Vulnerabilities in GitLab Community and Enterprise Edition — the DevOps platform that, when compromised, can expose an organization's entire source code history and CI/CD pipeline secrets. Combined article + CVE feed for the GitLab beat.https://0daynews.com/en-ushttps://0daynews.com/cve/cve-2021-22175/https://0daynews.com/cve/cve-2021-22175/GitLab contains a server-side request forgery (SSRF) vulnerability when requests to the internal network for webhooks are enabled.Thu, 03 Sep 2026 00:00:00 GMTGitLabmediumcvehttps://0daynews.com/cve/cve-2021-22205/https://0daynews.com/cve/cve-2021-22205/An improper-validation vulnerability in GitLab Community Edition and Enterprise Edition allows an unauthenticated attacker to achieve remote code execution by uploading a crafted image file processed through a vulnerable ExifTool image-metadata parser.Thu, 03 Sep 2026 00:00:00 GMTGitLabcriticalcvehttps://0daynews.com/cve/cve-2021-39935/https://0daynews.com/cve/cve-2021-39935/GitLab Community and Enterprise Editions contain a server-side request forgery vulnerability which could allow unauthorized external users to perform Server Side Requests via the CI Lint API. Thu, 03 Sep 2026 00:00:00 GMTGitLabmediumcvehttps://0daynews.com/cve/cve-2023-7028/https://0daynews.com/cve/cve-2023-7028/GitLab Community and Enterprise Editions contain an improper access control vulnerability. This allows an attacker to trigger password reset emails to be sent to an unverified email address to ultimately facilitate an account takeover.Thu, 03 Sep 2026 00:00:00 GMTGitLabcriticalcvehttps://0daynews.com/cve/cve-2026-10053/https://0daynews.com/cve/cve-2026-10053/GitLab CE/EE 18.8 through 19.2 allow an authenticated user to achieve RCE via path traversal in the package registry. Fixed in 19.0.6, 19.1.4, 19.2.2.Thu, 03 Sep 2026 00:00:00 GMTGitLabhighcvehttps://0daynews.com/cve/cve-2026-19478/https://0daynews.com/cve/cve-2026-19478/Critical GraphQL flaw in GitLab CE/EE lets unauthenticated attackers modify or delete public projects and user data. Patched; self-hosted instances need manual update.Thu, 03 Sep 2026 00:00:00 GMTGitLabcriticalcvehttps://0daynews.com/articles/2026-08-24-gitlab-cve-2026-10053-rce-package-registry/https://0daynews.com/articles/2026-08-24-gitlab-cve-2026-10053-rce-package-registry/GitLab CE/EE authenticated RCE via path traversal in the package registry affects 18.8 through 19.2. Upgrade to 19.0.6, 19.1.4, or 19.2.2 now.Mon, 24 Aug 2026 06:00:00 GMTGitLabarticlehttps://0daynews.com/articles/2026-08-17-gitlab-cve-2026-19478-graphql-unauth/https://0daynews.com/articles/2026-08-17-gitlab-cve-2026-19478-graphql-unauth/GitLab patched CVE-2026-19478 (CVSS 9.4): unauthenticated attackers can delete or modify public projects. Self-hosted instances need immediate manual update.Mon, 17 Aug 2026 22:00:00 GMTGitLabarticlehttps://0daynews.com/articles/2026-07-25-gitlab-18-11-3-rce-poc-published/https://0daynews.com/articles/2026-07-25-gitlab-18-11-3-rce-poc-published/A working RCE exploit for self-managed GitLab 18.11.3 is now public. Any authenticated user can execute server commands as git — no admin rights needed.Sat, 25 Jul 2026 10:00:00 GMTGitLabarticlehttps://0daynews.com/articles/2026-07-06-gitlab-exiftool-rce-cve-2021-22205/https://0daynews.com/articles/2026-07-06-gitlab-exiftool-rce-cve-2021-22205/CVE-2021-22205 was quietly fixed in April 2021 — but its full unauthenticated remote-code-execution severity wasn't widely understood until late 2021, by which point mass exploitation had already begun.Mon, 06 Jul 2026 13:00:00 GMTGitLabarticle