2194 matches found
Linux Distros Unpatched Vulnerability : CVE-2026-53769
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Avo is a framework to create admin panels for Ruby on Rails apps. From version 2.28.0 to before version 3.32.0, Avo's direct attachment upload endpoint lacks...
CVE-2026-53769 Avo: Direct attachment upload endpoint lacks upload authorization and bypasses field-level upload policy
Avo is a framework to create admin panels for Ruby on Rails apps. From version 2.28.0 to before version 3.32.0, Avo's direct attachment upload endpoint lacks server-side upload authorization and bypasses the documented field-level upload policy methods such as uploadFIELDID?. An authenticated Avo...
CVE-2026-53769 Avo: Direct attachment upload endpoint lacks upload authorization and bypasses field-level upload policy
Avo is a framework to create admin panels for Ruby on Rails apps. From version 2.28.0 to before version 3.32.0, Avo's direct attachment upload endpoint lacks server-side upload authorization and bypasses the documented field-level upload policy methods such as uploadFIELDID?. An authenticated Avo...
CVE-2026-79772 vulnerabilities
Vulnerabilities for packages: ruby3.2-rails, ruby4.0-rails, ruby3.3-rails, ruby3.4-rails...
CVE-2026-79770 vulnerabilities
Vulnerabilities for packages: ruby3.3-rails, gitlab-rails-ce, ruby3.2-rails, pact-broker-docker-fips, pact-broker-docker, ruby4.0-rails, kube-logging-operator, gitlab-rails-ce-fips, ruby3.4-rails...
GHSA-XQQH-3W52-Q8P7 vulnerabilities
Vulnerabilities for packages: ruby4.0-rails, ruby3.4-rails, ruby3.2-rails, ruby3.3-rails...
CVE-2026-79772 vulnerabilities
Vulnerabilities for packages: ruby4.0-rails, ruby3.4-rails, ruby3.2-rails, ruby3.3-rails...
CVE-2026-79771 vulnerabilities
Vulnerabilities for packages: ruby3.3-rails, kube-logging-operator, ruby3.4-rails, ruby4.0-rails, ruby3.2-rails...
CVE-2026-79770 vulnerabilities
Vulnerabilities for packages: ruby3.3-rails, kube-logging-operator, ruby3.4-rails, ruby4.0-rails, ruby3.2-rails...
GHSA-RH9X-7XJC-VWX2 vulnerabilities
Vulnerabilities for packages: ruby3.3-rails, kube-logging-operator, ruby3.4-rails, ruby4.0-rails, ruby3.2-rails...
GHSA-5JHF-FPP7-V2PV vulnerabilities
Vulnerabilities for packages: ruby3.3-rails, kube-logging-operator, ruby3.4-rails, ruby4.0-rails, ruby3.2-rails...
Attackers Exploit Critical Langflow and Rails Flaws in Credential-Probing and C2 Activity
Threat actors are exploiting two critical flaws impacting Langflow and Ruby on Rails, according to new findings from VulnCheck. The vulnerabilities in question are listed below - CVE-2026-0768 CVSS score: 9.8 - A lack of proper validation of a user-supplied input vulnerability that could be...
Linux Distros Unpatched Vulnerability : CVE-2026-44476
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Doorkeeper is an OAuth 2 provider for Ruby on Rails. In version 1.9.0, an attacker who knows only a dynamically registered client's clientid, which is public...
CVE-2026-44476
Doorkeeper is an OAuth 2 provider for Ruby on Rails. In version 1.9.0, an attacker who knows only a dynamically registered client's clientid, which is public information, can authenticate as that client at the token endpoint and obtain an access token without providing its clientsecret. This occu...
UBUNTU-CVE-2026-44476
Doorkeeper is an OAuth 2 provider for Ruby on Rails. In version 1.9.0, an attacker who knows only a dynamically registered client's clientid, which is public information, can authenticate as that client at the token endpoint and obtain an access token without providing its clientsecret. This occu...
CVE-2026-44476
Doorkeeper is an OAuth 2 provider for Ruby on Rails. In version 1.9.0, an attacker who knows only a dynamically registered client's clientid, which is public information, can authenticate as that client at the token endpoint and obtain an access token without providing its clientsecret. This occu...
Astra Linux – Vulnerability in ruby-rails-html-sanitizer
Rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. Prior to version 1.4.4, there was a potential XSS vulnerability with certain configurations of Rails::Html::Sanitizer, due to an incomplete fix of CVE-2022-32209. Rails::Html::Sanitizer might allow an attacke...
PT-2026-77143
Name of the Vulnerable Software and Affected Versions Mastodon versions prior to 4.4.19 Mastodon versions 4.5.0 through 4.5.11 Description When LDAP authentication is configured with LDAP TLS NO VERIFY=true, the file app/models/concerns/user/ldap authenticable.rb mutates...