5174 matches found
GHSA-23HP-3JRH-7FPW vulnerabilities
Vulnerabilities for packages: pulumi, saf, actions-runner, sqlpad, tensorflow-gpu-jupyter, graalvm, kubeflow-centraldashboard, kibana, gitlab-rails-ce-fips, prism, opensearch-dashboards, lerna, homepage, jupyter-base-notebook, code-server, wazuh-dashboard, npm, opensearch-dashboards-fips,...
GHSA-W8WR-V893-VJVP vulnerabilities
Vulnerabilities for packages: pulumi, saf, actions-runner, sqlpad, tensorflow-gpu-jupyter, graalvm, kubeflow-centraldashboard, kibana, gitlab-rails-ce-fips, prism, opensearch-dashboards, lerna, homepage, jupyter-base-notebook, code-server, wazuh-dashboard, npm, opensearch-dashboards-fips,...
CVE-2026-54466 vulnerabilities
Vulnerabilities for packages: gitlab-rails-ce-fips, arangodb, argo-workflows, gitlab-rails-ce...
GHSA-MP7J-QC5W-4988 vulnerabilities
Vulnerabilities for packages: gitlab-rails-ce-fips, arangodb, argo-workflows, gitlab-rails-ce...
CVE-2026-54490 vulnerabilities
Vulnerabilities for packages: gitlab-rails-ce-fips, arangodb, argo-workflows, gitlab-rails-ce...
GHSA-XV26-6W52-CPH6 vulnerabilities
Vulnerabilities for packages: gitlab-rails-ce-fips, arangodb, argo-workflows, gitlab-rails-ce...
PT-2026-63796
Summary There is a possible cross-site scripting vulnerability in rails-html-sanitizer when the sanitizer is configured to allow an SVG reference element such as . See related GHSA-9wjq-cp2p-hrgf in Loofah, whose SVG local-reference logic rails-html-sanitizer mirrors. - Versions affected: = 1.0.3...
PT-2026-71724
Name of the Vulnerable Software and Affected Versions rails-html-sanitizer versions 1.0.3 through 1.7.0 Description The Rails::HTML::PermitScrubber component fails to properly restrict SVG reference elements when SVG ALLOW LOCAL HREF is used. While the scrubber restricts the xlink:href attribute,...
EUVD-2026-45994
dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, the documentation and static markdown renderer accepts...
PT-2026-61627
Name of the Vulnerable Software and Affected Versions dataCycle-CORE versions prior to 26.06.08 Description The documentation and static markdown renderer in the core processing and framework rules module accepts attacker-controlled path segments. Because these segments are only processed by the...
CVE-2026-32823: Cross-Site Request Forgery (CSRF)
dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, the application exposes server-side state changes through GET routes...
CVE-2026-55518
Avo is a framework to create admin panels for Ruby on Rails apps. Prior to 3.32.1 and 4.0.0.beta.51, Avo's association attach workflow checks attach? in the UI and GET /resources/:resource/:id/:related/new path, but the actual write endpoint, POST /resources/:resource/:id/:related, does not run t...
CVE-2026-55518 Avo: Missing Authorization in Avo Association Attach Endpoint Allows Unauthorized Relationship Manipulation and Privilege Escalation
Avo is a framework to create admin panels for Ruby on Rails apps. Prior to 3.32.1 and 4.0.0.beta.51, Avo's association attach workflow checks attach? in the UI and GET /resources/:resource/:id/:related/new path, but the actual write endpoint, POST /resources/:resource/:id/:related, does not run t...
CVE-2026-55518
Avo is a framework to create admin panels for Ruby on Rails apps. Prior to 3.32.1 and 4.0.0.beta.51, Avo's association attach workflow checks attach? in the UI and GET /resources/:resource/:id/:related/new path, but the actual write endpoint, POST /resources/:resource/:id/:related, does not run t...
EUVD-2026-45334
Avo is a framework to create admin panels for Ruby on Rails apps. Prior to 3.32.1 and 4.0.0.beta.51, Avo's association attach workflow checks attach? in the UI and GET /resources/:resource/:id/:related/new path, but the actual write endpoint, POST /resources/:resource/:id/:related, does not run t...
EUVD-2026-45333
viewcomponent is a framework for building reusable, testable, and encapsulated view components in Ruby on Rails. From 4.0.0 until 4.12.0, ViewComponent::Basearoundrender can return HTML-unsafe strings that bypass the escaping behavior applied to normal call return values. This creates an XSS risk...
CVE-2026-54497: Concurrent Execution using Shared Resource with Improper Synchronization
viewcomponent is a framework for building reusable, testable, and encapsulated view components in Ruby on Rails. From 4.0.0 until 4.12.0, ViewComponent::Base instances retain render-scoped objects across calls to renderin; if the same component, collection, or spacer component instance is reused...
GHSA-H5PW-H3J7-CJ7F vulnerabilities
Vulnerabilities for packages: gitlab-runner-fips, gitlab-rails-ce, gitlab-runner...