19094 matches found
EUVD-2026-85566
OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From 5.1.0 until 7.3.0, authenticated non-administrator users can write content under targetsmodified/ that is later executed by multiple configuration paths below the intended...
CVE-2026-77602
OpenC3 COSMOS versions 5.1.0 through 7.3.0 are vulnerable to authenticated remote code execution (RCE) . The root cause is that the system processes a user-writable configuration overlay (targets_modified/) before the read-only targets/ tree. Authenticated non-administrator users can use features...
vim: Vim: Arbitrary code execution via crafted step-definition patterns
A flaw was found in Vim, a command-line text editor. This vulnerability, identified as a code injection, affects the cucumber filetype plugin when Vim is configured with Ruby support. An attacker could exploit this by creating a malicious repository containing specially crafted step-definition...
A library for client-side APIs for the IMAP protocol, written in Ruby. This issue involves insufficient checking of unusual or exceptional states, allowing attackers to execute “man-in-the-middle” attacks.
The vulnerability in the client API library for the IMAP protocol, written in Ruby, relates to insufficient checking of unusual or exceptional states. Exploiting this vulnerability could allow a malicious actor to carry out a “man-in-the-middle” attack...
A library error related to the client API for the IMAP protocol, written in Ruby. This issue arises from the failure to properly handle CRLF sequences, allowing attackers to execute arbitrary IMAP commands.
The vulnerability in the client API library for the IMAP protocol in Ruby is related to the failure to implement measures to neutralize CRLF sequences. Exploiting this vulnerability allows an attacker to execute arbitrary IMAP commands remotely...
CVE-2026-77602: Improper Control of Generation of Code
OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From 5.1.0 until 7.3.0, authenticated non-administrator users can write content under targetsmodified/ that is later executed by multiple configuration paths below the intended...
CVE-2026-94462
Spree is an open source e-commerce solution built with Ruby on Rails. From 5.4.0 until 5.4.4 and 5.5.4, PATCH /api/v3/store/carts/:id/associate in Spree::Api::V3::Store::CartsControllerassociate uses findcartforassociation to locate a cart by prefixedid but does not require a cart token or...
CVE-2026-94462 Spree: Broken Access Control in `PATCH /api/v3/store/carts/:id/associate` (IDOR)
Spree is an open source e-commerce solution built with Ruby on Rails. From 5.4.0 until 5.4.4 and 5.5.4, PATCH /api/v3/store/carts/:id/associate in Spree::Api::V3::Store::CartsControllerassociate uses findcartforassociation to locate a cart by prefixedid but does not require a cart token or...
CVE-2026-94462
The open source e-commerce solution Spree is vulnerable to a broken access control (IDOR) issue in versions 5.4.0 through 5.4.4 and 5.5.4 . The vulnerability exists in the Spree::Api::V3::Store::CartsController#associate method, where the PATCH /api/v3/store/carts/:id/associate endpoint uses find...
EUVD-2026-84794
Spree is an open source e-commerce solution built with Ruby on Rails. From 5.4.0 until 5.4.4 and 5.5.4, PATCH /api/v3/store/carts/:id/associate in Spree::Api::V3::Store::CartsControllerassociate uses findcartforassociation to locate a cart by prefixedid but does not require a cart token or...
CVE-2026-94462 Spree: Broken Access Control in `PATCH /api/v3/store/carts/:id/associate` (IDOR)
Spree is an open source e-commerce solution built with Ruby on Rails. From 5.4.0 until 5.4.4 and 5.5.4, PATCH /api/v3/store/carts/:id/associate in Spree::Api::V3::Store::CartsControllerassociate uses findcartforassociation to locate a cart by prefixedid but does not require a cart token or...
Malicious Package
Overview no-fun is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...
MAL-2026-17059 Malicious code in bunlder-ruby (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in bunlder-ruby (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in bundler-ruby (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-16965 Malicious code in bundler-ruby (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-16942 Malicious code in bundlef-ruby (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in bundlef-ruby (RubyGems)
--- -= Per source details. Do not edit below this line.=-...