Latest updates for Cve-2026-31431

Fresh curated links around CVE-2026-31431 are collected here so marketers can spot useful updates and turn timely ideas into posts faster.

Recent items include:

  • CVE-2026-45573 (decidim-core): Decidim - Push subscriptions can be abused for server-side requests
  • CVE-2026-45415 (decidim-verifications): Decidim - CSV census record endpoints improper authorization
  • CVE-2026-44587 (carrierwave): CarrierWave has a denylisted_content_type bypass via Unescaped Regex Metacharacters

Post angles to try

Share the most useful takeaway for your audience.
Turn one article into a quick practical checklist.
Ask your audience how this shift affects their work.
Turn angles into scheduled posts

Fresh articles and ideas

Recent curated links from global sources. Generate one free draft from any story, then use SocialBu to schedule and refine your content calendar.

rubysec.com /16 hours ago

CVE-2026-45573 (decidim-core): Decidim - Push subscriptions can be abused for server-side requests

Originally appeared on RubySec.## Description The push-subscription endpoint stores an attacker-controlled delivery URL, and the notification send path becomes an outbound-request...

Read source
rubysec.com /16 hours ago

CVE-2026-45415 (decidim-verifications): Decidim - CSV census record endpoints improper authorization

Originally appeared on RubySec.## Description A participant manager can access and modify the CSV census record admin forms. ## Impact Any participant admin can create, alter, o...

Read source
rubysec.com /1 month ago

CVE-2026-44587 (carrierwave): CarrierWave has a denylisted_content_type bypass via Unescaped Regex Metacharacters

Originally appeared on RubySec.### Summary CarrierWave's content_type_denylist check fails to escape regex metacharacters in string entries, causing the denylist to silently not m...

Read source
rubysec.com /16 hours ago

CVE-2026-45377 (decidim-core): Decidim - Private exports can be downloaded through reusable links

Originally appeared on RubySec.## Description The normal `download_your_data` flow requires the requester to be logged in as the export owner, but the resulting Active Storage blo...

Read source
rubysec.com /1 month ago

CVE-2026-47241 (net-imap): Net::IMAP: Denial of Service via incomplete raw argument validation

Originally appeared on RubySec.### Summary Several Net::IMAP commands accept a raw string argument which is only validated to prevent CRLF injection and then sent verbatim. If th...

Read source
rubysec.com /16 hours ago

CVE-2026-45572 (decidim-core): Decidim - HTML content blocks allow stored script execution

Originally appeared on RubySec.## Description A privileged admin user who can edit an affected landing page can store arbitrary HTML/JavaScript in an `HTML block`, and the public...

Read source
ubuntu.com /4 days ago

Januscape vulnerability CVE-2026-53359 mitigations available

Introduction A local privilege escalation (LPE) vulnerability affecting the Linux kernel was publicly disclosed on July 6, 2026. The vulnerability was assigned CVE ID CVE-2026-5335...

Read source
rubysec.com /1 month ago

CVE-2026-47736 (puma): Puma PROXY Protocol v1 Parser Allows Remote Memory Exhaustion

Originally appeared on RubySec.## Impact PROXY protocol support for Puma was added in version 5.5.0. When PROXY protocol v1 support is enabled, Puma reads incoming bytes into an...

Read source
rubysec.com /1 month ago

CVE-2026-47737 (puma): Puma PROXY Protocol v1 Accepts Repeated Protocol Headers on Persistent Connections

Originally appeared on RubySec.## Impact Puma is vulnerable to source IP spoofing when set_remote_address proxy_protocol: :v1 is enabled and persistent connections are used. PROX...

Read source
rubysec.com /1 month ago

CVE-2026-47240 (net-imap): Net::IMAP: Command Injection via non-synchronizing literal in "raw" argument

Originally appeared on RubySec.Several Net::IMAP commands accept a "raw data" argument that is sent verbatim after validation to prevent command injection. However, if a server do...

Read source
rubysec.com /2 weeks ago

CVE-2026-49342 (yard): YARD static cache reads raw traversal paths before router sanitization

Originally appeared on RubySec.## Summary YARD's static cache lookup reads a request path before the router's path cleanup runs. When a server is configured with a document root,...

Read source
rubysec.com /16 hours ago

CVE-2026-45378 (decidim-verifications): Decidim - Verification documents can be downloaded through reusable links

Originally appeared on RubySec.## Description Scanned identity-document images provided by participants and shown in the verification admin workflow are exposed through signed `/r...

