ruby-jwt: ruby-jwt: Authentication bypass due to empty key in HMAC verification

A flaw was found in ruby-jwt, a Ruby implementation of the RFC 7519 OAuth JSON Web Token JWT standard. A remote attacker can exploit this vulnerability by crafting a malicious token that is accepted due to an empty key being used in the HMAC Hash-based Message Authentication Code digest calculati...

GHSA-XQQH-3W52-Q8P7 vulnerabilities

Vulnerabilities for packages: ruby3.3-rails, ruby3.2-rails, ruby4.0-rails, ruby3.4-rails...

CVE-2026-79772 vulnerabilities

Vulnerabilities for packages: ruby3.3-rails, ruby3.2-rails, ruby4.0-rails, ruby3.4-rails...

CVE-2026-79770 vulnerabilities

Vulnerabilities for packages: ruby3.4-rails, gitlab-rails-ce-fips, pact-broker-docker, ruby3.3-rails, kube-logging-operator, pact-broker-docker-fips, gitlab-rails-ce, ruby3.2-rails, ruby4.0-rails...

GHSA-RH9X-7XJC-VWX2 vulnerabilities

Vulnerabilities for packages: ruby3.4-rails, gitlab-rails-ce-fips, pact-broker-docker, ruby3.3-rails, kube-logging-operator, pact-broker-docker-fips, gitlab-rails-ce, ruby3.2-rails, ruby4.0-rails...

CVE-2026-79771 vulnerabilities

Vulnerabilities for packages: ruby3.4-rails, gitlab-rails-ce-fips, pact-broker-docker, ruby3.3-rails, kube-logging-operator, pact-broker-docker-fips, gitlab-rails-ce, ruby3.2-rails, ruby4.0-rails...

GHSA-XQQH-3W52-Q8P7 vulnerabilities

Vulnerabilities for packages: ruby3.3-rails, ruby3.4-rails, ruby4.0-rails, ruby3.2-rails...

CVE-2026-79772 vulnerabilities

Vulnerabilities for packages: ruby3.3-rails, ruby3.4-rails, ruby4.0-rails, ruby3.2-rails...

CVE-2026-79771 vulnerabilities

Vulnerabilities for packages: ruby3.4-rails, kube-logging-operator, ruby4.0-rails, ruby3.3-rails, ruby3.2-rails...

CVE-2026-79770 vulnerabilities

Vulnerabilities for packages: ruby3.4-rails, kube-logging-operator, ruby4.0-rails, ruby3.3-rails, ruby3.2-rails...

GHSA-RH9X-7XJC-VWX2 vulnerabilities

Vulnerabilities for packages: ruby3.4-rails, kube-logging-operator, ruby4.0-rails, ruby3.3-rails, ruby3.2-rails...

GHSA-5JHF-FPP7-V2PV vulnerabilities

Vulnerabilities for packages: ruby3.4-rails, kube-logging-operator, ruby4.0-rails, ruby3.3-rails, ruby3.2-rails...

AZL-99087 CVE-2026-85396 affecting package rubygem-rubyzip 2.3.2-1

rubyzip versions before 3.4.0 contain a path traversal vulnerability in Zip::Entryextract that fails to properly validate extraction paths using prefix comparison without trailing separators. Attackers can craft archive entries with names like ../uploadbackup/owned.sh to write files outside the...

Linux Distros Unpatched Vulnerability : CVE-2026-63435

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Mail is an internet library for Ruby designed to handle email generation, parsing, and sending. Prior to 2.9.1, Mail::Utilities.qvaluedecode and...

EUVD-2026-69609

Mail: Email address spoofing via malformed RFC 2047 encoded-words...

CVE-2026-80212 affecting package ruby for versions less than 3.3.5-9

CVE-2026-80212 affecting package ruby for versions less than 3.3.5-9. A patched version of the package is available...

CVE-2026-80213 affecting package ruby for versions less than 3.3.5-9

CVE-2026-80213 affecting package ruby for versions less than 3.3.5-9. A patched version of the package is available...

SUSE CVE-2026-63435

Mail is an internet library for Ruby designed to handle email generation, parsing, and sending. Prior to 2.9.1, Mail::Utilities.qvaluedecode and Mail::Utilities.bvaluedecode used a single Stringmatch and an overly greedy charset capture to decode only the first RFC 2047 encoded-word and mishandle...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: ruby4.0: ruby4.0-4.0.6-37.3.hum1 aarch64, x8664 ruby4.0-bundled-gems-4.0.6-37.3.hum1 aarch64, x8664 ruby4.0-default-gems-4.0.6-37.3.hum1 noarch ruby4.0-devel-4.0.6-37.3.hum1 aarch64, x8664...

CVE-2026-71847

A flaw was found in Ruby JSON. A heap-use-after-free vulnerability exists in the JSON::ResumableParser component. A remote attacker, by supplying a specially crafted JSON stream with truncated duplicate keys, can cause the application to dereference freed memory. This can lead to process...