vim: Vim: Arbitrary code execution via crafted step-definition patterns

A flaw was found in Vim, a command-line text editor. This vulnerability, identified as a code injection, affects the cucumber filetype plugin when Vim is configured with Ruby support. An attacker could exploit this by creating a malicious repository containing specially crafted step-definition...

ROS-20260817-73-0215

The vulnerability in Ruby is related to the lack of measures taken to clean data at the management level. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

ROS-20260817-73-0216

The vulnerability in Ruby is related to the lack of measures taken to clean data at the management level. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

ROS-20260817-73-0217

The vulnerability in Ruby is related to uncontrolled resource consumption due to filtering and reducing data to unsafe values during the processing of HTTP headers. Exploiting this vulnerability can allow an attacker to cause service failures, provided that the default configurations of...

SUSE CVE-2026-71847

Ruby JSON is a JSON implementation for Ruby. From 2.20.0 until 2.21.2, Ruby's JSON native C extension clears the consumed JSON::ResumableParser input buffer but leaves state.start, state.cursor, and state.end pointing into released storage. When partialvalue reconstructs an incomplete object...

CVE-2026-73648 vulnerabilities

Vulnerabilities for packages: ruby3.2-rails, ruby3.4-rails, pghero-fips, gitlab-rails-ce-fips, pghero, gitlab-rails-ce, commercial-gitlab-rails-ee-fips, ruby3.3-rails, ruby4.0-rails, commercial-gitlab-rails-ee...

CVE-2026-73648 vulnerabilities

Vulnerabilities for packages: ruby3.2-rails, ruby3.4-rails, ruby4.0-rails...

SUSE CVE-2026-73491

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. From 2.25.0 until 2.25.2, Loofah::HTML5::Scrub.alloweduri? does not reject javascript: URIs whose scheme is split or prefixed with the HTML5 named whitespace character...

SUSE CVE-2026-73492

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. From 2.25.0 until 2.25.2, Loofah::HTML5::Scrub.alloweduri? does not reject javascript: or vbscript: URIs whose scheme is split by semicolon-less numeric character references...

CVE-2026-53970

ZeroBrew version 0.3.1 and prior contains a missing integrity verification vulnerability in the Ruby compatibility shim that allows network attackers to execute arbitrary code by substituting malicious content at formula resource or URL-based patch URLs without checksum validation. Attackers can...

CVE-2026-73492

A flaw was found in Loofah, a library used for processing HTML and XML documents. The 'alloweduri?' function, intended to validate Uniform Resource Identifiers URIs, does not correctly identify and reject 'javascript:' or 'vbscript:' URIs when their scheme is obscured by specific HTML-encoded...

CVE-2026-53970

ZeroBrew 0.3.1 and earlier is affected by a missing integrity verification vulnerability in the Ruby compatibility shim (shim.rb). An attacker could substitute malicious content at formula resources or URL-based patch URLs without checksum validation, allowing remote code execution when downloads...

EUVD-2026-58684

ZeroBrew version 0.3.1 and prior contains a missing integrity verification vulnerability in the Ruby compatibility shim that allows network attackers to execute arbitrary code by substituting malicious content at formula resource or URL-based patch URLs without checksum validation. Attackers can...

CVE-2026-53970 ZeroBrew version 0.3.1 and prior Missing Checksum Verification RCE via shim.rb

ZeroBrew version 0.3.1 and prior contains a missing integrity verification vulnerability in the Ruby compatibility shim that allows network attackers to execute arbitrary code by substituting malicious content at formula resource or URL-based patch URLs without checksum validation. Attackers can...

CVE-2026-53970

ZeroBrew version 0.3.1 and prior contains a missing integrity verification vulnerability in the Ruby compatibility shim that allows network attackers to execute arbitrary code by substituting malicious content at formula resource or URL-based patch URLs without checksum validation. Attackers can...

CVE-2026-53970: Download of Code Without Integrity Check

ZeroBrew version 0.3.1 and prior contains a missing integrity verification vulnerability in the Ruby compatibility shim that allows network attackers to execute arbitrary code by substituting malicious content at formula resource or URL-based patch URLs without checksum validation. Attackers can...

MiracleLinux 9 : ruby:4.0 (AXSA:2026-1542:01)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1542:01 advisory. ruby: net-imap: Net::IMAP: Denial of Service via crafted IMAP responses CVE-2026-42245 ruby/net-imap: ruby: Net::IMAP: IMAP Command Injection via...

Oracle Linux 10 : ruby4.0 (ELSA-2026-50773)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-50773 advisory. 4.0.6-36 - Upgrade to Ruby 4.0.6. Resolves: RHEL-211310 Resolves: RHEL-193660 Tenable has extracted the preceding description block directly from the...

Linux Distros Unpatched Vulnerability : CVE-2026-67986

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - amazing-print/amazingprint at commit dc890dfafdf07088ea901df53c19c2710e5c5234 contains a Ruby code injection condition in AwesomeMethodArraygrep. A specially...

Linux Distros Unpatched Vulnerability : CVE-2026-73648

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. From 1.0.3 until 1.7.1, Rails::HTML::PermitScrubber restricted SVG...