Vulnerability Search Examples · Example 2 of 14 in Filters › Affected Products (CPE)

Affected Vendor: GitLab

POSThttps://api.deepinfo.com/v1/discovery/vulnerability-search

CVEs that affect a product of the vendor gitlab.

Field: enrichment.cpe.vendor
Operator: eq

enrichment.cpe.vendor is the vendor part of the CPE name (gitlab, microsoft).

eq matches the exact value gitlab.

In the response, look at results[].enrichment.cpe[].vendor. Every entry of the three CVEs shown is gitlab, for the Community and Enterprise editions of GitLab (criteria ends in community or enterprise), once per affected range.

Request

curl

curl -X POST 'https://api.deepinfo.com/v1/discovery/vulnerability-search?page_size=25' \
  -H 'apikey: YOUR_API_KEY' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
  "filters": {
    "must": [
      {
        "name": "enrichment.cpe.vendor",
        "type": "eq",
        "value": "gitlab"
      }
    ]
  }
}'

Python

import requests

url = "https://api.deepinfo.com/v1/discovery/vulnerability-search"

params = {
    "page_size": "25"
}

headers = {
    "apikey": "YOUR_API_KEY",
    "Accept": "application/json",
    "Content-Type": "application/json"
}

payload = {
    "filters": {
        "must": [
            {
                "name": "enrichment.cpe.vendor",
                "type": "eq",
                "value": "gitlab"
            }
        ]
    }
}

response = requests.post(url, params=params, headers=headers, json=payload)
response.raise_for_status()
print(response.json())

JavaScript

const url = "https://api.deepinfo.com/v1/discovery/vulnerability-search?page_size=25";

const response = await fetch(url, {
  method: "POST",
  headers: {
    "apikey": "YOUR_API_KEY",
    "Accept": "application/json",
    "Content-Type": "application/json"
  },
  body: JSON.stringify({
    filters: {
      must: [
        {
          name: "enrichment.cpe.vendor",
          type: "eq",
          value: "gitlab"
        }
      ]
    }
  }),
});

const data = await response.json();
console.log(data);

package main

import (
	"fmt"
	"io"
	"net/http"
	"strings"
)

func main() {
	payload := strings.NewReader(`{
  "filters": {
    "must": [
      {
        "name": "enrichment.cpe.vendor",
        "type": "eq",
        "value": "gitlab"
      }
    ]
  }
}`)

	req, err := http.NewRequest("POST", "https://api.deepinfo.com/v1/discovery/vulnerability-search?page_size=25", payload)
	if err != nil {
		panic(err)
	}
	req.Header.Set("apikey", "YOUR_API_KEY")
	req.Header.Set("Accept", "application/json")
	req.Header.Set("Content-Type", "application/json")

	res, err := http.DefaultClient.Do(req)
	if err != nil {
		panic(err)
	}
	defer res.Body.Close()

	body, err := io.ReadAll(res.Body)
	if err != nil {
		panic(err)
	}
	fmt.Println(string(body))
}

Java

import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;

public class Main {
    public static void main(String[] args) throws Exception {
        String body = """
            {
              "filters": {
                "must": [
                  {
                    "name": "enrichment.cpe.vendor",
                    "type": "eq",
                    "value": "gitlab"
                  }
                ]
              }
            }""";

        HttpRequest request = HttpRequest.newBuilder()
            .uri(URI.create("https://api.deepinfo.com/v1/discovery/vulnerability-search?page_size=25"))
            .header("apikey", "YOUR_API_KEY")
            .header("Accept", "application/json")
            .header("Content-Type", "application/json")
            .POST(HttpRequest.BodyPublishers.ofString(body))
            .build();

        HttpResponse<String> response = HttpClient.newHttpClient()
            .send(request, HttpResponse.BodyHandlers.ofString());

        System.out.println(response.body());
    }
}

using System;
using System.Net.Http;
using System.Text;

using var client = new HttpClient();

var body = """
    {
      "filters": {
        "must": [
          {
            "name": "enrichment.cpe.vendor",
            "type": "eq",
            "value": "gitlab"
          }
        ]
      }
    }
    """;

var request = new HttpRequestMessage(HttpMethod.Post, "https://api.deepinfo.com/v1/discovery/vulnerability-search?page_size=25");
request.Headers.Add("apikey", "YOUR_API_KEY");
request.Headers.Add("Accept", "application/json");
request.Content = new StringContent(body, Encoding.UTF8, "application/json");

using var response = await client.SendAsync(request);
Console.WriteLine(await response.Content.ReadAsStringAsync());

PHP

<?php

$body = <<<'JSON'
{
  "filters": {
    "must": [
      {
        "name": "enrichment.cpe.vendor",
        "type": "eq",
        "value": "gitlab"
      }
    ]
  }
}
JSON;

$curl = curl_init();

curl_setopt_array($curl, [
    CURLOPT_URL => 'https://api.deepinfo.com/v1/discovery/vulnerability-search?page_size=25',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_CUSTOMREQUEST => 'POST',
    CURLOPT_HTTPHEADER => [
        'apikey: YOUR_API_KEY',
        'Accept: application/json',
        'Content-Type: application/json',
    ],
    CURLOPT_POSTFIELDS => $body,
]);

$response = curl_exec($curl);

if ($response === false) {
    throw new RuntimeException(curl_error($curl));
}

echo $response . PHP_EOL;