Read source
ubuntu.com /1 month ago

CVE-2026-46333 (ssh-keysign-pwn) Linux kernel vulnerability mitigations

An information disclosure security vulnerability in the Linux kernel was publicly disclosed on May 15th, 2026. The vulnerability was reported by Qualys and fixed in the mainline Li...

Read source
rubysec.com /2 weeks ago

CVE-2026-44024 (fluentd): Fluentd is Vulnerable to Remote Code Execution (RCE) via Arbitrary File Write in `${tag}` Plac...

Originally appeared on RubySec.Fluentd allows dynamically constructing file paths using the `${tag}` placeholder. It was discovered that validation for this placeholder was insuffi...

Read source
rubysec.com /16 hours ago

CVE-2026-45086 (decidim-demographics): Decidim - Forms admin question editor lacks authorization

Originally appeared on RubySec.## Description A participant can load the demographics questionnaire admin editor and make changes. ## Impact - Low-privilege users can access que...

Read source
gbhackers.com /1 month ago

Critical Splunk Enterprise Pre-Auth RCE Chain Exposes Databases

A critical pre-authentication remote code execution (RCE) vulnerability in Splunk Enterprise has been disclosed, carrying a near-perfect CVSS score of 9.8. Tracked as CVE-2026-2025...

Read source
rubysec.com /16 hours ago

CVE-2026-45414 (decidim): Decidim - JWT-backed authentication can be replayed across organizations

Originally appeared on RubySec.## Description A JWT issued to an Org 1 account is accepted on the Org 2 API and can read the admin-only GraphQL `participantDetails` field for an O...

Read source
rubysec.com /1 month ago

CVE-2026-47242 (net-imap): Net::IMAP: Command Injection via ID command argument

Originally appeared on RubySec.### Summary Two `Net::IMAP` commands, `#id` and `#enable`, do not validate their arguments. Arguments to either command could be used by an attacke...

Read source
rubysec.com /1 month ago

CVE-2026-33637 (faraday): Faraday has a possible incomplete fix for GHSA-33mh-2634-fwr2 - protocol-relative URI objects...

Originally appeared on RubySec.## Summary `Faraday::Connection#build_exclusive_url` still allows protocol-relative host override when the request target is provided as a `URI` obj...

Read source
rubysec.com /3 weeks ago

CVE-2026-54905 (concurrent-ruby): Concurrent Ruby - `ReentrantReadWriteLock` read-count overflow grants a write lock wit...

Originally appeared on RubySec.### Summary `Concurrent::ReentrantReadWriteLock` can incorrectly grant a write lock after one thread acquires the read lock 32,768 times. The lock...

Read source
rubysec.com /3 weeks ago

CVE-2026-54500 (oj): Oj - intern.c form_attr (uninitialized stack read)

Originally appeared on RubySec.### Summary `Oj.load` in `:object` mode reads uninitialized stack memory (and, for long keys, reads out of bounds) when parsing a JSON object whose...

Read source
thehackernews.com /1 month ago

LiteLLM Flaw CVE-2026-42271 Exploited in the Wild, Chains to Unauthenticated RCE

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added a high-severity flaw impacting BerriAI LiteLLM to its Known Exploited Vulnerabilities (KEV) catalog...

Read source
rubysec.com /3 weeks ago

CVE-2026-55518 (avo): Avo - Missing Authorization in Avo Association Attach Endpoint Allows Unauthorized Relationship Ma...

Originally appeared on RubySec.## Summary A critical missing authorization flaw exists in Avo's association attach workflow. The UI and `GET /resources/:resource/:id/:related/new`...

Read source
rubysec.com /1 month ago

CVE-2026-44476 (doorkeeper-openid_connect): Dynamic Client Registration feature creates public clients with client_secre...

Originally appeared on RubySec.### Impact The `DynamicClientRegistrationController#register` action hard-codes `confidential: false` when creating applications (dynamic_client_reg...

Read source

Turn fresh research into a full content calendar

Use SocialBu to discover ideas, generate post drafts, and schedule them across your social channels.

Start creating posts

Sources covering Cve-2026-31431

rubyland.news

Recent coverage from public sources
Public source

feeds.feedburner.com

Recent coverage from public sources
Public source

gbhackers.com

Recent coverage from public sources
Public source

insights.ubuntu.com

Recent coverage from public sources
Public source

Related searches

Security Vulnerabilities Cyber Security News cyber security

Recent searches

Artificial Intelligence Machine Learning Data Science Data Engineering Business Intelligence Web Development Software Development Software Testing Programming JavaScript DevOps Cyber Security Product Management Project Management Design UX UX Research Graphic Design Video Production Video Editing