Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: ruby (UTSA-2026-106187)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-106187 advisory. Net::IMAP implements Internet Message Access Protocol IMAP client functionality in Ruby. Prior to 0.6.5 and 0.5.15, several Net::IMAP commands accept a raw string...

CVE-2026-53769: Missing Authorization

Avo is a framework to create admin panels for Ruby on Rails apps. From version 2.28.0 to before version 3.32.0, Avo's direct attachment upload endpoint lacks server-side upload authorization and bypasses the documented field-level upload policy methods such as uploadFIELDID?. An authenticated Avo...

Important: Red Hat Security Advisory: Satellite 6.16.13 Async Update

An update is now available for Red Hat Satellite 6.16 for RHEL 8 and RHEL 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...

ruby-jwt: ruby-jwt: Authentication bypass due to empty key in HMAC verification

A flaw was found in ruby-jwt, a Ruby implementation of the RFC 7519 OAuth JSON Web Token JWT standard. A remote attacker can exploit this vulnerability by crafting a malicious token that is accepted due to an empty key being used in the HMAC Hash-based Message Authentication Code digest calculati...

ruby-jwt: ruby-jwt: Authentication bypass due to empty key in HMAC verification

A flaw was found in ruby-jwt, a Ruby implementation of the RFC 7519 OAuth JSON Web Token JWT standard. A remote attacker can exploit this vulnerability by crafting a malicious token that is accepted due to an empty key being used in the HMAC Hash-based Message Authentication Code digest calculati...

ruby-jwt: ruby-jwt: Authentication bypass due to empty key in HMAC verification

A flaw was found in ruby-jwt, a Ruby implementation of the RFC 7519 OAuth JSON Web Token JWT standard. A remote attacker can exploit this vulnerability by crafting a malicious token that is accepted due to an empty key being used in the HMAC Hash-based Message Authentication Code digest calculati...

Important: Red Hat Security Advisory: Satellite 6.17.11 Async Update

A new release is now available for Red Hat Satellite 6.17 for RHEL 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

ruby-jwt: ruby-jwt: Authentication bypass due to empty key in HMAC verification

A flaw was found in ruby-jwt, a Ruby implementation of the RFC 7519 OAuth JSON Web Token JWT standard. A remote attacker can exploit this vulnerability by crafting a malicious token that is accepted due to an empty key being used in the HMAC Hash-based Message Authentication Code digest calculati...

GHSA-XQQH-3W52-Q8P7 vulnerabilities

Vulnerabilities for packages: ruby3.4-rails, ruby4.0-rails, ruby3.2-rails, ruby3.3-rails...

CVE-2026-79772 vulnerabilities

Vulnerabilities for packages: ruby3.4-rails, ruby4.0-rails, ruby3.2-rails, ruby3.3-rails...

CVE-2026-79770 vulnerabilities

Vulnerabilities for packages: pact-broker-docker, ruby3.3-rails, kube-logging-operator, gitlab-rails-ce, ruby3.2-rails, gitlab-rails-ce-fips, pact-broker-docker-fips, ruby4.0-rails, ruby3.4-rails...

GHSA-RH9X-7XJC-VWX2 vulnerabilities

Vulnerabilities for packages: pact-broker-docker, ruby3.3-rails, kube-logging-operator, gitlab-rails-ce, ruby3.2-rails, gitlab-rails-ce-fips, pact-broker-docker-fips, ruby4.0-rails, ruby3.4-rails...

CVE-2026-79771 vulnerabilities

Vulnerabilities for packages: pact-broker-docker, ruby3.3-rails, kube-logging-operator, gitlab-rails-ce, ruby3.2-rails, gitlab-rails-ce-fips, pact-broker-docker-fips, ruby4.0-rails, ruby3.4-rails...

CVE-2026-79772 vulnerabilities

Vulnerabilities for packages: ruby3.3-rails, ruby4.0-rails, ruby3.2-rails, ruby3.4-rails...

GHSA-XQQH-3W52-Q8P7 vulnerabilities

Vulnerabilities for packages: ruby3.3-rails, ruby4.0-rails, ruby3.2-rails, ruby3.4-rails...

CVE-2026-79771 vulnerabilities

Vulnerabilities for packages: ruby3.2-rails, kube-logging-operator, ruby3.3-rails, ruby4.0-rails, ruby3.4-rails...

CVE-2026-79770 vulnerabilities

Vulnerabilities for packages: ruby3.2-rails, kube-logging-operator, ruby3.3-rails, ruby4.0-rails, ruby3.4-rails...

GHSA-5JHF-FPP7-V2PV vulnerabilities

Vulnerabilities for packages: ruby3.2-rails, kube-logging-operator, ruby3.3-rails, ruby4.0-rails, ruby3.4-rails...

GHSA-RH9X-7XJC-VWX2 vulnerabilities

Vulnerabilities for packages: ruby3.2-rails, kube-logging-operator, ruby3.3-rails, ruby4.0-rails, ruby3.4-rails...

AZL-99087 CVE-2026-85396 affecting package rubygem-rubyzip 2.3.2-1

rubyzip versions before 3.4.0 contain a path traversal vulnerability in Zip::Entryextract that fails to properly validate extraction paths using prefix comparison without trailing separators. Attackers can craft archive entries with names like ../uploadbackup/owned.sh to write files outside the...