CVE-2026-22588 Spree API has Authenticated Insecure Direct Object Reference (IDOR) via Order Modification

Spree is an open source e-commerce solution built with Ruby on Rails. Prior to versions 4.10.2, 5.0.7, 5.1.9, and 5.2.5, an Authenticated Insecure Direct Object Reference IDOR vulnerability was identified that allows an authenticated user to retrieve other users’ address information by modifying ...

ruby:fuzz_ruby_parser: Crash in literal_hash

Project: https://github.com/ruby/ruby.git Detailed Report: https://oss-fuzz.com/testcase?key=5328702033690624 Project: ruby Fuzzing Engine: libFuzzer Fuzz Target: fuzzrubyparser Job Type: libfuzzerubsanruby Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x7aa28f9efc08 Crash State:...

GHSA-J4PR-3WM6-XX2R vulnerabilities

Vulnerabilities for packages: jruby, ruby...

CVE-2025-61594 vulnerabilities

Vulnerabilities for packages: jruby, ruby...

CVE-2025-61594 vulnerabilities

Vulnerabilities for packages: truffleruby, jruby, ruby, logstash...

GHSA-J4PR-3WM6-XX2R vulnerabilities

Vulnerabilities for packages: truffleruby, jruby, ruby, logstash...

CVE-2026-22588: Authorization Bypass Through User-Controlled Key

Spree is an open source e-commerce solution built with Ruby on Rails. Prior to versions 4.10.2, 5.0.7, 5.1.9, and 5.2.5, an Authenticated Insecure Direct Object Reference IDOR vulnerability was identified that allows an authenticated user to retrieve other users’ address information by modifying ...

Moderate Photon OS Security Update - PHSA-2026-4.0-0942

Updates of 'rubygem-aws-sdk-s3', 'aws-sdk-cpp' packages of Photon OS have been released...

CVE-2019-16060

The Airbrake Ruby notifier 4.2.3 for Airbrake mishandles the blacklistkeys configuration option and consequently may disclose passwords to unauthorized actors. This is fixed in 4.2.4 also, 4.2.2 and earlier are unaffected...

AlmaLinux 8 : ruby:3.3 (ALSA-2025:23062)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2025:23062 advisory. resolv: Denial of Service in resolv gem CVE-2025-24294 rexml: REXML denial of service CVE-2025-58767 Tenable has extracted the preceding description bloc...

AlmaLinux 9 : ruby:3.3 (ALSA-2025:23063)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2025:23063 advisory. resolv: Denial of Service in resolv gem CVE-2025-24294 rexml: REXML denial of service CVE-2025-58767 Tenable has extracted the preceding description bloc...

Debian: Security Advisory (DLA-4433-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

DLA-4433-1 ruby-rmagick - security update

Bulletin has no description...

[SECURITY] [DLA 4433-1] ruby-rmagick security update

----------------------------------------------------------------------- Debian LTS Advisory DLA-4433-1 [email protected] https://www.debian.org/lts/security/ Utkarsh Gupta January 05, 2026 https://wiki.debian.org/LTS -...

Debian dla-4433 : ruby-rmagick - security update

The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dla-4433 advisory. - ----------------------------------------------------------------------- Debian LTS Advisory DLA-4433-1 [email protected] https://www.debian.org/lts/security/...

Exploit for Code Injection in Symfony Twig

Successful Errors: New Code Injection and SSTI Techniques !R...

RHSA-2025:23141 Red Hat Security Advisory: ruby security update

Bulletin has no description...

RHSA-2025:23062 Red Hat Security Advisory: ruby:3.3 security update

Bulletin has no description...

RHSA-2025:23063 Red Hat Security Advisory: ruby:3.3 security update

Bulletin has no description...

ruby security update

An update is available for ruby. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Ruby is an extensible, interpreted, object-oriented, scripting language. It has...