https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-05T01:17:16.509146+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cnvd-2015-04549 cnvd-2015-04549 2026-10-05T01:17:16.590445+00:00 cnvd-2015-04549 https://cve.radiocsirt.org/vuln/euvd-2026-91498 EUVD-2026-91498 2026-10-05T01:17:16.590491+00:00 EUVD-2026-91498 https://cve.radiocsirt.org/vuln/fkie_cve-2015-2963 fkie_cve-2015-2963 2026-10-05T01:17:16.590507+00:00

The thoughtbot paperclip gem before 4.2.2 for Ruby does not consider the content-type value during media-type validation, which allows remote attackers to upload HTML documents and conduct cross-site scripting (XSS) attacks via a spoofed value, as demonstrated by image/jpeg.

 https://cve.radiocsirt.org/vuln/ghsa-6jvm-3j5h-79f6 GHSA-6jvm-3j5h-79f6 — paperclip Cross-site Scripting vulnerability 2026-10-05T01:17:16.590537+00:00

Affected: RubyGems: paperclip

The thoughtbot paperclip gem before 4.2.2 for Ruby does not consider the content-type value during media-type validation, which allows remote attackers to upload HTML documents and conduct cross-site scripting (XSS) attacks via a spoofed value, as demonstrated by image/jpeg.

 https://cve.radiocsirt.org/vuln/gsd-2015-2963 gsd-2015-2963 2026-10-05T01:17:16.590560+00:00 gsd-2015-2963 https://cve.radiocsirt.org/vuln/jvndb-2015-000088 jvndb-2015-000088 2026-10-05T01:17:16.590572+00:00

Paperclip provided by thoughtbot is a library to upload files in Ruby on Rails. Paperclip contains a persistent cross-site scripting vulnerability (CWE-79). MORI Shingo of DeNA Co., Ltd. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.