CVE-2026-41316
ERB has an @_init deserialization guard bypass via def_module / def_method / def_class
CVSS score
8.1
EPSS probability
%1.3
Risk score
0.1
Published
5 mo ago
Public Exploits · GitHub and Metasploit Intelligence
This tab scans the sources that NVD labels as exploits, GitHub repositories matching the CVE identifier and Rapid7 Metasploit Framework modules. Only links to sources that were actually found are shown.
No verified public exploit code was found.
GitHub repositories, NVD exploit references and the Metasploit Framework were scanned. A record of active exploitation does not mean that public exploit code has been published.
Similar Vulnerabilities
8.3
CVE-2026-33210
Ruby JSON has a format string injection vulnerability
R
Patch status unknownEPSS %1
5.8
CVE-2026-42258
net-imap: Command Injection via unvalidated Symbol inputs
R
Patch status unknownEPSS %1
8.7
CVE-2026-71847
Ruby JSON: JSON::ResumableParser#partial_value dereferences a freed input buffer and crashes on truncated duplicate-key streams
R
Patch verifiedEPSS %0
7.5
CVE-2026-80212
Resource allocation without limits in Ruby Resolv
R
Patch status unknownEPSS %0
7.6
CVE-2026-42246
net-imap vulnerable to STARTTLS stripping via invalid response timing
R
Patch verifiedEPSS %0
4.0
CVE-2026-80213
Vulnerability in Ruby Resolv
R
Patch status unknownEPSS %0
Get this vulnerability through the API
Affected products, version ranges, exploitation status and patch information in a single request, with a free key.
curl -H "x-api-key: $DAYBREACH_API_KEY" \ "https://api.daybreach.dev/api/v1/intel/cves/CVE-2026-41316"