CVE-2026-79788: Server-Side Request Forgery (SSRF)

In Dradis Community Edition, the ProvidersController and AgentsController gate their adminrequired beforeaction on defined?Dradis::Pro, a constant that is never defined in CE, so the authorization check is never applied. As a result, any authenticated non-admin user can create an AI provider...

CVE-2026-73491 vulnerabilities

Vulnerabilities for packages: ruby3.2-rails, ruby4.0-rails, ruby3.4-rails...

Fedora 45 : rubygem-actioncable / rubygem-actionmailbox / rubygem-actionmailer / etc (2026-000149d00e)

The remote Fedora 45 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2026-000149d00e advisory. Update Ruby on Rails 8.1.3.1 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not teste...

ruby4.0-rubygem-actioncable-8.0-8.0.3-1.3 on GA media (moderate)

ruby4.0-rubygem-actioncable-8.0-8.0.3-1.3 on GA media Announcement ID: openSUSE-SU-2026:10335-1 Rating: moderate Cross-References: CVE-2024-54133 Affected Products: openSUSE Tumbleweed An update that solves one vulnerability can now be installed. Description: These are all security issues fixed i...

OPENSUSE-SU-2026:10335-1 ruby4.0-rubygem-actioncable-8.0-8.0.3-1.3 on GA media

These are all security issues fixed in the ruby4.0-rubygem-actioncable-8.0-8.0.3-1.3 package on the GA media of openSUSE Tumbleweed...

CVE-2025-1198

An issue discovered in GitLab CE/EE affecting all versions from 16.11 prior to 17.6.5, 17.7 prior to 17.7.4, and 17.8 prior to 17.8.2 meant that long-lived connections in ActionCable potentially allowed revoked Personal Access Tokens access to streaming results...

EUVD-2025-2071

Malicious code in bioql PyPI...

Fedora 43 : rubygem-actioncable / rubygem-actionmailbox / rubygem-actionmailer / etc (2025-203b7db566)

The remote Fedora 43 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2025-203b7db566 advisory. https://fedoraproject.org/wiki/Changes/RubyonRails8.0 Tenable has extracted the preceding description block directly from the Fedora security...

BIT-GITLAB-2025-1198 Insufficient Session Expiration in GitLab

An issue discovered in GitLab CE/EE affecting all versions from 16.11 prior to 17.6.5, 17.7 prior to 17.7.4, and 17.8 prior to 17.8.2 meant that long-lived connections in ActionCable potentially allowed revoked Personal Access Tokens access to streaming results...

CVE-2025-1198

An issue discovered in GitLab CE/EE affecting all versions from 16.11 prior to 17.6.5, 17.7 prior to 17.7.4, and 17.8 prior to 17.8.2 meant that long-lived connections in ActionCable potentially allowed revoked Personal Access Tokens access to streaming results...

UBUNTU-CVE-2025-1198

An issue discovered in GitLab CE/EE affecting all versions from 16.11 prior to 17.6.5, 17.7 prior to 17.7.4, and 17.8 prior to 17.8.2 meant that long-lived connections in ActionCable potentially allowed revoked Personal Access Tokens access to streaming results...

CVE-2025-1198 Insufficient Session Expiration in GitLab

An issue discovered in GitLab CE/EE affecting all versions from 16.11 prior to 17.6.5, 17.7 prior to 17.7.4, and 17.8 prior to 17.8.2 meant that long-lived connections in ActionCable potentially allowed revoked Personal Access Tokens access to streaming results...

CVE-2025-1198 Insufficient Session Expiration in GitLab

An issue discovered in GitLab CE/EE affecting all versions from 16.11 prior to 17.6.5, 17.7 prior to 17.7.4, and 17.8 prior to 17.8.2 meant that long-lived connections in ActionCable potentially allowed revoked Personal Access Tokens access to streaming results...

CVE-2025-1198

Removed by vendor...

CVE-2025-1198 Insufficient Session Expiration in GitLab

An issue discovered in GitLab CE/EE affecting all versions from 16.11 prior to 17.6.5, 17.7 prior to 17.7.4, and 17.8 prior to 17.8.2 meant that long-lived connections in ActionCable potentially allowed revoked Personal Access Tokens access to streaming results...

GitLab 16.11 < 17.6.5 / 17.7 < 17.7.4 / 17.8 < 17.8.2 (CVE-2025-1198)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - An issue discovered in GitLab CE/EE affecting all versions from 16.11 prior to 17.6.5, 17.7 prior to 17.7.4, and 17.8 prior to 17.8.2 meant that long-lived connections in ActionCable potentially allow...

CVE-2025-1198: Insufficient Session Expiration

An issue discovered in GitLab CE/EE affecting all versions from 16.11 prior to 17.6.5, 17.7 prior to 17.7.4, and 17.8 prior to 17.8.2 meant that long-lived connections in ActionCable potentially allowed revoked Personal Access Tokens access to streaming results...

Gitlab -- Vulnerabilities

Gitlab reports: A CSP-bypass XSS in merge-request page Denial of Service due to Unbounded Symbol Creation Exfiltrate content from private issues using Prompt Injection A custom permission may allow overriding Repository settings Internal HTTP header leak via route confusion in workhorse SSRF via...

ruby3.4-rubygem-actioncable-8.0-8.0.1-1.1 on GA media (moderate)

ruby3.4-rubygem-actioncable-8.0-8.0.1-1.1 on GA media Announcement ID: openSUSE-SU-2025:14668-1 Rating: moderate Cross-References: CVE-2024-54133 Affected Products: openSUSE Tumbleweed An update that solves one vulnerability can now be installed. Description: These are all security issues fixed i...

OPENSUSE-SU-2024:11818-1 ruby3.1-rubygem-actioncable-6.0-6.0.4.4-1.1 on GA media

These are all security issues fixed in the ruby3.1-rubygem-actioncable-6.0-6.0.4.4-1.1 package on the GA media of openSUSE Tumbleweed...