Ruby

require 'net/http'
require 'uri'

uri = URI('https://api.deepinfo.com/v1/discovery/vulnerability-search?page_size=25')

request = Net::HTTP::Post.new(uri)
request['apikey'] = 'YOUR_API_KEY'
request['Accept'] = 'application/json'
request['Content-Type'] = 'application/json'
request.body = <<~'JSON'.chomp
  {
    "filters": {
      "must": [
        {
          "name": "enrichment.cpe.vendor",
          "type": "eq",
          "value": "gitlab"
        }
      ]
    }
  }
JSON

response = Net::HTTP.start(uri.hostname, uri.port, use_ssl: uri.scheme == 'https') do |http|
  http.request(request)
end

puts response.body

Response

200 OK · application/json

Shortened for this page: results: 3 of 25 shown; results[].references: first 10 items; results[].enrichment.cwe[].impact: first 10 items

Response Body

{
  "page": 1,
  "page_size": 25,
  "result_count": 1450,
  "results": [
    {
      "id": "CVE-2026-85706",
      "source_identifier": "user@gitlab.com",
      "published": "2026-09-12T03:16:30Z",
      "last_modified": "2026-09-23T22:16:59Z",
      "status": "Modified",
      "evaluator_comment": null,
      "evaluator_solution": null,
      "evaluator_impact": null,
      "cisa_exploit_add": "2026-09-11",
      "cisa_action_due": "2026-09-14",
      "cisa_required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
      "cisa_vulnerability_name": "GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability",
      "descriptions": [
        {
          "lang": "en",
          "value": "GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 18.11.12, 19.0 before 19.0.9, 19.1 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions, an unauthenticated user could have read arbitrary files from the GitLab server due to improper path confinement and missing authentication enforcement in the repository commits API."
        }
      ],
      "references": [
        {
          "url": "https://gitlab.com/gitlab-org/gitlab/-/work_items/627748",
          "source": "user@gitlab.com",
          "tags": [
            "Broken Link"
          ]
        },
        {
          "url": "https://hackerone.com/reports/3909881",
          "source": "user@gitlab.com",
          "tags": [
            "Permissions Required"
          ]
        },
        {
          "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-85706",
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "tags": [
            "Third Party Advisory",
            "US Government Resource"
          ]
        }
      ],
      "metrics": {
        "cvss_metric_v40": null,
        "cvss_metric_v31": [
          {
            "source": "user@gitlab.com",
            "type": "Secondary",
            "cvss_data": {
              "version": "3.1",
              "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N",
              "attack_vector": "NETWORK",
              "attack_complexity": "LOW",
              "privileges_required": "NONE",
              "user_interaction": "NONE",
              "scope": "CHANGED",
              "confidentiality_impact": "HIGH",
              "integrity_impact": "HIGH",
              "availability_impact": "NONE",
              "base_score": 10.0,
              "base_severity": "CRITICAL",
              "exploit_code_maturity": null,
              "remediation_level": null,
              "report_confidence": null,
              "temporal_score": null,
              "temporal_severity": null,
              "confidentiality_requirement": null,
              "integrity_requirement": null,
              "availability_requirement": null,
              "modified_attack_vector": null,
              "modified_attack_complexity": null,
              "modified_privileges_required": null,
              "modified_user_interaction": null,
              "modified_scope": null,
              "modified_confidentiality_impact": null,
              "modified_integrity_impact": null,
              "modified_availability_impact": null,
              "environmental_score": null,
              "environmental_severity": null
            },
            "exploitability_score": 3.9,
            "impact_score": 5.8
          }
        ],
        "cvss_metric_v30": null,
        "cvss_metric_v2": null
      },
      "weaknesses": [
        {
          "source": "user@gitlab.com",
          "type": "Secondary",
          "description": [
            {
              "lang": "en",
              "value": "CWE-22"
            }
          ]
        }
      ],
      "configurations": [
        {
          "operator": null,
          "negate": null,
          "nodes": [
            {
              "operator": "OR",
              "negate": false,
              "cpe_match": [
                {
                  "vulnerable": true,
                  "criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*",
                  "match_criteria_id": "8308AEE0-FFC1-48F0-8E66-E3D6E3EF301E",
                  "version_start_including": "18.7.0",
                  "version_start_excluding": null,
                  "version_end_including": null,
                  "version_end_excluding": "19.1.8"
                },
                {
                  "vulnerable": true,
                  "criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*",
                  "match_criteria_id": "D19F6592-4940-46BE-A140-BCD284B0EC37",
                  "version_start_including": "18.7.0",
                  "version_start_excluding": null,
                  "version_end_including": null,
                  "version_end_excluding": "19.1.8"
                },
                {
                  "vulnerable": true,
                  "criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*",
                  "match_criteria_id": "4A6AAECA-E557-43EF-B109-B92D1281E48B",
                  "version_start_including": "19.2.0",
                  "version_start_excluding": null,
                  "version_end_including": null,
                  "version_end_excluding": "19.2.6"
                },
                {
                  "vulnerable": true,
                  "criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*",
                  "match_criteria_id": "8598AF82-D212-4B5D-ABC3-C12C9B217BF3",
                  "version_start_including": "19.2.0",
                  "version_start_excluding": null,
                  "version_end_including": null,
                  "version_end_excluding": "19.2.6"
                },
                {
                  "vulnerable": true,
                  "criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*",
                  "match_criteria_id": "198FF0EF-1A45-484F-9268-F7821E006BA8",
