799 matches found
CVE-2026-33168
CVE-2026-33168 (Rails / Action View) affects Rails’ Action View tag helpers. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, using a blank string as an HTML attribute name bypasses attribute escaping, producing malformed HTML. A crafted attribute could be misinterpreted by the browser as a new a...
EUVD-2026-14630
Rails Active Support has a possible DoS vulnerability in its number helpers...
GHSA-2J26-FRM8-CMJ9 Rails Active Support has a possible DoS vulnerability in its number helpers
Impact Active Support number helpers accept strings containing scientific notation e.g. 1e10000, which when converted to a string could be expanded into extremely large decimal representations. This can cause excessive memory allocation and CPU consumption when the expanded number is formatted,...
Rails Active Support has a possible DoS vulnerability in its number helpers
Impact Active Support number helpers accept strings containing scientific notation e.g. 1e10000, which when converted to a string could be expanded into extremely large decimal representations. This can cause excessive memory allocation and CPU consumption when the expanded number is formatted,...
Rails has a possible XSS vulnerability in its Action View tag helpers
Impact When a blank string is used as an HTML attribute name in Action View tag helpers, the attribute escaping is bypassed, producing malformed HTML. A carefully crafted attribute value could then be misinterpreted by the browser as a separate attribute name, possibly leading to XSS. Application...
EUVD-2026-14616
Rails has a possible XSS vulnerability in its Action View tag helpers...
GHSA-V55J-83PF-R9CQ Rails has a possible XSS vulnerability in its Action View tag helpers
Impact When a blank string is used as an HTML attribute name in Action View tag helpers, the attribute escaping is bypassed, producing malformed HTML. A carefully crafted attribute value could then be misinterpreted by the browser as a separate attribute name, possibly leading to XSS. Application...
Rails Active Support has a possible DoS vulnerability in its number helpers
Impact Active Support number helpers accept strings containing scientific notation e.g. 1e10000, which when converted to a string could be expanded into extremely large decimal representations. This can cause excessive memory allocation and CPU consumption when the expanded number is formatted,...
MAL-2026-2024 Malicious code in @mesh-helpers/themehelper (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1743b5d260ab5fc722b3c6d24903ff994a0f9e77630220b02cc8d8d036e84195 The package @mesh-helpers/themehelper was found to contain malicious code. Source: ossf-package-analysis...
Malicious code in @mesh-helpers/common (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cb7b29c037fd6e505ddbd1506f78292b2b69aef43c5750ef655bb27d5dd9986e The package @mesh-helpers/common was found to contain malicious code. Source: ossf-package-analysis...
MAL-2026-2021 Malicious code in @mesh-helpers/common (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cb7b29c037fd6e505ddbd1506f78292b2b69aef43c5750ef655bb27d5dd9986e The package @mesh-helpers/common was found to contain malicious code. Source: ossf-package-analysis...
SUSE CVE-2026-23276
In the Linux kernel, the following vulnerability has been resolved: net: add xmit recursion limit to tunnel xmit functions Tunnel xmit functions iptunnelxmit, ip6tunnelxmit lack their own recursion limit. When a bond device in broadcast mode has GRE tap interfaces as slaves, and those GRE tunnels...
EUVD-2026-13612
In the Linux kernel, the following vulnerability has been resolved: net: add xmit recursion limit to tunnel xmit functions Tunnel xmit functions iptunnelxmit, ip6tunnelxmit lack their own recursion limit. When a bond device in broadcast mode has GRE tap interfaces as slaves, and those GRE tunnels...
CVE-2026-23276
In the Linux kernel, the following vulnerability has been resolved: net: add xmit recursion limit to tunnel xmit functions Tunnel xmit functions iptunnelxmit, ip6tunnelxmit lack their own recursion limit. When a bond device in broadcast mode has GRE tap interfaces as slaves, and those GRE tunnels...
Malicious code in iron-demo-helpers (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2eab1a57b93ed5fd15072cc6fcf50181933725cba4d6f98da5b81a99bec5f71e The package iron-demo-helpers was found to contain malicious code...
MAL-2026-1755 Malicious code in iron-demo-helpers (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2eab1a57b93ed5fd15072cc6fcf50181933725cba4d6f98da5b81a99bec5f71e The package iron-demo-helpers was found to contain malicious code...
CVE-2026-22169
OpenClaw versions prior to 2026.2.22 contain an allowlist bypass vulnerability in the safeBins configuration that allows attackers to invoke external helpers through the compress-program option. When sort is explicitly added to tools.exec.safeBins, remote attackers can bypass intended safe-bin...
CVE-2026-22169
OpenClaw before version 2026.2.22 has an allowlist bypass in safeBins. When sort is enabled in tools.exec.safeBins, the compress-program parameter can be exploited to invoke external helpers and execute unauthorized external programs. This is a LOCAL, high-severity issue with high impact on confi...
CVE-2026-22169 OpenClaw < 2026.2.22 - Allowlist Bypass via sort Configuration in safeBins
OpenClaw versions prior to 2026.2.22 contain an allowlist bypass vulnerability in the safeBins configuration that allows attackers to invoke external helpers through the compress-program option. When sort is explicitly added to tools.exec.safeBins, remote attackers can bypass intended safe-bin...
CVE-2026-22169 OpenClaw < 2026.2.22 - Allowlist Bypass via sort Configuration in safeBins
OpenClaw versions prior to 2026.2.22 contain an allowlist bypass vulnerability in the safeBins configuration that allows attackers to invoke external helpers through the compress-program option. When sort is explicitly added to tools.exec.safeBins, remote attackers can bypass intended safe-bin...