What is the GitLab CNA?

GitLab is a CVE Numbering Authority (CNA) — an organization authorized to assign CVE IDs to vulnerabilities in its scope. It has published 1,076 CVE records since 2020.

How many CVEs has GitLab published?

GitLab has published 1,076 CVE records, including 368 in the last two years.

What is GitLab's CVE data quality grade?

RadicalNotion.AI grades GitLab's CVE data quality as B, with an overall completeness score of 89.2%. This reflects how consistently its CVE records include vendor (100%), product (100%), CVSS (99.9%), and CWE (57%) information.

What products does GitLab publish CVEs for?

GitLab most frequently publishes CVEs for GitLab, Wireshark, debian linux, fedora, GitLab EE.

Which vendors does GitLab cover?

GitLab publishes CVEs across 22 distinct vendors, most often GitLab, Wireshark, debian, fedoraproject, libtiff.

Is GitLab actively publishing CVEs?

GitLab is currently active, based on 368 CVEs in the last two years.

What is the average severity of GitLab's CVEs?

The average CVSS base score across GitLab's scored CVEs is 5.7.

How many critical CVEs has GitLab published?

GitLab has published 48 critical-severity CVEs and 403 high-severity CVEs.

Are any of GitLab's CVEs in CISA's Known Exploited Vulnerabilities catalog?

Yes. 5 of GitLab's CVEs are listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, meaning they are confirmed to be exploited in the wild.

What are the most common weakness types in GitLab's CVEs?

GitLab's CVEs most often map to these CWE weakness types: CWE-770 (Allocation of Resources Without Limits or Throttling), CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), CWE-863 (Incorrect Authorization), CWE-862 (Missing Authorization).

How does GitLab rank among CNAs?

By total CVE volume, GitLab ranks #35 of 370 CNAs, and it reports more complete CVE records than 36% of all CNAs.

RadicalNotion.AI

Log in Start free

Log in

Log in Start free

Grade B

Active

GitLab

Name: GitLab CNA CVE data quality report card
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

CVE Numbering Authority

Latest CVE published February 11, 2026

1,076

CVEs published

Total assigned

5.7

Years active

2020–2026

5.7

Avg CVSS

Across scored CVEs

368

Recent CVEs

Last 2 years

Overview

GitLab is a CVE Numbering Authority that has published 1,076 CVE records since 2020. It is currently classified as active, with 368 CVEs published in the last two years. Its CVE data quality is graded B (89.2% overall completeness).

Among the 370 CNAs tracked here, GitLab ranks #35 by CVE volume and reports more complete records than 36% of all CNAs.

Data quality report card

How complete and consistent GitLab's CVE records are, scored across vendor, product, CVSS, and CWE coverage.

A CVE record only requires a description to be published. “Completeness” measures how often GitLab also fills in the optional — but extremely useful — fields that make a vulnerability actually actionable: the affected vendor and product, a CVSS severity score, and a CWE weakness type. A higher score means more of this CNA’s CVEs include those details, so defenders spend less time enriching records by hand.

Report card grade

B

89.2%

Overall score

Overall completeness89.2%

Vendor completeness100%

Product completeness100%

CVSS completeness99.9%

CWE completeness57%

100%

Update rate

Records revised after publishing

22

Vendor diversity

Distinct vendors covered

247 chars

Avg description length

Per CVE record

2020-06-09

First CVE date

Earliest assignment

2026-02-11

Latest CVE date

Most recent assignment

5.7

Average CVSS

Across scored CVEs

What these scores mean

Vendor completeness: The share of this CNA's CVEs that name an affected vendor.
Product completeness: The share that name a specific affected product.
CVSS completeness: The share that include a CVSS severity score.
CWE completeness: The share mapped to a CWE weakness type.
Update rate: How often this CNA revises CVE records after first publishing them.
Vendor diversity: How many distinct vendors this CNA publishes CVEs for.

Severity and exploitation

How the CVSS severity of GitLab's published CVEs breaks down, and how many are known to be exploited in the wild.

Critical48

High403

Medium760

Low55

In CISA’s Known Exploited Vulnerabilities catalog

5

5 of GitLab's CVEs are confirmed exploited in the wild and carry a CISA remediation deadline.

Common weakness types

The CWE weakness categories GitLab most often assigns to its CVEs. Follow any weakness to its full explanation.

Publishing activity by year

How many CVEs GitLab has published each year.

2020

114

2021

181

2022

183

2023

210

2024

170

2025

181

2026

227

Top vendors

The vendors GitLab publishes the most CVEs for.

GitLab1,048 CVEs
Wireshark149 CVEs
debian60 CVEs
fedoraproject53 CVEs
libtiff32 CVEs
netapp20 CVEs
oracle15 CVEs
vadz12 CVEs

Top products

The products GitLab publishes the most CVEs for.

