19094 matches found
Malicious code in giga-max-kit (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-15695 Malicious code in giga-clean-box (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-15694 Malicious code in circle-w3s (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
CVE-2026-62382: Incorrect Authorization
PasswordPusher versions v1.45.11 through v2.9.5 contain an improper authorization vulnerability in the push deletion logic. The ownership check compares @push.user against currentuser; for an anonymously created push both values are nil, and Ruby evaluates nil == nil as true, so the check passes...
Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: ruby3.4: ruby3.4-3.4.10-31.6.hum1 aarch64, x8664 ruby3.4-bundled-gems-3.4.10-31.6.hum1 aarch64, x8664 ruby3.4-default-gems-3.4.10-31.6.hum1 noarch ruby3.4-devel-3.4.10-31.6.hum1 aarch64, x8664...
Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: ruby3.3: ruby3.3-3.3.10-23.5.hum1 aarch64, x8664 ruby3.3-bundled-gems-3.3.10-23.5.hum1 aarch64, x8664 ruby3.3-default-gems-3.3.10-23.5.hum1 noarch ruby3.3-devel-3.3.10-23.5.hum1 aarch64, x8664...
ruby/json: Ruby JSON: Denial of Service or Information Disclosure via format string injection
A flaw was found in Ruby JSON. This vulnerability, a format string injection, allows a remote attacker to cause a denial of service DoS or disclose sensitive information. The flaw occurs when processing specially crafted user-supplied documents with the allowduplicatekey: false parsing option...
A Bootiful Podcast: JRuby lead Charles Nutter
In this episode, we sit down with the lead of the JRuby project for a fascinating look at how Ruby and the JVM came together, how JRuby became a production-ready powerhouse, and why it still matters today. We dig into threading, performance, Invoke Dynamic, Project Loom, Panama, Valhalla, and the...
[SECURITY] [DLA 4706-2] ruby-grape regression update
------------------------------------------------------------------------- Debian LTS Advisory DLA-4706-2 [email protected] https://www.debian.org/lts/security/ Abhijith PA August 19, 2026 https://wiki.debian.org/LTS -...
CVE-2026-59825
When LDAP auth uses LDAP_TLS_NO_VERIFY=true, app/models/concerns/user/ldap_authenticable.rb mutates OpenSSL::SSL::SSLContext::DEFAULT_PARAMS, disabling SSL/TLS verification globally for puma web processes. This enables MITM attacks against all puma-originated HTTPS requests. Fixed in Mastodon 4.4...
PT-2026-77143
Name of the Vulnerable Software and Affected Versions Mastodon versions prior to 4.4.19 Mastodon versions 4.5.0 through 4.5.11 Description When LDAP authentication is configured with LDAP TLS NO VERIFY=true, the file app/models/concerns/user/ldap authenticable.rb mutates...
CVE-2026-69185 vulnerabilities
Vulnerabilities for packages: gitlab-rails-ce, jupyter-base-notebook, gitlab-rails-ce-fips...
CVE-2026-61666 websocket-driver: Denial of service via malformed Host header
websocket-driver is a WebSocket protocol handler with pluggable I/O. Prior to 0.8.2, WebSocket::Driver.server passes a malformed Host header to URI.parse in lib/websocket/http/request.rb without catching URI::InvalidURIError, allowing a remote client to crash a TCP-backed WebSocket server when th...
CVE-2026-61666
websocket-driver is a WebSocket protocol handler with pluggable I/O. Prior to 0.8.2, WebSocket::Driver.server passes a malformed Host header to URI.parse in lib/websocket/http/request.rb without catching URI::InvalidURIError, allowing a remote client to crash a TCP-backed WebSocket server when th...
CVE-2026-61666 websocket-driver: Denial of service via malformed Host header
websocket-driver is a WebSocket protocol handler with pluggable I/O. Prior to 0.8.2, WebSocket::Driver.server passes a malformed Host header to URI.parse in lib/websocket/http/request.rb without catching URI::InvalidURIError, allowing a remote client to crash a TCP-backed WebSocket server when th...
CVE-2026-61666 websocket-driver: Denial of service via malformed Host header
websocket-driver is a WebSocket protocol handler with pluggable I/O. Prior to 0.8.2, WebSocket::Driver.server passes a malformed Host header to URI.parse in lib/websocket/http/request.rb without catching URI::InvalidURIError, allowing a remote client to crash a TCP-backed WebSocket server when th...
CVE-2026-61666
CVE-2026-61666 affects the Ruby gem websocket-driver (a WebSocket protocol handler with pluggable I/O). In versions prior to 0.8.2 , WebSocket::Driver.server() passes a malformed Host header to URI.parse in lib/websocket/http/request.rb without catching URI::InvalidURIError. A remote client can e...
CVE-2026-61666
websocket-driver is a WebSocket protocol handler with pluggable I/O. Prior to 0.8.2, WebSocket::Driver.server passes a malformed Host header to URI.parse in lib/websocket/http/request.rb without catching URI::InvalidURIError, allowing a remote client to crash a TCP-backed WebSocket server when th...
vim: Vim: Arbitrary code execution via crafted step-definition patterns
A flaw was found in Vim, a command-line text editor. This vulnerability, identified as a code injection, affects the cucumber filetype plugin when Vim is configured with Ruby support. An attacker could exploit this by creating a malicious repository containing specially crafted step-definition...
