GHSA-PGGX-2V9R-J6GM vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce, gitlab-runner, gitlab-runner-fips...

Possible XSS vulnerability with certain configurations of rails-html-sanitizer

Summary There is a possible cross-site scripting vulnerability in rails-html-sanitizer when the sanitizer is configured to allow an SVG reference element such as . See related GHSA-9wjq-cp2p-hrgf in Loofah, whose SVG local-reference logic rails-html-sanitizer mirrors. Impact...

openSUSE 16: ansible-rmt-server / rmt-server / rmt-server-config / etc (openSUSE-SU-2026:21225-1)

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:21225-1 advisory. This update for rmt-server fixes the following issue Update to 3.0.0: - CVE-2026-42256: net-imap: hostile server can perform a DoS on client...

CVE-2025-6545 vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce-fips, gitlab-rails-ce...

GHSA-V62P-RQ8G-8H59 vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce-fips, gitlab-rails-ce...

GHSA-H7CP-R72F-JXH6 vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce-fips, gitlab-rails-ce...

CVE-2025-6547 vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce-fips, gitlab-rails-ce...

OPENSUSE-SU-2026:21225-1 Security update for rmt-server

This update for rmt-server fixes the following issue Update to 3.0.0: - CVE-2026-42256: net-imap: hostile server can perform a DoS on client authenticating a connection with SCRAM-SHA1 or SCRAM-SHA2 bsc1265369. Changes for rmt-server: - Version 3.0.0 Security fix: Remove unused...

Timing Attack

Overview pay is a package for processing payments in Ruby on Rails apps Affected versions of this package are vulnerable to Timing Attack via the validsignature? function. An attacker can recover valid webhook signatures by sending multiple requests with crafted Paddle-Signature header values and...

The vulnerability of the Active Storage component of the Ruby on Rails software framework allows attackers to execute arbitrary code.

The vulnerability of the Active Storage component in the Ruby on Rails programming framework is related to insufficient checking of the intentions by the recipient of the broadcast message. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

GHSA-7FH5-64P2-3V2J vulnerabilities

Vulnerabilities for packages: py3-captum, arangodb, gitlab-rails-ce, gitlab-rails-ce-fips...

CVE-2023-44270 vulnerabilities

Vulnerabilities for packages: py3-captum, arangodb, gitlab-rails-ce, gitlab-rails-ce-fips...

GHSA-8452-54WP-RMV6 vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce-fips...

CVE-2025-68429 vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce-fips...

GHSA-95JQ-XPH2-CX9H vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce-fips...

CVE-2025-8101 vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce-fips...

GHSA-X527-X647-Q7GG vulnerabilities

Vulnerabilities for packages: nerdctl, gitlab-kas, commercial-grafana, gitea-fips, gitlab-rails-ce-fips, opentelemetry-collector, seaweedfs-rocksdb-fips, tekton-pipelines, terraform, trivy, cloudbeat, zot, etcd, snyk-cli, argocd-image-updater, vitess, harbor-fips, frankenphp-8.3,...

GHSA-45GG-VH54-H5M9 vulnerabilities

Vulnerabilities for packages: nerdctl, gitlab-kas, commercial-grafana, gitea-fips, gitlab-rails-ce-fips, opentelemetry-collector, seaweedfs-rocksdb-fips, tekton-pipelines, terraform, trivy, cloudbeat, zot, etcd, snyk-cli, argocd-image-updater, vitess, harbor-fips, frankenphp-8.3,...

GHSA-9M57-25V3-79X9 vulnerabilities

Vulnerabilities for packages: nerdctl, gitlab-kas, commercial-grafana, gitlab-rails-ce-fips, opentelemetry-collector, teleport-operator-fips, tekton-pipelines, terraform, zot, etcd, snyk-cli, vitess, harbor-fips, podman-fips, frankenphp-8.3, prometheus-mongodb-exporter, kyverno-fips,...

GHSA-JPPX-RXG9-JMRX vulnerabilities

Vulnerabilities for packages: nerdctl, gitlab-kas, commercial-grafana, gitlab-rails-ce-fips, opentelemetry-collector, teleport-operator-fips, tekton-pipelines, terraform, zot, etcd, snyk-cli, vitess, harbor-fips, podman-fips, frankenphp-8.3, prometheus-mongodb-exporter, kyverno-fips,...