https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T17:19:45.613824+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2018-3760 CVE-2018-3760 2026-10-04T17:19:45.644269+00:00

Affected: HackerOne Sprockets

There is an information leak vulnerability in Sprockets. Versions Affected: 4.0.0.beta7 and lower, 3.7.1 and lower, 2.12.4 and lower. Specially crafted requests can be used to access files that exists on the filesystem that is outside an application's root directory, when the Sprockets server is used in production. All users running an affected release should either upgrade or use one of the work arounds immediately.

 https://cve.radiocsirt.org/vuln/ghsa-pr3h-jjhj-573x GHSA-pr3h-jjhj-573x — Sprockets path traversal leads to information leak 2026-10-04T17:19:45.644326+00:00

Affected: RubyGems: sprockets

Specially crafted requests can be used to access files that exist on the filesystem that is outside an application's root directory, when the Sprockets server is used in production. All users running an affected release should either upgrade or use one of the work arounds immediately. ### Workaround: In Rails applications, work around this issue, set `config.assets.compile = false` and `config.public_file_server.enabled = true` in an initializer and precompile the assets.

This work around will not be possible in all hosting environments and upgrading is advised.