5461 matches found
abhinavagarwal07.github.io
Chirpy Starter When installing the Chirpy theme through RubyGems.org, Jekyll can only read files in the folders data, layouts, includes, sass and assets, as well as a small part of options of the config.yml file from the theme's gem. If you have ever installed this theme gem, you can use the...
CVE-2026-82455
RubyGems fails to re-validate path containment after filesystem symlink resolution during gem extraction. When a pre-existing symlink inside the destination directory points outside the extraction root, extracted files that appear to be written under the destination directory can instead be writt...
CVE-2026-82455 RubyGems before 4.0.13 Path Traversal via Symlink Resolution
RubyGems fails to re-validate path containment after filesystem symlink resolution during gem extraction. When a pre-existing symlink inside the destination directory points outside the extraction root, extracted files that appear to be written under the destination directory can instead be writt...
CVE-2026-82455
RubyGems versions before 4.0.13 are vulnerable to a path traversal issue during gem extraction. The root cause is a failure to re-validate path containment after filesystem symlink resolution : if a pre-existing symlink inside the destination directory points outside the extraction root, extracte...
EUVD-2026-68102
RubyGems fails to re-validate path containment after filesystem symlink resolution during gem extraction. When a pre-existing symlink inside the destination directory points outside the extraction root, extracted files that appear to be written under the destination directory can instead be writt...
bomber
bomber is an application that scans SBOMs for security vulnerabilities. Overview So you've asked a vendor for an Software Bill of Materials SBOM for one of their closed source products, and they provided one to you in a JSON file... now what? The first thing you're going to want to do is see if a...
16 Typosquatted RubyGems Packages Steal Browser Credentials and Crypto Wallets
Cybersecurity researchers have flagged a new typosquatting campaign targeting RubyGems users with a Windows-based information stealer. OpenSourceMalware, which discovered the activity on August 15, 2026, is tracking the threat under the moniker StubMaker. The complete list of packages published a...
CVE-2026-73426 vulnerabilities
Vulnerabilities for packages: ruby3.2-rails, ruby3.4-rails, ruby3.3-rails, ruby4.0-rails...
UBUNTU-CVE-2026-73648
rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. From 1.0.3 until 1.7.1, Rails::HTML::PermitScrubber restricted SVG reference elements in SVGALLOWLOCALHREF only when they used xlink:href, even though browsers also accept the plain href attribute. Applicatio...
CVE-2026-56443
CVE-2026-56443 affects Gitea:Token public-only scope bypassed for Limited-visibility owners (Repositories + Package categories) due to an access-control deficiency, described as a residual issue after CVE-2026-25714 / PR #37118. The vulnerability targets the token’s public-scope handling on Limit...
CVE-2026-0292
creationtimestamp| type| source ---|---|--- 2026-08-12 19:03:28+00:00| seen| https://bsky.app/profile/ripjyr.bsky.social/post/3msvsz34hf32y 2026-08-13 04:53:05+00:00| seen| https://bsky.app/profile/samilaiho.com/post/3mswtxd7e4k27 2026-08-13 10:21:24+00:00| seen|...
Oracle Linux 9 : ruby:4.0 (ELSA-2026-50827)
The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-50827 advisory. ruby 4.0.6-34 - Upgrade to Ruby 4.0.6. Resolves: RHEL-211301 Resolves: RHEL-193663 rubygem-mysql2 0.5.7-1 - Upgrade to mysql2 0.5.7. Related:...
SleeperGem Uses Three Malicious RubyGems Packages to Target Developer Machines
Cybersecurity researchers have flagged a new software supply chain attack codenamed SleeperGem targeting the Ruby ecosystem after three malicious gems were published to RubyGems with the end goal of serving additional payloads. The rogue gems are listed below - gitcredentialmanager versions 2.8.0...
Malicious code in zzzltestfoobarxyz (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-10005 Malicious code in zzzltestfoobarxyz (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in zzwandtemp1778552518 (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-10003 Malicious code in zzwandtemp1778552518 (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-10004 Malicious code in zzwmgweb02 (RubyGems)
--- -= Per source details. Do not edit below this line.=-...