CVE-2026-72915 Mastodon: Personally-identifying information disclosure due to incorrect access control validation

Mastodon is a free, open-source social network server based on ActivityPub. From 4.6.0-beta.1 until 4.6.4 and 4.7.0-beta.1, any logged-in local user could use the show action in app/controllers/admin/collectionscontroller.rb to access personally identifying information about another local user in...

CLSA-2026-1786373168 TuxCare security update for mysql2 (1 CVE)

TuxCare rebuilt mysql2 to address 1 CVE. Fixed in 2.3.3-tuxcare.5...

Ruby on Rails Web Console - IP Bypass RCE (CVE-2015-3224)

Exploits CVE-2015-3224 by bypassing Web Console IP restrictions with X-Forwarded-For: 0000::1 and evaluating backtick OS commands. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Ruby on Rails Web Console IP whitelist bypass RCE CVE-2015-3224 — opens execute...

Ruby on Rails - Accept Header File Read (CVE-2019-5418)

Reads arbitrary files via CVE-2019-5418 Accept-header path traversal ../../../../file. !/usr/bin/env python3 -- coding: utf-8 -- """Rails Accept-header arbitrary file read CVE-2019-5418.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.protocols.http.lfi...

Oracle Linux 8 : ruby:3.3 (ELSA-2026-50728)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-50728 advisory. ruby 3.3.12-8 - Upgrade to Ruby 3.3.12. Resolves: RHEL-170929 Resolves: RHEL-193664 rubygem-abrt rubygem-mysql2 rubygem-pg Tenable has extracted the...

Oracle Linux 9 : ruby:4.0 (ELSA-2026-50827)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-50827 advisory. ruby 4.0.6-34 - Upgrade to Ruby 4.0.6. Resolves: RHEL-211301 Resolves: RHEL-193663 rubygem-mysql2 0.5.7-1 - Upgrade to mysql2 0.5.7. Related:...

Photon OS 5.0: Ruby PHSA-2024-5.0-91-0247

An update of the ruby package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2024-5.0-91-0247. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Oracle Linux 7 : ruby (ELSA-2026-37397)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-37397 advisory. 2.0.0.648-39.0.1 - Fix CVE-2026-42246 and CVE-2026-42258 Orabug: 39711420 Tenable has extracted the preceding description block directly from the Orac...

Photon OS 5.0: Ruby PHSA-2025-5.0-91-0468

An update of the ruby package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2025-5.0-91-0468. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Photon OS 5.0: Ruby PHSA-2024-5.0-91-0221

An update of the ruby package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2024-5.0-91-0221. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Photon OS 5.0: Ruby PHSA-2024-5.0-91-0423

An update of the ruby package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2024-5.0-91-0423. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Photon OS 5.0: Ruby PHSA-2025-5.0-91-0488

An update of the ruby package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2025-5.0-91-0488. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Oracle Linux 9 : ruby:3.3 (ELSA-2026-50828)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-50828 advisory. ruby 3.3.12-8 - Upgrade to Ruby 3.3.12. Resolves: RHEL-171335 Resolves: RHEL-193665 rubygem-mysql2 0.5.5-3 - Disable tests on the 32bit platforms ix86...

ruby:4.0 security, bug fix, and enhancement update

ruby 4.0.6-34 - Upgrade to Ruby 4.0.6. Resolves: RHEL-211301 Resolves: RHEL-193663 rubygem-mysql2 0.5.7-1 - Upgrade to mysql2 0.5.7. Related: RHEL-142278 0.5.5-3 - Disable tests on the 32bit platforms ix86. Related: RHEL-80222 0.5.5-2 - Adapt tests to openssl 3.2 Resolves: RHEL-80222 rubygem-pg...

ruby:3.3 security, bug fix, and enhancement update

ruby 3.3.12-8 - Upgrade to Ruby 3.3.12. Resolves: RHEL-170929 Resolves: RHEL-193664 rubygem-abrt rubygem-mysql2 rubygem-pg...

Photon OS 5.0: Ruby PHSA-2025-5.0-91-0672

An update of the ruby package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2025-5.0-91-0672. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

CVE-2026-47167

A flaw was found in Vim, a command-line text editor. This vulnerability, identified as a code injection, affects the cucumber filetype plugin when Vim is configured with Ruby support. An attacker could exploit this by creating a malicious repository containing specially crafted step-definition...

EulerOS 2.0 SP11 : ruby (EulerOS-SA-2026-3101)

According to the versions of the ruby packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : ERB is a templating system for Ruby. Ruby 2.7.0 before ERB 2.2.0 was published on rubygems.org introduced an @init instance variable guard in...

ruby security update

2.0.0.648-39.0.1 - Fix CVE-2026-42246 and CVE-2026-42258 Orabug: 39711420...

EulerOS 2.0 SP11 : ruby (EulerOS-SA-2026-3155)

According to the versions of the ruby packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : ERB is a templating system for Ruby. Ruby 2.7.0 before ERB 2.2.0 was published on rubygems.org introduced an @init instance variable guard in...