commercial-gitlab-rails-ee-fips-19.4

Direct Vulnerabilities

Known vulnerabilities in the commercial-gitlab-rails-ee-fips-19.4 package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free
VulnerabilityVulnerable Version
  • L
GHSA-m6vc-f87m-cc2h

<19.4.1-r4
  • L
GHSA-8wmf-6v46-5gfg

<19.4.1-r4
  • L
Information Exposure

<19.4.1-r4
  • L
GHSA-xv9c-mjw8-79gf

<19.4.1-r4
  • L
GHSA-mvxr-6m87-mv2q

<19.4.1-r4
  • L
Improper Authentication

<19.4.1-r4
  • L
GHSA-pg57-6jwg-q645

<19.4.1-r4
  • L
Resource Exhaustion

<19.4.1-r4
  • L
Interpretation Conflict

<19.4.1-r4
  • L
CVE-2025-67202

<19.4.1-r4
  • L
CVE-2026-56857

<19.4.1-r3
  • L
GHSA-2gfw-j3c5-j46w

<19.4.1-r3
  • L
GHSA-wpfx-qch4-q5j2

<19.4.1-r3
  • L
CVE-2026-78660

<19.4.1-r5
  • L
CVE-2026-97031

<19.4.1-r3
  • L
GHSA-c3q7-m35p-9qq7

<19.4.1-r3
  • L
CVE-2026-78659

<19.4.1-r5
  • L
CVE-2026-94448

<19.4.1-r3
  • L
CVE-2026-94439

<19.4.1-r3
  • L
CVE-2026-94440

<19.4.1-r3
  • L
GHSA-f5vf-8pvc-394g

<19.4.1-r3
  • L
GHSA-874m-fcc5-9gqf

<19.4.1-r3
  • L
GHSA-22jx-p735-qcpm

<19.4.1-r3
  • L
CVE-2026-97030

<19.4.1-r3
  • L
CVE-2026-78669

<19.4.1-r5
  • L
GHSA-hq7w-2xrq-wp2j

<19.4.1-r3
  • L
CVE-2026-78663

<19.4.1-r5
  • L
GHSA-f4xw-m386-m277

<19.4.1-r3
  • L
CVE-2026-56866

<19.4.1-r3
  • L
CVE-2026-97032

<19.4.1-r5
  • L
CVE-2026-78667

<19.4.1-r3
  • L
GHSA-3xpg-4rpp-hhhm

<19.4.1-r1
  • L
CVE-2026-84292

<19.4.1-r1
  • M
Improper Resource Shutdown or Release

<19.4.1-r1
  • L
GHSA-c8x8-7fp4-3x9w

<19.4.1-r1
  • L
GHSA-rx4f-c7p8-82vq

<19.4.1-r1
  • M
Improper Validation of Specified Quantity in Input

<19.4.1-r1
  • L
GHSA-c83g-rgw3-j3cx

<19.4.1-r1
  • L
GHSA-68fv-2mgg-jv7q

<19.4.1-r1
  • H
CVE-2026-14643

<19.4.1-r1
  • L
CVE-2026-56761

<19.4.1-r1
  • L
GHSA-g6gw-c38x-mqfc

<19.4.1-r1
  • L
Directory Traversal

<19.4.1-r1
  • L
GHSA-jqcg-44mw-7w3h

<19.4.1-r1
  • L
CVE-2024-6783

<19.4.1-r1
  • H
CVE-2026-85014

<19.4.1-r1
  • L
HTTP Request Smuggling

<19.4.1-r1
  • L
GHSA-p77w-8qqv-26rm

<19.4.1-r1
  • L
GHSA-9fr6-4gfg-395g

<19.4.1-r1
  • L
Insufficient Comparison

<19.4.1-r1
  • L
Incorrect Regular Expression

<19.4.1-r1
  • L
CVE-2026-102414

<19.4.1-r1
  • L
CVE-2026-84890

<19.4.1-r1
  • M
Directory Traversal

<19.4.1-r1
  • L
CVE-2024-9506

<19.4.1-r1
  • M
Arbitrary Code Injection

<19.4.1-r1
  • M
Directory Traversal

<19.4.1-r1
  • L
GHSA-h3mg-xc3c-68pw

<19.4.1-r1
  • L
GHSA-fx2h-pf6j-xcff

<19.4.1-r1
  • L
GHSA-rv63-4mwf-qqc2

<19.4.1-r1
  • L
CVE-2026-86472

<19.4.1-r1
  • L
GHSA-p9ff-h696-f583

<19.4.1-r1
  • L
Cross-site Scripting (XSS)

