RubyGems vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2025-6442Mediumwebrick: Ruby WEBrick read_headers method can lead to HTTP Request/Response SmugglingCVE-2025-28382Highopenc3-cosmos-tool-iframe: OpenC3 COSMOS Vulnerable to Directory Traversal via openc3-api/tables endpointCVE-2025-28384Criticalopenc3-cosmos-tool-iframe: OpenC3 COSMOS Vulnerable to Directory Traversal via /script-api/scripts/ endpointCVE-2025-49007Mediumrack: ReDoS Vulnerability in Rack::Multipart handle_mime_headCVE-2025-48069Mediumgithub.com/Shopify/ejson2env/v2: Insufficient input sanitization in ejson2env CVE-2025-46727Highrack: Rack has an Unbounded-Parameter DoS in Rack::QueryParserCVE-2025-46336Mediumrack-session: Rack session gets restored after deletionCVE-2025-32441Mediumrack: Rack session gets restored after deletionCVE-2025-46551Mediumrubygems:jruby-openssl: JRuby-OpenSSL has hostname verification disabled by defaultCVE-2025-43857Mediumnet-imap: net-imap rubygem vulnerable to possible DoS by memory exhaustionGHSA-5W6V-399V-W3CCLownokogiri: Nokogiri updates packaged libxml2 to v2.13.8 to resolve CVE-2025-32414 and CVE-2025-32415CVE-2024-39311Lowpublify_core: Publify Vulnerable To Cross-Site Scripting (XSS) Via Redirects Requiring User InteractionCVE-2025-30221Mediumpitchfork: Pitchfork HTTP Request/Response Splitting vulnerabilityGHSA-MRXW-MXHJ-P664Highnokogiri: Nokogiri updates packaged libxslt to v1.1.43 to resolve multiple CVEsCVE-2025-2304Criticalcamaleon_cms: Camaleon CMS Vulnerable to Privilege Escalation through a Mass AssignmentCVE-2025-25292Criticalruby-saml: Ruby SAML allows a SAML authentication bypass due to namespace handling (parser differential)CVE-2025-25291Criticalruby-saml: Ruby SAML allows a SAML authentication bypass due to DOCTYPE handling (parser differential)CVE-2025-25293Highruby-saml: Ruby SAML allows remote Denial of Service (DoS) with compressed SAML responsesGHSA-HW46-3HMR-X9XVCriticalomniauth-saml: omniauth-saml has dependency on ruby-saml version with Signature Wrapping Attack issueCVE-2025-27407Criticalgraphql: graphql allows remote code execution when loading a crafted GraphQL schemaCVE-2025-27788Highjson: Out-of-bounds Read in Ruby JSON Parser CVE-2025-27610Highrack: Local File Inclusion in Rack::StaticCVE-2025-27111Mediumrack: Escape Sequence Injection vulnerability in Rack lead to Possible Log InjectionCVE-2025-27221Lowuri: URI allows for userinfo Leakage in URI#join, URI#merge, and URI#+CVE-2025-27220Mediumcgi: CGI has Regular Expression Denial of Service (ReDoS) potential in Util#escapeElement

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo