Rocky Linux 9.2 [CIQ] Security Update: rubygem-io-console / rubygem-io-console-debuginfo (ciqsa-2026_1288)

The Rocky Linux 9.2 host has packages installed that are affected by a vulnerability as referenced in the CIQ ciqsa-20261288 advisory. This advisory aggregates security fixes for the ruby SRPM in CIQ LTS 9.2. It addresses 1 CVE: CVE-2024-49761. Tenable has extracted the preceding description bloc...

Rocky Linux 9.2 [CIQ] Security Update: rubygem-psych / rubygem-psych-debuginfo (ciqsa-2026_1287)

The Rocky Linux 9.2 host has packages installed that are affected by a vulnerability as referenced in the CIQ ciqsa-20261287 advisory. This advisory aggregates security fixes for the ruby SRPM in CIQ LTS 9.2. It addresses 1 CVE: CVE-2024-49761. Tenable has extracted the preceding description bloc...

Important: Red Hat Security Advisory: ruby:2.5 security update

An update for the ruby:2.5 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

RHEL 8 : ruby:2.5 (RHSA-2026:73519)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:73519 advisory. Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system...

ruby:4.0 security update

ruby 4.0.6-35 - Fix resolv: do not register on-demand classes for unknown DNS types and SvcParamKeys to prevent memory exhaustion CVE-2026-80212 Resolves: RHEL-252035 4.0.6-34 - Upgrade to Ruby 4.0.6. Resolves: RHEL-211301 Resolves: RHEL-193663 4.0.3-33 - Fix Net::IMAP ResponseReader quadratic...

ruby:4.0 security update

An update is available for rubygem-mysql2, module.rubygem-mysql2, module.ruby, ruby, rubygem-pg, module.rubygem-pg. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE li...

ruby:3.3 security update

An update is available for rubygem-mysql2, module.rubygem-mysql2, module.ruby, ruby, rubygem-abrt, rubygem-pg, module.rubygem-pg, module.rubygem-abrt. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

AZL-104954 CVE-2026-94399 affecting package rubygem-elasticsearch 8.9.0-1

Uncontrolled Resource Consumption CWE-400 in Elasticsearch can lead denial of service via Excessive Allocation CAPEC-130...

AZL-104945 CVE-2026-94397 affecting package rubygem-elasticsearch 8.9.0-1

Uncontrolled Resource Consumption CWE-400 in Elasticsearch can lead denial of service via Excessive Allocation CAPEC-130...

AZL-104942 CVE-2026-94408 affecting package rubygem-elasticsearch 8.9.0-1

Uncontrolled Resource Consumption CWE-400 in Elasticsearch can lead denial of service via Excessive Allocation CAPEC-130...

AZL-104948 CVE-2026-82294 affecting package rubygem-elasticsearch 8.9.0-1

Uncontrolled Resource Consumption CWE-400 in Elasticsearch can lead to denial of service via Excessive Allocation CAPEC-130...

AZL-104951 CVE-2026-82300 affecting package rubygem-elasticsearch 8.9.0-1

Uncontrolled Resource Consumption CWE-400 in Elasticsearch can lead to denial of service via Excessive Allocation CAPEC-130...

CVE-2026-92904 Rubygem-foreman_remote_execution: job output readable without object-level view_job_invocations check

A flaw was found in the foremanremoteexecution plugin's template invocations controller. The showtemplateinvocationbyhost action resolves the job invocation by ID without evaluating the caller's viewjobinvocations permission filter against the record. An authenticated user whose job invocation...

CVE-2026-54522 affecting package rubygem-msgpack for versions less than 1.8.4-1

CVE-2026-54522 affecting package rubygem-msgpack for versions less than 1.8.4-1. An upgraded version of the package is available that resolves this issue...

AZL-98445 CVE-2026-78607 affecting package rubygem-elasticsearch 8.9.0-1

Missing Authorization CWE-862 in the Elasticsearch custom inference service can lead to information disclosure via Privilege Abuse CAPEC-122. A user holding only inference execution privileges could cause outbound inference traffic to be directed to a destination of their choosing and could cause...

AZL-98448 CVE-2026-56143 affecting package rubygem-elasticsearch 8.9.0-1

Allocation of Resources Without Limits or Throttling CWE-770 in Elasticsearch can lead to a denial of service via Excessive Allocation CAPEC-130. A user with elevated privileges can submit a specially crafted request that causes excessive memory consumption, which may render the affected node...

Unity Linux 20.1070e Security Update: rubygem-websocket-driver (UTSA-2026-104953)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-104953 advisory. websocket-driver is a WebSocket protocol handler with pluggable I/O. Prior to 0.8.2, WebSocket::Driver.server passes a malformed Host header to URI.parse in...

Unity Linux 20.1070e Security Update: rubygem-websocket-driver (UTSA-2026-104954)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-104954 advisory. websocket-driver is a WebSocket protocol handler with pluggable I/O. Prior to 0.8.1, draft versions of the WebSocket protocol in websocket-driver include a length...

Unity Linux 20.1050e / 20.1060e / 20.1070-8ae / 20.1070e Security Update: rubygem-bundler (UTSA-2024-005590)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2024-005590 advisory. Bundler prior to 2.1.0 uses a predictable path in /tmp/, created with insecure permissions as a storage location for gems, if locations under the user's home directo...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: rubygem-activeresource (UTSA-2026-093008)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093008 advisory. There is a possible information disclosure issue in Active Resource v5.1.1 that could allow an attacker to create specially crafted requests to access data in an...