2192 matches found
CVE-2026-53769 Avo: Direct attachment upload endpoint lacks upload authorization and bypasses field-level upload policy
Avo is a framework to create admin panels for Ruby on Rails apps. From version 2.28.0 to before version 3.32.0, Avo's direct attachment upload endpoint lacks server-side upload authorization and bypasses the documented field-level upload policy methods such as uploadFIELDID?. An authenticated Avo...
CVE-2026-53769 Avo: Direct attachment upload endpoint lacks upload authorization and bypasses field-level upload policy
Avo is a framework to create admin panels for Ruby on Rails apps. From version 2.28.0 to before version 3.32.0, Avo's direct attachment upload endpoint lacks server-side upload authorization and bypasses the documented field-level upload policy methods such as uploadFIELDID?. An authenticated Avo...
CVE-2026-79772 vulnerabilities
Vulnerabilities for packages: ruby3.3-rails, ruby3.4-rails, ruby3.2-rails, ruby4.0-rails...
CVE-2026-79770 vulnerabilities
Vulnerabilities for packages: pact-broker-docker, ruby3.3-rails, gitlab-rails-ce-fips, ruby3.2-rails, pact-broker-docker-fips, kube-logging-operator, ruby3.4-rails, gitlab-rails-ce, ruby4.0-rails...
GHSA-XQQH-3W52-Q8P7 vulnerabilities
Vulnerabilities for packages: ruby4.0-rails, ruby3.2-rails, ruby3.4-rails, ruby3.3-rails...
CVE-2026-79772 vulnerabilities
Vulnerabilities for packages: ruby4.0-rails, ruby3.2-rails, ruby3.4-rails, ruby3.3-rails...
CVE-2026-79771 vulnerabilities
Vulnerabilities for packages: ruby4.0-rails, kube-logging-operator, ruby3.3-rails, ruby3.2-rails, ruby3.4-rails...
CVE-2026-79770 vulnerabilities
Vulnerabilities for packages: ruby4.0-rails, kube-logging-operator, ruby3.3-rails, ruby3.2-rails, ruby3.4-rails...
GHSA-RH9X-7XJC-VWX2 vulnerabilities
Vulnerabilities for packages: ruby4.0-rails, kube-logging-operator, ruby3.3-rails, ruby3.2-rails, ruby3.4-rails...
GHSA-5JHF-FPP7-V2PV vulnerabilities
Vulnerabilities for packages: ruby4.0-rails, kube-logging-operator, ruby3.3-rails, ruby3.2-rails, ruby3.4-rails...
Linux Distros Unpatched Vulnerability : CVE-2026-44476
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Doorkeeper is an OAuth 2 provider for Ruby on Rails. In version 1.9.0, an attacker who knows only a dynamically registered client's clientid, which is public...
CVE-2026-44476
Doorkeeper is an OAuth 2 provider for Ruby on Rails. In version 1.9.0, an attacker who knows only a dynamically registered client's clientid, which is public information, can authenticate as that client at the token endpoint and obtain an access token without providing its clientsecret. This occu...
UBUNTU-CVE-2026-44476
Doorkeeper is an OAuth 2 provider for Ruby on Rails. In version 1.9.0, an attacker who knows only a dynamically registered client's clientid, which is public information, can authenticate as that client at the token endpoint and obtain an access token without providing its clientsecret. This occu...
CVE-2026-44476
Doorkeeper is an OAuth 2 provider for Ruby on Rails. In version 1.9.0, an attacker who knows only a dynamically registered client's clientid, which is public information, can authenticate as that client at the token endpoint and obtain an access token without providing its clientsecret. This occu...
Astra Linux – Vulnerability in ruby-rails-html-sanitizer
Rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. Prior to version 1.4.4, there was a potential XSS vulnerability with certain configurations of Rails::Html::Sanitizer, due to an incomplete fix of CVE-2022-32209. Rails::Html::Sanitizer might allow an attacke...
PT-2026-77143
Name of the Vulnerable Software and Affected Versions Mastodon versions prior to 4.4.19 Mastodon versions 4.5.0 through 4.5.11 Description When LDAP authentication is configured with LDAP TLS NO VERIFY=true, the file app/models/concerns/user/ldap authenticable.rb mutates...
CVE-2026-69185 vulnerabilities
Vulnerabilities for packages: gitlab-rails-ce-fips, gitlab-rails-ce...
CVE-2026-73648 vulnerabilities
Vulnerabilities for packages: ruby4.0-rails, ruby3.2-rails, ruby3.4-rails...
Linux Distros Unpatched Vulnerability : CVE-2026-73648
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. From 1.0.3 until 1.7.1, Rails::HTML::PermitScrubber restricted SVG...