Open Source GitLab <18.4.1

productDE

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

KEV-listed

public exploit

EPSS ≥ 10%

by severity

1critical3high3medium0low

updated 2026-10-28

vulnerabilities (10)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2025-8014US	—	0.59% (48th)	—	no fix	2025-09-27	—
CVE-2025-10858US	—	0.58% (48th)	—	no fix	2025-09-26	—
CVE-2025-9642US	critical9.6	0.56% (46th)	—	no fix	2025-09-26	—
CVE-2025-9958US	—	0.51% (43rd)	—	no fix	2025-09-26	—
CVE-2025-7691US	high8.8	0.38% (32nd)	—	no fix	2025-09-26	—
CVE-2025-10871US	high7.2OT elevated	0.38% (32nd)	—	no fix	2025-09-26	—
CVE-2025-10867US	medium6.5	0.34% (27th)	—	no fix	2025-09-26	—
CVE-2025-11042US	high7.5	0.32% (25th)	—	no fix	2025-09-26	—
CVE-2025-10868US	medium5.3	0.26% (18th)	—	no fix	2025-09-26	—
CVE-2025-5069US	medium6.5	0.25% (16th)	—	no fix	2025-09-26	—

The flaw types (CWEs) most of these CVEs share.

CWE-770Allocation of Resources Without Limits or Throttling4 CVEs
CWE-201Insertion of Sensitive Information Into Sent Data1 CVEs
CWE-267Privilege Defined With Unsafe Actions1 CVEs
CWE-708Incorrect Ownership Assignment1 CVEs
CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')1 CVEs
CWE-840CWE-8401 CVEs
CWE-862Missing Authorization1 CVEs

Which sources assert this record, and when.

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.