The private email address GitLab gives you for filing issues by email is a credential. Anyone who gets it can email a patch that GitLab commits in your name, to any branch you can push to, including ...

Over 1,000 Internet-exposed GitLab servers are still unpatched against a maximum-severity flaw actively exploited in remote code execution attacks.

GitLab is urging users of self-managed instances to patch a critical vulnerability (CVE-2026-97229) in its CI/CD Regular Expression Compiler.

Attackers have started exploiting a maximum-severity GitLab vulnerability patched earlier this month, according to the US ...

GitLab fixes CVE-2026-110264, a critical flaw that could allow unauthenticated code execution on self-managed versions dating back to 7.0.

A long-lived token embedded in GitLab’s issue-creating email address means anyone with the address, not just the project owner, can push code and trigger CI/CD jobs subject to the account’s existing ...

On October 21, GitLab released an emergency patch. There are seven versions: 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, ...

If you operate GitLab in-house, there is a vulnerability you should check today: CVE-2026-97229. It is an integer overflow vulnerability in the CI/CD regular expression compiler, fixed in a critical ...

GitLab said it resolved CI/CD failures and slower interface performance affecting a limited number of GitLab.com customers after several days of intermittent platform disruptions.