19234 matches found
Linux Distros Unpatched Vulnerability : CVE-2026-54696
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Ruby JSON is a JSON implementation for Ruby. Versions 2.9.0 through 2.19.8 are vulnerable to heap buffer overflow when the JSON generator is provided with an...
Linux Distros Unpatched Vulnerability : CVE-2026-54900
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Oj Optimized JSON is a JSON parser and Object marshaller packaged as a Ruby gem. In versions prior to 3.17.2, when in usual mode with createid enabled,...
Linux Distros Unpatched Vulnerability : CVE-2026-54899
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Oj Optimized JSON is a JSON parser and Object marshaller packaged as a Ruby gem. Prior to version 3.17.2, disabling symbolkeys on a reused Oj::Parser instance...
Linux Distros Unpatched Vulnerability : CVE-2026-54901
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Oj Optimized JSON is a JSON parser and Object marshaller packaged as a Ruby gem. In versions prior to 3.17.2, Oj::Parser in usual mode does not mark arrayclass...
Oracle Linux 9 : ruby:4.0 (ELSA-2026-20596)
The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-20596 advisory. - Fix ERB: Arbitrary code execution via deserialization bypass CVE-2026-41316 Resolves: RHEL-171258 - Fix JSON: Denial of Service or Information...
Linux Distros Unpatched Vulnerability : CVE-2026-54903
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Oj Optimized JSON is a JSON parser and Object marshaller packaged as a Ruby gem. In versions prior to 3.17.2, Oj.load is vulnerable to heap corruption when...
Linux Distros Unpatched Vulnerability : CVE-2026-54592
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Oj Optimized JSON is a JSON parser and Object marshaller packaged as a Ruby gem. In versions prior to 3.17.3, Oj::Doceachchild, when invoked recursively over a...
pay-rails/pay: non-constant-time HMAC comparison in Paddle Billing webhook signature verifier
Summary Pay::Webhooks::PaddleBillingControllervalidsignature? app/controllers/pay/webhooks/paddlebillingcontroller.rb verifies the Paddle Billing webhook signature by computing OpenSSL::HMAC.hexdigest... and comparing it to the attacker-supplied header value using Ruby's String==. Ruby's == is...
Timing Attack
Overview pay is a package for processing payments in Ruby on Rails apps Affected versions of this package are vulnerable to Timing Attack via the validsignature? function. An attacker can recover valid webhook signatures by sending multiple requests with crafted Paddle-Signature header values and...
net-imap: Net::IMAP: Arbitrary IMAP command injection due to improper input validation
A flaw was found in Net::IMAP, a Ruby library that implements Internet Message Access Protocol IMAP client functionality. This vulnerability arises from improper input validation when handling ID field values and arguments to the enable command. A remote attacker could exploit this by injecting...
net-imap: rubygem-net-imap: Net::IMAP: Denial of Service via malformed command input
A flaw was found in Net::IMAP, a Ruby client library for the Internet Message Access Protocol IMAP. This vulnerability allows a remote attacker to cause a denial of service by sending specially crafted input to certain Net::IMAP commands. When a raw string argument, derived from user-controlled...
Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: ruby3.4: ruby3.4-3.4.8-31.3.hum1 aarch64, x8664 ruby3.4-bundled-gems-3.4.8-31.3.hum1 aarch64, x8664 ruby3.4-default-gems-3.4.8-31.3.hum1 noarch ruby3.4-devel-3.4.8-31.3.hum1 aarch64, x8664...
RHSA-2026:33630 Red Hat Security Advisory: ruby security update
Bulletin has no description...
RHSA-2026:33577 Red Hat Security Advisory: ruby:4.0 security update
Bulletin has no description...
RHSA-2026:33576 Red Hat Security Advisory: ruby:3.3 security update
Bulletin has no description...
RHSA-2026:33565 Red Hat Security Advisory: ruby security update
Bulletin has no description...
RHSA-2026:33540 Red Hat Security Advisory: ruby4.0 security update
Bulletin has no description...
RHSA-2026:33514 Red Hat Security Advisory: ruby:2.5 security update
Bulletin has no description...