Savon::Model evaluates WSDL operation names as Ruby source

Impact Savon::Model generated SOAP operation methods by interpolating operation names into Ruby source passed to moduleeval. An attacker who can control the operation names of a WSDL, can inject Ruby code that executes in the application process. This affects only the .alloperations class method...

GHSA-MX5J-MP4F-G8JG Savon::Model evaluates WSDL operation names as Ruby source

Impact Savon::Model generated SOAP operation methods by interpolating operation names into Ruby source passed to moduleeval. An attacker who can control the operation names of a WSDL, can inject Ruby code that executes in the application process. This affects only the .alloperations class method...

Missing Authorization

Overview graphql is a plain-Ruby implementation of GraphQL. Affected versions of this package are vulnerable to Missing Authorization in the Execution::Next process. An attacker can access unauthorized fields by triggering authorization failures that do not properly halt execution for fields usin...

Camaleon CMS (2.1.1 to 2.9.1) contains an authenticated RCE vulnerability

Camaleon CMS versions 2.1.1 through 2.9.1 contains an authenticated remote code execution RCE vulnerability that allows users with customfields manage permission to execute arbitrary Ruby code by supplying a malicious expression through the selecteval custom field type. Attackers can store an...

Ruby on Rails Active Storage CVE-2026-66066 Detection Tool

A safe detection tool for identifying Ruby on Rails Active Storage deployments that may be affected by the CVE-2026-66066 vulnerability. The utility performs non-invasive fingerprinting by checking for Rails and Active Storage indicators, exposed endpoints, and version information without...

CVE-2026-53510: Improper Control of Generation of Code

Savon is a Ruby SOAP client. From 0.9.8 until 2.17.2, Savon::Model .alloperations interpolates attacker-controlled WSDL operation names into Ruby source passed to moduleeval, allowing Ruby code execution in the application process. This issue is fixed in version 2.17.2...

PT-2026-66845

Savon is a Ruby SOAP client. From 0.9.8 until 2.17.2, Savon::Model .all operations interpolates attacker-controlled WSDL operation names into Ruby source passed to module eval, allowing Ruby code execution in the application process. This issue is fixed in version 2.17.2...

[SECURITY] [DLA 4706-1] ruby-rack security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4706-1 [email protected] https://www.debian.org/lts/security/ Abhijith PA July 31, 2026 https://wiki.debian.org/LTS -...

AZL-94449 CVE-2026-54522 affecting package rubygem-msgpack for versions less than 1.8.4-1

MessagePack for Ruby is an implementation of the MessagePack binary serialization format. Prior to 1.8.2, MessagePack::Bufferclear in ext/msgpack/buffer.c leaves rmemlast, rmemend, and rmemowner stale after msgpackbuffershiftchunk returns an rmem page to the shared pool, allowing a subsequent...

CVE-2026-54522

MessagePack for Ruby is an implementation of the MessagePack binary serialization format. Prior to 1.8.2, MessagePack::Bufferclear in ext/msgpack/buffer.c leaves rmemlast, rmemend, and rmemowner stale after msgpackbuffershiftchunk returns an rmem page to the shared pool, allowing a subsequent...

CVE-2026-54522

MessagePack for Ruby is an implementation of the MessagePack binary serialization format. Prior to 1.8.2, MessagePack::Bufferclear in ext/msgpack/buffer.c leaves rmemlast, rmemend, and rmemowner stale after msgpackbuffershiftchunk returns an rmem page to the shared pool, allowing a subsequent...

UBUNTU-CVE-2026-54522

MessagePack for Ruby is an implementation of the MessagePack binary serialization format. Prior to 1.8.2, MessagePack::Bufferclear in ext/msgpack/buffer.c leaves rmemlast, rmemend, and rmemowner stale after msgpackbuffershiftchunk returns an rmem page to the shared pool, allowing a subsequent...

CVE-2026-54522 MessagePack::Buffer#clear Use-After-Free that Enables Cross-Buffer Disclosure

MessagePack for Ruby is an implementation of the MessagePack binary serialization format. Prior to 1.8.2, MessagePack::Bufferclear in ext/msgpack/buffer.c leaves rmemlast, rmemend, and rmemowner stale after msgpackbuffershiftchunk returns an rmem page to the shared pool, allowing a subsequent...

CVE-2026-54522

MessagePack for Ruby is an implementation of the MessagePack binary serialization format. Prior to 1.8.2, MessagePack::Bufferclear in ext/msgpack/buffer.c leaves rmemlast, rmemend, and rmemowner stale after msgpackbuffershiftchunk returns an rmem page to the shared pool, allowing a subsequent...

CVE-2026-54522 MessagePack::Buffer#clear Use-After-Free that Enables Cross-Buffer Disclosure

MessagePack for Ruby is an implementation of the MessagePack binary serialization format. Prior to 1.8.2, MessagePack::Bufferclear in ext/msgpack/buffer.c leaves rmemlast, rmemend, and rmemowner stale after msgpackbuffershiftchunk returns an rmem page to the shared pool, allowing a subsequent...

CVE-2026-54522

MessagePack for Ruby is an implementation of the MessagePack binary serialization format. Prior to 1.8.2, MessagePack::Bufferclear in ext/msgpack/buffer.c leaves rmemlast, rmemend, and rmemowner stale after msgpackbuffershiftchunk returns an rmem page to the shared pool, allowing a subsequent...

CVE-2026-54522

CVE-2026-54522 affects MessagePack for Ruby prior to 1.8.2, where MessagePack::Buffer#clear can leave internal rmem pointers stale after a chunk return, enabling a subsequent Buffer#write to alias the freed page and potentially disclose or corrupt cross-buffer data. Root cause: stale rmem_last/rm...

CVE-2026-54522 MessagePack::Buffer#clear Use-After-Free that Enables Cross-Buffer Disclosure

MessagePack for Ruby is an implementation of the MessagePack binary serialization format. Prior to 1.8.2, MessagePack::Bufferclear in ext/msgpack/buffer.c leaves rmemlast, rmemend, and rmemowner stale after msgpackbuffershiftchunk returns an rmem page to the shared pool, allowing a subsequent...

CVE-2026-54620

A flaw was found in sqlite3-ruby, a Ruby binding for the SQLite3 embedded database. This vulnerability occurs because callbacks used for SQLite aggregate functions can be prematurely freed while still being referenced during aggregation. A local attacker could potentially exploit this...

GHSA-5P9G-J988-PCWV MCP Ruby SDK: Ruby SSE Session Poisoning

Summary Vulnerability: Missing Session Ownership Validation in the Ruby MCP SDK's Streamable and SSE HTTP transport implementation. Any attacker with a stolen session ID can execute tools with the victim's session. This is a silent attack - the victim's session is compromised and being used for...