GitLab1,034 CVEs
Wireshark149 CVEs
debian linux60 CVEs
fedora53 CVEs
GitLab EE44 CVEs
GitLab CE32 CVEs
libtiff32 CVEs
GitLab CE/EE21 CVEs

Latest CVEs

The most recent CVEs assigned by GitLab.

CVE-2026-15168CWE-457
Use of Uninitialized Variable in Wireshark
Low · CVSS 3.3
EPSS 0.1%2026-07-08
CVE-2026-15166CWE-121
Stack-based Buffer Overflow in Wireshark
Medium · CVSS 5.5
EPSS 0.1%2026-07-08
CVE-2026-15174CWE-122
Heap-based Buffer Overflow in Wireshark
Medium · CVSS 5.5
EPSS 0.1%2026-07-08
CVE-2026-15172CWE-606
Unchecked Input for Loop Condition in Wireshark
Medium · CVSS 5.5
EPSS 0.1%2026-07-08
CVE-2026-15173CWE-122
Heap-based Buffer Overflow in Wireshark
Medium · CVSS 5.5
EPSS 0.1%2026-07-08
CVE-2026-15171CWE-476
NULL Pointer Dereference in Wireshark
Medium · CVSS 5.5
EPSS 0.1%2026-07-08
CVE-2026-15169CWE-122
Heap-based Buffer Overflow in Wireshark
High · CVSS 7.5
EPSS 0.2%2026-07-08
CVE-2026-15167CWE-121
Stack-based Buffer Overflow in Wireshark
High · CVSS 7.5
EPSS 0.2%2026-07-08
CVE-2026-15170CWE-122
Heap-based Buffer Overflow in Wireshark
Medium · CVSS 5.5
EPSS 0.1%2026-07-08
CVE-2026-15165CWE-122
Heap-based Buffer Overflow in Wireshark
Medium · CVSS 5.5
EPSS 0.1%2026-07-08
CVE-2026-15163CWE-835
Loop with Unreachable Exit Condition ('Infinite Loop') in Wireshark
High · CVSS 7.5
EPSS 0.2%2026-07-08
CVE-2026-15164CWE-122
Heap-based Buffer Overflow in ciscodump
Medium · CVSS 5.5
EPSS 0.1%2026-07-08

Track new GitLab CVEs as they are published and get AI-written analysis and remediation guidance.

Monitor GitLab CVEs

Other CNAs

Compare data quality across other CVE Numbering Authorities.

mitreGrade F · 112,208 CVEs PatchstackGrade A · 14,729 CVEs VulDBGrade A · 12,140 CVEs microsoftGrade F · 11,701 CVEs redhatGrade F · 10,745 CVEs GitHub_MGrade A · 10,605 CVEs LinuxGrade F · 10,294 CVEs WordfenceGrade A · 8,652 CVEs

Browse all CNAs

Frequently asked questions

Common questions about the GitLab CNA.

What is the GitLab CNA?: GitLab is a CVE Numbering Authority (CNA) — an organization authorized to assign CVE IDs to vulnerabilities in its scope. It has published 1,076 CVE records since 2020.
How many CVEs has GitLab published?: GitLab has published 1,076 CVE records, including 368 in the last two years.
What is GitLab's CVE data quality grade?: RadicalNotion.AI grades GitLab's CVE data quality as B, with an overall completeness score of 89.2%. This reflects how consistently its CVE records include vendor (100%), product (100%), CVSS (99.9%), and CWE (57%) information.
What products does GitLab publish CVEs for?: GitLab most frequently publishes CVEs for GitLab, Wireshark, debian linux, fedora, GitLab EE.
Which vendors does GitLab cover?: GitLab publishes CVEs across 22 distinct vendors, most often GitLab, Wireshark, debian, fedoraproject, libtiff.
Is GitLab actively publishing CVEs?: GitLab is currently active, based on 368 CVEs in the last two years.
What is the average severity of GitLab's CVEs?: The average CVSS base score across GitLab's scored CVEs is 5.7.
How many critical CVEs has GitLab published?: GitLab has published 48 critical-severity CVEs and 403 high-severity CVEs.
Are any of GitLab's CVEs in CISA's Known Exploited Vulnerabilities catalog?: Yes. 5 of GitLab's CVEs are listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, meaning they are confirmed to be exploited in the wild.
What are the most common weakness types in GitLab's CVEs?: GitLab's CVEs most often map to these CWE weakness types: CWE-770 (Allocation of Resources Without Limits or Throttling), CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), CWE-863 (Incorrect Authorization), CWE-862 (Missing Authorization).
How does GitLab rank among CNAs?: By total CVE volume, GitLab ranks #35 of 370 CNAs, and it reports more complete CVE records than 36% of all CNAs.

References

CNA report-card grades are computed by RadicalNotion.AI from published CVE records. CVE data is sourced from the CVE Program.

Track GitLab CVEs

Monitor new vulnerabilities as this CNA publishes them, with AI-written analysis and remediation guidance.

Start free See pricing