RubyGems vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2024-27456Mediumrack-cors: Rack CORS Middleware has Insecure File Permissions CVE-2023-51447Mediumdecidim: Cross-site scripting (XSS) in the dynamic file uploads CVE-2023-48220Mediumdecidim: Possibility to circumvent the invitation token expiry period CVE-2023-47635Mediumdecidim-templates: Possible CSRF attack at questionnaire templates preview CVE-2023-47634Lowdecidim: Race condition in Endorsements CVE-2024-25122Highsidekiq-unique-jobs: XSS sidekiq-unique-jobs UI server vulnerability GHSA-XC9X-JJ77-9P9JMediumnokogiri: Nokogiri update packaged libxml2 to v2.12.5 to resolve CVE-2024-25062 CVE-2024-22411Mediumavo: Cross-site scripting (XSS) in Action messages on Avo CVE-2024-22191Highavo: avo vulnerable to stored cross-site scripting (XSS) in key_value field CVE-2024-21647Mediumpuma: Puma HTTP Request/Response Smuggling vulnerability CVE-2024-21636Mediumview_component: view_component Cross-site Scripting vulnerability CVE-2024-21632Highomniauth-microsoft_graph: Omniauth::MicrosoftGraph Account takeover (nOAuth)CVE-2023-51763Mediumactiveadmin: ActiveAdmin CSV Injection leading to sensitive information disclosure CVE-2023-50724Mediumresque: Resque vulnerable to Reflected Cross Site Scripting through pathnames CVE-2023-50725Mediumresque: Resque vulnerable to reflected XSS in resque-web failed and queues lists CVE-2023-50727Mediumresque: Resque vulnerable to reflected XSS in Queue Endpoint CVE-2022-44303Mediumresque-scheduler: Resque Scheduler Reflected XSS In Delayed Jobs View CVE-2023-50448Highactiveadmin: Potential CSV export data leak CVE-2023-26154Mediumpubnub: pubnub Insufficient Entropy vulnerability CVE-2023-49090Mediumcarrierwave: CarrierWave Content-Type allowlist bypass vulnerability, possibly leading to XSS CVE-2023-5349Mediumrmagick: memory leak flaw was found in ruby-magick CVE-2024-0241Highencoded_id-rails: encoded_id-rails potential DOS vulnerability due to URIs with extremely long encoded IDs CVE-2023-46035Mediumsvg_optimizer: svg_optimizer rubygem external XML entity (XXE) vulnerability CVE-2023-5214Criticalbolt: Puppet Bolt privilege escalation vulnerability CVE-2023-26153Criticalgeokit-rails: geokit-rails Command Injection vulnerability

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Browse by ecosystem

Stop the waste.Protect your environment with Kodem.

Stop the waste.
Protect your environment with Kodem.