19097 matches found
Critical Photon OS Security Update - PHSA-2026-5.0-90-0929
Updates of 'rubygem-concurrent-ruby' packages of Photon OS have been released...
The vulnerability of the YARD documentation generation and hosting tool, written in the Ruby programming language, arises from an incorrect limitation on the path to the directory. This allows attackers to gain unauthorized access to protected information.
The vulnerability of the YARD tool for generating and hosting documentation in the Ruby programming language is related to an incorrect limitation on the path to the directory. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to protected information...
Ruby json: JSON generator heap buffer overflow when streaming to an IO
Summary JSON.dumpobj, io and JSON::Stategenerateobj, io can write past the internal JSON generator buffer when a streamed object contains an attacker-controlled string near 16 KB. The issue is a heap out-of-bounds write in the IO-streaming path and is demonstrated as a reliable process crash /...
GHSA-X2F5-4PRF-W687 Ruby json: JSON generator heap buffer overflow when streaming to an IO
Summary JSON.dumpobj, io and JSON::Stategenerateobj, io can write past the internal JSON generator buffer when a streamed object contains an attacker-controlled string near 16 KB. The issue is a heap out-of-bounds write in the IO-streaming path and is demonstrated as a reliable process crash /...
EUVD-2026-40626
Ruby json: JSON generator heap buffer overflow when streaming to an IO...
GHSA-5QHF-9PHG-95M2 vulnerabilities
Vulnerabilities for packages: ruby3.4-rails, ruby4.0-rails, ruby3.2-rails...
GHSA-8WHX-365G-H9VV vulnerabilities
Vulnerabilities for packages: ruby3.3-rails, pghero-fips, gitlab-rails-ce, ruby4.0-rails, pghero, ruby3.2-rails, ruby3.4-rails, gitlab-rails-ce-fips, commercial-gitlab-rails-ee...
GHSA-CJ75-F6XR-R4G7 vulnerabilities
Vulnerabilities for packages: ruby3.3-rails, pghero-fips, gitlab-rails-ce, ruby4.0-rails, pghero, commercial-gitlab-rails-ee-fips, ruby3.2-rails, ruby3.4-rails, gitlab-rails-ce-fips, commercial-gitlab-rails-ee...
GHSA-9WJQ-CP2P-HRGF vulnerabilities
Vulnerabilities for packages: ruby3.3-rails, pghero-fips, gitlab-rails-ce, ruby4.0-rails, pghero, commercial-gitlab-rails-ee-fips, ruby3.2-rails, ruby3.4-rails, gitlab-rails-ce-fips, commercial-gitlab-rails-ee...
Critical Photon OS Security Update - PHSA-2026-5.0-0927
Updates of 'rubygem-fluentd' packages of Photon OS have been released...
websocket-driver-ruby: Denial of service via malformed Host header
Impact If this library is used to implement a WebSocket server on top of a TCP server, by using the WebSocket::Driver.server method, then a client can cause the server to crash by sending a Host header that is not a valid host:port string. When this happens, a URI::InvalidURIError exception is...
GHSA-2X63-GW47-W4MM websocket-driver-ruby: Denial of service via malformed Host header
Impact If this library is used to implement a WebSocket server on top of a TCP server, by using the WebSocket::Driver.server method, then a client can cause the server to crash by sending a Host header that is not a valid host:port string. When this happens, a URI::InvalidURIError exception is...
CLEANSTART-2026-RG00675 Security fixes for CVE-2026-33637, CVE-2026-42245, CVE-2026-42246, CVE-2026-42256, CVE-2026-42257, CVE-2026-42258, ghsa-5rv5-xj5j-3484, ghsa-75xq-5h9v-w6px, ghsa-87pf-fpwv-p7m7, ghsa-hm49-wcqc-g2xg, ghsa-q2mw-fvj9-vvcw, ghsa-vcgp-9326-pqcp applied in versions: 1.19.2-r2
Multiple security vulnerabilities affect the ruby-fluentd-1.19 package. These issues are resolved in later releases. See references for individual vulnerability details...
CLEANSTART-2026-DE16221 Security fixes for CVE-2026-54171, CVE-2026-54297, CVE-2026-54522, CVE-2026-54904, CVE-2026-54905, CVE-2026-54906, ghsa-6wx8-w4f5-wwcr, ghsa-98m9-hrrm-r99r, ghsa-h8w8-99g7-qmvj, ghsa-wv3x-4vxv-whpp applied in versions: 1.18.0-r4, 1.18.0-r5
Multiple security vulnerabilities affect the ruby-fluentd-1.18 package. These issues are resolved in later releases. See references for individual vulnerability details...
CLEANSTART-2026-UT74115 Security fixes for CVE-2026-33637, CVE-2026-41316, CVE-2026-42245, CVE-2026-42246, CVE-2026-42256, CVE-2026-42257, CVE-2026-42258, CVE-2026-54171, CVE-2026-54297, CVE-2026-54696, CVE-2026-54904, CVE-2026-54905, CVE-2026-54906, ghsa-5rv5-xj5j-3484, ghsa-6wx8-w4f5-wwcr, ghsa-75xq-5h9v-w6px, ghsa-87pf-fpwv-p7m7, ghsa-98m9-hrrm-r99r, ghsa-h8w8-99g7-qmvj, ghsa-hm49-wcqc-g2xg, ghsa-q2mw-fvj9-vvcw, ghsa-vcgp-9326-pqcp, ghsa-wv3x-4vxv-whpp applied in versions: 1.19.2-r2, 1.19.2-r3, 1.19.2-r4
Multiple security vulnerabilities affect the ruby-fluentd-1.19 package. These issues are resolved in later releases. See references for individual vulnerability details...
PT-2026-66528
Name of the Vulnerable Software and Affected Versions MessagePack for Ruby versions prior to 1.8.2 Description A use-after-free issue exists in the MessagePack::Bufferclear function within ext/msgpack/buffer.c. When this function is called, it returns memory pages to a shared pool but fails to...
PT-2026-71346
Name of the Vulnerable Software and Affected Versions Loofah versions 2.25.0 through 2.25.1 Description Loofah is a library for manipulating and transforming HTML/XML documents and fragments. The allowed uri? function within Loofah::HTML5::Scrub fails to reject javascript: or vbscript: URIs when...
CVE-2026-53727
A flaw was found in cssparser from 2.2.0 before 3.0.0. CssParser::Parserreadremotefile used by loaduri! and @import handling in addblock! issues HTTP/HTTPS requests without host, IP, or scheme restrictions, including to loopback and RFC1918 targets, and recursively follows Location redirects. Tho...
