19576 matches found
GHSA-3M6G-2423-7CP3 Ruby JSON has a format string injection vulnerability
Impact A format string injection vulnerability than that lead to denial of service attacks or information disclosure, when the allowduplicatekey: false parsing option is used to parse user supplied documents. This option isn't the default, if you didn't opt-in to use it, you are not impacted...
Use of Externally-Controlled Format String
Overview json is a JSON implementation as a Ruby extension in C. Affected versions of this package are vulnerable to Use of Externally-Controlled Format String in JSON.parsedoc, allowduplicatekey: false. An attacker can cause denial of service or disclose sensitive information via malicious forma...
Ruby JSON has a format string injection vulnerability
Impact A format string injection vulnerability than that lead to denial of service attacks or information disclosure, when the allowduplicatekey: false parsing option is used to parse user supplied documents. This option isn't the default, if you didn't opt-in to use it, you are not impacted...
CVE-2026-32698
OpenProject is an open-source, web-based project management software. Versions prior to 16.6.9, 17.0.6, 17.1.3, and 17.2.1 are vulnerable to an SQL injection attack via a custom field's name. When that custom field was used in a Cost Report, the custom field's name was injected into the SQL query...
org.jenkins-ci.main:jenkins-test-harness (1.442), org.jenkins-ci.main:jenkins-war (1.442) +6 more potentially affected by CVE-2026-33001 via org.jenkins-ci.main:jenkins-core (1.442)
org.jenkins-ci.main:jenkins-core MAVEN version 1.442 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - org.jenkins-ci.main:jenkins-test-harness 1.442 - org.jenkins-ci.main:jenkins-war 1.442 -...
MAL-2026-1924 Malicious code in testcatplzignore (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in sq-minimal-feature-flags (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-1923 Malicious code in sq-minimal-feature-flags (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in resolvrtest (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in rails_structured_logging (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-1920 Malicious code in rails_structured_logging (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in newlogger (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in kaleido (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-1917 Malicious code in kaleido (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in freshworks-ruby (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-1916 Malicious code in freshworks-ruby (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-1915 Malicious code in doctolib (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
CVE-2026-32698: Improper Neutralization of Special Elements used in an SQL Command
OpenProject is an open-source, web-based project management software. Versions prior to 16.6.9, 17.0.6, 17.1.3, and 17.2.1 are vulnerable to an SQL injection attack via a custom field's name. When that custom field was used in a Cost Report, the custom field's name was injected into the SQL query...
OpenProject SQL injection vulnerability
OpenProject is an open-source web-based project management software. Versions of OpenProject prior to 16.6.9, 17.0.6, 17.1.3, and 17.2.1 have a SQL injection vulnerability. This vulnerability arises from custom field names not being properly cleaned in SQL queries, which can allow SQL injection...
ruby4.0-rubygem-web-console-4.2.1-1.9 on GA media (moderate)
ruby4.0-rubygem-web-console-4.2.1-1.9 on GA media Announcement ID: openSUSE-SU-2026:10367-1 Rating: moderate Cross-References: CVE-2015-3224 Affected Products: openSUSE Tumbleweed An update that solves one vulnerability can now be installed. Description: These are all security issues fixed in the...