CVE-2026-68006

CriticalCVSS 9.1/10Last modified Sep 14, 2026

Description

An issue in Puma v.5.0.0 and before v.8.0.3 allows an attacker to execute arbitrary code via the ext/puma_http11/http11_parser.rl file

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-444

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Sep 10, 2026
Last modified
Sep 14, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-68015.3The Context Blog theme for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.3.5 via the conCVE-2026-68025.3The Easy Upload Files During Checkout plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 3.0.1.CVE-2026-68035.3The AI Chatbot & Workflow Automation by AIWU plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and includinCVE-2026-68045.3The AI Chatbot & Workflow Automation by AIWU plugin for WordPress is vulnerable to authorization bypass in all versions up to, and includingCVE-2026-68057.5Vulnerability on the external sharing feature in Cryptobox allows an attacker knowing a sharing link URL to retrieve information from the seCVE-2026-68067.5The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'stm_lCVE-2026-680607.5A pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to potential denial of service. CVE-2026-680625.8SKYSEA Client View and SKYMEC IT Manager contain a path traversal vulnerability. If this vulnerability is exploited, an attacker who can logCVE-2026-680679.8The login endpoint on the Mira cloud API accepts any format-valid string in the password field and returns a live active session token for tCVE-2026-680689.0The "screenID" parameter in the electronic transaction queue viewer feature within the manual transactions section is susceptible to a time-CVE-2026-68075.5A vulnerability in GRASSMARLIN v3.2.1 allows crafted session data to trigger improper handling of XML input, which may result in unintendedCVE-2026-680708.8The affected products are missing authentication for a critical function, which could allow an attacker to run as root and pass received byt
CVE-2026-68006: Critical severity, CVSS 9.1 | Vulnix