                  "version_start_including": "19.3.0",
                  "version_start_excluding": null,
                  "version_end_including": null,
                  "version_end_excluding": "19.3.2"
                },
                {
                  "vulnerable": true,
                  "criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*",
                  "match_criteria_id": "03B1901F-AAF4-421E-B704-5345CB840DEF",
                  "version_start_including": "19.3.0",
                  "version_start_excluding": null,
                  "version_end_including": null,
                  "version_end_excluding": "19.3.2"
                }
              ]
            }
          ]
        }
      ],
      "vendor_comments": null,
      "enrichment": {
        "cpe": [
          {
            "criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*",
            "vendor": "gitlab",
            "product": "gitlab",
            "product_type": "a",
            "vulnerable": true,
            "version_start_including": "18.7.0",
            "version_start_excluding": null,
            "version_end_including": null,
            "version_end_excluding": "19.1.8",
            "affected_versions_first": "18.7.0",
            "affected_versions_last": "19.1.7"
          },
          {
            "criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*",
            "vendor": "gitlab",
            "product": "gitlab",
            "product_type": "a",
            "vulnerable": true,
            "version_start_including": "18.7.0",
            "version_start_excluding": null,
            "version_end_including": null,
            "version_end_excluding": "19.1.8",
            "affected_versions_first": "18.7.0",
            "affected_versions_last": "19.1.7"
          },
          {
            "criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*",
            "vendor": "gitlab",
            "product": "gitlab",
            "product_type": "a",
            "vulnerable": true,
            "version_start_including": "19.2.0",
            "version_start_excluding": null,
            "version_end_including": null,
            "version_end_excluding": "19.2.6",
            "affected_versions_first": "19.2.0",
            "affected_versions_last": "19.2.5"
          },
          {
            "criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*",
            "vendor": "gitlab",
            "product": "gitlab",
            "product_type": "a",
            "vulnerable": true,
            "version_start_including": "19.2.0",
            "version_start_excluding": null,
            "version_end_including": null,
            "version_end_excluding": "19.2.6",
            "affected_versions_first": "19.2.0",
            "affected_versions_last": "19.2.5"
          },
          {
            "criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*",
            "vendor": "gitlab",
            "product": "gitlab",
            "product_type": "a",
            "vulnerable": true,
            "version_start_including": "19.3.0",
            "version_start_excluding": null,
            "version_end_including": null,
            "version_end_excluding": "19.3.2",
            "affected_versions_first": "19.3.0",
            "affected_versions_last": "19.3.1"
          },
          {
            "criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*",
            "vendor": "gitlab",
            "product": "gitlab",
            "product_type": "a",
            "vulnerable": true,
            "version_start_including": "19.3.0",
            "version_start_excluding": null,
            "version_end_including": null,
            "version_end_excluding": "19.3.2",
            "affected_versions_first": "19.3.0",
            "affected_versions_last": "19.3.1"
          }
        ],
        "cwe": [
          {
            "id": 22,
            "owasptop10_2021": "A01 Broken Access Control",
            "name": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')",
            "description": "The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.",
            "capec_id": [
              64,
              76,
              78,
              79,
              126
            ],
            "scope": [
              "Availability",
              "Confidentiality",
              "Integrity"
            ],
            "impact": [
              "DoS: Crash, Exit, or Restart",
              "Execute Unauthorized Code or Commands",
              "Modify Files or Directories",
              "Read Files or Directories"
            ],
            "detection_method": [
              "Architecture or Design Review",
              "Automated Static Analysis",
              "Automated Static Analysis - Binary or Bytecode",
              "Automated Static Analysis - Source Code",
              "Dynamic Analysis with Automated Results Interpretation",
              "Dynamic Analysis with Manual Results Interpretation",
              "Manual Static Analysis",
              "Manual Static Analysis - Binary or Bytecode",
              "Manual Static Analysis - Source Code"
            ]
          }
        ],
        "epss_score": {
          "epss": 0.09287,
          "percentile": 0.95144,
          "date": "2026-09-23"
        },
        "cisa_kev": {
          "vendor_project": "GitLab",
          "product": "Community Edition and Enterprise Edition",
          "vulnerability_name": "GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability",
          "date_added": "2026-09-11",
          "short_description": "GitLab Community Edition and Enterprise Edition contains a path traversal vulnerability that allows an unauthenticated user to read arbitrary files due to an improper path confinement and missing authentication enforcement in the repository commits API.",
          "required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
          "due_date": "2026-09-14",
          "known_ransomware_campaign_use": "Unknown",
          "notes": "https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-3-2-released/ ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-85706"
        },
        "vdeep_metric": {
          "available_versions": [
            "3.1"
          ],
          "source": "user@gitlab.com",
          "type": "Secondary",
          "cvss_data": {
            "version": "3.1",
            "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N",
            "attack_vector": "NETWORK",
            "attack_complexity": "LOW",
            "attack_requirements": null,