<19.4.1-r1
  • L
Resource Exhaustion

<19.4.1-r1
  • L
GHSA-mh99-v99m-4gvg

<19.4.1-r1
  • L
Algorithmic Complexity

<19.4.1-r1
  • M
CVE-2026-16729

<19.4.1-r1
  • L
GHSA-v6wh-96g9-6wx3

<19.4.1-r1
  • L
Inefficient Regular Expression Complexity

<19.4.1-r1
  • L
GHSA-w5hq-g745-h8pq

<19.4.1-r1
  • L
GHSA-f23p-vx2j-j53r

<19.4.1-r1
  • L
GHSA-3pq3-5fj3-cg6v

<19.4.1-r1
  • L
Arbitrary Code Injection

<19.4.1-r1
  • L
GHSA-crvj-82cr-hjcx

<19.4.1-r1
  • L
Resource Exhaustion

<19.4.1-r1
  • L
GHSA-4hqw-qxg8-jxx2

<19.4.1-r1
  • L
GHSA-j8rh-479h-cp32

<19.4.1-r1
  • L
GHSA-mghh-pgcx-3jjj

<19.4.1-r1
  • L
CVE-2026-19534

<19.4.1-r1
  • L
GHSA-rpw4-54j3-4h4q

<19.4.1-r1
  • L
CVE-2026-18540

<19.4.1-r1
  • M
CVE-2026-15157

<19.4.1-r1
  • L
GHSA-477h-4r7f-fvrx

<19.4.1-r1
  • L
CVE-2026-90711

<19.4.1-r1
  • L
GHSA-v3r7-h72x-cjcm

<19.4.1-r1
  • L
GHSA-xgm2-5f3f-mvvc

<19.4.1-r1
  • L
GHSA-j6r3-76f7-8jcv

<19.4.1-r1
  • L
GHSA-c29m-xwm3-cm6r

<19.4.1-r1
  • L
GHSA-69xw-7hcm-h432

<19.4.1-r1
  • L
GHSA-4x5r-pxfx-6jf8

<19.4.1-r1
  • L
CVE-2026-84394

<19.4.1-r1
  • L
GHSA-6j4f-fj2g-mc7p

<19.4.1-r1
  • L
CVE-2026-74866

<19.4.1-r1
  • L
HTTP Request Smuggling

<19.4.1-r1
  • L
CVE-2026-19481

<19.4.1-r1
  • L
Directory Traversal

<19.4.1-r1
  • L
Directory Traversal

<19.4.1-r1
  • L
GHSA-wwfh-h76j-fc44

<19.4.1-r1
  • L
GHSA-5p4m-2wfm-xmqj

<19.4.1-r1
  • L
GHSA-wgpf-jwqj-8h8p

<19.4.1-r1
  • L
Overly Permissive Cross-domain Whitelist

<19.4.1-r1
  • L
Cross-site Scripting (XSS)

<19.4.1-r1
  • C
CVE-2026-13697

<19.4.1-r1
  • L
Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

<19.4.1-r1
  • L
GHSA-9vqf-7f2p-gf9v

<19.4.1-r1
  • L
GHSA-x97p-jq2g-jp4f

<19.4.1-r1
  • L
CVE-2026-19484

<19.4.1-r1
  • L
GHSA-86w9-cpqp-85rv

<19.4.1-r1
  • L
GHSA-88fw-hqm2-52qc

<19.4.1-r1
  • L
GHSA-4w7w-66w2-5vf9

<19.4.1-r1
  • L
GHSA-44g4-m2mj-wpvx

<19.4.1-r1
  • H
Improper Verification of Cryptographic Signature

<19.4.1-r1
  • C
Directory Traversal

<19.4.1-r1
  • L
GHSA-54fx-42gc-7vw4

<19.4.1-r1
  • L
Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

<19.4.1-r1
  • L
Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

<19.4.1-r1
  • M
HTTP Response Splitting

<19.4.1-r1
  • L
Resource Exhaustion

<19.4.1-r1
  • L
Resource Exhaustion

<19.4.1-r1
  • L
GHSA-3jxr-9vmj-r5cp

<19.4.1-r1
  • L
GHSA-4cwx-7wf7-3272

<19.4.1-r1
  • L
Algorithmic Complexity

<19.4.1-r1
  • L
GHSA-r28c-9q8g-f849

<19.4.1-r1
  • H
CVE-2026-84933

<19.4.1-r1
  • L
GHSA-2vr4-cq9g-pvrc

<19.4.1-r1
  • L
GHSA-7mx3-vvmw-hjmv

<19.4.1-r1
  • L
GHSA-58mr-gqgx-xq4g

<19.4.1-r1
  • L
CVE-2026-45249

<19.4.2-r0
  • L
GHSA-3hrh-pfw6-9m5x

<19.4.1-r1
  • H
Uncontrolled Recursion

<19.4.1-r1
  • L
Server-Side Request Forgery (SSRF)

