Skip to content
Edition of Sunday, November 8, 2026
Daily CISO

The five-minute briefing for security leaders.

Security vendor · Static application security testing · in CISA KEV

GitLab in the CISA KEV catalog

CISA’s Known Exploited Vulnerabilities catalog lists 6 entries for GitLab as of catalog version 2026.11.06, released November 6, 2026. The newest was added October 29, 2026, and the latest federal due date is November 1, 2026. CISA marks 1 of them as known ransomware use.

Updated

entries in the catalog
6
newest addition
October 29, 2026
latest federal due date
November 1, 2026
marked known ransomware use
1

Directory record

Website
about.gitlab.com
Categories
Static application security testing (primary), Software composition analysis, Secrets detection, Software supply chain security
Headquarters
HQ not established
Founded
Not established
Ownership
Public (Nasdaq Global Market: GTLB)
Company record
GitLab on CISO Tribune

Directory data as of November 8, 2026. What the company sells, and the source for every fact, is on its CISO Tribune page.

KEV entries, newest first

Filed by CISA under the name “GitLab”. Each row links to the CVE’s NVD record; entries added in the last 45 days also link to their place on must-patch. The due date is CISA’s remediation deadline for federal civilian agencies, as the feed states it.

  1. Added October 29, 2026

    CVE-2026-97229 GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability

    Community Edition and Enterprise Edition · on must-patch

    Due November 1, 2026

  2. Added September 11, 2026

    CVE-2026-85706 GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability

    Community Edition and Enterprise Edition

    Due September 14, 2026

  3. Added February 18, 2026

    CVE-2021-22175 GitLab Server-Side Request Forgery (SSRF) Vulnerability

    GitLab

    Due March 11, 2026

  4. Added February 3, 2026

    CVE-2021-39935 GitLab Community and Enterprise Editions Server-Side Request Forgery (SSRF) Vulnerability

    Community and Enterprise Editions

    Due February 24, 2026

  5. Added May 1, 2024

    CVE-2023-7028 GitLab Community and Enterprise Editions Improper Access Control Vulnerability

    GitLab CE/EE

    Due May 22, 2024

  6. Added November 3, 2021

    CVE-2021-22205 GitLab Community and Enterprise Editions Remote Code Execution Vulnerability

    Community and Enterprise Editions · known ransomware use

    Due November 17, 2021

Snapshot of CISA’s feed taken November 7, 2026; the whole catalog is counted on the KEV tracker.

On Daily CISO, newest first

  1. Daily briefing · November 2, 2026

    CISA Confirms Active Exploitation of Max-Severity GitLab Flaw

  2. Daily briefing · October 16, 2026

    GitLab Patches Maximum-Severity CVSS 10.0 RCE in CI/CD Regex Compiler

  3. Daily briefing · October 15, 2026

    GitLab patches maximum-severity CI/CD regex RCE flaw

  4. Weekly archive · Feb 16 – Feb 22, 2026

    CISA adds Dell and GitLab flaws to Known Exploited Vulnerabilities Catalog

  5. Weekly archive · Feb 2 – Feb 8, 2026

    CISA Adds Four Actively Exploited Vulnerabilities to KEV Catalog

  6. Weekly archive · Dec 22 – Dec 28, 2025

    Nissan Discloses Impact From Red Hat GitLab Breach

  7. Weekly archive · Sep 29 – Oct 5, 2025

    Crimson Collective Claims Breach of Red Hat Consulting GitLab

  8. Weekly archive · Apr 29 – May 5, 2024

    CISA Adds GitLab Access-Control Flaw to KEV Catalog

  9. Weekly archive · Aug 22 – Aug 28, 2022

    GitLab Patched Critical Remote Code Execution Flaw

Sources

  1. Cybersecurity and Infrastructure Security Agency, KEV catalog · primary source
  2. Cybersecurity and Infrastructure Security Agency, KEV JSON feed (catalog version 2026.11.06), published November 6, 2026 · primary source
  3. CISO Tribune, vendor directory record for GitLab, published November 8, 2026