BugRater
Early access. The directory is still filling out, and every rating here comes from a researcher's reported experience.

Security releases

GitLab

GitLab Security Releases - February 2026

gitlab-2026-02 Feb 1, 2026 Source: Vendor

GitLab security advisories for February 2026: 23 CVEs, 18 credited researchers.

Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.

Credited

25 lines
All 25 CVEs 25 Additional recognition 0 Unclaimed only
Showing 1–25 of 25
CVE-2025-12073 BR2026-0000-031972 unclaimed
Server-Side Request Forgery issue in Git repository import impacts GitLab CE/EE
Credited as yunus0x
CVE-2025-12575 BR2026-0000-031973 unclaimed
Server-Side Request Forgery issue in Virtual Registry impacts GitLab EE
Credited as go7f0qho
CVE-2025-14103 BR2026-0000-031974 unclaimed
Access Control issue in CI job mutation impacts GitLab CE/EE
Credited as go7f0
CVE-2025-14511 BR2026-0000-031975 unclaimed
Denial of Service issue in container registry impacts GitLab CE/EE
Credited as a92847865
CVE-2025-14560 BR2026-0000-031976 unclaimed
Cross-site Scripting issue in Code Flow impacts GitLab CE/EE
Credited as joaxcar
CVE-2025-14560 BR2026-0000-031977 unclaimed
Cross-site Scripting issue in Code Flow impacts GitLab CE/EE
Credited as yvvdwf
CVE-2025-14592 BR2026-0000-031978 unclaimed
Missing Authorization issue in GLQL API impacts GitLab CE/EE
Credited as go7f0
CVE-2025-14594 BR2026-0000-031979 unclaimed
Authorization Bypass issue in Pipeline Schedules API impacts GitLab CE/EE
Credited as sndd
CVE-2025-3525 BR2026-0000-031980 unclaimed
Denial of Service issue in CI trigger API impacts GitLab CE/EE
Credited as pwnie
CVE-2025-7659 BR2026-0000-031981 unclaimed
Incomplete Validation issue in Web IDE impacts GitLab CE/EE
Credited as cav0ur
CVE-2025-8099 BR2026-0000-031982 unclaimed
Denial of Service issue in GraphQL introspection impacts GitLab CE/EE
Credited as foxribeye
CVE-2026-0595 BR2026-0000-031983 unclaimed
HTML Injection issue in test case titles impacts GitLab CE/EE
Credited as yvvdwf
CVE-2026-0595 BR2026-0000-031984 unclaimed
HTML Injection issue in test case titles impacts GitLab CE/EE
Credited as joaxcar
CVE-2026-0752 BR2026-0000-031985 unclaimed
Cross-site Scripting issue in Mermaid sandbox impacts GitLab CE/EE
Credited as aphantom
CVE-2026-0958 BR2026-0000-031986 unclaimed
Denial of Service issue in JSON validation middleware impacts GitLab CE/EE
Credited as elbo7
CVE-2026-1080 BR2026-0000-031987 unclaimed
Authorization Bypass issue in iterations API impacts GitLab EE
Credited as go7f0
CVE-2026-1094 BR2026-0000-031988 unclaimed
Improper Validation issue in diff parser impacts GitLab CE/EE
Credited as u3mur4
CVE-2026-1282 BR2026-0000-031989 unclaimed
Stored HTML Injection issue in project label impacts GitLab CE/EE
Credited as rafabd1
CVE-2026-1387 BR2026-0000-031990 unclaimed
Denial of Service issue in dashboard impacts GitLab EE
Credited as a92847865
CVE-2026-1388 BR2026-0000-031991 unclaimed
Regular Expression Denial of Service issue in GitLab merge requests impacts GitLab CE/EE
Credited as sim4n6
CVE-2026-1456 BR2026-0000-031992 unclaimed
Denial of Service issue in Markdown Preview impacts GitLab CE/EE
Credited as maksyche
CVE-2026-1458 BR2026-0000-031993 unclaimed
Denial of Service issue in Markdown processor impacts GitLab CE/EE
Credited as maksyche
CVE-2026-1662 BR2026-0000-031994 unclaimed
Denial of Service issue in Jira events endpoint impacts GitLab CE/EE
Credited as a92847865
CVE-2026-1725 BR2026-0000-031995 unclaimed
Denial of Service issue in token decoder impacts GitLab CE/EE
Credited as vinax
CVE-2026-1747 BR2026-0000-031996 unclaimed
Improper Access Control issue in Conan package registry impacts GitLab EE
Credited as modhanami