https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T10:29:30.392332+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2025-00917 bdu:2025-00917 2026-10-04T10:29:30.414101+00:00 bdu:2025-00917 https://cve.radiocsirt.org/vuln/certfr-2024-avi-1060 certfr-2024-avi-1060 — De multiples vulnérabilités ont été découvertes dans Ruby on Rails. Elles permettent à un attaquant de provoquer une in… 2026-10-04T10:29:30.414144+00:00 certfr-2024-avi-1060 https://cve.radiocsirt.org/vuln/euvd-2026-221218 EUVD-2026-221218 2026-10-04T10:29:30.414165+00:00 EUVD-2026-221218 https://cve.radiocsirt.org/vuln/fkie_cve-2024-54133 fkie_cve-2024-54133 2026-10-04T10:29:30.414178+00:00

Action Pack is a framework for handling and responding to web requests. There is a possible Cross Site Scripting (XSS) vulnerability in the `content_security_policy` helper starting in version 5.2.0 of Action Pack and prior to versions 7.0.8.7, 7.1.5.1, 7.2.2.1, and 8.0.0.1. Applications which set Content-Security-Policy (CSP) headers dynamically from untrusted user input may be vulnerable to carefully crafted inputs being able to inject new directives into the CSP. This could lead to a bypass of the CSP and its protection against XSS and other attacks. Versions 7.0.8.7, 7.1.5.1, 7.2.2.1, and 8.0.0.1 contain a fix. As a workaround, applications can avoid setting CSP headers dynamically from untrusted input, or can validate/sanitize that input.

 https://cve.radiocsirt.org/vuln/ghsa-vfm5-rmrh-j26v GHSA-vfm5-rmrh-j26v — Possible Content Security Policy bypass in Action Dispatch 2026-10-04T10:29:30.414211+00:00

Affected: RubyGems: actionpack

There is a possible Cross Site Scripting (XSS) vulnerability in the `content_security_policy` helper in Action Pack.

Impact ------ Applications which set Content-Security-Policy (CSP) headers dynamically from untrusted user input may be vulnerable to carefully crafted inputs being able to inject new directives into the CSP. This could lead to a bypass of the CSP and its protection against XSS and other attacks.

Releases -------- The fixed releases are available at the normal locations.

Workarounds ----------- Applications can avoid setting CSP headers dynamically from untrusted input, or can validate/sanitize that input.

Credits ------- Thanks to [ryotak](https://hackerone.com/ryotak) for the report!

 https://cve.radiocsirt.org/vuln/opensuse-su-2025:14668-1 openSUSE-SU-2025:14668-1 — ruby3.4-rubygem-actioncable-8.0-8.0.1-1.1 on GA media 2026-10-04T10:29:30.414246+00:00

ruby3.4-rubygem-actioncable-8.0-8.0.1-1.1 on GA media

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2024-54133 UBUNTU-CVE-2024-54133 2026-10-04T10:29:30.414266+00:00

Affected: Ubuntu:Pro:16.04:LTS: rails, Ubuntu:Pro:18.04:LTS: rails, Ubuntu:Pro:20.04:LTS: rails, Ubuntu:Pro:22.04:LTS: rails, Ubuntu:24.04:LTS: rails, Ubuntu:25.10: rails, Ubuntu:26.04:LTS: rails

Action Pack is a framework for handling and responding to web requests. There is a possible Cross Site Scripting (XSS) vulnerability in the `content_security_policy` helper starting in version 5.2.0 of Action Pack and prior to versions 7.0.8.7, 7.1.5.1, 7.2.2.1, and 8.0.0.1. Applications which set Content-Security-Policy (CSP) headers dynamically from untrusted user input may be vulnerable to carefully crafted inputs being able to inject new directives into the CSP. This could lead to a bypass of the CSP and its protection against XSS and other attacks. Versions 7.0.8.7, 7.1.5.1, 7.2.2.1, and 8.0.0.1 contain a fix. As a workaround, applications can avoid setting CSP headers dynamically from untrusted input, or can validate/sanitize that input.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2024-3665 WID-SEC-W-2024-3665 — Ruby on Rails: Mehrere Schwachstellen ermöglichen Cross-Site Scripting 2026-10-04T10:29:30.414299+00:00

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Ruby on Rails ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen.