CVE-2026-107151

The smart_proxy_dynflow Ruby gem contains a missing authentication vulnerability in remote-execution task updates. When remote execution is configured in pull or pull-mqtt mode, the progress and completion callbacks accept reports even if the one-time token is missing. An attacker who knows a run...

AZL-106724 CVE-2026-103006 affecting package rubygem-elasticsearch 8.9.0-1

Uncontrolled Recursion CWE-674 in Elasticsearch can lead to Denial of Service via a specially crafted, deeply nested request submitted to the aggregation feature of the search API. Elasticsearch contains an uncontrolled recursion weakness in its search aggregation processing. An authenticated use...

AZL-106721 CVE-2026-102411 affecting package rubygem-elasticsearch 8.9.0-1

Allocation of Resources Without Limits or Throttling CWE-770 in Elasticsearch can lead to Denial of Service via Excessive Allocation CAPEC-130. Elasticsearch enforces a size limit on the user-supplied metadata field for each individual template resource, but does not limit the total memory used...

AZL-106715 CVE-2026-102407 affecting package rubygem-elasticsearch 8.9.0-1

Incorrect Authorization CWE-863 in Elasticsearch can lead to unauthorized data stream modification via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated user with sufficient privileges over a single resource could use the Modify Data Streams API to modify a data...

AZL-106718 CVE-2026-102404 affecting package rubygem-elasticsearch 8.9.0-1

Uncontrolled Resource Consumption CWE-400 in Elasticsearch can lead to denial of service via Excessive Allocation CAPEC-130. A low-privileged authenticated user can submit a specially crafted query that causes uncontrolled memory growth in the query processing engine, resulting in an out-of-memor...

Exploit for CVE-2026-105221

abraxaslabs.tech · github.com/abraxas ·&...

AlmaLinux 8 : ruby:2.5 (ALSA-2026:73519)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:73519 advisory. resolv: resolv gem: Denial of Service via uncontrolled memory growth from crafted DNS responses CVE-2026-80212 rubygem-mongo: MongoDB Ruby Driver: Data...

SUSE SLES15 Security Update : rubygem-rails-html-sanitizer (SUSE-SU-2026:4445-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2026:4445-1 advisory. This update for rubygem-rails-html-sanitizer fixes the following issue: - CVE-2026-73648: rails-html-sanitizer: cross-site scripting is possible when t...

Security update for rubygem-rails-html-sanitizer

This update for rubygem-rails-html-sanitizer fixes the following issue: CVE-2026-73648: rails-html-sanitizer: cross-site scripting is possible when the sanitizer is configured to allow certain SVG reference elements bsc1275199. Patch Instructions: To install this SUSE update use the SUSE...

SUSE-SU-2026:4445-1 Security update for rubygem-rails-html-sanitizer

This update for rubygem-rails-html-sanitizer fixes the following issue: - CVE-2026-73648: rails-html-sanitizer: cross-site scripting is possible when the sanitizer is configured to allow certain SVG reference elements bsc1275199...

EUVD-2026-92134

The gist RubyGem before 6.1.0 contains an improper certificate validation vulnerability that allows on-path attackers to intercept HTTPS traffic because httpconnection in lib/gist.rb sets VERIFYNONE. Attackers can present any certificate to read or modify GitHub API traffic, stealing OAuth tokens...

Linux Distros Unpatched Vulnerability : CVE-2026-105221

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The gist RubyGem before 6.1.0 contains an improper certificate validation vulnerability that allows on- path attackers to intercept HTTPS traffic because...

CVE-2026-105221

The gist RubyGem before 6.1.0 contains an improper certificate validation vulnerability that allows on-path attackers to intercept HTTPS traffic because httpconnection in lib/gist.rb sets VERIFYNONE. Attackers can present any certificate to read or modify GitHub API traffic, stealing OAuth tokens...

CVE-2026-105221

The gist RubyGem before 6.1.0 contains an improper certificate validation vulnerability that allows on-path attackers to intercept HTTPS traffic because httpconnection in lib/gist.rb sets VERIFYNONE. Attackers can present any certificate to read or modify GitHub API traffic, stealing OAuth tokens...

UBUNTU-CVE-2026-105221

The gist RubyGem before 6.1.0 contains an improper certificate validation vulnerability that allows on-path attackers to intercept HTTPS traffic because httpconnection in lib/gist.rb sets VERIFYNONE. Attackers can present any certificate to read or modify GitHub API traffic, stealing OAuth tokens...

CVE-2026-105221

The gist RubyGem before version 6.1.0 is vulnerable to an improper certificate validation flaw. The root cause is located in lib/gist.rb, where the http_connection function sets VERIFY_NONE, effectively disabling TLS certificate verification. This allows on-path attackers to intercept HTTPS traff...

CVE-2026-105221 Gist RubyGem before 6.1.0 Disabled TLS Certificate Verification

The gist RubyGem before 6.1.0 contains an improper certificate validation vulnerability that allows on-path attackers to intercept HTTPS traffic because httpconnection in lib/gist.rb sets VERIFYNONE. Attackers can present any certificate to read or modify GitHub API traffic, stealing OAuth tokens...

CVE-2026-105221 Gist RubyGem before 6.1.0 Disabled TLS Certificate Verification

The gist RubyGem before 6.1.0 contains an improper certificate validation vulnerability that allows on-path attackers to intercept HTTPS traffic because httpconnection in lib/gist.rb sets VERIFYNONE. Attackers can present any certificate to read or modify GitHub API traffic, stealing OAuth tokens...

CVE-2026-105221 Gist RubyGem before 6.1.0 Disabled TLS Certificate Verification

The gist RubyGem before 6.1.0 contains an improper certificate validation vulnerability that allows on-path attackers to intercept HTTPS traffic because httpconnection in lib/gist.rb sets VERIFYNONE. Attackers can present any certificate to read or modify GitHub API traffic, stealing OAuth tokens...

PT-2026-104655

Name of the Vulnerable Software and Affected Versions gist RubyGem versions prior to 6.1.0 Description Improper certificate validation occurs because the http connection function in lib/gist.rb sets VERIFY NONE, which disables TLS certificate verification. This allows on-path attackers to interce...