Unity Linux 20.1060e / 20.1070e Security Update: rubygem-puma (UTSA-2026-017658)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-017658 advisory. Puma is a concurrent HTTP 1.1 server for Ruby/Rack applications. The fix for CVE-2019-16770 was incomplete. The original fix only protected existing connections that...

ruby4.0-rubygem-puma-6.4.3-1.5 on GA media (moderate)

ruby4.0-rubygem-puma-6.4.3-1.5 on GA media Announcement ID: openSUSE-SU-2026:10357-1 Rating: moderate Cross-References: CVE-2019-16770 CVE-2020-11076 CVE-2022-23634 CVE-2024-45614 CVSS scores: CVE-2019-16770 SUSE : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2020-11076 SUSE : 6.8...

OPENSUSE-SU-2026:10357-1 ruby4.0-rubygem-puma-6.4.3-1.5 on GA media

These are all security issues fixed in the ruby4.0-rubygem-puma-6.4.3-1.5 package on the GA media of openSUSE Tumbleweed...

CVE-2025-63221

The Axel Technology puma devices firmware versions 0.8.5 to 1.0.3 are vulnerable to Broken Access Control due to missing authentication on the /cgi-bin/gstFcgi.fcgi endpoint. Unauthenticated remote attackers can list user accounts, create new administrative users, delete users, and modify system...

CVE-2025-63221

The Axel Technology puma devices firmware versions 0.8.5 to 1.0.3 are vulnerable to Broken Access Control due to missing authentication on the /cgi-bin/gstFcgi.fcgi endpoint. Unauthenticated remote attackers can list user accounts, create new administrative users, delete users, and modify system...

CVE-2025-63221

The Axel Technology puma devices firmware versions 0.8.5 to 1.0.3 are vulnerable to Broken Access Control due to missing authentication on the /cgi-bin/gstFcgi.fcgi endpoint. Unauthenticated remote attackers can list user accounts, create new administrative users, delete users, and modify system...

PT-2025-47469

The Axel Technology puma devices firmware versions 0.8.5 to 1.0.3 are vulnerable to Broken Access Control due to missing authentication on the /cgi-bin/gstFcgi.fcgi endpoint. Unauthenticated remote attackers can list user accounts, create new administrative users, delete users, and modify system...

CVE-2025-63221

The Axel Technology puma devices firmware versions 0.8.5 to 1.0.3 are vulnerable to Broken Access Control due to missing authentication on the /cgi-bin/gstFcgi.fcgi endpoint. Unauthenticated remote attackers can list user accounts, create new administrative users, delete users, and modify system...

CVE-2025-63221

The Axel Technology puma devices firmware versions 0.8.5 to 1.0.3 are vulnerable to Broken Access Control due to missing authentication on the /cgi-bin/gstFcgi.fcgi endpoint. Unauthenticated remote attackers can list user accounts, create new administrative users, delete users, and modify system...

Axel PUMA 安全漏洞

Axel PUMA is an FM re-broadcast receiver and IP encoder device from Axel Italy. A security vulnerability exists in Axel PUMA versions 0.8.5 through 1.0.3, which stems from a lack of authentication in the /cgi-bin/gstFcgi.fcgi endpoint, and could lead to a complete crack of the device...

CVE-2025-63221

CVE-2025-63221 (Axel Technology puma devices) affects firmware versions 0.8.5–1.0.3. The vulnerability is due to broken access control from missing authentication on the /cgi-bin/gstFcgi.fcgi endpoint. An unauthenticated remote attacker can enumerate user accounts, create new administrative users...

Malicious code in tired-pink-puma (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 21223ebc4b925a1c5bd80e1e7a30662c0864466865d1c85a8fe8e2a210e12cc2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-117022

Malicious code in tired-pink-puma npm...

MAL-2025-138803 Malicious code in inland-apricot-puma (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 40fd8eb906ddac610a69eb7dd65b6527d2b36d32a2342a31b1fb2da4eb773edf This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in inland-apricot-puma (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 40fd8eb906ddac610a69eb7dd65b6527d2b36d32a2342a31b1fb2da4eb773edf This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-117299

Malicious code in inland-apricot-puma npm...

MAL-2025-139080 Malicious code in tired-pink-puma (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 21223ebc4b925a1c5bd80e1e7a30662c0864466865d1c85a8fe8e2a210e12cc2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-131867 Malicious code in academic_puma_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bb674e560b519a06a52e266bc7192a3fd8858e66953a8de0b5e6a758bb4ba31c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-92048

Malicious code in faithfulpumaz3n npm...

Malicious code in cuddly_puma_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e9a4809c288b6c58824ee8e23e6c4f271edbdf54f9bf334e660fd201a41217cc This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...