Critical Photon OS Security Update - PHSA-2026-5.0-0927

Updates of 'rubygem-fluentd' packages of Photon OS have been released...

websocket-driver-ruby: Denial of service via malformed Host header

Impact If this library is used to implement a WebSocket server on top of a TCP server, by using the WebSocket::Driver.server method, then a client can cause the server to crash by sending a Host header that is not a valid host:port string. When this happens, a URI::InvalidURIError exception is...

GHSA-2X63-GW47-W4MM websocket-driver-ruby: Denial of service via malformed Host header

Impact If this library is used to implement a WebSocket server on top of a TCP server, by using the WebSocket::Driver.server method, then a client can cause the server to crash by sending a Host header that is not a valid host:port string. When this happens, a URI::InvalidURIError exception is...

CLEANSTART-2026-RG00675 Security fixes for CVE-2026-33637, CVE-2026-42245, CVE-2026-42246, CVE-2026-42256, CVE-2026-42257, CVE-2026-42258, ghsa-5rv5-xj5j-3484, ghsa-75xq-5h9v-w6px, ghsa-87pf-fpwv-p7m7, ghsa-hm49-wcqc-g2xg, ghsa-q2mw-fvj9-vvcw, ghsa-vcgp-9326-pqcp applied in versions: 1.19.2-r2

Multiple security vulnerabilities affect the ruby-fluentd-1.19 package. These issues are resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-DE16221 Security fixes for CVE-2026-54171, CVE-2026-54297, CVE-2026-54522, CVE-2026-54904, CVE-2026-54905, CVE-2026-54906, ghsa-6wx8-w4f5-wwcr, ghsa-98m9-hrrm-r99r, ghsa-h8w8-99g7-qmvj, ghsa-wv3x-4vxv-whpp applied in versions: 1.18.0-r4, 1.18.0-r5

Multiple security vulnerabilities affect the ruby-fluentd-1.18 package. These issues are resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-UT74115 Security fixes for CVE-2026-33637, CVE-2026-41316, CVE-2026-42245, CVE-2026-42246, CVE-2026-42256, CVE-2026-42257, CVE-2026-42258, CVE-2026-54171, CVE-2026-54297, CVE-2026-54696, CVE-2026-54904, CVE-2026-54905, CVE-2026-54906, ghsa-5rv5-xj5j-3484, ghsa-6wx8-w4f5-wwcr, ghsa-75xq-5h9v-w6px, ghsa-87pf-fpwv-p7m7, ghsa-98m9-hrrm-r99r, ghsa-h8w8-99g7-qmvj, ghsa-hm49-wcqc-g2xg, ghsa-q2mw-fvj9-vvcw, ghsa-vcgp-9326-pqcp, ghsa-wv3x-4vxv-whpp applied in versions: 1.19.2-r2, 1.19.2-r3, 1.19.2-r4

Multiple security vulnerabilities affect the ruby-fluentd-1.19 package. These issues are resolved in later releases. See references for individual vulnerability details...

PT-2026-71346

Name of the Vulnerable Software and Affected Versions Loofah versions 2.25.0 through 2.25.1 Description Loofah is a library for manipulating and transforming HTML/XML documents and fragments. The allowed uri? function within Loofah::HTML5::Scrub fails to reject javascript: or vbscript: URIs when...

PT-2026-66528

Name of the Vulnerable Software and Affected Versions MessagePack for Ruby versions prior to 1.8.2 Description A use-after-free issue exists in the MessagePack::Bufferclear function within ext/msgpack/buffer.c. When this function is called, it returns memory pages to a shared pool but fails to...

CVE-2026-53727

A flaw was found in cssparser from 2.2.0 before 3.0.0. CssParser::Parserreadremotefile used by loaduri! and @import handling in addblock! issues HTTP/HTTPS requests without host, IP, or scheme restrictions, including to loopback and RFC1918 targets, and recursively follows Location redirects. Tho...

Malicious code in my_shoaib_gem (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-10914 Malicious code in my_shoaib_gem (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in ike-artifactory-ruby (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-10913 Malicious code in ike-artifactory-ruby (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

TencentOS Server 3: ruby:3.3 (TSSA-2026:0657)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0657 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...

Concurrent Ruby AtomicReference Heap Buffer Overflow DoS

The vulnerability of the update method in the Concurrent::AtomicReference class in the Ruby Concurrent library is related to the execution of a loop with an unreachable exit condition. Exploiting this vulnerability could allow a malicious actor to cause service failures...

EXPLOIT_POC

Estudo de Vulnerabilidade: CVE-2018-14847 MikroTik 📜 Des...

APEX_FRAMEWORK

ApexFramework A high-performance Ruby-based framework for sec...

Malicious Package

Overview fastlane-plugin-runtestsfirebasetestlab is a malicious package. This package contains malicious code and is part of the SleeperGem supply chain campaign targeting RubyGems users. Malicious functionality was introduced in the specified affected versions of the package. Remediation Avoid...

Malicious Package

Overview zwkact1 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview zwtenc1 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...