            "privileges_required": "NONE",
            "user_interaction": "NONE",
            "vulnerable_system_confidentiality": "HIGH",
            "vulnerable_system_integrity": "HIGH",
            "vulnerable_system_availability": "NONE",
            "subsequent_system_confidentiality": null,
            "subsequent_system_integrity": null,
            "subsequent_system_availability": null,
            "exploit_maturity": null,
            "confidentiality_requirements": null,
            "integrity_requirements": null,
            "availability_requirements": null,
            "modified_attack_vector": null,
            "modified_attack_complexity": null,
            "modified_attack_requirements": null,
            "modified_privileges_required": null,
            "modified_user_interaction": null,
            "modified_vulnerable_system_confidentiality": null,
            "modified_vulnerable_system_integrity": null,
            "modified_vulnerable_system_availability": null,
            "modified_subsequent_system_confidentiality": null,
            "modified_subsequent_system_integrity": null,
            "modified_subsequent_system_availability": null,
            "safety": null,
            "automatable": null,
            "recovery": null,
            "value_density": null,
            "vulnerability_response_effort": null,
            "provider_urgency": null,
            "base_score": 10.0,
            "base_severity": "CRITICAL"
          }
        }
      }
    },
    {
      "id": "CVE-2021-22205",
      "source_identifier": "user@gitlab.com",
      "published": "2021-04-23T18:15:08Z",
      "last_modified": "2026-08-06T05:16:35Z",
      "status": "Analyzed",
      "evaluator_comment": null,
      "evaluator_solution": null,
      "evaluator_impact": null,
      "cisa_exploit_add": "2021-11-03",
      "cisa_action_due": "2021-11-17",
      "cisa_required_action": "Apply updates per vendor instructions.",
      "cisa_vulnerability_name": "GitLab Community and Enterprise Editions Remote Code Execution Vulnerability",
      "descriptions": [
        {
          "lang": "en",
          "value": "An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. GitLab was not properly validating image files that were passed to a file parser which resulted in a remote command execution."
        },
        {
          "lang": "es",
          "value": "Se ha detectado un problema en GitLab CE/EE que afecta a todas las versiones a partir de 11.9.&#xa0;GitLab no estaba comprobado apropiadamente archivos de imagen que fueron pasados a un analizador de archivos, lo que resultó en una ejecución de comando remoto"
        }
      ],
      "references": [
        {
          "url": "http://packetstormsecurity.com/files/164768/GitLab-Unauthenticated-Remote-ExifTool-Command-Injection.html",
          "source": "user@gitlab.com",
          "tags": [
            "Exploit",
            "Third Party Advisory",
            "VDB Entry"
          ]
        },
        {
          "url": "http://packetstormsecurity.com/files/164994/GitLab-13.10.2-Remote-Code-Execution.html",
          "source": "user@gitlab.com",
          "tags": [
            "Exploit",
            "Third Party Advisory",
            "VDB Entry"
          ]
        },
        {
          "url": "https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22205.json",
          "source": "user@gitlab.com",
          "tags": [
            "Vendor Advisory"
          ]
        },
        {
          "url": "https://gitlab.com/gitlab-org/gitlab/-/issues/327121",
          "source": "user@gitlab.com",
          "tags": [
            "Broken Link"
          ]
        },
        {
          "url": "https://hackerone.com/reports/1154542",
          "source": "user@gitlab.com",
          "tags": [
            "Permissions Required",
            "Third Party Advisory"
          ]
        },
        {
          "url": "http://packetstormsecurity.com/files/164768/GitLab-Unauthenticated-Remote-ExifTool-Command-Injection.html",
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Exploit",
            "Third Party Advisory",
            "VDB Entry"
          ]
        },
        {
          "url": "http://packetstormsecurity.com/files/164994/GitLab-13.10.2-Remote-Code-Execution.html",
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Exploit",
            "Third Party Advisory",
            "VDB Entry"
          ]
        },
        {
          "url": "https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22205.json",
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Vendor Advisory"
          ]
        },
        {
          "url": "https://gitlab.com/gitlab-org/gitlab/-/issues/327121",
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Broken Link"
          ]
        },
        {
          "url": "https://hackerone.com/reports/1154542",
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Permissions Required",
            "Third Party Advisory"
          ]
        }
      ],
      "metrics": {
        "cvss_metric_v40": null,
        "cvss_metric_v31": [
          {
            "source": "user@gitlab.com",
            "type": "Secondary",
            "cvss_data": {
              "version": "3.1",
              "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
              "attack_vector": "NETWORK",
              "attack_complexity": "LOW",
              "privileges_required": "NONE",
              "user_interaction": "NONE",
              "scope": "CHANGED",
              "confidentiality_impact": "HIGH",
              "integrity_impact": "HIGH",
              "availability_impact": "HIGH",
              "base_score": 10.0,
              "base_severity": "CRITICAL",
              "exploit_code_maturity": null,
              "remediation_level": null,
              "report_confidence": null,
              "temporal_score": null,
              "temporal_severity": null,
              "confidentiality_requirement": null,
              "integrity_requirement": null,
              "availability_requirement": null,
              "modified_attack_vector": null,
              "modified_attack_complexity": null,
              "modified_privileges_required": null,
              "modified_user_interaction": null,
              "modified_scope": null,
              "modified_confidentiality_impact": null,
              "modified_integrity_impact": null,
              "modified_availability_impact": null,
              "environmental_score": null,
              "environmental_severity": null
            },
            "exploitability_score": 3.9,
            "impact_score": 6.0
          },
