GHSA-GVWX-54WH-QM9J vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce, lerna, kubeflow-centraldashboard, wazuh-dashboard, prism, npm, kibana, graalvm, actions-runner, sqlpad, wazuh-dashboard-fips, pulumi, code-server, opensearch-dashboards, opensearch-dashboards-fips, saf, gitlab-rails-ce-fips...

GHSA-MP7J-QC5W-4988 vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce, arangodb, gitlab-rails-ce-fips...

CVE-2026-54466 vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce, arangodb, gitlab-rails-ce-fips...

CVE-2026-54490 vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce, arangodb, gitlab-rails-ce-fips...

GHSA-XV26-6W52-CPH6 vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce, arangodb, gitlab-rails-ce-fips...

CVE-2026-55518

Avo is a framework to create admin panels for Ruby on Rails apps. Prior to 3.32.1 and 4.0.0.beta.51, Avo's association attach workflow checks attach? in the UI and GET /resources/:resource/:id/:related/new path, but the actual write endpoint, POST /resources/:resource/:id/:related, does not run t...

CVE-2026-55518 Avo: Missing Authorization in Avo Association Attach Endpoint Allows Unauthorized Relationship Manipulation and Privilege Escalation

Avo is a framework to create admin panels for Ruby on Rails apps. Prior to 3.32.1 and 4.0.0.beta.51, Avo's association attach workflow checks attach? in the UI and GET /resources/:resource/:id/:related/new path, but the actual write endpoint, POST /resources/:resource/:id/:related, does not run t...

EUVD-2026-45333

viewcomponent is a framework for building reusable, testable, and encapsulated view components in Ruby on Rails. From 4.0.0 until 4.12.0, ViewComponent::Basearoundrender can return HTML-unsafe strings that bypass the escaping behavior applied to normal call return values. This creates an XSS risk...

GHSA-M49F-RVV4-R4RV vulnerabilities

Vulnerabilities for packages: gitlab-runner, gitlab-rails-ce, gitlab-runner-fips...

GHSA-H5PW-H3J7-CJ7F vulnerabilities

Vulnerabilities for packages: gitlab-runner, gitlab-rails-ce, gitlab-runner-fips...

GHSA-PGGX-2V9R-J6GM vulnerabilities

Vulnerabilities for packages: gitlab-runner, gitlab-rails-ce, gitlab-runner-fips...

CVE-2026-13320 vulnerabilities

Vulnerabilities for packages: gitlab-runner, gitlab-rails-ce, gitlab-runner-fips...

CVE-2025-12506 vulnerabilities

Vulnerabilities for packages: gitlab-runner, gitlab-rails-ce, gitlab-runner-fips...

Possible XSS vulnerability with certain configurations of rails-html-sanitizer

Summary There is a possible cross-site scripting vulnerability in rails-html-sanitizer when the sanitizer is configured to allow an SVG reference element such as . See related GHSA-9wjq-cp2p-hrgf in Loofah, whose SVG local-reference logic rails-html-sanitizer mirrors. Impact...

openSUSE 16: ansible-rmt-server / rmt-server / rmt-server-config / etc (openSUSE-SU-2026:21225-1)

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:21225-1 advisory. This update for rmt-server fixes the following issue Update to 3.0.0: - CVE-2026-42256: net-imap: hostile server can perform a DoS on client...

CVE-2025-6545 vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce, gitlab-rails-ce-fips...

GHSA-V62P-RQ8G-8H59 vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce, gitlab-rails-ce-fips...

GHSA-H7CP-R72F-JXH6 vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce, gitlab-rails-ce-fips...

CVE-2025-6547 vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce, gitlab-rails-ce-fips...

OPENSUSE-SU-2026:21225-1 Security update for rmt-server

This update for rmt-server fixes the following issue Update to 3.0.0: - CVE-2026-42256: net-imap: hostile server can perform a DoS on client authenticating a connection with SCRAM-SHA1 or SCRAM-SHA2 bsc1265369. Changes for rmt-server: - Version 3.0.0 Security fix: Remove unused...