PT-2026-102107

Security vulnerability affects the ruby package. This issue is resolved in later releases. See references for vulnerability details...

PT-2026-100375

Security vulnerability affects the ruby package. This issue is resolved in later releases. See references for vulnerability details...

EulerOS 2.0 SP10 : ruby (EulerOS-SA-2026-3721)

According to the versions of the ruby packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Net::IMAP implements Internet Message Access Protocol IMAP client functionality in Ruby. Prior to versions 0.4.24, 0.5.14, and 0.6.4,...

PT-2026-101399

Security vulnerability affects the ruby package. This issue is resolved in later releases. See references for vulnerability details...

PT-2026-101933

Security vulnerability affects the ruby package. This issue is resolved in later releases. See references for vulnerability details...

PT-2026-102221

Security vulnerability affects the ruby package. This issue is resolved in later releases. See references for vulnerability details...

vim: Vim: Arbitrary code execution via crafted step-definition patterns

A flaw was found in Vim, a command-line text editor. This vulnerability, identified as a code injection, affects the cucumber filetype plugin when Vim is configured with Ruby support. An attacker could exploit this by creating a malicious repository containing specially crafted step-definition...

CVE-2026-92904 Rubygem-foreman_remote_execution: job output readable without object-level view_job_invocations check

A flaw was found in the foremanremoteexecution plugin's template invocations controller. The showtemplateinvocationbyhost action resolves the job invocation by ID without evaluating the caller's viewjobinvocations permission filter against the record. An authenticated user whose job invocation...

EulerOS 2.0 SP15 : ruby (EulerOS-SA-2026-3821)

According to the versions of the ruby packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Net::IMAP implements Internet Message Access Protocol IMAP client functionality in Ruby. Prior to versions 0.3.10, 0.4.24, 0.5.14, and 0.6.4, a...

[SECURITY] Fedora 44 Update: ruby-4.0.6-38.fc44

Ruby is the interpreted scripting language for quick and easy object-oriented programming. It has many features to process text files and to do system management tasks as in Perl. It is simple, straight-forward, and extensible...

[SECURITY] Fedora 45 Update: rubygems-4.0.20-1.fc45

RubyGems is the Ruby standard for publishing and managing third party libraries...

[SECURITY] Fedora 45 Update: ruby-4.0.6-38.fc45

Ruby is the interpreted scripting language for quick and easy object-oriented programming. It has many features to process text files and to do system management tasks as in Perl. It is simple, straight-forward, and extensible...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in json

Summary IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in json Vulnerability Details CVEID:CVE-2026-71847 DESCRIPTION: Ruby JSON is a JSON implementation for Ruby. From 2.20.0 until 2.21.2, Ruby's JSON native C extension clears the consumed JSON::ResumableParser input...

Fedora 44 : ruby (2026-da06bdeb38)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-da06bdeb38 advisory. This rpm updates included resolv gem to 0.7.2 to resolve CVE security issues. Tenable has extracted the preceding description block directly from th...

Fedora 45 : ruby (2026-ab0c751524)

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-ab0c751524 advisory. This rpm updates included resolv gem to 0.7.2 to resolve CVE security issues. Tenable has extracted the preceding description block directly from th...

CVE-2026-68489

Static Code Injection in Plesk extensions "Ruby" before 1.6.6 and "Node.js Toolkit" before 2.5.0 allows remote authenticated users to execute arbitrary code as root via custom environment variables...

CVE-2026-68489

CVE-2026-68489 is a Static Code Injection vulnerability in two Plesk extensions: Ruby (before 1.6.6) and Node.js Toolkit (before 2.5.0). A remote authenticated user can execute arbitrary code as root by crafting malicious custom environment variables . The vulnerability scores 8.7 (HIGH) under CV...

EUVD-2026-78137

Static Code Injection in Plesk extensions "Ruby" before 1.6.6 and "Node.js Toolkit" before 2.5.0 allows remote authenticated users to execute arbitrary code as root via custom environment variables...

EUVD-2026-77671

dd-trace-rb is Datadog's client library for Ruby. Prior to 2.32.0, W3C baggage extraction does not enforce DDTRACEBAGGAGEMAXITEMS, which defaults to 64, or DDTRACEBAGGAGEMAXBYTES, which defaults to 8192, although those limits apply during baggage injection. A remote unauthenticated attacker can...

CVE-2026-50276 dd-trace-rb: Improper parsing of W3C baggage headers may lead to DoS

dd-trace-rb is Datadog's client library for Ruby. Prior to 2.32.0, W3C baggage extraction does not enforce DDTRACEBAGGAGEMAXITEMS, which defaults to 64, or DDTRACEBAGGAGEMAXBYTES, which defaults to 8192, although those limits apply during baggage injection. A remote unauthenticated attacker can...