From 54e7412006a6b97cbe59c7a9e64510c7a1be65c3 Mon Sep 17 00:00:00 2001 From: Jean-Etienne Durand Date: Thu, 15 Oct 2026 08:33:17 +0200 Subject: [PATCH 1/4] Fix avo patched_versions for CVE-2026-53769 --- gems/avo/CVE-2026-53769.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/gems/avo/CVE-2026-53769.yml b/gems/avo/CVE-2026-53769.yml index 08c637f6ce..285a46cf97 100644 --- a/gems/avo/CVE-2026-53769.yml +++ b/gems/avo/CVE-2026-53769.yml @@ -26,7 +26,7 @@ cvss_v3: 6.5 unaffected_versions: - "< 2.28.0" patched_versions: - - "~> 3.32.0" + - ">= 3.32.0" - ">= 4.0.0.beta.41" related: url: From 1587242323832baf6d1379c08d51328bb12ee802 Mon Sep 17 00:00:00 2001 From: Jean-Etienne Durand Date: Thu, 15 Oct 2026 08:33:32 +0200 Subject: [PATCH 2/4] Fix avo patched_versions for CVE-2026-55518 --- gems/avo/CVE-2026-55518.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/gems/avo/CVE-2026-55518.yml b/gems/avo/CVE-2026-55518.yml index 43802e88dc..b7e3d1ccc1 100644 --- a/gems/avo/CVE-2026-55518.yml +++ b/gems/avo/CVE-2026-55518.yml @@ -39,7 +39,7 @@ description: | button or deny the attach form. cvss_v3: 9.6 patched_versions: - - "~> 3.32.1" + - ">= 3.32.1" - ">= 4.0.0.beta.51" related: url: From bf44340955d7be0f6c07cbe089074705e9ecd61d Mon Sep 17 00:00:00 2001 From: Jean-Etienne Durand Date: Thu, 15 Oct 2026 08:34:07 +0200 Subject: [PATCH 3/4] Exclude 4.0 betas from avo 3.x patched range for CVE-2026-55518 --- gems/avo/CVE-2026-55518.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/gems/avo/CVE-2026-55518.yml b/gems/avo/CVE-2026-55518.yml index b7e3d1ccc1..8a9a492bff 100644 --- a/gems/avo/CVE-2026-55518.yml +++ b/gems/avo/CVE-2026-55518.yml @@ -39,7 +39,7 @@ description: | button or deny the attach form. cvss_v3: 9.6 patched_versions: - - ">= 3.32.1" + - ">= 3.32.1, < 4.0.0.beta.1" - ">= 4.0.0.beta.51" related: url: From fcac5200c1aff53c7fc36db7f5499563c98205dc Mon Sep 17 00:00:00 2001 From: Jean-Etienne Durand Date: Thu, 15 Oct 2026 08:34:23 +0200 Subject: [PATCH 4/4] Exclude 4.0 betas from avo 3.x patched range for CVE-2026-53769 --- gems/avo/CVE-2026-53769.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/gems/avo/CVE-2026-53769.yml b/gems/avo/CVE-2026-53769.yml index 285a46cf97..bbf1b09f7a 100644 --- a/gems/avo/CVE-2026-53769.yml +++ b/gems/avo/CVE-2026-53769.yml @@ -26,7 +26,7 @@ cvss_v3: 6.5 unaffected_versions: - "< 2.28.0" patched_versions: - - ">= 3.32.0" + - ">= 3.32.0, < 4.0.0.beta.1" - ">= 4.0.0.beta.41" related: url: