The CISA KEV Catalogue, Searchable
Every flaw attackers are known to be using: what it is, how bad, and what fixes it.
- Flaws on the list
- 1,779
- Added in 30 days
- 40
- Used in ransomware
- 361
- In web & server software
- 181
29 Oct 2026 GitLab Community Edition and Enterprise Edition Memory corruption
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- gitlab 19.4.2, gitlab 19.3.5, gitlab 19.2.8, ruby-lang ruby 4.0.8, ruby-lang ruby 3.4.12 and 1 older
- CISA due date
- 1 Nov 2026
- Weakness
- CWE-190
11 Sep 2026 GitLab Community Edition and Enterprise Edition Path traversal
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 18.11.12, 19.0 before 19.0.9, 19.1 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions, an unauthenticated user could have read arbitrary files from the GitLab server due to improper path confinement and missing authentication enforcement in the repository commits API.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- gitlab 19.3.2, gitlab 19.2.6, gitlab 19.1.8, gitlab 19.0.9, gitlab 18.11.12
- CISA due date
- 14 Sep 2026
- Weakness
- CWE-35
18 Feb 2026 GitLab Server-side request forgery
When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab affecting all versions starting from 10.5 was possible to exploit for an unauthenticated attacker even on a GitLab instance where registration is disabled
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- gitlab 13.8.4, gitlab 13.7.7, gitlab 13.6.7
- CISA due date
- 11 Mar 2026
- Weakness
- CWE-918
3 Feb 2026 GitLab Community and Enterprise Editions Server-side request forgery
An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.5 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2. Unauthorized external users could perform Server Side Requests via the CI Lint API
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- gitlab 14.5.2, gitlab 14.4.4, gitlab 14.3.6
- CISA due date
- 24 Feb 2026
- Weakness
- CWE-918
1 May 2024 GitLab CE/EE Authentication bypass
An issue has been discovered in GitLab CE/EE affecting all versions from 16.1 prior to 16.1.6, 16.2 prior to 16.2.9, 16.3 prior to 16.3.7, 16.4 prior to 16.4.5, 16.5 prior to 16.5.6, 16.6 prior to 16.6.4, and 16.7 prior to 16.7.2 in which user account password reset emails could be delivered to an unverified email address.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- gitlab 16.7.2, gitlab 16.6.4, gitlab 16.5.6, gitlab 16.4.5, gitlab 16.3.7 and 2 older
- CISA due date
- 22 May 2024
- Weakness
- CWE-284
On Hacker News
POC of Gitlab Account-Take-Over CVE-2023-70283 Nov 2021 GitLab Community and Enterprise Editions Remote code execution
An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. GitLab was not properly validating image files that were passed to a file parser which resulted in a remote command execution.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- gitlab 13.10.3, gitlab 13.9.6, gitlab 13.8.8
- CISA due date
- 17 Nov 2021
- Weakness
- CWE-20, CWE-95
On Hacker News
Gitlab CVE-2021-22205: RCE by unauthenticated curl -FKnow when it's your software
Get an email within half an hour when a flaw in your software is added. Free.
About the KEV Catalogue
What is the CISA KEV catalogue?
CISA's list of flaws attackers are known to be using. A flaw is added only with reliable evidence of attacks and a known fix.
Why does it matter more than the CVSS score?
Few CVEs are ever used in attacks. These are, so fix them first, whatever their score.
What is the due date?
The deadline for US federal agencies to fix it (BOD 26-04, which replaced BOD 22-01): as little as three days for recent entries. A sensible deadline for anyone.
Does it apply outside the US?
The deadlines don't, but the flaws are in software used everywhere. If you run it, it applies to you.
What does "used in ransomware" mean?
CISA knows ransomware groups have used the flaw.
How often is it updated?
CISA adds flaws several times a week. CVE Hawk checks hourly and alerts you within half an hour if it's your software.