CVE-2026-63144 vulnerabilities

Vulnerabilities for packages: ruby4.0-elasticsearch, ruby3.2-elasticsearch, ruby3.4-elasticsearch, ruby3.3-elasticsearch...

CVE-2026-63263 vulnerabilities

Vulnerabilities for packages: ruby4.0-elasticsearch, ruby3.2-elasticsearch, ruby3.4-elasticsearch, ruby3.3-elasticsearch...

GHSA-5V5G-HVW6-X2X7 vulnerabilities

Vulnerabilities for packages: ruby4.0-elasticsearch, ruby3.2-elasticsearch, ruby3.4-elasticsearch, ruby3.3-elasticsearch...

CVE-2026-54522 vulnerabilities

Vulnerabilities for packages: ruby3.2-fluentd-kubernetes-daemonset...

GHSA-5V5G-HVW6-X2X7 vulnerabilities

Vulnerabilities for packages: ruby4.0-elasticsearch, ruby3.4-elasticsearch, ruby3.3-elasticsearch, ruby3.2-elasticsearch...

CVE-2026-56144 vulnerabilities

Vulnerabilities for packages: ruby4.0-elasticsearch, ruby3.4-elasticsearch, ruby3.3-elasticsearch, ruby3.2-elasticsearch...

CVE-2026-63144 vulnerabilities

Vulnerabilities for packages: ruby4.0-elasticsearch, ruby3.4-elasticsearch, ruby3.3-elasticsearch, ruby3.2-elasticsearch...

GHSA-9FHM-53XW-H9C3 vulnerabilities

Vulnerabilities for packages: ruby4.0-elasticsearch, ruby3.4-elasticsearch, ruby3.3-elasticsearch, ruby3.2-elasticsearch...

GHSA-4MRV-5P47-P938 vulnerabilities

Vulnerabilities for packages: ruby3.2-fluentd-kubernetes-daemonset...

CVE-2026-63263 vulnerabilities

Vulnerabilities for packages: ruby4.0-elasticsearch, ruby3.4-elasticsearch, ruby3.3-elasticsearch, ruby3.2-elasticsearch...

CVE-2026-56145 vulnerabilities

Vulnerabilities for packages: ruby4.0-elasticsearch, ruby3.4-elasticsearch, ruby3.3-elasticsearch, ruby3.2-elasticsearch...

ROOT-APP-RUBY-CVE-2026-54902 CVE-2026-54902 in rootio-oj - Patched by Root

Root has patched CVE-2026-54902 in the rootio-oj package for Root:Ruby. Multiple fixed versions available...

Session Hijacking

MCP Ruby SDK is vulnerable to Session Hijacking. The vulnerability is due to missing session ownership validation in StreamableHTTPTransport, allowing attackers with a stolen session ID to execute tool calls within the victim's session...

nokogiri: Nokogiri: Denial of Service or Information Disclosure via invalid encoding handling

A flaw was found in Nokogiri, an XML and HTML library for Ruby. When an attacker provides an invalid encoding to the Documentencoding= function, the library frees the document's current encoding string without replacing it. This leaves the document referencing freed memory, which can lead to a...

Important: Red Hat Security Advisory: Satellite 6.17.10 Async Update

A new release is now available for Red Hat Satellite 6.17 for RHEL 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

SUSE CVE-2026-54522

MessagePack for Ruby is an implementation of the MessagePack binary serialization format. Prior to 1.8.2, MessagePack::Bufferclear in ext/msgpack/buffer.c leaves rmemlast, rmemend, and rmemowner stale after msgpackbuffershiftchunk returns an rmem page to the shared pool, allowing a subsequent...

CVE-2026-53510

Savon is a Ruby SOAP client. From 0.9.8 until 2.17.2, Savon::Model .alloperations interpolates attacker-controlled WSDL operation names into Ruby source passed to moduleeval, allowing Ruby code execution in the application process. This issue is fixed in version 2.17.2...

CVE-2026-53510

Savon (Ruby SOAP client) contains a vulnerability in Savon::Model.all_operations, which interpolates attacker-controlled WSDL operation names into Ruby source passed to module_eval, allowing arbitrary code execution in the application process. Affected versions are 0.9.8 through 2.17.1; the issue...

EUVD-2026-51624

Savon is a Ruby SOAP client. From 0.9.8 until 2.17.2, Savon::Model .alloperations interpolates attacker-controlled WSDL operation names into Ruby source passed to moduleeval, allowing Ruby code execution in the application process. This issue is fixed in version 2.17.2...

CVE-2026-53510 Savon::Model evaluates WSDL operation names as Ruby source

Savon is a Ruby SOAP client. From 0.9.8 until 2.17.2, Savon::Model .alloperations interpolates attacker-controlled WSDL operation names into Ruby source passed to moduleeval, allowing Ruby code execution in the application process. This issue is fixed in version 2.17.2...