https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T07:47:20.086660+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2026-07236 bdu:2026-07236 2026-10-03T07:47:20.221853+00:00 bdu:2026-07236 https://cve.radiocsirt.org/vuln/brew-krane-cve-2026-33169 BREW-krane-CVE-2026-33169 — Rails Active Support has a possible ReDoS vulnerability in number_to_delimited 2026-10-03T07:47:20.221890+00:00

Affected: Homebrew: krane

### Impact `NumberToDelimitedConverter` used a regular expression with `gsub!` to insert thousands delimiters. This could produce quadratic time complexity on long digit strings.

### Releases The fixed releases are available at the normal locations.

### Credit This issue was responsibly reported by Hackerone researcher [scyoon](https://hackerone.com/scyoon).

 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0349 certfr-2026-avi-0349 — De multiples vulnérabilités ont été découvertes dans les produits Ruby on Rails. Certaines d'entre elles permettent à u… 2026-10-03T07:47:20.221926+00:00 certfr-2026-avi-0349 https://cve.radiocsirt.org/vuln/euvd-2026-277208 EUVD-2026-277208 2026-10-03T07:47:20.221944+00:00 EUVD-2026-277208 https://cve.radiocsirt.org/vuln/fkie_cve-2026-33169 fkie_cve-2026-33169 2026-10-03T07:47:20.221955+00:00

Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework. `NumberToDelimitedConverter` uses a lookahead-based regular expression with `gsub!` to insert thousands delimiters. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, the interaction between the repeated lookahead group and `gsub!` can produce quadratic time complexity on long digit strings. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.

 https://cve.radiocsirt.org/vuln/ghsa-cg4j-q9v8-6v38 GHSA-cg4j-q9v8-6v38 — Rails Active Support has a possible ReDoS vulnerability in number_to_delimited 2026-10-03T07:47:20.221978+00:00

Affected: RubyGems: activesupport

### Impact `NumberToDelimitedConverter` used a regular expression with `gsub!` to insert thousands delimiters. This could produce quadratic time complexity on long digit strings.

### Releases The fixed releases are available at the normal locations.

### Credit This issue was responsibly reported by Hackerone researcher [scyoon](https://hackerone.com/scyoon).

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-33169 UBUNTU-CVE-2026-33169 2026-10-03T07:47:20.222001+00:00

Affected: Ubuntu:Pro:16.04:LTS: rails, Ubuntu:Pro:18.04:LTS: rails, Ubuntu:Pro:20.04:LTS: rails, Ubuntu:Pro:22.04:LTS: rails, Ubuntu:24.04:LTS: rails, Ubuntu:25.10: rails, Ubuntu:26.04:LTS: rails

Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework. `NumberToDelimitedConverter` uses a lookahead-based regular expression with `gsub!` to insert thousands delimiters. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, the interaction between the repeated lookahead group and `gsub!` can produce quadratic time complexity on long digit strings. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0833 WID-SEC-W-2026-0833 — Ruby on Rails: Mehrere Schwachstellen 2026-10-03T07:47:20.222030+00:00

Ein Angreifer kann mehrere Schwachstellen in Ruby on Rails ausnutzen, um einen Denial of Service Angriff durchzuführen, um Dateien zu manipulieren, und um einen Cross-Site Scripting Angriff durchzuführen.