Vulnerabilities in GitLab Community and Enterprise Edition — the DevOps platform that, when compromised, can expose an organization's entire source code history and CI/CD pipeline secrets. Combined article + CVE feed for the GitLab beat.https://0daynews.com/en-ushttps://0daynews.com/cve/cve-2021-22175/https://0daynews.com/cve/cve-2021-22175/GitLab contains a server-side request forgery (SSRF) vulnerability when requests to the internal network for webhooks are enabled.Fri, 14 Aug 2026 00:00:00 GMTGitLabmediumcvehttps://0daynews.com/cve/cve-2021-22205/https://0daynews.com/cve/cve-2021-22205/An improper-validation vulnerability in GitLab Community Edition and Enterprise Edition allows an unauthenticated attacker to achieve remote code execution by uploading a crafted image file processed through a vulnerable ExifTool image-metadata parser.Fri, 14 Aug 2026 00:00:00 GMTGitLabcriticalcvehttps://0daynews.com/cve/cve-2021-39935/https://0daynews.com/cve/cve-2021-39935/GitLab Community and Enterprise Editions contain a server-side request forgery vulnerability which could allow unauthorized external users to perform Server Side Requests via the CI Lint API. Fri, 14 Aug 2026 00:00:00 GMTGitLabmediumcvehttps://0daynews.com/cve/cve-2023-7028/https://0daynews.com/cve/cve-2023-7028/GitLab Community and Enterprise Editions contain an improper access control vulnerability. This allows an attacker to trigger password reset emails to be sent to an unverified email address to ultimately facilitate an account takeover.Fri, 14 Aug 2026 00:00:00 GMTGitLabcriticalcvehttps://0daynews.com/articles/2026-07-25-gitlab-18-11-3-rce-poc-published/https://0daynews.com/articles/2026-07-25-gitlab-18-11-3-rce-poc-published/A working RCE exploit for self-managed GitLab 18.11.3 is now public. Any authenticated user can execute server commands as git — no admin rights needed.Sat, 25 Jul 2026 10:00:00 GMTGitLabarticlehttps://0daynews.com/articles/2026-07-06-gitlab-exiftool-rce-cve-2021-22205/https://0daynews.com/articles/2026-07-06-gitlab-exiftool-rce-cve-2021-22205/CVE-2021-22205 was quietly fixed in April 2021 — but its full unauthenticated remote-code-execution severity wasn't widely understood until late 2021, by which point mass exploitation had already begun.Mon, 06 Jul 2026 13:00:00 GMTGitLabarticle