https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T14:27:41.436838+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/certfr-2026-avi-0349 certfr-2026-avi-0349 — De multiples vulnérabilités ont été découvertes dans les produits Ruby on Rails. Certaines d'entre elles permettent à u… 2026-10-03T14:27:41.548863+00:00 certfr-2026-avi-0349 https://cve.radiocsirt.org/vuln/euvd-2026-277266 EUVD-2026-277266 2026-10-03T14:27:41.548904+00:00 EUVD-2026-277266 https://cve.radiocsirt.org/vuln/fkie_cve-2026-33167 fkie_cve-2026-33167 2026-10-03T14:27:41.548920+00:00

Action Pack is a Rubygem for building web applications on the Rails framework. In versions on the 8.1 branch prior to 8.1.2.1, the debug exceptions page does not properly escape exception messages. A carefully crafted exception message could inject arbitrary HTML and JavaScript into the page, leading to XSS. This affects applications with detailed exception pages enabled (`config.consider_all_requests_local = true`), which is the default in development. Version 8.1.2.1 contains a patch.

 https://cve.radiocsirt.org/vuln/ghsa-pgm4-439c-5jp6 GHSA-pgm4-439c-5jp6 — Rails has a possible XSS vulnerability in its Action Pack debug exceptions 2026-10-03T14:27:41.548954+00:00

Affected: RubyGems: actionpack

### Impact The debug exceptions page does not properly escape exception messages. A carefully crafted exception message could inject arbitrary HTML and JavaScript into the page, leading to XSS. This affects applications with detailed exception pages enabled (`config.consider_all_requests_local = true`), which is the default in development.

### Releases The fixed releases are available at the normal locations.

### Credit This issue was responsibly reported by Hackerone researcher [fbettag](https://hackerone.com/fbettag).

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-33167 UBUNTU-CVE-2026-33167 2026-10-03T14:27:41.548984+00:00

Affected: Ubuntu:Pro:16.04:LTS: rails, Ubuntu:Pro:18.04:LTS: rails, Ubuntu:Pro:20.04:LTS: rails, Ubuntu:Pro:22.04:LTS: rails, Ubuntu:24.04:LTS: rails, Ubuntu:25.10: rails, Ubuntu:26.04:LTS: rails

Action Pack is a Rubygem for building web applications on the Rails framework. In versions on the 8.1 branch prior to 8.1.2.1, the debug exceptions page does not properly escape exception messages. A carefully crafted exception message could inject arbitrary HTML and JavaScript into the page, leading to XSS. This affects applications with detailed exception pages enabled (`config.consider_all_requests_local = true`), which is the default in development. Version 8.1.2.1 contains a patch.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0833 WID-SEC-W-2026-0833 — Ruby on Rails: Mehrere Schwachstellen 2026-10-03T14:27:41.549016+00:00

Ein Angreifer kann mehrere Schwachstellen in Ruby on Rails ausnutzen, um einen Denial of Service Angriff durchzuführen, um Dateien zu manipulieren, und um einen Cross-Site Scripting Angriff durchzuführen.