CVE-2026-44837

viewcomponent is a framework for building reusable, testable, and encapsulated view components in Ruby on Rails. From 3.0.0 to 4.9.0, the system test entrypoint canonicalizes a user-controlled file path with File.realpath, then checks whether the resolved path starts with the temp directory path...

CVE-2026-44837

ViewComponent CVE-2026-44837 affects Rails ViewComponent from 3.0.0 to 4.9.0. Root cause: system test entrypoint uses File.realpath and starts_with to check the path, which is not a safe containment check and allows potential sibling-directory escapes. Impact: could permit access to files outside...

The vulnerability of the activesupport component in the Ruby on Rails software framework allows a hacker to trigger a service failure.

The vulnerability of the activesupport component in the Ruby on Rails software framework is related to an uncontrolled resource consumption. Exploiting this vulnerability can allow a malicious actor to cause service failures...

Astra Linux – Vulnerability in ruby-rails-html-sanitizer

Rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. Prior to version 1.4.4, there was a potential XSS vulnerability with certain configurations of Rails::Html::Sanitizer, due to an incomplete fix of CVE-2022-32209. Rails::Html::Sanitizer might allow an attacke...

CVE-2026-42205

Avo is a framework to create admin panels for Ruby on Rails apps. Prior to version 3.31.2, a broken access control vulnerability was identified in the ActionsController of the Avo framework. Due to insecure action lookup logic, an authenticated user can execute any Action class descendants of...

CVE-2026-42205

CVE-2026-42205 (Avo) affects the Avo framework for Ruby on Rails. The issue resides in the ActionsController’s insecure action lookup, which can ignore resource context and let an authenticated user execute any action class (descendants of Avo::BaseAction) on any resource. This creates privilege ...

EUVD-2026-28836

Avo is a framework to create admin panels for Ruby on Rails apps. Prior to version 3.31.2, a broken access control vulnerability was identified in the ActionsController of the Avo framework. Due to insecure action lookup logic, an authenticated user can execute any Action class descendants of...

CVE-2026-42205 Avo: Broken Access Control: Unauthorized Execution of Arbitrary Action Classes Across Resources

Avo is a framework to create admin panels for Ruby on Rails apps. Prior to version 3.31.2, a broken access control vulnerability was identified in the ActionsController of the Avo framework. Due to insecure action lookup logic, an authenticated user can execute any Action class descendants of...

GHSA-V2FC-QM4H-8HQV vulnerabilities

Vulnerabilities for packages: pact-broker-docker, ruby3.2-rails, ruby4.0-rails, gitlab-rails-ce, ruby3.4-rails, pact-broker-docker-fips, ruby3.3-rails, gitlab-rails-ce-fips, kube-logging-operator...

Avo 访问控制错误漏洞

Avo is an open-source Ruby on Rails management panel framework developed by Avo itself. Versions of Avo prior to 3.31.2 contained a security vulnerability related to access control. This vulnerability stemmed from insecure operation search logic in the ActionsController, allowing authenticated...

Rails: Active Support: Active Support: Denial of Service via large scientific notation strings

A flaw was found in Active Support, a toolkit of support libraries for Ruby on Rails. A remote attacker can exploit this vulnerability by providing specially crafted strings containing scientific notation e.g., "1e10000" to number helpers. This input causes the BigDecimal component to expand into...

RHCOS 6 : Ruby on Rails (RHSA-2013:0153)

The remote Red Hat Enterprise Linux CoreOS 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2013:0153 advisory. - rubygem-activesupport: Multiple vulnerabilities in parameter parsing in ActionPack CVE-2013-0156 Note that Nessus has not tested for this...

Decidim 跨站脚本漏洞

Decidim is an open-source participatory democracy framework developed using Ruby on Rails. Versions of Decidim prior to 0.30.5, as well as versions 0.31.0.rc1 to 0.31.0, contained a cross-site scripting vulnerability. This vulnerability stemmed from a storage-based code execution issue in the use...

GHSA-RX22-G9MX-QRHV vulnerabilities

Vulnerabilities for packages: ruby3.4-rails, ruby3.2-rails...

CVE-2026-34830 vulnerabilities

Vulnerabilities for packages: ruby4.0-rack, logstash, kube-fluentd-operator, ruby3.4-rack, ruby3.3-rack, ruby3.2-rack...

GHSA-8VQR-QJWX-82MW vulnerabilities

Vulnerabilities for packages: ruby4.0-rack, ruby3.2-rails, ruby3.3-rack, ruby3.2-rack, gitlab-rails-ce, ruby3.4-rack, logstash, gitlab-cng, pact-broker-docker-fips, ruby3.4-rails, gitlab-rails-ce-fips, pact-broker-docker, kube-fluentd-operator...

CVE-2026-34827 vulnerabilities

Vulnerabilities for packages: ruby3.2-rails, ruby3.4-rails, logstash, pact-broker-docker-fips, pact-broker-docker, kube-fluentd-operator...

CVE-2026-34230 vulnerabilities

Vulnerabilities for packages: ruby4.0-rack, ruby3.2-rails, ruby3.3-rack, ruby3.2-rack, gitlab-rails-ce, ruby3.4-rack, logstash, gitlab-cng, pact-broker-docker-fips, ruby3.4-rails, gitlab-rails-ce-fips, pact-broker-docker, kube-fluentd-operator...

GHSA-RX22-G9MX-QRHV vulnerabilities

Vulnerabilities for packages: pact-broker-docker, ruby3.4-rails, pact-broker-docker-fips, ruby3.2-rails...

GHSA-7MQQ-6CF9-V2QP vulnerabilities

Vulnerabilities for packages: ruby4.0-rack, ruby3.2-rails, ruby3.3-rack, ruby3.2-rack, gitlab-rails-ce, ruby3.4-rack, logstash, gitlab-cng, pact-broker-docker-fips, ruby3.4-rails, gitlab-rails-ce-fips, pact-broker-docker, kube-fluentd-operator...