16831 matches found
Microsoft Kiota: Code Generation Literal Injection in Kiota Ruby Generator
Code Generation Literal Injection in Kiota Ruby Generator Leads to Arbitrary Code Execution Impact The Kiota Ruby code generator is vulnerable to a code generation literal injection attack. The generator embeds string values from OpenAPI default fields and property names directly into Ruby...
EUVD-2026-44926
Microsoft Kiota: Code Generation Literal Injection in Kiota Ruby Generator...
GHSA-2X63-GW47-W4MM vulnerabilities
Vulnerabilities for packages: pghero-fips, pghero, ruby4.0-rails...
Critical Photon OS Security Update - PHSA-2026-5.0-90-0929
Updates of 'rubygem-concurrent-ruby' packages of Photon OS have been released...
Critical Photon OS Security Update - PHSA-2026-5.0-0929
Updates of 'libmicrohttpd', 'rubygem-concurrent-ruby' packages of Photon OS have been released...
EUVD-2026-40626
Ruby json: JSON generator heap buffer overflow when streaming to an IO...
GHSA-X2F5-4PRF-W687 Ruby json: JSON generator heap buffer overflow when streaming to an IO
Summary JSON.dumpobj, io and JSON::Stategenerateobj, io can write past the internal JSON generator buffer when a streamed object contains an attacker-controlled string near 16 KB. The issue is a heap out-of-bounds write in the IO-streaming path and is demonstrated as a reliable process crash /...
Ruby json: JSON generator heap buffer overflow when streaming to an IO
Summary JSON.dumpobj, io and JSON::Stategenerateobj, io can write past the internal JSON generator buffer when a streamed object contains an attacker-controlled string near 16 KB. The issue is a heap out-of-bounds write in the IO-streaming path and is demonstrated as a reliable process crash /...
GHSA-5QHF-9PHG-95M2 vulnerabilities
Vulnerabilities for packages: ruby3.2-rails, ruby3.4-rails, ruby4.0-rails...
GHSA-CJ75-F6XR-R4G7 vulnerabilities
Vulnerabilities for packages: pghero, ruby3.3-rails, ruby3.2-rails, ruby3.4-rails, ruby4.0-rails, pghero-fips...
GHSA-9WJQ-CP2P-HRGF vulnerabilities
Vulnerabilities for packages: pghero, ruby3.3-rails, ruby3.2-rails, ruby3.4-rails, ruby4.0-rails, pghero-fips...
GHSA-8WHX-365G-H9VV vulnerabilities
Vulnerabilities for packages: pghero, ruby3.3-rails, ruby3.2-rails, ruby3.4-rails, ruby4.0-rails, pghero-fips...
Critical Photon OS Security Update - PHSA-2026-5.0-0927
Updates of 'rubygem-fluentd' packages of Photon OS have been released...
GHSA-2X63-GW47-W4MM websocket-driver-ruby: Denial of service via malformed Host header
Impact If this library is used to implement a WebSocket server on top of a TCP server, by using the WebSocket::Driver.server method, then a client can cause the server to crash by sending a Host header that is not a valid host:port string. When this happens, a URI::InvalidURIError exception is...
websocket-driver-ruby: Denial of service via malformed Host header
Impact If this library is used to implement a WebSocket server on top of a TCP server, by using the WebSocket::Driver.server method, then a client can cause the server to crash by sending a Host header that is not a valid host:port string. When this happens, a URI::InvalidURIError exception is...
CLEANSTART-2026-RG00675 Security fixes for CVE-2026-33637, CVE-2026-42245, CVE-2026-42246, CVE-2026-42256, CVE-2026-42257, CVE-2026-42258, ghsa-5rv5-xj5j-3484, ghsa-75xq-5h9v-w6px, ghsa-87pf-fpwv-p7m7, ghsa-hm49-wcqc-g2xg, ghsa-q2mw-fvj9-vvcw, ghsa-vcgp-9326-pqcp applied in versions: 1.19.2-r2
Multiple security vulnerabilities affect the ruby-fluentd-1.19 package. These issues are resolved in later releases. See references for individual vulnerability details...
CLEANSTART-2026-DE16221 Security fixes for CVE-2026-54171, CVE-2026-54297, CVE-2026-54522, CVE-2026-54904, CVE-2026-54905, CVE-2026-54906, ghsa-6wx8-w4f5-wwcr, ghsa-98m9-hrrm-r99r, ghsa-h8w8-99g7-qmvj, ghsa-wv3x-4vxv-whpp applied in versions: 1.18.0-r4, 1.18.0-r5
Multiple security vulnerabilities affect the ruby-fluentd-1.18 package. These issues are resolved in later releases. See references for individual vulnerability details...
CLEANSTART-2026-UT74115 Security fixes for CVE-2026-33637, CVE-2026-41316, CVE-2026-42245, CVE-2026-42246, CVE-2026-42256, CVE-2026-42257, CVE-2026-42258, CVE-2026-54171, CVE-2026-54297, CVE-2026-54696, CVE-2026-54904, CVE-2026-54905, CVE-2026-54906, ghsa-5rv5-xj5j-3484, ghsa-6wx8-w4f5-wwcr, ghsa-75xq-5h9v-w6px, ghsa-87pf-fpwv-p7m7, ghsa-98m9-hrrm-r99r, ghsa-h8w8-99g7-qmvj, ghsa-hm49-wcqc-g2xg, ghsa-q2mw-fvj9-vvcw, ghsa-vcgp-9326-pqcp, ghsa-wv3x-4vxv-whpp applied in versions: 1.19.2-r2, 1.19.2-r3, 1.19.2-r4
Multiple security vulnerabilities affect the ruby-fluentd-1.19 package. These issues are resolved in later releases. See references for individual vulnerability details...
CVE-2026-53727
A flaw was found in cssparser from 2.2.0 before 3.0.0. CssParser::Parserreadremotefile used by loaduri! and @import handling in addblock! issues HTTP/HTTPS requests without host, IP, or scheme restrictions, including to loopback and RFC1918 targets, and recursively follows Location redirects. Tho...