<19.4.1-r1
  • L
GHSA-73wf-gq98-2v4g

<19.4.1-r1
  • L
Race Condition

<19.4.1-r1
  • L
GHSA-rgw5-rvv9-x895

<19.4.1-r1
  • L
GHSA-2gqq-gqf2-x968

<19.4.1-r1
  • L
Improper Encoding or Escaping of Output

<19.4.1-r1
  • L
GHSA-v2wj-q39q-566r

<19.4.1-r1
  • L
Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

<19.4.1-r1
  • M
Improper Authorization

<19.4.1-r1
  • L
GHSA-fxqj-rqcc-2cmp

<19.4.1-r1
  • L
GHSA-m8m8-qj5v-23w3

<19.4.1-r1
  • L
Insufficient Comparison

<19.4.1-r1
  • L
Uncaught Exception

<19.4.1-r1
  • H
Information Exposure

<19.4.1-r1
  • L
CVE-2026-14257

<19.4.1-r1
  • L
GHSA-vh66-26gq-q6x8

<19.4.1-r1
  • L
GHSA-w9m9-85wc-3x92

<19.4.1-r1
  • L
Information Exposure

<19.4.1-r1
  • L
Cross-site Scripting (XSS)

<19.4.1-r1
  • L
GHSA-qhr7-859c-m2p7

<19.4.1-r1
  • L
GHSA-hvrm-45r6-mjfj

<19.4.1-r1
  • L
GHSA-3wwx-pv8p-q78v

<19.4.1-r1
  • L
GHSA-g3ch-rx76-35fx

<19.4.1-r1
  • L
GHSA-f577-qrjj-4474

<19.4.1-r1
  • L
Protection Mechanism Failure

<19.4.1-r1
  • L
Resource Exhaustion

<19.4.1-r1
  • L
Resource Exhaustion

<19.4.1-r1
  • L
GHSA-p98j-92pf-mc4p

<19.4.1-r1
  • M
Cross-site Scripting (XSS)

