https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T17:48:56.294617+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-111221 EUVD-2026-111221 2026-10-03T17:48:56.395793+00:00 EUVD-2026-111221 https://cve.radiocsirt.org/vuln/fkie_cve-2012-2694 fkie_cve-2012-2694 2026-10-03T17:48:56.395837+00:00

actionpack/lib/action_dispatch/http/request.rb in Ruby on Rails before 3.0.14, 3.1.x before 3.1.6, and 3.2.x before 3.2.6 does not properly consider differences in parameter handling between the Active Record component and the Rack interface, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks via a crafted request, as demonstrated by certain "['xyz', nil]" values, a related issue to CVE-2012-2660.

 https://cve.radiocsirt.org/vuln/ghsa-q34c-48gc-m9g8 GHSA-q34c-48gc-m9g8 — actionpack allows remote attackers to bypass database-query restrictions, perform NULL checks via crafted request 2026-10-03T17:48:56.395874+00:00

Affected: RubyGems: actionpack

`actionpack/lib/action_dispatch/http/request.rb` in Ruby on Rails before 3.0.14, 3.1.x before 3.1.6, and 3.2.x before 3.2.6 does not properly consider differences in parameter handling between the Active Record component and the Rack interface, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks via a crafted request, as demonstrated by certain `['xyz', nil]` values, a related issue to CVE-2012-2660.

 https://cve.radiocsirt.org/vuln/gsd-2012-2694 gsd-2012-2694 2026-10-03T17:48:56.395903+00:00 gsd-2012-2694 https://cve.radiocsirt.org/vuln/rhsa-2012:1542 RHSA-2012:1542 — Red Hat Security Advisory: CloudForms Commons 1.1 security update 2026-10-03T17:48:56.395916+00:00

puppet: Filebucket arbitrary file read puppet: Filebucket denial of service puppet: Filebucket arbitrary code execution rubygem-mail: directory traversal rubygem-mail: arbitrary command execution when using exim or sendmail from commandline rubygem-actionpack: Unsafe query generation rubygem-activerecord: SQL injection when processing nested query paramaters rubygem-actionpack: Unsafe query generation (a different flaw than CVE-2012-2660) rubygem-activerecord: SQL injection when processing nested query paramaters (a different flaw than CVE-2012-2661) rubygem-actionpack: DoS vulnerability in authenticate_or_request_with_http_digest rubygem-actionpack: potential XSS vulnerability in select_tag prompt rubygem-actionpack: potential XSS vulnerability rubygem-actionpack: XSS Vulnerability in strip_tags puppet: authenticated clients allowed to read arbitrary files from the puppet master puppet: authenticated clients allowed to delete arbitrary files on the puppet master puppet: insufficient validation of agent names in CN of SSL certificate requests