GitLab Multiple Vulnerabilities
CSIRTS triage
- What
- Multiple vulnerabilities have been discovered in GitLab.
- Who is affected
- Users of GitLab are affected.
- Urgency
- Remediation is not urgent as there are no known exploits for these vulnerabilities.
- Action
- Stay updated with GitLab releases and apply patches as they become available.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch GitLab
Get an email when a new GitLab advisory drops — max one per day, one-click unsubscribe.
Details
Original advisory: https://www.hkcert.org/security-bulletin/gitlab-multiple-vulnerabilities_20260730
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Low exploitation riskCVE-2025-145620.22% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 13% of all scored CVEs.
- Low exploitation riskCVE-2026-30930.24% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 15% of all scored CVEs.
- Low exploitation riskCVE-2026-46720.24% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 16% of all scored CVEs.
- Low exploitation riskCVE-2026-62670.34% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 26% of all scored CVEs.
- Low exploitation riskCVE-2026-63360.26% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 17% of all scored CVEs.
- Low exploitation riskCVE-2026-124360.30% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 23% of all scored CVEs.
- Low exploitation riskCVE-2026-131130.21% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 11% of all scored CVEs.
- Low exploitation riskCVE-2026-143410.33% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 25% of all scored CVEs.
- Low exploitation riskCVE-2026-143510.25% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 17% of all scored CVEs.
- Low exploitation riskCVE-2026-150770.24% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 16% of all scored CVEs.
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2025-14562 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-3093 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-4672 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-6267 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-6336 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-12436 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-13113 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-14341 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-14351 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-15077 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-15831 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-15975 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-16553 | coverage & exploitation status | NVD · CVE.org |
Same CVEs, other sources
How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.
- high[NEW] [high] GitLab: Multiple vulnerabilitiescert-bund
- unknownNCSC-2026-0270 [1.00] [M/M] Vulnerabilities fixed in GitLab by GitLab Inc.ncsc-nl
- unknownMultiple Vulnerabilities in GitLab (July 30, 2026)cert-fr-avis
- mediumCVE-2026-6336: GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.6 before 19.0.5, …nvd
- highCVE-2026-6267: GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.1.0 before 19.0.5…nvd
- mediumCVE-2026-4672: GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.4 before 19.0.5, …nvd
- mediumCVE-2026-3093: GitLab has remediated an issue in GitLab CE/EE affecting all versions from 14.0 before 19.0.5, …nvd
- mediumCVE-2026-16553: GitLab has remediated an issue in GitLab EE affecting all versions from 18.8 before 19.0.5, 19…nvd
- highCVE-2026-15975: GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.8 before 19.0.5,…nvd
- mediumCVE-2026-15831: GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.3 and…nvd
- mediumCVE-2026-15077: GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.3 and…nvd
- mediumCVE-2026-14351: GitLab has remediated an issue in GitLab CE/EE affecting all versions from 8.8 before 19.0.5, …nvd
More from HKCERT Security Bulletins
- unknownCisco Secure Firewall Management Center Software Information Disclosure Vulnerability2026-07-30
- unknownGoogle Chrome Multiple Vulnerabilities2026-07-30
- unknownIBM WebSphere Products Multiple Vulnerabilities2026-07-30
- unknownNode.js Multiple Vulnerabilities2026-07-30
- unknownXen Multiple Vulnerabilities2026-07-30