{
  "site": "https://pwn.watch",
  "generatedAt": "2026-10-22T19:58:23.236Z",
  "tag": {
    "id": "ruby",
    "label": "Ruby",
    "isStack": true,
    "url": "https://pwn.watch/t/ruby",
    "feed": "https://pwn.watch/t/ruby/feed.xml"
  },
  "counts": {
    "incidents": 2,
    "live": 0,
    "notFullyPatched": 0,
    "patched": 2
  },
  "incidents": [
    {
      "slug": "rails-ruby-on-rails-cve-2019-5418",
      "title": "Rails Ruby on Rails: Ruby on Rails Path Traversal Vulnerability",
      "url": "https://pwn.watch/i/rails-ruby-on-rails-cve-2019-5418",
      "json": "https://pwn.watch/i/rails-ruby-on-rails-cve-2019-5418.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Rails Ruby on Rails",
      "tags": [
        "ruby",
        "rails",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2019-5418"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2025-07-07",
      "closedAt": "2025-07-07",
      "updatedAt": "2025-07-07",
      "summary": "Rails Ruby on Rails contains a path traversal vulnerability in Action View. Specially crafted accept headers in combination with calls to `render file:` can cause arbitrary files on the target server to be rendered, disclosing the file contents. Added to CISA KEV on 2025-07-07.",
      "xPost": null
    },
    {
      "slug": "gitlab-ce-ee-cve-2023-7028",
      "title": "GitLab Community and Enterprise Editions Improper Access Control",
      "url": "https://pwn.watch/i/gitlab-ce-ee-cve-2023-7028",
      "json": "https://pwn.watch/i/gitlab-ce-ee-cve-2023-7028.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "GitLab CE/EE",
      "tags": [
        "devtools",
        "ruby",
        "gitlab",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2023-7028"
      ],
      "affectedVersions": [
        "See vendor advisory (versions are not listed in the KEV record)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2024-01-12",
      "closedAt": "2024-05-01",
      "updatedAt": "2024-05-01",
      "summary": "GitLab Community and Enterprise Editions contain an improper access control vulnerability. This allows an attacker to trigger password reset emails to be sent to an unverified email address to ultimately facilitate an account takeover. Added to the CISA KEV catalog on 2024-05-01. CVE-2023-7028 was assigned before 2024; the KEV listing came in 2024.",
      "xPost": null
    }
  ],
  "posts": [],
  "changes": [
    {
      "incident": "rails-ruby-on-rails-cve-2019-5418",
      "incidentTitle": "Rails Ruby on Rails: Ruby on Rails Path Traversal Vulnerability",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-07-07",
      "title": "CISA added CVE-2019-5418 to the KEV catalog (due 2025-07-28).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/rails-ruby-on-rails-cve-2019-5418"
    },
    {
      "incident": "gitlab-ce-ee-cve-2023-7028",
      "incidentTitle": "GitLab Community and Enterprise Editions Improper Access Control",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-05-01",
      "title": "CISA added CVE-2023-7028 to the KEV catalog (federal deadline 2024-05-22)",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "url": "https://pwn.watch/i/gitlab-ce-ee-cve-2023-7028"
    },
    {
      "incident": "gitlab-ce-ee-cve-2023-7028",
      "incidentTitle": "GitLab Community and Enterprise Editions Improper Access Control",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-01-12",
      "title": "CVE-2023-7028 published",
      "body": null,
      "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2023-7028",
      "url": "https://pwn.watch/i/gitlab-ce-ee-cve-2023-7028"
    }
  ]
}