          {
            "source": "user@nist.gov",
            "type": "Primary",
            "cvss_data": {
              "version": "3.1",
              "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
              "attack_vector": "NETWORK",
              "attack_complexity": "LOW",
              "privileges_required": "NONE",
              "user_interaction": "NONE",
              "scope": "CHANGED",
              "confidentiality_impact": "HIGH",
              "integrity_impact": "HIGH",
              "availability_impact": "HIGH",
              "base_score": 10.0,
              "base_severity": "CRITICAL",
              "exploit_code_maturity": null,
              "remediation_level": null,
              "report_confidence": null,
              "temporal_score": null,
              "temporal_severity": null,
              "confidentiality_requirement": null,
              "integrity_requirement": null,
              "availability_requirement": null,
              "modified_attack_vector": null,
              "modified_attack_complexity": null,
              "modified_privileges_required": null,
              "modified_user_interaction": null,
              "modified_scope": null,
              "modified_confidentiality_impact": null,
              "modified_integrity_impact": null,
              "modified_availability_impact": null,
              "environmental_score": null,
              "environmental_severity": null
            },
            "exploitability_score": 3.9,
            "impact_score": 6.0
          }
        ],
        "cvss_metric_v30": null,
        "cvss_metric_v2": [
          {
            "source": "user@nist.gov",
            "type": "Primary",
            "cvss_data": {
              "version": "2.0",
              "vector_string": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
              "access_vector": "NETWORK",
              "access_complexity": "LOW",
              "authentication": "NONE",
              "confidentiality_impact": "PARTIAL",
              "integrity_impact": "PARTIAL",
              "availability_impact": "PARTIAL",
              "base_score": 7.5,
              "exploitability": null,
              "remediation_level": null,
              "report_confidence": null,
              "temporal_score": null,
              "collateral_damage_potential": null,
              "target_distribution": null,
              "confidentiality_requirement": null,
              "integrity_requirement": null,
              "availability_requirement": null,
              "environmental_score": null
            },
            "base_severity": "HIGH",
            "exploitability_score": 10.0,
            "impact_score": 6.4,
            "ac_insuf_info": false,
            "obtain_all_privilege": false,
            "obtain_user_privilege": false,
            "obtain_other_privilege": false,
            "user_interaction_required": false
          }
        ]
      },
      "weaknesses": [
        {
          "source": "user@nist.gov",
          "type": "Primary",
          "description": [
            {
              "lang": "en",
              "value": "CWE-94"
            }
          ]
        },
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "type": "Secondary",
          "description": [
            {
              "lang": "en",
              "value": "CWE-94"
            }
          ]
        }
      ],
      "configurations": [
        {
          "operator": null,
          "negate": null,
          "nodes": [
            {
              "operator": "OR",
              "negate": false,
              "cpe_match": [
                {
                  "vulnerable": true,
                  "criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*",
                  "match_criteria_id": "01EAFA19-205A-4512-9B97-CAE6C5C9E150",
                  "version_start_including": "11.9.0",
                  "version_start_excluding": null,
                  "version_end_including": null,
                  "version_end_excluding": "13.8.8"
                },
                {
                  "vulnerable": true,
                  "criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*",
                  "match_criteria_id": "E50A00D3-A0CA-4A2C-9863-DF3FDD03598F",
                  "version_start_including": "11.9.0",
                  "version_start_excluding": null,
                  "version_end_including": null,
                  "version_end_excluding": "13.8.8"
                },
                {
                  "vulnerable": true,
                  "criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*",
                  "match_criteria_id": "2A6892FA-6192-48DE-B3A6-E3992A95487D",
                  "version_start_including": "13.9.0",
                  "version_start_excluding": null,
                  "version_end_including": null,
                  "version_end_excluding": "13.9.6"
                },
                {
                  "vulnerable": true,
                  "criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*",
                  "match_criteria_id": "C38714A5-8AE4-432E-B67B-99F393E1D566",
                  "version_start_including": "13.9.0",
                  "version_start_excluding": null,
                  "version_end_including": null,
                  "version_end_excluding": "13.9.6"
                },
                {
                  "vulnerable": true,
                  "criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*",
                  "match_criteria_id": "AD03F460-6E1E-4504-B924-D416AF98744B",
                  "version_start_including": "13.10.0",
                  "version_start_excluding": null,
                  "version_end_including": null,
                  "version_end_excluding": "13.10.3"
                },
                {
                  "vulnerable": true,
                  "criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*",
                  "match_criteria_id": "58904C4B-E763-4870-921D-65D6A7F6A0AF",
                  "version_start_including": "13.10.0",
                  "version_start_excluding": null,
                  "version_end_including": null,
                  "version_end_excluding": "13.10.3"
                }
              ]
            }
          ]
        }
      ],
      "vendor_comments": null,
      "enrichment": {
        "cpe": [
          {
            "criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*",
            "vendor": "gitlab",
            "product": "gitlab",
            "product_type": "a",
            "vulnerable": true,
