5174 matches found
GHSA-MRX9-2RRP-RHPX vulnerabilities
Vulnerabilities for packages: thingsboard-fips, opensearch-dashboards, thingsboard, unleash, opensearch-dashboards-fips, gitlab-rails-ce-fips...
[SECURITY] [DSA 6546-1] rails security update
------------------------------------------------------------------------- Debian Security Advisory DSA-6546-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff October 06, 2026 https://www.debian.org/security/faq -...
SUSE SLES15 Security Update : rubygem-rails-html-sanitizer (SUSE-SU-2026:4445-1)
The remote SUSE Linux SLES15 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2026:4445-1 advisory. This update for rubygem-rails-html-sanitizer fixes the following issue: - CVE-2026-73648: rails-html-sanitizer: cross-site scripting is possible when t...
Debian dsa-6546 : rails - security update
The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6546 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6546-1 [email protected] https://www.debian.org/securit...
CVE-2026-19484 vulnerabilities
Vulnerabilities for packages: langfuse-fips, langfuse, commercial-gitlab-rails-ee-fips, gitlab-rails-ce, commercial-gitlab-rails-ee, gitlab-rails-ce-fips...
GHSA-XJH9-V7X6-24JW vulnerabilities
Vulnerabilities for packages: langfuse-fips, langfuse, commercial-gitlab-rails-ee-fips, gitlab-rails-ce, commercial-gitlab-rails-ee, gitlab-rails-ce-fips...
Ruby on Rails YAML Deserialization RCE (CVE-2013-0156)
Exploits CVE-2013-0156 in Rails 3.x: XML requests with type=yaml deserialize attacker-controlled YAML into Ruby objects, reaching Kernelsystem via Gem gadgets. !/usr/bin/env python3 -- coding: utf-8 -- """Ruby on Rails XML/YAML deserialization RCE CVE-2013-0156.""" from kittysploit import from...
Astra Linux – Vulnerability in Rails
Active Storage allows users to attach cloud and local files in Rails applications. Before versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, when serving files through Active Storage’s proxy delivery mode, the proxy controller would load the entire requested byte range into memory before sending it. A reque...
Astra Linux – Vulnerability in Rails
A potential information disclosure/vulnerability in Action Pack = 2.0.0, where using the redirectto or polymorphicurl helper with untrusted user input may lead to unintended method executions...
Astra Linux – Vulnerability in Rails
Active Storage allows users to attach cloud and local files in Rails applications. Before versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, Active Storage’s DiskServicepathfor method did not validate that the resolved filesystem path remained within the storage root directory. If a blob key containing path...
Astra Linux – Vulnerability in ruby-rails-html-sanitizer
rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. Certain configurations of rails-html-sanitizer 1.4.4 use a inefficient regular expression that is susceptible to excessive backtracking when attempting to sanitize certain SVG attributes. This may lead to a...
Security update for rubygem-rails-html-sanitizer
This update for rubygem-rails-html-sanitizer fixes the following issue: CVE-2026-73648: rails-html-sanitizer: cross-site scripting is possible when the sanitizer is configured to allow certain SVG reference elements bsc1275199. Patch Instructions: To install this SUSE update use the SUSE...
SUSE-SU-2026:4445-1 Security update for rubygem-rails-html-sanitizer
This update for rubygem-rails-html-sanitizer fixes the following issue: - CVE-2026-73648: rails-html-sanitizer: cross-site scripting is possible when the sanitizer is configured to allow certain SVG reference elements bsc1275199...
CVE-2026-66010 vulnerabilities
Vulnerabilities for packages: awx, opensearch-dashboards, nextcloud-server, langfuse, gitlab-rails-ce, librechat, wazuh-dashboard-fips, kibana, langfuse-fips, wazuh-dashboard, jupyter-base-notebook, tensorflow-gpu-jupyter, opensearch-dashboards-fips, gitlab-rails-ce-fips...
GHSA-JXRP-R7GX-Q4J8 vulnerabilities
Vulnerabilities for packages: awx, opensearch-dashboards, nextcloud-server, langfuse, gitlab-rails-ce, librechat, wazuh-dashboard-fips, kibana, langfuse-fips, wazuh-dashboard, jupyter-base-notebook, tensorflow-gpu-jupyter, opensearch-dashboards-fips, gitlab-rails-ce-fips...
GHSA-P98J-92PF-MC4P vulnerabilities
Vulnerabilities for packages: awx, langfuse-fips, opensearch-dashboards, nextcloud-server, langfuse, commercial-gitlab-rails-ee-fips, gitlab-rails-ce, librechat, wazuh-dashboard-fips, commercial-gitlab-rails-ee, wazuh-dashboard, opensearch-dashboards-fips, gitlab-rails-ce-fips...
CVE-2026-102599 vulnerabilities
Vulnerabilities for packages: commercial-gitlab-rails-ee-fips, gitlab-rails-ce, redisinsight, commercial-gitlab-rails-ee, jupyter-base-notebook, gitlab-rails-ce-fips...
GHSA-2GC4-CQFQ-P2GV vulnerabilities
Vulnerabilities for packages: commercial-gitlab-rails-ee-fips, gitlab-rails-ce, redisinsight, commercial-gitlab-rails-ee, jupyter-base-notebook, gitlab-rails-ce-fips...
Rocky Linux 8 [CIQ] Security Update: libdb-cxx / libdb-cxx-debuginfo / libdb-debuginfo / etc Multiple Vulnerabilities (crlsa-2022_8506)
The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20228506 advisory. netty-codec: Bzip2Decoder doesn't allow setting size restrictions for decompressed data CVE-2021-37136 netty-codec: SnappyFrameDecoder doesn't restrict chu...