CVE-2026-73426 vulnerabilities

Vulnerabilities for packages: ruby3.3-rails, ruby4.0-rails, ruby3.2-rails, ruby3.4-rails...

CVE-2026-73427 vulnerabilities

Vulnerabilities for packages: ruby3.3-rails, ruby4.0-rails, ruby3.2-rails, ruby3.4-rails...

CVE-2026-73490 vulnerabilities

Vulnerabilities for packages: ruby4.0-rails, ruby3.2-rails, ruby3.4-rails...

CVE-2026-73491 vulnerabilities

Vulnerabilities for packages: ruby4.0-rails, ruby3.2-rails, ruby3.4-rails...

CVE-2026-73427 vulnerabilities

Vulnerabilities for packages: ruby4.0-rails, ruby3.4-rails, ruby3.2-rails, ruby3.3-rails...

CVE-2026-73490 vulnerabilities

Vulnerabilities for packages: pghero-fips, ruby4.0-rails, gitlab-rails-ce, ruby3.3-rails, pghero, ruby3.4-rails, ruby3.2-rails, gitlab-rails-ce-fips...

CVE-2026-73491 vulnerabilities

Vulnerabilities for packages: pghero-fips, ruby4.0-rails, gitlab-rails-ce, ruby3.3-rails, pghero, ruby3.4-rails, ruby3.2-rails, gitlab-rails-ce-fips...

CVE-2026-73648

rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. From 1.0.3 until 1.7.1, Rails::HTML::PermitScrubber restricted SVG reference elements in SVGALLOWLOCALHREF only when they used xlink:href, even though browsers also accept the plain href attribute. Applicatio...

UBUNTU-CVE-2026-73648

rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. From 1.0.3 until 1.7.1, Rails::HTML::PermitScrubber restricted SVG reference elements in SVGALLOWLOCALHREF only when they used xlink:href, even though browsers also accept the plain href attribute. Applicatio...

CVE-2026-67986

A flaw was found in amazingprint. This vulnerability allows an attacker to inject and execute arbitrary Ruby code within the host process. The flaw occurs when the grep method is called with a block, and a specially crafted method name containing Ruby interpolation syntax is processed. Successful...

CVE-2026-67986

amazing-print/amazingprint at commit dc890dfafdf07088ea901df53c19c2710e5c5234 contains a Ruby code injection condition in AwesomeMethodArraygrep. A specially named method containing Ruby interpolation syntax can be interpolated into a dynamically constructed eval string when grep is called with a...

CVE-2026-67991

crmne/rubyllm at commit fa6f279847d6d7027814539d9c0dfc3bbdfd2a83 contains a polynomial-time regular expression denial-of-service condition in RubyLLM::Utils.underscore on Ruby 3.1.x. A very long crafted class, agent, or tool name can cause excessive CPU consumption and a denial of service...

DEBIAN-CVE-2026-67986

amazing-print/amazingprint at commit dc890dfafdf07088ea901df53c19c2710e5c5234 contains a Ruby code injection condition in AwesomeMethodArraygrep. A specially named method containing Ruby interpolation syntax can be interpolated into a dynamically constructed eval string when grep is called with a...

CVE-2026-67986

amazing-print/amazingprint at commit dc890dfafdf07088ea901df53c19c2710e5c5234 contains a Ruby code injection condition in AwesomeMethodArraygrep. A specially named method containing Ruby interpolation syntax can be interpolated into a dynamically constructed eval string when grep is called with a...

JLSEC-2026-1291

A ReDoS issue was discovered in the Time component through 0.2.1 in Ruby through 3.2.1. The Time parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to Time objects. The fixed versions are 0.1.1 and 0.2.2...

JLSEC-2026-1282

The REXML gem before 3.2.5 in Ruby before 2.6.7, 2.7.x before 2.7.3, and 3.x before 3.0.1 does not properly address XML round-trip issues. An incorrect document can be produced after parsing and serializing...

JLSEC-2026-1288

CGI::Cookie.parse in Ruby through 2.6.8 mishandles security prefixes in cookie names. This also affects the CGI gem through 0.3.0 for Ruby...

JLSEC-2026-1290

There is a buffer over-read in Ruby before 2.6.10, 2.7.x before 2.7.6, 3.x before 3.0.4, and 3.1.x before 3.1.2. It occurs in String-to-Float conversion, including KernelFloat and Stringtof...

JLSEC-2026-1287

Date.parse in the date gem through 3.2.0 for Ruby allows ReDoS regular expression Denial of Service via a long string. The fixed versions are 3.2.1, 3.1.2, 3.0.2, and 2.0.1...

JLSEC-2026-1281

An issue was discovered in Ruby through 2.5.8, 2.6.x through 2.6.6, and 2.7.x through 2.7.1. WEBrick, a simple HTTP server bundled with Ruby, had not checked the transfer-encoding header value rigorously. An attacker may potentially exploit this issue to bypass a reverse proxy which also has a po...