            "version_start_including": "11.9.0",
            "version_start_excluding": null,
            "version_end_including": null,
            "version_end_excluding": "13.8.8",
            "affected_versions_first": "11.9.0",
            "affected_versions_last": "13.8.7"
          },
          {
            "criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*",
            "vendor": "gitlab",
            "product": "gitlab",
            "product_type": "a",
            "vulnerable": true,
            "version_start_including": "11.9.0",
            "version_start_excluding": null,
            "version_end_including": null,
            "version_end_excluding": "13.8.8",
            "affected_versions_first": "11.9.0",
            "affected_versions_last": "13.8.7"
          },
          {
            "criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*",
            "vendor": "gitlab",
            "product": "gitlab",
            "product_type": "a",
            "vulnerable": true,
            "version_start_including": "13.9.0",
            "version_start_excluding": null,
            "version_end_including": null,
            "version_end_excluding": "13.9.6",
            "affected_versions_first": "13.9.0",
            "affected_versions_last": "13.9.5"
          },
          {
            "criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*",
            "vendor": "gitlab",
            "product": "gitlab",
            "product_type": "a",
            "vulnerable": true,
            "version_start_including": "13.9.0",
            "version_start_excluding": null,
            "version_end_including": null,
            "version_end_excluding": "13.9.6",
            "affected_versions_first": "13.9.0",
            "affected_versions_last": "13.9.5"
          },
          {
            "criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*",
            "vendor": "gitlab",
            "product": "gitlab",
            "product_type": "a",
            "vulnerable": true,
            "version_start_including": "13.10.0",
            "version_start_excluding": null,
            "version_end_including": null,
            "version_end_excluding": "13.10.3",
            "affected_versions_first": "13.10.0",
            "affected_versions_last": "13.10.2"
          },
          {
            "criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*",
            "vendor": "gitlab",
            "product": "gitlab",
            "product_type": "a",
            "vulnerable": true,
            "version_start_including": "13.10.0",
            "version_start_excluding": null,
            "version_end_including": null,
            "version_end_excluding": "13.10.3",
            "affected_versions_first": "13.10.0",
            "affected_versions_last": "13.10.2"
          }
        ],
        "cwe": [
          {
            "id": 94,
            "owasptop10_2021": "A03 Injection",
            "name": "Improper Control of Generation of Code ('Code Injection')",
            "description": "The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.",
            "capec_id": [
              35,
              77,
              242
            ],
            "scope": [
              "Access Control",
              "Availability",
              "Confidentiality",
              "Integrity",
              "Non-Repudiation"
            ],
            "impact": [
              "Bypass Protection Mechanism",
              "Execute Unauthorized Code or Commands",
              "Gain Privileges or Assume Identity",
              "Hide Activities"
            ],
            "detection_method": [
              "Automated Static Analysis"
            ]
          }
        ],
        "epss_score": {
          "epss": 0.99731,
          "percentile": 0.99953,
          "date": "2026-09-23"
        },
        "cisa_kev": {
          "vendor_project": "GitLab",
          "product": "Community and Enterprise Editions",
          "vulnerability_name": "GitLab Community and Enterprise Editions Remote Code Execution Vulnerability",
          "date_added": "2021-11-03",
          "short_description": "GitHub Community and Enterprise Editions that utilize the ability to upload images through GitLab Workhorse are vulnerable to remote code execution. Workhorse passes image file extensions through ExifTool, which improperly validates the image files.",
          "required_action": "Apply updates per vendor instructions.",
          "due_date": "2021-11-17",
          "known_ransomware_campaign_use": "Known",
          "notes": "https://nvd.nist.gov/vuln/detail/CVE-2021-22205"
        },
        "vdeep_metric": {
          "available_versions": [
            "3.1",
            "2.0"
          ],
          "source": "user@nist.gov",
          "type": "Primary",
          "cvss_data": {
            "version": "3.1",
            "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "attack_vector": "NETWORK",
            "attack_complexity": "LOW",
            "attack_requirements": null,
            "privileges_required": "NONE",
            "user_interaction": "NONE",
            "vulnerable_system_confidentiality": "HIGH",
            "vulnerable_system_integrity": "HIGH",
            "vulnerable_system_availability": "HIGH",
            "subsequent_system_confidentiality": null,
            "subsequent_system_integrity": null,
            "subsequent_system_availability": null,
            "exploit_maturity": null,
            "confidentiality_requirements": null,
            "integrity_requirements": null,
            "availability_requirements": null,
            "modified_attack_vector": null,
            "modified_attack_complexity": null,
            "modified_attack_requirements": null,
            "modified_privileges_required": null,
            "modified_user_interaction": null,
            "modified_vulnerable_system_confidentiality": null,
            "modified_vulnerable_system_integrity": null,
            "modified_vulnerable_system_availability": null,
            "modified_subsequent_system_confidentiality": null,
            "modified_subsequent_system_integrity": null,
            "modified_subsequent_system_availability": null,
            "safety": null,
            "automatable": null,
            "recovery": null,
            "value_density": null,
            "vulnerability_response_effort": null,
            "provider_urgency": null,
            "base_score": 10.0,
            "base_severity": "CRITICAL"
          }
        }
      }
    },
    {
      "id": "CVE-2020-13300",
      "source_identifier": "user@gitlab.com",
