https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T04:21:32.870694+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/alsa-2021:2587 ALSA-2021:2587 — Moderate: ruby:2.5 security, bug fix, and enhancement update 2026-10-03T04:21:32.905806+00:00

Affected: AlmaLinux:8: rubygem-abrt, AlmaLinux:8: rubygem-abrt-doc, AlmaLinux:8: rubygem-bson, AlmaLinux:8: rubygem-bson-doc, AlmaLinux:8: rubygem-mongo, AlmaLinux:8: rubygem-mongo-doc, AlmaLinux:8: rubygem-mysql2, AlmaLinux:8: rubygem-mysql2-doc, AlmaLinux:8: rubygem-pg, AlmaLinux:8: rubygem-pg-doc

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.

The following packages have been upgraded to a later upstream version: ruby (2.5.9). (BZ#1952626)

Security Fix(es):

* ruby: NUL injection vulnerability of File.fnmatch and File.fnmatch? (CVE-2019-15845)

* ruby: Regular expression denial of service vulnerability of WEBrick's Digest authentication (CVE-2019-16201)

* ruby: Code injection via command argument of Shell#test / Shell#[] (CVE-2019-16255)

* rubygem-json: Unsafe object creation vulnerability in JSON (CVE-2020-10663)

* ruby: BasicSocket#read_nonblock method leads to information disclosure (CVE-2020-10933)

* ruby: Potential HTTP request smuggling in WEBrick (CVE-2020-25613)

* ruby: XML round-trip vulnerability in REXML (CVE-2021-28965)

* ruby: HTTP response splitting in WEBrick (CVE-2019-16254)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

 https://cve.radiocsirt.org/vuln/bdu:2020-00835 bdu:2020-00835 2026-10-03T04:21:32.905902+00:00 bdu:2020-00835 https://cve.radiocsirt.org/vuln/bell-cve-2019-16255 Withdrawn: BELL-CVE-2019-16255 — CVE-2019-16255 does not affect BellSoft software 2026-10-03T04:21:32.905926+00:00

Withdrawn by the publisher.

https://cve.radiocsirt.org/vuln/certfr-2021-avi-788 certfr-2021-avi-788 — De multiples vulnérabilités ont été découvertes dans IBM Cloud Foundry Migration Runtime. Certaines d'entre elles perme… 2026-10-03T04:21:32.905942+00:00 certfr-2021-avi-788 https://cve.radiocsirt.org/vuln/cleanstart-2026-df79860 CLEANSTART-2026-DF79860 — Security fix for CVE-2019-16255 applied in: ruby 2.6.5-r0 2026-10-03T04:21:32.905957+00:00

Affected: CleanStart: ruby

Security vulnerability affects the ruby package. This issue is resolved in later releases. See references for vulnerability details.

 https://cve.radiocsirt.org/vuln/cnvd-2020-12797 cnvd-2020-12797 2026-10-03T04:21:32.905978+00:00 cnvd-2020-12797 https://cve.radiocsirt.org/vuln/euvd-2026-57650 EUVD-2026-57650 2026-10-03T04:21:32.905990+00:00 EUVD-2026-57650 https://cve.radiocsirt.org/vuln/fkie_cve-2019-16255 fkie_cve-2019-16255 2026-10-03T04:21:32.906000+00:00

Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows code injection if the first argument (aka the "command" argument) to Shell#[] or Shell#test in lib/shell.rb is untrusted data. An attacker can exploit this to call an arbitrary Ruby method.

 https://cve.radiocsirt.org/vuln/ghsa-ph7w-p94x-9vvw GHSA-ph7w-p94x-9vvw 2026-10-03T04:21:32.906021+00:00

Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows code injection if the first argument (aka the "command" argument) to Shell#[] or Shell#test in lib/shell.rb is untrusted data. An attacker can exploit this to call an arbitrary Ruby method.

 https://cve.radiocsirt.org/vuln/gsd-2019-16255 gsd-2019-16255 2026-10-03T04:21:32.906036+00:00 gsd-2019-16255 https://cve.radiocsirt.org/vuln/msrc_cve-2019-16255 msrc_CVE-2019-16255 — Ruby through 2.4.7 2.5.x through 2.5.6 and 2.6.x through 2.6.4 allows code injection if the first argument (aka the "co… 2026-10-03T04:21:32.906047+00:00 msrc_CVE-2019-16255 https://cve.radiocsirt.org/vuln/opensuse-su-2020:0395-1 openSUSE-SU-2020:0395-1 — Recommended update for ruby2.5 2026-10-03T04:21:32.906064+00:00

Recommended update for ruby2.5

 https://cve.radiocsirt.org/vuln/rhsa-2021:2104 RHSA-2021:2104 — Red Hat Security Advisory: rh-ruby25-ruby security, bug fix, and enhancement update 2026-10-03T04:21:32.906082+00:00

ruby: NUL injection vulnerability of File.fnmatch and File.fnmatch? ruby: Regular expression denial of service vulnerability of WEBrick's Digest authentication ruby: HTTP response splitting in WEBrick ruby: Code injection via command argument of Shell#test / Shell#[] rubygem-json: Unsafe object creation vulnerability in JSON ruby: BasicSocket#read_nonblock method leads to information disclosure ruby: Potential HTTP request smuggling in WEBrick ruby: XML round-trip vulnerability in REXML

 https://cve.radiocsirt.org/vuln/suse-su-2020:0737-1 SUSE-SU-2020:0737-1 — Recommended update for ruby2.5 2026-10-03T04:21:32.906110+00:00

Recommended update for ruby2.5

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2019-16255 UBUNTU-CVE-2019-16255 2026-10-03T04:21:32.906126+00:00

Affected: Ubuntu:Pro:14.04:LTS: jruby, Ubuntu:16.04:LTS: ruby2.3, Ubuntu:16.04:LTS: jruby, Ubuntu:18.04:LTS: ruby2.5, Ubuntu:18.04:LTS: jruby, Ubuntu:20.04:LTS: jruby, Ubuntu:24.04:LTS: jruby, Ubuntu:25.10: jruby, Ubuntu:26.04:LTS: jruby

Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows code injection if the first argument (aka the "command" argument) to Shell#[] or Shell#test in lib/shell.rb is untrusted data. An attacker can exploit this to call an arbitrary Ruby method.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2023-1110 WID-SEC-W-2023-1110 — Ruby: Mehrere Schwachstellen 2026-10-03T04:21:32.906154+00:00

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Ruby ausnutzen, um Sicherheitsvorkehrungen zu umgehen, um Daten zu manipulieren oder einen Denial of Servie zu verursachen.