CVE-2026-19478

CVE-2026-19478 GitLab GraphQL 未认证项目删除 ★ CVE-2026-19478 GitLab GraphQL @glintroduced 未认证任意方法调用 PoC ★ https://github.com/user-attachments/assets/bb5d5f8a-a9bf-4148-854b-14c25c501d4b 概述 CVE-2026-19478 是 GitLab CE/EE 中的一个未认证数据篡改/删除 漏洞（CVSS 9.4）。 GitLab 附带一个 GraphQL 客户端指令 @glintroducedversion: "X.Y.Z"...

kobako Sandbox Escape: guest eval reaches host RCE via method_missing → public_send (any bound Service)

Summary A guest mruby script running inside the Kobako sandbox can execute arbitrary Ruby in the host process, fully escaping the sandbox. Details A host embeds bound "Service" objects that guest scripts call across the wasm boundary through the transport dispatcher. The dispatcher passed the...

GHSA-7PWQ-Q9JF-539H kobako Sandbox Escape: guest eval reaches host RCE via method_missing → public_send (any bound Service)

Summary A guest mruby script running inside the Kobako sandbox can execute arbitrary Ruby in the host process, fully escaping the sandbox. Details A host embeds bound "Service" objects that guest scripts call across the wasm boundary through the transport dispatcher. The dispatcher passed the...

view_component - Preview Route Can Dispatch Inherited Helper Methods'

The preview route derives an example name from the URL and calls it with publicsend. The code does not verify that the requested method is one of the preview examples explicitly defined by the preview class. As a result, inherited public methods on ViewComponent::Preview are route-reachable. The...

Discourse < 2.3.0.beta10 Multiple Vulnerabilities

Discourse is prone to multiple vulnerabilities including vulnerabilities in 3rdparty components. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-onl...