      "published": "2020-09-14T19:15:10Z",
      "last_modified": "2026-06-17T02:52:54Z",
      "status": "Modified",
      "evaluator_comment": null,
      "evaluator_solution": null,
      "evaluator_impact": null,
      "cisa_exploit_add": null,
      "cisa_action_due": null,
      "cisa_required_action": null,
      "cisa_vulnerability_name": null,
      "descriptions": [
        {
          "lang": "en",
          "value": "GitLab CE/EE version 13.3 prior to 13.3.4 was vulnerable to an OAuth authorization scope change without user consent in the middle of the authorization flow."
        },
        {
          "lang": "es",
          "value": "La versión 13.3 de GitLab CE/EE anterior a la 13.3.4 era vulnerable a un cambio de ámbito de autorización OAuth sin el consentimiento del usuario en medio del flujo de autorización"
        }
      ],
      "references": [
        {
          "url": "https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13300.json",
          "source": "user@gitlab.com",
          "tags": [
            "Vendor Advisory"
          ]
        },
        {
          "url": "https://gitlab.com/gitlab-org/gitlab/-/issues/219931",
          "source": "user@gitlab.com",
          "tags": [
            "Broken Link"
          ]
        },
        {
          "url": "https://hackerone.com/reports/884766",
          "source": "user@gitlab.com",
          "tags": [
            "Permissions Required",
            "Third Party Advisory"
          ]
        },
        {
          "url": "https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13300.json",
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Vendor Advisory"
          ]
        },
        {
          "url": "https://gitlab.com/gitlab-org/gitlab/-/issues/219931",
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Broken Link"
          ]
        },
        {
          "url": "https://hackerone.com/reports/884766",
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Permissions Required",
            "Third Party Advisory"
          ]
        }
      ],
      "metrics": {
        "cvss_metric_v40": null,
        "cvss_metric_v31": [
          {
            "source": "user@gitlab.com",
            "type": "Secondary",
            "cvss_data": {
              "version": "3.1",
              "vector_string": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N",
              "attack_vector": "NETWORK",
              "attack_complexity": "HIGH",
              "privileges_required": "NONE",
              "user_interaction": "REQUIRED",
              "scope": "CHANGED",
              "confidentiality_impact": "HIGH",
              "integrity_impact": "HIGH",
              "availability_impact": "NONE",
              "base_score": 8.0,
              "base_severity": "HIGH",
              "exploit_code_maturity": null,
              "remediation_level": null,
              "report_confidence": null,
              "temporal_score": null,
              "temporal_severity": null,
              "confidentiality_requirement": null,
              "integrity_requirement": null,
              "availability_requirement": null,
              "modified_attack_vector": null,
              "modified_attack_complexity": null,
              "modified_privileges_required": null,
              "modified_user_interaction": null,
              "modified_scope": null,
              "modified_confidentiality_impact": null,
              "modified_integrity_impact": null,
              "modified_availability_impact": null,
              "environmental_score": null,
              "environmental_severity": null
            },
            "exploitability_score": 1.6,
            "impact_score": 5.8
          },
          {
            "source": "user@nist.gov",
            "type": "Primary",
            "cvss_data": {
              "version": "3.1",
              "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N",
              "attack_vector": "NETWORK",
              "attack_complexity": "LOW",
              "privileges_required": "NONE",
              "user_interaction": "NONE",
              "scope": "CHANGED",
              "confidentiality_impact": "HIGH",
              "integrity_impact": "HIGH",
              "availability_impact": "NONE",
              "base_score": 10.0,
              "base_severity": "CRITICAL",
              "exploit_code_maturity": null,
              "remediation_level": null,
              "report_confidence": null,
              "temporal_score": null,
              "temporal_severity": null,
              "confidentiality_requirement": null,
              "integrity_requirement": null,
              "availability_requirement": null,
              "modified_attack_vector": null,
              "modified_attack_complexity": null,
              "modified_privileges_required": null,
              "modified_user_interaction": null,
              "modified_scope": null,
              "modified_confidentiality_impact": null,
              "modified_integrity_impact": null,
              "modified_availability_impact": null,
              "environmental_score": null,
              "environmental_severity": null
            },
            "exploitability_score": 3.9,
            "impact_score": 5.8
          }
        ],
        "cvss_metric_v30": null,
        "cvss_metric_v2": [
          {
            "source": "user@nist.gov",
            "type": "Primary",
            "cvss_data": {
              "version": "2.0",
              "vector_string": "AV:N/AC:L/Au:N/C:P/I:P/A:N",
              "access_vector": "NETWORK",
              "access_complexity": "LOW",
              "authentication": "NONE",
              "confidentiality_impact": "PARTIAL",
              "integrity_impact": "PARTIAL",
              "availability_impact": "NONE",
              "base_score": 6.4,
              "exploitability": null,
              "remediation_level": null,
              "report_confidence": null,
              "temporal_score": null,
              "collateral_damage_potential": null,
              "target_distribution": null,
              "confidentiality_requirement": null,
              "integrity_requirement": null,
              "availability_requirement": null,
              "environmental_score": null
            },
            "base_severity": "MEDIUM",
            "exploitability_score": 10.0,
            "impact_score": 4.9,
            "ac_insuf_info": false,
            "obtain_all_privilege": false,
            "obtain_user_privilege": false,
            "obtain_other_privilege": false,
            "user_interaction_required": false
          }
