Timing Attack

Overview pay is a package for processing payments in Ruby on Rails apps Affected versions of this package are vulnerable to Timing Attack via the validsignature? function. An attacker can recover valid webhook signatures by sending multiple requests with crafted Paddle-Signature header values and...

The vulnerability of the Active Storage component of the Ruby on Rails software framework allows attackers to execute arbitrary code.

The vulnerability of the Active Storage component in the Ruby on Rails programming framework is related to insufficient checking of the intentions by the recipient of the broadcast message. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

GHSA-7FH5-64P2-3V2J vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce, arangodb, gitlab-rails-ce-fips, py3-captum...

CVE-2023-44270 vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce, arangodb, gitlab-rails-ce-fips, py3-captum...

GHSA-8452-54WP-RMV6 vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce-fips...

CVE-2025-68429 vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce-fips...

GHSA-95JQ-XPH2-CX9H vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce-fips...

CVE-2025-8101 vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce-fips...

GHSA-X527-X647-Q7GG vulnerabilities

Vulnerabilities for packages: knative-eventing-fips, etcd-fips, snyk-cli, frankenphp-8.3, rancher-agent, gatekeeper-fips, osv-scanner, spire-server, kube-arangodb-fips, vault, drone-fips, opentofu-fips, zot, external-secrets-operator-fips, argo-cd, backup-restore-operator, skaffold-fips,...

GHSA-45GG-VH54-H5M9 vulnerabilities

Vulnerabilities for packages: knative-eventing-fips, etcd-fips, snyk-cli, frankenphp-8.3, rancher-agent, gatekeeper-fips, osv-scanner, spire-server, kube-arangodb-fips, vault, drone-fips, opentofu-fips, zot, external-secrets-operator-fips, argo-cd, backup-restore-operator, skaffold-fips,...

GHSA-JPPX-RXG9-JMRX vulnerabilities

Vulnerabilities for packages: knative-eventing-fips, etcd-fips, snyk-cli, frankenphp-8.3, rancher-agent, gatekeeper-fips, buildah-fips, spire-server, kube-arangodb-fips, vault, opentofu-fips, zot, external-secrets-operator-fips, argo-cd, backup-restore-operator, fscrypt, external-secrets-operator...

GHSA-9M57-25V3-79X9 vulnerabilities

Vulnerabilities for packages: knative-eventing-fips, etcd-fips, snyk-cli, frankenphp-8.3, rancher-agent, gatekeeper-fips, buildah-fips, spire-server, kube-arangodb-fips, vault, opentofu-fips, zot, external-secrets-operator-fips, argo-cd, backup-restore-operator, fscrypt, external-secrets-operator...

GHSA-QPW4-5X99-6VJP vulnerabilities

Vulnerabilities for packages: pulumi-language-dotnet, act, knative-eventing-fips, terragrunt-fips, apply-cve-bump, etcd-fips, amazon-ssm-agent-fips, snyk-cli, frankenphp-8.3, rancher-agent, gitlab-runner-fips, gatekeeper-fips, scorecard, witness, osv-scanner, amazon-ssm-agent, spire-server,...

CVE-2026-52783

OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, OpenProject's Storages module writes the OneDrive/SharePoint userless OAuth accesstoken plaintext to Rails.cache under the deterministic key storage..httpxaccesstoken, repopulated continuously by an...

CVE-2026-52783

OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, OpenProject's Storages module writes the OneDrive/SharePoint userless OAuth accesstoken plaintext to Rails.cache under the deterministic key storage..httpxaccesstoken, repopulated continuously by an...

PT-2026-52914

Name of the Vulnerable Software and Affected Versions OpenProject versions prior to 17.3.3 OpenProject versions prior to 17.4.1 Description The Storages module writes the OneDrive/SharePoint userless OAuth access token in plaintext to the Rails.cache using the deterministic key storage..httpx...

CVE-2026-54904 vulnerabilities

Vulnerabilities for packages: kube-fluentd-operator, kube-logging-operator, ruby4.0-fluentd-kubernetes-daemonset, ruby3.3-rails, logstash, logstash-fips, ruby3.2-fluentd-kubernetes-daemonset, ruby4.0-rails, ruby3.3-fluentd-kubernetes-daemonset, ruby3.4-fluentd-kubernetes-daemonset, ruby3.4-rails,...

GHSA-6WX8-W4F5-WWCR vulnerabilities

Vulnerabilities for packages: kube-fluentd-operator, kube-logging-operator, ruby4.0-fluentd-kubernetes-daemonset, ruby3.3-rails, logstash, logstash-fips, ruby3.2-fluentd-kubernetes-daemonset, ruby4.0-rails, ruby3.3-fluentd-kubernetes-daemonset, ruby3.4-fluentd-kubernetes-daemonset, ruby3.4-rails,...

GHSA-H8W8-99G7-QMVJ vulnerabilities

Vulnerabilities for packages: kube-fluentd-operator, kube-logging-operator, ruby4.0-fluentd-kubernetes-daemonset, ruby3.3-rails, logstash, logstash-fips, ruby3.2-fluentd-kubernetes-daemonset, ruby4.0-rails, ruby3.3-fluentd-kubernetes-daemonset, ruby3.4-fluentd-kubernetes-daemonset, ruby3.4-rails,...

GHSA-PHWJ-RPRQ-35PP vulnerabilities

Vulnerabilities for packages: kube-logging-operator, ruby3.3-rails, pact-broker-docker, logstash, gitlab-rails-ce, logstash-fips, ruby4.0-rails, ruby3.4-rails, pact-broker-docker-fips, ruby3.2-rails...