Our Analyses
What it means for your servers
The security stories that matter, explained by our team — with the concrete steps to take.
The security stories that matter, explained by our team — with the concrete steps to take.
Collected every two hours from specialised publications — each link leads to the original article.
Update to Rack 2.0.8.
An update that fixes one vulnerability is now available.
In haml, when using user input to perform tasks on the server, characters like " ' must be escaped properly. In this case, the ' character was missed. An atta…
An update that fixes one vulnerability is now available.
Rebased pcs to the newest major version (see CHANGELOG.md) - includes fix for CVE-2026-84828 Updated standalone web UI and HA Cluster Management Cockpit applic…
Rebased pcs to the newest major version (see CHANGELOG.md) - includes fix for CVE-2026-84828 Updated standalone web UI and HA Cluster Management Cockpit applic…
A RCE (Remote Code Execution) escalation was discovered in Ruby on Rails, a MVC Ruby-based framework for web development. This vulnerability exists when using …
Multiple vulnerabilities were found in Ruby on Rails, a MVC ruby-based framework geared for web application development, which could lead to remote code execut…
Two vulnerabilities were found in Ruby on Rails, a MVC ruby-based framework geared for web application development, which could lead to remote code execution a…
A critical flaw in Ruby on Rails could allow an unauthenticated attacker to write arbitrary files on an app's server by uploading a crafted file if the app pro…
Ubuntu announced a security vulnerability in ruby-sinatra affecting multiple LTS versions, which could lead to a denial of service via crafted network traffic,…
Moderate: ruby:2.5 security update
The North Korean threat actor known as ScarCruft has been attributed to a fresh set of tools, including a backdoor that uses Zoho WorkDrive for command-and-con…
Upgrade to Ruby 3.4.7. Fix URI Credential Leakage Bypass previous fixes. Resolves: CVE-2025-61594 Fix REXML denial of service. Resolves: rhbz#2396204
Two vulnerabilities have been fixed in puma, a threaded HTTP server for Ruby/Rack applications.
Two vulnerabilities were fixed in YARD, a documentation tool for the Ruby programming laguage. CVE-2019-1020001
Aviv Keller discovered that the frames.html file generated by YARD, a documentation generation tool for the Ruby programming language, was vulnerable to cross-…
Brief introduction Two vulnerabilities were discovered in rails, the Ruby based server-side MVC web application framework, which could lead to XSS and DOM based
Multiple vunerabilities were discovered in rails, the Ruby based server-side MVC web application framework, which could result in XSS, data disclosure and open…
Xi Lu discovered that missing input sanitising in Emacs (in etags, the Ruby mode and htmlfontify) could result in the execution of arbitrary shell commands.
rubygem-rack: crafted requests can cause shell escape sequences (CVE-2022-30123) * jquery: Prototype pollution in object's prototype leading to denial of servi…
A command injection vulnerability was found in Rexical, a lexical scanner generator for the Ruby programming language. Processes are vulnerable only if the und…
- Fixed ruby socket permissions
Fixed ruby socket permissions
