CVE-2026-42205 Avo: Broken Access Control: Unauthorized Execution of Arbitrary Action Classes Across Resources

Avo is a framework to create admin panels for Ruby on Rails apps. Prior to version 3.31.2, a broken access control vulnerability was identified in the ActionsController of the Avo framework. Due to insecure action lookup logic, an authenticated user can execute any Action class descendants of...

GHSA-V2FC-QM4H-8HQV vulnerabilities

Vulnerabilities for packages: ruby3.2-rails, ruby3.4-rails, pact-broker-docker, ruby3.3-rails, gitlab-rails-ce-fips, pact-broker-docker-fips, ruby4.0-rails, kube-logging-operator, gitlab-rails-ce...

Avo 访问控制错误漏洞

Avo is an open-source Ruby on Rails management panel framework developed by Avo itself. Versions of Avo prior to 3.31.2 contained a security vulnerability related to access control. This vulnerability stemmed from insecure operation search logic in the ActionsController, allowing authenticated...

Rails: Active Support: Active Support: Denial of Service via large scientific notation strings

A flaw was found in Active Support, a toolkit of support libraries for Ruby on Rails. A remote attacker can exploit this vulnerability by providing specially crafted strings containing scientific notation e.g., "1e10000" to number helpers. This input causes the BigDecimal component to expand into...

RHCOS 6 : Ruby on Rails (RHSA-2013:0153)

The remote Red Hat Enterprise Linux CoreOS 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2013:0153 advisory. - rubygem-activesupport: Multiple vulnerabilities in parameter parsing in ActionPack CVE-2013-0156 Note that Nessus has not tested for this...

Decidim 跨站脚本漏洞

Decidim is an open-source participatory democracy framework developed using Ruby on Rails. Versions of Decidim prior to 0.30.5, as well as versions 0.31.0.rc1 to 0.31.0, contained a cross-site scripting vulnerability. This vulnerability stemmed from a storage-based code execution issue in the use...

GHSA-RX22-G9MX-QRHV vulnerabilities

Vulnerabilities for packages: ruby3.4-rails, ruby3.2-rails...

CVE-2026-34830 vulnerabilities

Vulnerabilities for packages: ruby3.3-rack, ruby3.4-rack, logstash, kube-fluentd-operator, ruby3.2-rack, ruby4.0-rack...

CVE-2026-34827 vulnerabilities

Vulnerabilities for packages: logstash, ruby3.2-rails, ruby3.4-rails, pact-broker-docker, pact-broker-docker-fips, kube-fluentd-operator...

CVE-2026-34835 vulnerabilities

Vulnerabilities for packages: logstash, ruby3.2-rails, ruby3.4-rails, pact-broker-docker, pact-broker-docker-fips, kube-fluentd-operator...

CVE-2026-34230 vulnerabilities

Vulnerabilities for packages: ruby3.3-rack, gitlab-cng, logstash, ruby3.2-rails, ruby3.2-rack, ruby4.0-rack, ruby3.4-rails, pact-broker-docker, gitlab-rails-ce-fips, ruby3.4-rack, pact-broker-docker-fips, kube-fluentd-operator, gitlab-rails-ce...

CVE-2026-34831 vulnerabilities

Vulnerabilities for packages: ruby3.3-rack, gitlab-cng, logstash, ruby3.2-rails, ruby3.2-rack, ruby4.0-rack, ruby3.4-rails, pact-broker-docker, gitlab-rails-ce-fips, ruby3.4-rack, pact-broker-docker-fips, kube-fluentd-operator, gitlab-rails-ce...

GHSA-X8CG-FQ8G-MXFX vulnerabilities

Vulnerabilities for packages: ruby3.3-rack, gitlab-cng, logstash, ruby3.2-rails, ruby3.2-rack, ruby4.0-rack, ruby3.4-rails, pact-broker-docker, gitlab-rails-ce-fips, ruby3.4-rack, pact-broker-docker-fips, kube-fluentd-operator, gitlab-rails-ce...

GHSA-8VQR-QJWX-82MW vulnerabilities

Vulnerabilities for packages: ruby3.3-rack, gitlab-cng, logstash, ruby3.2-rails, ruby3.2-rack, ruby4.0-rack, ruby3.4-rails, pact-broker-docker, gitlab-rails-ce-fips, ruby3.4-rack, pact-broker-docker-fips, kube-fluentd-operator, gitlab-rails-ce...

GHSA-RX22-G9MX-QRHV vulnerabilities

Vulnerabilities for packages: ruby3.4-rails, ruby3.2-rails, pact-broker-docker-fips, pact-broker-docker...

CVE-2026-34763 vulnerabilities

Vulnerabilities for packages: ruby3.3-rack, gitlab-cng, logstash, ruby3.2-rails, ruby3.2-rack, ruby4.0-rack, ruby3.4-rails, pact-broker-docker, gitlab-rails-ce-fips, ruby3.4-rack, pact-broker-docker-fips, kube-fluentd-operator, gitlab-rails-ce...

GHSA-7MQQ-6CF9-V2QP vulnerabilities

Vulnerabilities for packages: ruby3.3-rack, gitlab-cng, logstash, ruby3.2-rails, ruby3.2-rack, ruby4.0-rack, ruby3.4-rails, pact-broker-docker, gitlab-rails-ce-fips, ruby3.4-rack, pact-broker-docker-fips, kube-fluentd-operator, gitlab-rails-ce...

GHSA-2J22-PR5W-6GQ8 vulnerabilities

Vulnerabilities for packages: ruby3.4-rails...

Linux Distros Unpatched Vulnerability : CVE-2026-33167

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Action Pack is a Rubygem for building web applications on the Rails framework. In versions on the 8.1 branch prior to 8.1.2.1, the debug exceptions page does no...

CVE-2026-33209

Avo is a framework to create admin panels for Ruby on Rails apps. Prior to version 3.30.3, a reflected cross-site scripting XSS vulnerability exists in the returnto query parameter used in the avo interface. An attacker can craft a malicious URL that injects arbitrary JavaScript, which is execute...