GitLab
CVEs currently on EVULNABLE's Priority Feed for GitLab, and this vendor's own CISA KEV history.
CISA KEV additions over time
Weekly additions to the KEV catalog, last 26 weeks. Ransomware-linked additions are the base of each bar. Ransomware-linked as currently marked by CISA; recent weeks can rise as CISA updates entries.
20 Apr – 12 Oct; busiest week: 1 added.
- Not ransomware-linked
- Ransomware-linked
- This week (so far)
| Week of | Added to KEV | Ransomware-linked |
|---|---|---|
| 2026-04-20 | 0 | 0 |
| 2026-04-27 | 0 | 0 |
| 2026-05-04 | 0 | 0 |
| 2026-05-11 | 0 | 0 |
| 2026-05-18 | 0 | 0 |
| 2026-05-25 | 0 | 0 |
| 2026-06-01 | 0 | 0 |
| 2026-06-08 | 0 | 0 |
| 2026-06-15 | 0 | 0 |
| 2026-06-22 | 0 | 0 |
| 2026-06-29 | 0 | 0 |
| 2026-07-06 | 0 | 0 |
| 2026-07-13 | 0 | 0 |
| 2026-07-20 | 0 | 0 |
| 2026-07-27 | 0 | 0 |
| 2026-08-03 | 0 | 0 |
| 2026-08-10 | 0 | 0 |
| 2026-08-17 | 0 | 0 |
| 2026-08-24 | 0 | 0 |
| 2026-08-31 | 0 | 0 |
| 2026-09-07 | 1 | 0 |
| 2026-09-14 | 0 | 0 |
| 2026-09-21 | 0 | 0 |
| 2026-09-28 | 0 | 0 |
| 2026-10-05 | 0 | 0 |
| 2026-10-12 (so far) | 0 | 0 |
In EVULNABLE's ranked feed
Showing all 5 GitLab CVEs in EVULNABLE's ranked feed.
#1 94 Immediate CVE-2021-22205 ExigentKEV since 2021 · listed over a yearRansomwareCISA KEV GitLab — GitLab Community and Enterprise Editions Remote Code Execution Vulnerability KEV + ransomware, EPSS 99.7%
EVRS 94/100 · EVRS priority: Immediate · Exigent, a flag within Immediate. CVSS severity and EPSS are separate measurements, shown below.
Why it matters: Listed in the CISA KEV catalog, and associated with known ransomware campaigns.
#2 90 Immediate CVE-2026-85706 ExigentCISA federal deadline · Overdue by 32 daysCISA KEV GitLab — GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability KEV, EPSS 93.0%, added to KEV within the last 90 days
EVRS 90/100 · EVRS priority: Immediate · Exigent, a flag within Immediate. CVSS severity and EPSS are separate measurements, shown below.
Why it matters: Listed in the CISA KEV catalog, and an EPSS probability of 0.930.
#3 86 Immediate CVE-2023-7028 ExigentKEV since 2024 · listed over a yearCISA KEV GitLab — GitLab Community and Enterprise Editions Improper Access Control Vulnerability KEV, EPSS 94.6%
EVRS 86/100 · EVRS priority: Immediate · Exigent, a flag within Immediate. CVSS severity and EPSS are separate measurements, shown below.
Why it matters: Listed in the CISA KEV catalog, and an EPSS probability of 0.946.
#4 77 Urgent CVE-2021-22175 CISA federal deadline · Overdue by 7 monthsCISA KEV GitLab — GitLab Server-Side Request Forgery (SSRF) Vulnerability KEV, EPSS 53.4%
EVRS 77/100 · EVRS priority: Urgent. CVSS severity and EPSS are separate measurements, shown below.
Why it matters: Listed in the CISA KEV catalog, and an EPSS probability of 0.534.
#5 75 Urgent CVE-2021-39935 CISA federal deadline · Overdue by 8 monthsCISA KEV GitLab — GitLab Community and Enterprise Editions Server-Side Request Forgery (SSRF) Vulnerability KEV, EPSS 36.1%
EVRS 75/100 · EVRS priority: Urgent. CVSS severity and EPSS are separate measurements, shown below.
Why it matters: Listed in the CISA KEV catalog, and an EPSS probability of 0.361.