The vulnerability of the activesupport component of the Ruby on Rails software framework allows a hacker to execute arbitrary code.

The vulnerability of the activesupport component in the Ruby on Rails software framework is related to the lack of protective measures for the website structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

Astra Linux – Vulnerability in ruby-rails-html-sanitizer

Rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. Prior to version 1.4.4, there was a potential XSS vulnerability with certain configurations of Rails::Html::Sanitizer, due to an incomplete fix of CVE-2022-32209. Rails::Html::Sanitizer might allow an attacke...

CVE-2026-42205

Avo is a framework to create admin panels for Ruby on Rails apps. Prior to version 3.31.2, a broken access control vulnerability was identified in the ActionsController of the Avo framework. Due to insecure action lookup logic, an authenticated user can execute any Action class descendants of...

EUVD-2026-28836

Avo is a framework to create admin panels for Ruby on Rails apps. Prior to version 3.31.2, a broken access control vulnerability was identified in the ActionsController of the Avo framework. Due to insecure action lookup logic, an authenticated user can execute any Action class descendants of...

CVE-2026-42205

CVE-2026-42205 (Avo) affects the Avo framework for Ruby on Rails. The issue resides in the ActionsController’s insecure action lookup, which can ignore resource context and let an authenticated user execute any action class (descendants of Avo::BaseAction) on any resource. This creates privilege ...

CVE-2026-42205 Avo: Broken Access Control: Unauthorized Execution of Arbitrary Action Classes Across Resources

Avo is a framework to create admin panels for Ruby on Rails apps. Prior to version 3.31.2, a broken access control vulnerability was identified in the ActionsController of the Avo framework. Due to insecure action lookup logic, an authenticated user can execute any Action class descendants of...

GHSA-V2FC-QM4H-8HQV vulnerabilities

Vulnerabilities for packages: ruby4.0-rails, ruby3.2-rails, ruby3.3-rails, pact-broker-docker-fips, kube-logging-operator, pact-broker-docker, gitlab-rails-ce-fips, gitlab-rails-ce, ruby3.4-rails...

Avo 访问控制错误漏洞

Avo is an open-source Ruby on Rails management panel framework developed by Avo itself. Versions of Avo prior to 3.31.2 contained a security vulnerability related to access control. This vulnerability stemmed from insecure operation search logic in the ActionsController, allowing authenticated...

Rails: Active Support: Active Support: Denial of Service via large scientific notation strings

A flaw was found in Active Support, a toolkit of support libraries for Ruby on Rails. A remote attacker can exploit this vulnerability by providing specially crafted strings containing scientific notation e.g., "1e10000" to number helpers. This input causes the BigDecimal component to expand into...

RHCOS 6 : Ruby on Rails (RHSA-2013:0153)

The remote Red Hat Enterprise Linux CoreOS 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2013:0153 advisory. - rubygem-activesupport: Multiple vulnerabilities in parameter parsing in ActionPack CVE-2013-0156 Note that Nessus has not tested for this...

Decidim 跨站脚本漏洞

Decidim is an open-source participatory democracy framework developed using Ruby on Rails. Versions of Decidim prior to 0.30.5, as well as versions 0.31.0.rc1 to 0.31.0, contained a cross-site scripting vulnerability. This vulnerability stemmed from a storage-based code execution issue in the use...

GHSA-RX22-G9MX-QRHV vulnerabilities

Vulnerabilities for packages: ruby3.4-rails, ruby3.2-rails...

CVE-2026-34830 vulnerabilities

Vulnerabilities for packages: ruby3.3-rack, kube-fluentd-operator, ruby4.0-rack, ruby3.2-rack, ruby3.4-rack, logstash...

CVE-2026-34827 vulnerabilities

Vulnerabilities for packages: logstash, ruby3.2-rails, pact-broker-docker-fips, kube-fluentd-operator, pact-broker-docker, ruby3.4-rails...

CVE-2026-34230 vulnerabilities

Vulnerabilities for packages: logstash, ruby3.2-rails, ruby3.2-rack, pact-broker-docker-fips, ruby3.4-rack, kube-fluentd-operator, pact-broker-docker, gitlab-rails-ce-fips, gitlab-cng, ruby3.3-rack, ruby4.0-rack, gitlab-rails-ce, ruby3.4-rails...

CVE-2026-34831 vulnerabilities

Vulnerabilities for packages: logstash, ruby3.2-rails, ruby3.2-rack, pact-broker-docker-fips, ruby3.4-rack, kube-fluentd-operator, pact-broker-docker, gitlab-rails-ce-fips, gitlab-cng, ruby3.3-rack, ruby4.0-rack, gitlab-rails-ce, ruby3.4-rails...

CVE-2026-34835 vulnerabilities

Vulnerabilities for packages: logstash, ruby3.2-rails, pact-broker-docker-fips, kube-fluentd-operator, pact-broker-docker, ruby3.4-rails...

GHSA-7MQQ-6CF9-V2QP vulnerabilities

Vulnerabilities for packages: logstash, ruby3.2-rails, ruby3.2-rack, pact-broker-docker-fips, ruby3.4-rack, kube-fluentd-operator, pact-broker-docker, gitlab-rails-ce-fips, gitlab-cng, ruby3.3-rack, ruby4.0-rack, gitlab-rails-ce, ruby3.4-rails...

GHSA-8VQR-QJWX-82MW vulnerabilities

Vulnerabilities for packages: logstash, ruby3.2-rails, ruby3.2-rack, pact-broker-docker-fips, ruby3.4-rack, kube-fluentd-operator, pact-broker-docker, gitlab-rails-ce-fips, gitlab-cng, ruby3.3-rack, ruby4.0-rack, gitlab-rails-ce, ruby3.4-rails...

GHSA-X8CG-FQ8G-MXFX vulnerabilities

Vulnerabilities for packages: logstash, ruby3.2-rails, ruby3.2-rack, pact-broker-docker-fips, ruby3.4-rack, kube-fluentd-operator, pact-broker-docker, gitlab-rails-ce-fips, gitlab-cng, ruby3.3-rack, ruby4.0-rack, gitlab-rails-ce, ruby3.4-rails...