Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop and so on. Prior to 1.19.3, Fluentd's Monitor Agent plugin in_monitor_agent exposes internal metrics and plugin information via a REST API, and responses from /api/plugins.json and related endpoints unintentionally include internal instance variables that may contain database passwords, API keys, or cloud credentials. This issue is fixed in version 1.19.3.
Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop and so on. Prior to 1.19.3, Fluentd allows dynamically constructing file paths using the ${tag} placeholder, and insufficient validation of ${tag} in file configurations such as the path parameter of the out_file plugin allows attackers sending untrusted tags containing path traversal characters to write or overwrite arbitrary files and potentially achieve remote code execution. This issue is fixed in version 1.19.3.
The RubyGems package 'zzzltestfoobarxyz' versions 0.0.1 and 0.0.2 contain malicious code. This package is identified as a malicious package by the OpenSSF and is listed in the malicious packages database. No CVSS score or detailed technical exploitation information is provided.
The RubyGems package 'zzwandtemp1778552518' versions 0.0.1 and 0.0.2 contain malicious code. This package is identified as a malicious package by the OpenSSF and is listed in the malicious packages database. There is no CVSS score or detailed technical exploit information available. No known exploits in the wild have been reported.
The RubyGems package 'zzwmgweb02' version 0.0.1 has been identified as containing malicious code. This package is flagged as a malicious package by the OpenSSF project and is listed in the malicious packages database. There is no CVSS score or detailed technical exploit information available. No patches or fixes have been indicated for this package version.
The RubyGems package 'zzwandsxabc119' version 0.0.1 is identified as containing malicious code. This package is flagged as a malicious package by the OpenSSF and is listed in the malicious packages database. No specific technical details about the nature of the malicious code or its impact are provided.
The RubyGems package 'zztxtwtmp13' version 0.0.1 contains malicious code as identified by the OpenSSF malicious packages project. This package is flagged as a malicious package in the RubyGems ecosystem. There is no CVSS score or detailed technical exploit information available. No patch or remediation guidance is provided for this package version.
The RubyGem package 'zztxtwtmp14' version 0.0.1 contains malicious code as identified by the OpenSSF malicious packages project. This package is flagged as a malicious package in the RubyGems ecosystem. There is no CVSS score or detailed technical vulnerability description available. No known exploits in the wild have been reported. No patch or remediation information is provided.
---
_-= Per source details. Do not edit below this line.=-_
## Source: ghsa-malware (e68008eb00de03f4b1fc2f80ab7930b59a0305ace0a681864a1d025186bcd1e9)
---
Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/9fbb5fba02ba2f02395d3d2d43c31b2c482b7a9d/osv/malicious/rubygems/zztxtwtmp12/MAL-2026-9999.json))
---
_-= Per source details. Do not edit below this line.=-_
## Source: ghsa-malware (ae6a5afcedcdfdc53b2404bb13a6b30de93c9d71d0697e4a58bed9ee490042eb)
---
Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/9fbb5fba02ba2f02395d3d2d43c31b2c482b7a9d/osv/malicious/rubygems/zztxtwtmp11/MAL-2026-9998.json))
---
_-= Per source details. Do not edit below this line.=-_
## Source: ghsa-malware (a9c06fa97c290e6c44e357ba895d7ff66733519f29fc592e94e7149de63ceeaa)
---
Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/9fbb5fba02ba2f02395d3d2d43c31b2c482b7a9d/osv/malicious/rubygems/zztxtwtmp10/MAL-2026-9997.json))
---
_-= Per source details. Do not edit below this line.=-_
## Source: ghsa-malware (a0b1df77ae67924b6d063d2da58a43c8e2253dde93222a037a98f49376b359c7)
---
Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/9fbb5fba02ba2f02395d3d2d43c31b2c482b7a9d/osv/malicious/rubygems/zztxtwtmp08/MAL-2026-9995.json))
---
_-= Per source details. Do not edit below this line.=-_
## Source: ghsa-malware (fa30ff936894b20c6a757ae0e6b0fc98f6ad23cd6c12fd9896a34fe6d2038ea3)
---
Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/9fbb5fba02ba2f02395d3d2d43c31b2c482b7a9d/osv/malicious/rubygems/zztxtwtmp09/MAL-2026-9996.json))
---
_-= Per source details. Do not edit below this line.=-_
## Source: ghsa-malware (06edcf6baef91d8eee16da3b1170b5ac25b047490ee3ad8570d639d6c57ab04d)
---
Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/9fbb5fba02ba2f02395d3d2d43c31b2c482b7a9d/osv/malicious/rubygems/zztxtwtmp06/MAL-2026-9993.json))
---
_-= Per source details. Do not edit below this line.=-_
## Source: ghsa-malware (710b2b5878e3104ee22de0059795fdc6b309be8b8c30100291f6097feb2acf48)
---
Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/9fbb5fba02ba2f02395d3d2d43c31b2c482b7a9d/osv/malicious/rubygems/zztxtwtmp07/MAL-2026-9994.json))
---
_-= Per source details. Do not edit below this line.=-_
## Source: ghsa-malware (395a2747617485255b7f6566c59ca148b5d59b3acd44e256f943aa8875474f99)
---
Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/9fbb5fba02ba2f02395d3d2d43c31b2c482b7a9d/osv/malicious/rubygems/zztxtwtmp05/MAL-2026-9992.json))
---
_-= Per source details. Do not edit below this line.=-_
## Source: ghsa-malware (d0ea687d400a3a0e9ce3b50e73fa061c80dc716665ea50f27f1238a26c2529ea)
---
Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/9fbb5fba02ba2f02395d3d2d43c31b2c482b7a9d/osv/malicious/rubygems/zztxtwtmp03/MAL-2026-9990.json))
---
_-= Per source details. Do not edit below this line.=-_
## Source: ghsa-malware (889ebf2a26e92fcb8ec7ddf08da0804f0f46db582463b7504c2175d5075bfdde)
---
Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/9fbb5fba02ba2f02395d3d2d43c31b2c482b7a9d/osv/malicious/rubygems/zztxtwtmp04/MAL-2026-9991.json))
---
_-= Per source details. Do not edit below this line.=-_
## Source: ghsa-malware (2284c54b67ee670e1710e2cf7442dbdcbe2aaee2471d82edb4178e8af04d983c)
---
Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/9fbb5fba02ba2f02395d3d2d43c31b2c482b7a9d/osv/malicious/rubygems/zztxtwtmp01/MAL-2026-9988.json))
---
_-= Per source details. Do not edit below this line.=-_
## Source: ghsa-malware (f61a5a990ac9c442440841875510ad83f3c73e8bcbd6a07f1709f26a77a3cec3)
---
Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/9fbb5fba02ba2f02395d3d2d43c31b2c482b7a9d/osv/malicious/rubygems/zztxtwtmp02/MAL-2026-9989.json))