5595 matches found
16 Typosquatted RubyGems Packages Steal Browser Credentials and Crypto Wallets
Cybersecurity researchers have flagged a new typosquatting campaign targeting RubyGems users with a Windows-based information stealer. OpenSourceMalware, which discovered the activity on August 15, 2026, is tracking the threat under the moniker StubMaker. The complete list of packages published a...
CVE-2026-73426 vulnerabilities
Vulnerabilities for packages: ruby4.0-rails, ruby3.3-rails, ruby3.4-rails, ruby3.2-rails...
UBUNTU-CVE-2026-73648
rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. From 1.0.3 until 1.7.1, Rails::HTML::PermitScrubber restricted SVG reference elements in SVGALLOWLOCALHREF only when they used xlink:href, even though browsers also accept the plain href attribute. Applicatio...
CVE-2026-56443
Token public-only scope bypassed on Limited-visibility owners Repository + Package categories — residual after CVE-2026-25714 / PR 37118...
CVE-2026-0292
creationtimestamp| type| source ---|---|--- 2026-08-12 19:03:28+00:00| seen| https://bsky.app/profile/ripjyr.bsky.social/post/3msvsz34hf32y 2026-08-13 04:53:05+00:00| seen| https://bsky.app/profile/samilaiho.com/post/3mswtxd7e4k27 2026-08-13 10:21:24+00:00| seen|...
Oracle Linux 9 : ruby:4.0 (ELSA-2026-50827)
The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-50827 advisory. ruby 4.0.6-34 - Upgrade to Ruby 4.0.6. Resolves: RHEL-211301 Resolves: RHEL-193663 rubygem-mysql2 0.5.7-1 - Upgrade to mysql2 0.5.7. Related:...
Fedora 45 : rubygem-actioncable / rubygem-actionmailbox / rubygem-actionmailer / etc (2026-000149d00e)
The remote Fedora 45 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2026-000149d00e advisory. Update Ruby on Rails 8.1.3.1 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not teste...
SleeperGem Uses Three Malicious RubyGems Packages to Target Developer Machines
Cybersecurity researchers have flagged a new software supply chain attack codenamed SleeperGem targeting the Ruby ecosystem after three malicious gems were published to RubyGems with the end goal of serving additional payloads. The rogue gems are listed below - gitcredentialmanager versions 2.8.0...
Malicious code in zzzltestfoobarxyz (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-10005 Malicious code in zzzltestfoobarxyz (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in zzwandtemp1778552518 (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-10003 Malicious code in zzwandtemp1778552518 (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-10004 Malicious code in zzwmgweb02 (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in zzwmgweb02 (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-10002 Malicious code in zzwandsxabc119 (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in zztxtwtmp13 (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-10001 Malicious code in zztxtwtmp14 (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in zztxtwtmp14 (RubyGems)
--- -= Per source details. Do not edit below this line.=-...