<19.4.1-r1
  • L
Resource Exhaustion

<19.4.1-r1
  • L
Resource Exhaustion

<19.4.1-r1
  • L
Use of Less Trusted Source

<19.4.1-r1
  • C
CVE-2026-84961

<19.4.1-r1
  • L
GHSA-fgmj-fm8m-jvvx

<19.4.2-r0
  • L
Exposure of Data Element to Wrong Session

<19.4.1-r1
  • L
GHSA-2gcr-mfcq-wcc3

<19.4.1-r1
  • L
Insufficient Verification of Data Authenticity

<19.4.1-r1
  • L
Allocation of Resources Without Limits or Throttling

<19.4.1-r1
  • L
Improper Certificate Validation

<19.4.1-r1
  • L
GHSA-82fw-gwwq-j7x9

<19.4.1-r1
  • L
Reliance on Untrusted Inputs in a Security Decision

<19.4.1-r1
  • L
CVE-2025-14505

<19.4.1-r1
  • L
GHSA-w293-vg96-wgc3

<19.4.1-r1
  • L
GHSA-pqg4-j6r4-53mv

<19.4.1-r1
  • L
Improper Validation of Specified Quantity in Input

<19.4.1-r1
  • M
CVE-2026-84947

<19.4.1-r1
  • L
Inefficient Regular Expression Complexity

<19.4.1-r1
  • L
GHSA-848j-6mx2-7j84

<19.4.1-r1
  • L
GHSA-qx2v-qp2m-jg93

<19.4.1-r1
  • L
GHSA-hrr3-gc8f-f4qj

<19.4.1-r1
  • L
GHSA-hp3w-g68c-fv3c

<19.4.1-r1
  • L
GHSA-m8rv-5g2x-5cg5

<19.4.1-r1
  • L
Uncaught Exception

<19.4.1-r1
  • L
CVE-2026-45819

<19.4.1-r1
  • L
GHSA-w62v-xxxg-mg59

<19.4.1-r1
  • L
GHSA-x8mw-p69m-v3mx

<19.4.1-r1
  • L
GHSA-2883-xcg3-v3hh

<19.4.1-r1
  • L
Arbitrary Code Injection

<19.4.1-r1
  • L
GHSA-xjh9-v7x6-24jw

<19.4.1-r1
  • L
GHSA-r4gj-5m52-g5wh

<19.4.1-r1
  • L
GHSA-6688-9rhm-gjv2

<19.4.1-r1
  • L
GHSA-g2v6-rqmx-r4w6

<19.4.1-r1
  • L
Arbitrary Code Injection

<19.4.1-r1
  • L
GHSA-238p-pmpm-9mq7

<19.4.1-r1
  • M
CVE-2026-85008

<19.4.1-r1
  • H
Out-of-bounds Write

<19.4.1-r1
  • L
GHSA-gqvv-2mrq-wpjv

<19.4.1-r1
  • L
GHSA-8j4g-w8fx-2239

<19.4.1-r1
  • L
GHSA-jr45-8vmc-qm54

<19.4.1-r1
  • L
CVE-2026-18149

<19.4.1-r1
  • H
Improper Validation of Specified Quantity in Input

<19.4.1-r1
  • L
GHSA-cp6q-959q-f8rh

<19.4.1-r1
  • L
GHSA-rfgv-xxqx-mfg5

<19.4.1-r1
  • L
GHSA-542g-h47m-68v8

<19.4.1-r1
  • L
GHSA-frvp-7c67-39w9

<19.4.1-r1
  • L
GHSA-8436-99hf-9mmv

<19.4.1-r1
  • L
CVE-2026-102422

<19.4.1-r1
  • L
GHSA-458j-xx4x-4375

<19.4.1-r1
  • L
GHSA-2jfj-6hjv-fm6j

<19.4.1-r1
  • L
Unintended Proxy or Intermediary ('Confused Deputy')

<19.4.1-r1
  • L
GHSA-qw65-cvwx-89v3

<19.4.1-r1
  • L
GHSA-5j4c-8p2g-v4jx

<19.4.1-r1
  • L
Directory Traversal

<19.4.1-r1
  • L
GHSA-6fw5-9hq8-w87g

<19.4.1-r1
  • H
Incorrect Behavior Order: Validate Before Canonicalize

<19.4.1-r1
  • L
Use of Less Trusted Source

<19.4.1-r1
  • L
Unintended Proxy or Intermediary ('Confused Deputy')

<19.4.1-r1
  • L
GHSA-gxm5-99cw-xjw9

<19.4.1-r1
  • L
GHSA-rj75-hqrm-r3gf

<19.4.1-r1
  • L
Directory Traversal

<19.4.1-r1
  • L
GHSA-r53p-7pc4-xj5r

<19.4.1-r1
  • L
Resource Exhaustion

<19.4.1-r1
  • L
External Control of File Name or Path

<19.4.1-r1
  • L
GHSA-2gc4-cqfq-p2gv

<19.4.1-r1
  • L
GHSA-xrhx-7g5j-rcj5

<19.4.1-r1
  • L
GHSA-79qm-7rj5-m7r9

<19.4.1-r1
  • L
GHSA-qp7p-654g-cw7p

<19.4.1-r1
  • L
Server-Side Request Forgery (SSRF)

<19.4.1-r1
  • L
Resource Exhaustion

<19.4.1-r1
  • L
GHSA-8xcm-r25x-g524

<19.4.1-r1
  • L
CVE-2026-13149

<19.4.1-r1
  • L
GHSA-52cp-r559-cp3m

<19.4.1-r1
  • L
GHSA-w5vr-8v7q-w6rv

<19.4.1-r1
  • L
CVE-2026-85024

<19.4.1-r1
  • L
GHSA-hxh3-vqpv-xpqv

<19.4.1-r1
  • L
Resource Exhaustion

<19.4.1-r1
  • L
Insufficient Verification of Data Authenticity

<19.4.1-r1
  • L
GHSA-253c-mchw-3w2r

<19.4.1-r1
  • L
GHSA-6qxp-vccf-f47h

<19.4.1-r1
  • M
CVE-2026-16728

<19.4.1-r1
  • L
GHSA-q2hr-2g5m-vwhr

<19.4.1-r1
  • L
GHSA-pmjh-fq2x-6v4x

<19.4.1-r1
  • L
GHSA-j6c9-x7qj-28xf

<19.4.1-r1
  • L
GHSA-6g55-p6wh-862q

<19.4.1-r1
  • L
GHSA-vfj7-8cjw-p6xm

<19.4.1-r1
  • L
GHSA-6623-4q32-82v8

<19.4.1-r1
  • L
Information Exposure Through Caching

<19.4.1-r1
  • L
Directory Traversal

<19.4.1-r1
  • L
GHSA-hm8q-7f3q-5f36

<19.4.1-r1