https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-07T14:17:37.761142+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/cve-2022-29970 CVE-2022-29970 2026-10-07T14:17:37.776657+00:00

Sinatra before 2.2.0 does not validate that the expanded path matches public_dir when serving static files.

 https://vulnerability.circl.lu/vuln/usn-7664-1 USN-7664-1 — ruby-sinatra vulnerabilities 2026-10-07T14:17:37.776915+00:00

Affected: Ubuntu:Pro:16.04:LTS: ruby-sinatra, Ubuntu:Pro:18.04:LTS: ruby-sinatra, Ubuntu:Pro:20.04:LTS: ruby-sinatra, Ubuntu:22.04:LTS: ruby-sinatra

It was discovered that Sinatra incorrectly handled serving static files. An attacker could possibly use this issue to perform local file inclusion, obtaining sensitive information. (CVE-2022-29970)

It was discovered that Sinatra incorrectly handled special characters in the Content-Disposition HTTP header. An attacker could possibly use this issue to perform a reflected file download attack, achieving remote code execution. (CVE-2022-45442)