPSS 0.4%CVE-2025-6016MEDIUMAllocation of Resources Without Limits or Throttling in GitLabEPSS 0.4%CVE-2025-0186MEDIUMAllocation of Resources Without Limits or Throttling in GitLabEPSS 0.4%CVE-2024-12093MEDIUMImproper Validation of Consistency within Input in GitLabEPSS 0.4%CVE-2025-8099HIGHAllocation of Resources Without Limits or Throttling in GitLabEPSS 0.4%CVE-2023-3979LOWIncorrect Authorization in GitLabEPSS 0.4%CVE-2021-39879LOWMissing authentication in all versions of GitLab CE/EE since version 7.11.0 allows an attacker with access to a victim's session to disable EPSS 0.4%CVE-2024-10219MEDIUMIncorrect Authorization in GitLabEPSS 0.4%CVE-2023-2576MEDIUMIncorrect Authorization in GitLabEPSS 0.4%