CVE-2026-53769 Avo: Direct attachment upload endpoint lacks upload authorization and bypasses field-level upload policy

Avo is a framework to create admin panels for Ruby on Rails apps. From version 2.28.0 to before version 3.32.0, Avo's direct attachment upload endpoint lacks server-side upload authorization and bypasses the documented field-level upload policy methods such as uploadFIELDID?. An authenticated Avo...

CVE-2026-53769

Avo , a Ruby on Rails admin panel framework, contains a missing server-side authorization vulnerability in Avo::AttachmentsController#create (the direct attachment upload endpoint) affecting versions 2.28.0 through before 3.32.0 . The endpoint creates an ActiveStorage::Blob before validating the ...

CVE-2026-53769 Avo: Direct attachment upload endpoint lacks upload authorization and bypasses field-level upload policy

Avo is a framework to create admin panels for Ruby on Rails apps. From version 2.28.0 to before version 3.32.0, Avo's direct attachment upload endpoint lacks server-side upload authorization and bypasses the documented field-level upload policy methods such as uploadFIELDID?. An authenticated Avo...

GHSA-XQQH-3W52-Q8P7 vulnerabilities

Vulnerabilities for packages: ruby3.2-rails, ruby3.4-rails, ruby3.3-rails, ruby4.0-rails...

CVE-2026-79772 vulnerabilities

Vulnerabilities for packages: ruby3.2-rails, ruby3.4-rails, ruby3.3-rails, ruby4.0-rails...

GHSA-RH9X-7XJC-VWX2 vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce-fips, ruby3.2-rails, ruby3.4-rails, pact-broker-docker, pact-broker-docker-fips, kube-logging-operator, gitlab-rails-ce, ruby3.3-rails, ruby4.0-rails...

CVE-2026-79770 vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce-fips, ruby3.2-rails, ruby3.4-rails, pact-broker-docker, pact-broker-docker-fips, kube-logging-operator, gitlab-rails-ce, ruby3.3-rails, ruby4.0-rails...

GHSA-5JHF-FPP7-V2PV vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce-fips, ruby3.2-rails, ruby3.4-rails, pact-broker-docker, pact-broker-docker-fips, kube-logging-operator, gitlab-rails-ce, ruby3.3-rails, ruby4.0-rails...

CVE-2026-79771 vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce-fips, ruby3.2-rails, ruby3.4-rails, pact-broker-docker, pact-broker-docker-fips, kube-logging-operator, gitlab-rails-ce, ruby3.3-rails, ruby4.0-rails...

GHSA-XQQH-3W52-Q8P7 vulnerabilities

Vulnerabilities for packages: ruby3.2-rails, ruby3.3-rails, ruby3.4-rails, ruby4.0-rails...

CVE-2026-79772 vulnerabilities

Vulnerabilities for packages: ruby3.2-rails, ruby3.3-rails, ruby3.4-rails, ruby4.0-rails...

CVE-2026-79771 vulnerabilities

Vulnerabilities for packages: kube-logging-operator, ruby4.0-rails, ruby3.2-rails, ruby3.3-rails, ruby3.4-rails...

CVE-2026-79770 vulnerabilities

Vulnerabilities for packages: kube-logging-operator, ruby4.0-rails, ruby3.2-rails, ruby3.3-rails, ruby3.4-rails...

GHSA-RH9X-7XJC-VWX2 vulnerabilities

Vulnerabilities for packages: kube-logging-operator, ruby4.0-rails, ruby3.2-rails, ruby3.3-rails, ruby3.4-rails...

GHSA-5JHF-FPP7-V2PV vulnerabilities

Vulnerabilities for packages: kube-logging-operator, ruby4.0-rails, ruby3.2-rails, ruby3.3-rails, ruby3.4-rails...

Ruby on Rails: Action Text to_markdown: <code>/<pre> content escapes its delimiter, letting a stored body inject arbitrary Markdown

Summary ActionText::Contenttomarkdown escapes text nodes so that a stored rich text body cannot turn into Markdown syntax. Text whose immediate parent is or is exempt from that escaping MarkdownConversion::SKIPESCAPINGPARENTS and is instead kept inert by the delimiter its visitor wraps around it...

Attackers Exploit Critical Langflow and Rails Flaws in Credential-Probing and C2 Activity

Threat actors are exploiting two critical flaws impacting Langflow and Ruby on Rails, according to new findings from VulnCheck. The vulnerabilities in question are listed below - CVE-2026-0768 CVSS score: 9.8 - A lack of proper validation of a user-supplied input vulnerability that could be...

CVE-2026-81097 rails-mcp-server 1.4.0 through 1.6.0 OS Command Execution via execute_ruby PTY Escape

The executeruby tool is documented as a read-only Ruby sandbox and is enforced by a pattern denylist together with replacements for the process-spawning methods on Kernel. The pseudo-terminal library's spawn entry points are neither in the denylist nor replaced, so a normal tool call could reach...

CVE-2026-81097

rails-mcp-server (versions 1.4.0 through 1.6.0 ) contains an OS command execution vulnerability in the execute_ruby tool. The tool is documented as a read-only Ruby sandbox enforced by a pattern denylist and replacements for process-spawning methods on Kernel , but the pseudo-terminal library's s...

CVE-2026-81097 rails-mcp-server 1.4.0 through 1.6.0 OS Command Execution via execute_ruby PTY Escape

The executeruby tool is documented as a read-only Ruby sandbox and is enforced by a pattern denylist together with replacements for the process-spawning methods on Kernel. The pseudo-terminal library's spawn entry points are neither in the denylist nor replaced, so a normal tool call could reach...