CVE-2026-42205

CVE-2026-42205 (Avo) affects the Avo framework for Ruby on Rails. The issue resides in the ActionsController’s insecure action lookup, which can ignore resource context and let an authenticated user execute any action class (descendants of Avo::BaseAction) on any resource. This creates privilege ...

CVE-2026-42205 Avo: Broken Access Control: Unauthorized Execution of Arbitrary Action Classes Across Resources

Avo is a framework to create admin panels for Ruby on Rails apps. Prior to version 3.31.2, a broken access control vulnerability was identified in the ActionsController of the Avo framework. Due to insecure action lookup logic, an authenticated user can execute any Action class descendants of...

GHSA-V2FC-QM4H-8HQV vulnerabilities

Vulnerabilities for packages: ruby3.3-rails, pact-broker-docker, pact-broker-docker-fips, gitlab-rails-ce-fips, ruby3.2-rails, ruby3.4-rails, kube-logging-operator, ruby4.0-rails, gitlab-rails-ce...

Avo 访问控制错误漏洞

Avo is an open-source Ruby on Rails management panel framework developed by Avo itself. Versions of Avo prior to 3.31.2 contained a security vulnerability related to access control. This vulnerability stemmed from insecure operation search logic in the ActionsController, allowing authenticated...

Rails: Active Support: Active Support: Denial of Service via large scientific notation strings

A flaw was found in Active Support, a toolkit of support libraries for Ruby on Rails. A remote attacker can exploit this vulnerability by providing specially crafted strings containing scientific notation e.g., "1e10000" to number helpers. This input causes the BigDecimal component to expand into...

RHCOS 6 : Ruby on Rails (RHSA-2013:0153)

The remote Red Hat Enterprise Linux CoreOS 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2013:0153 advisory. - rubygem-activesupport: Multiple vulnerabilities in parameter parsing in ActionPack CVE-2013-0156 Note that Nessus has not tested for this...

Decidim 跨站脚本漏洞

Decidim is an open-source participatory democracy framework developed using Ruby on Rails. Versions of Decidim prior to 0.30.5, as well as versions 0.31.0.rc1 to 0.31.0, contained a cross-site scripting vulnerability. This vulnerability stemmed from a storage-based code execution issue in the use...

GHSA-RX22-G9MX-QRHV vulnerabilities

Vulnerabilities for packages: ruby3.4-rails, ruby3.2-rails...

CVE-2026-34830 vulnerabilities

Vulnerabilities for packages: kube-fluentd-operator, ruby3.2-rack, logstash, ruby3.4-rack, ruby3.3-rack, ruby4.0-rack...

CVE-2026-34827 vulnerabilities

Vulnerabilities for packages: pact-broker-docker, pact-broker-docker-fips, logstash, kube-fluentd-operator, ruby3.2-rails, ruby3.4-rails...

CVE-2026-34230 vulnerabilities

Vulnerabilities for packages: pact-broker-docker, ruby3.2-rack, pact-broker-docker-fips, gitlab-cng, logstash, kube-fluentd-operator, gitlab-rails-ce-fips, ruby3.2-rails, ruby3.4-rails, ruby3.3-rack, gitlab-rails-ce, ruby4.0-rack, ruby3.4-rack...

CVE-2026-34835 vulnerabilities

Vulnerabilities for packages: pact-broker-docker, pact-broker-docker-fips, logstash, kube-fluentd-operator, ruby3.2-rails, ruby3.4-rails...

CVE-2026-34831 vulnerabilities

Vulnerabilities for packages: pact-broker-docker, ruby3.2-rack, pact-broker-docker-fips, gitlab-cng, logstash, kube-fluentd-operator, gitlab-rails-ce-fips, ruby3.2-rails, ruby3.4-rails, ruby3.3-rack, gitlab-rails-ce, ruby4.0-rack, ruby3.4-rack...

CVE-2026-34763 vulnerabilities

Vulnerabilities for packages: pact-broker-docker, ruby3.2-rack, pact-broker-docker-fips, gitlab-cng, logstash, kube-fluentd-operator, gitlab-rails-ce-fips, ruby3.2-rails, ruby3.4-rails, ruby3.3-rack, gitlab-rails-ce, ruby4.0-rack, ruby3.4-rack...

GHSA-7MQQ-6CF9-V2QP vulnerabilities

Vulnerabilities for packages: pact-broker-docker, ruby3.2-rack, pact-broker-docker-fips, gitlab-cng, logstash, kube-fluentd-operator, gitlab-rails-ce-fips, ruby3.2-rails, ruby3.4-rails, ruby3.3-rack, gitlab-rails-ce, ruby4.0-rack, ruby3.4-rack...

GHSA-8VQR-QJWX-82MW vulnerabilities

Vulnerabilities for packages: pact-broker-docker, ruby3.2-rack, pact-broker-docker-fips, gitlab-cng, logstash, kube-fluentd-operator, gitlab-rails-ce-fips, ruby3.2-rails, ruby3.4-rails, ruby3.3-rack, gitlab-rails-ce, ruby4.0-rack, ruby3.4-rack...

GHSA-X8CG-FQ8G-MXFX vulnerabilities

Vulnerabilities for packages: pact-broker-docker, ruby3.2-rack, pact-broker-docker-fips, gitlab-cng, logstash, kube-fluentd-operator, gitlab-rails-ce-fips, ruby3.2-rails, ruby3.4-rails, ruby3.3-rack, gitlab-rails-ce, ruby4.0-rack, ruby3.4-rack...

GHSA-RX22-G9MX-QRHV vulnerabilities

Vulnerabilities for packages: ruby3.2-rails, pact-broker-docker, ruby3.4-rails, pact-broker-docker-fips...

GHSA-2J22-PR5W-6GQ8 vulnerabilities

Vulnerabilities for packages: ruby3.4-rails...

Linux Distros Unpatched Vulnerability : CVE-2026-33167

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Action Pack is a Rubygem for building web applications on the Rails framework. In versions on the 8.1 branch prior to 8.1.2.1, the debug exceptions page does no...