RubyGems vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-63414Highshopify_app: Shopify App: Token exchange shop context confusion may allow cross-shop authorization bypass in affected appsCVE-2026-61848Mediumcrass: Crass: Non-ASCII characters cause superlinear CPU consumptionCVE-2026-61847Mediumcrass: Crass: A large number of adjacent CSS comments can trigger a SystemStackErrorCVE-2026-61846Mediumcrass: Crass: Deeply nested CSS blocks and functions can trigger a SystemStackError or excessive memory usageCVE-2026-116695Mediumcrass: Crass: Incorrect tokenization of bad URLs enables CSS sanitizer bypassCVE-2026-61845Highcrass: Crass : Large numeric exponents cause CPU and memory denial of serviceCVE-2026-107399Mediummechanize: Mechanize sends credential headers to another origin after a meta refreshCVE-2026-107715Mediummechanize: Mechanize sends credential headers to another host after an HTTP redirectGHSA-MWM8-39RW-8826Mediumsqlite3: sqlite3-ruby: Use-After-Free in SQLite Aggregate Arguments in Heap-Allocated Argument ArrayCVE-2026-77602Criticalopenc3: OpenC3 COSMOS: Authenticated remote code execution via the user-writable config overlay (table definitions, cmd/tlm definitions, and script…CVE-2026-77601Highopenc3: OpenC3 COSMOS: Authenticated OS command injection via the `pypi_url` settingCVE-2026-94462Highspree_api: Spree: Broken Access Control in `PATCH /api/v3/store/carts/:id/associate` (IDOR)CVE-2026-65829MediumMPXJ.Net: MPXJ: Potential Path Traversal Vulnerability in Primavera P3 PRX and SureTrak STX readersCVE-2026-61570Highnet.sf.mpxj:mpxj: MPXJ: XXE Vulnerability in MerlinReaderCVE-2026-44282Mediumdecidim-elections: decidim-elections: Election question titles allow stored script executionCVE-2026-85396Highrubyzip: rubyzip path traversal vulnerabilityCVE-2026-63435Mediummail: Mail: Email address spoofing via malformed RFC 2047 encoded-wordsCVE-2026-55107Criticalkobako: kobako Sandbox Escape: guest eval reaches host RCE via method_missing → public_send (any bound Service)CVE-2026-71847Lowjson: Ruby JSON: JSON::ResumableParser#partial_value dereferences a freed input buffer and crashes on truncated duplicate-key streamsCVE-2016-1000305Mediumguard-livereload: guard-livereload has a directory traversal vulnerabilityCVE-2026-53510Highsavon: Savon::Model evaluates WSDL operation names as Ruby sourceCVE-2026-66066Criticalactivestorage: Active Storage has possible arbitrary file read and remote code execution in Active Storage variant processingCVE-2026-54522Lowmsgpack: MessagePack::Buffer#clear Use-After-Free that Enables Cross-Buffer DisclosureCVE-2026-67431Highmcp: MCP Ruby SDK: Ruby SSE Session PoisoningCVE-2026-67432Highmcp: MCP Ruby SDK: Unbounded JSON-RPC request body causes uncontrolled memory allocation in StreamableHTTPTransport

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo