Our Analyses
What it means for your servers
The security stories that matter, explained by our team — with the concrete steps to take.
The security stories that matter, explained by our team — with the concrete steps to take.
Collected every two hours from specialised publications — each link leads to the original article.
An update that solves three vulnerabilities and has one errata is now available.
A vulnerability was discovered in ruby-oauth2, a Ruby library for OAuth 2.0, which could result in a bearer token being sent to the host named by a redirect Lo…
ruby-jwt is a Ruby implementation of the RFC 7519 OAuth JSON Web Token standard. JWT.decode(token, '', true, algorithm: 'HS256') accepts an attacker-forged tok…
Oracle Linux 10 has released updates for various Ruby packages, addressing multiple security vulnerabilities related to CVEs, and improving overall functionali…
Fedora released an update for rubygem-yard to version 0.9.40-2, addressing path traversal vulnerabilities and allowing users to generate consistent documentati…
Two vulnerabilities were discovered in ruby-rack, a modular Ruby webserver interface. CVE-2026-22860 Rack::Directory's path check used a string prefix match on…
A memory leak flaw was found in ruby-magick, an interface between Ruby and ImageMagick. This issue can lead to a denial of service (DOS) by memory exhaustion. …
ruby-sidekiq, a simple, efficient background processing for Ruby, had a couple of vulnerabilities as follows: CVE-2021-30151 Sidekiq allows XSS via the queue n…
Multiple vulnerabilities were found in ruby-rack, a modular Ruby webserver interface, as follows: - CVE-2025-32441: Rack session can be restored after deletion.
Upgrade to Ruby 3.3.10. CVE-2025-58767 ruby: REXML denial of service (rhbz#2396203)
DoS with large SAML responses has been fixed in ruby-saml, a library implementing the client side of SAML authorization for the Ruby interpreter.
ruby-graphql is GraphQL language and runtime for Ruby. It was discovered that loading a malicious schema definition in `GraphQL::Schema.from_introspection` (or…
Multiple vulnerabilities have been fixed in ruby-rails-html-sanitizer, a Ruby library for sanitizing HTML fragments in Rails applications. CVE-2022-23517
Multiple vulnerabilities have been fixed in ruby-loofah, a Ruby library for manipulating and transforming HTML/XML documents and fragments. CVE-2022-23514
Multiple vulnerabilities were fixed in ruby-rack, an interface for developing web applications in Ruby. CVE-2024-25126
It was discovered that there was a HTTP header injection vulnerability in ruby-httparty, a web service library used in various Ruby applications.
A couple of security issues were discovered in ruby2.5, the Ruby interpreter, and are as follows - CVE-2021-33621
Several vulnerabilities were fixed in JRuby, a Java implementation of the Ruby programming language. CVE-2017-17742
ruby-sidekiq, a simple, efficient background processing for Ruby, had a couple of vulnerabilities as follows: CVE-2021-30151
It was discovered that there was a potential reflected file download (RFD) vulnerability in ruby-sinatra, a Ruby library for writing HTTP applications. A Conte…
A file traversal vulnerability was discovered in src:ruby-sinatra, a popular web server often used with Ruby on Rails. We now validate that any expanded paths …
Multiple security issues were discovered in mruby, a lightweight implementation of the Ruby language CVE-2017-9527
ruby-sidekiq, a simple, efficient background processing for Ruby, had a couple of vulnerabilities as follows: CVE-2021-30151
Several vulnerabilities have been discovered in the interpreter for the Ruby language and the Rubygems included, which may result on result in information disc…