        ]
      },
      "weaknesses": [
        {
          "source": "user@nist.gov",
          "type": "Primary",
          "description": [
            {
              "lang": "en",
              "value": "CWE-863"
            }
          ]
        }
      ],
      "configurations": [
        {
          "operator": null,
          "negate": null,
          "nodes": [
            {
              "operator": "OR",
              "negate": false,
              "cpe_match": [
                {
                  "vulnerable": true,
                  "criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*",
                  "match_criteria_id": "CE11E630-53C8-43AF-9F81-EA4AD52D8241",
                  "version_start_including": "13.3.0",
                  "version_start_excluding": null,
                  "version_end_including": null,
                  "version_end_excluding": "13.3.4"
                },
                {
                  "vulnerable": true,
                  "criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*",
                  "match_criteria_id": "5044D423-9351-4840-BAD4-43EFB42FC527",
                  "version_start_including": "13.3.0",
                  "version_start_excluding": null,
                  "version_end_including": null,
                  "version_end_excluding": "13.3.4"
                }
              ]
            }
          ]
        }
      ],
      "vendor_comments": null,
      "enrichment": {
        "cpe": [
          {
            "criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*",
            "vendor": "gitlab",
            "product": "gitlab",
            "product_type": "a",
            "vulnerable": true,
            "version_start_including": "13.3.0",
            "version_start_excluding": null,
            "version_end_including": null,
            "version_end_excluding": "13.3.4",
            "affected_versions_first": "13.3.0",
            "affected_versions_last": "13.3.2"
          },
          {
            "criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*",
            "vendor": "gitlab",
            "product": "gitlab",
            "product_type": "a",
            "vulnerable": true,
            "version_start_including": "13.3.0",
            "version_start_excluding": null,
            "version_end_including": null,
            "version_end_excluding": "13.3.4",
            "affected_versions_first": "13.3.0",
            "affected_versions_last": "13.3.2"
          }
        ],
        "cwe": [
          {
            "id": 863,
            "owasptop10_2021": "A01 Broken Access Control",
            "name": "Incorrect Authorization",
            "description": "The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.",
            "capec_id": null,
            "scope": [
              "Access Control",
              "Availability",
              "Confidentiality",
              "Integrity"
            ],
            "impact": [
              "Bypass Protection Mechanism",
              "DoS: Crash, Exit, or Restart",
              "DoS: Resource Consumption (CPU)",
              "DoS: Resource Consumption (Memory)",
              "DoS: Resource Consumption (Other)",
              "Execute Unauthorized Code or Commands",
              "Gain Privileges or Assume Identity",
              "Modify Application Data",
              "Modify Files or Directories",
              "Read Application Data"
            ],
            "detection_method": [
              "Architecture or Design Review",
              "Automated Dynamic Analysis",
              "Automated Static Analysis",
              "Automated Static Analysis - Source Code",
              "Dynamic Analysis with Automated Results Interpretation",
              "Dynamic Analysis with Manual Results Interpretation",
              "Manual Analysis",
              "Manual Static Analysis - Binary or Bytecode",
              "Manual Static Analysis - Source Code"
            ]
          }
        ],
        "epss_score": {
          "epss": 0.01292,
          "percentile": 0.69022,
          "date": "2026-09-23"
        },
        "cisa_kev": null,
        "vdeep_metric": {
          "available_versions": [
            "3.1",
            "2.0"
          ],
          "source": "user@nist.gov",
          "type": "Primary",
          "cvss_data": {
            "version": "3.1",
            "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N",
            "attack_vector": "NETWORK",
            "attack_complexity": "LOW",
            "attack_requirements": null,
            "privileges_required": "NONE",
            "user_interaction": "NONE",
            "vulnerable_system_confidentiality": "HIGH",
            "vulnerable_system_integrity": "HIGH",
            "vulnerable_system_availability": "NONE",
            "subsequent_system_confidentiality": null,
            "subsequent_system_integrity": null,
            "subsequent_system_availability": null,
            "exploit_maturity": null,
            "confidentiality_requirements": null,
            "integrity_requirements": null,
            "availability_requirements": null,
            "modified_attack_vector": null,
            "modified_attack_complexity": null,
            "modified_attack_requirements": null,
            "modified_privileges_required": null,
            "modified_user_interaction": null,
            "modified_vulnerable_system_confidentiality": null,
            "modified_vulnerable_system_integrity": null,
            "modified_vulnerable_system_availability": null,
            "modified_subsequent_system_confidentiality": null,
            "modified_subsequent_system_integrity": null,
            "modified_subsequent_system_availability": null,
            "safety": null,
            "automatable": null,
            "recovery": null,
            "value_density": null,
            "vulnerability_response_effort": null,
            "provider_urgency": null,
            "base_score": 10.0,
            "base_severity": "CRITICAL"
          }
        }
      }
    }
  ]
}

Content-Type: application/json
ratelimit-limit: 1
ratelimit-remaining: 0
ratelimit-reset: 1
x-ratelimit-limit-second: 1
x-ratelimit-remaining-second: 0
deepinfo-request-id: 5f0c6a8e-1b2d-4c3e-9f4a-7b8c9d0e1f2a

Request

What this example sends. Every parameter is documented on Search; the exact request is in the code panel.

Parameter	Value
`page_size`query	`25`
`filters.must[0].name`body	`enrichment.cpe.vendor`
`filters.must[0].type`body	`eq`
`filters.must[0].value`body	`gitlab`

Reference updated September 26, 2026

Request

Related Examples