RubyGems vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2024-7106Mediumspina: Cross-Site Request Forgery in Spina CVE-2024-39908Mediumrexml: REXML denial of service vulnerability CVE-2024-27095Mediumdecidim-admin: Decidim cross-site scripting (XSS) in the admin panel CVE-2024-32469Mediumdecidim: Decidim cross-site scripting (XSS) in the pagination CVE-2024-27090Mediumdecidim: Decidim vulnerable to data disclosure through the embed feature CVE-2024-39308Mediumrails_admin: RailsAdmin Cross-site Scripting vulnerability in the list view CVE-2024-39316Mediumrack: Rack ReDoS Vulnerability in HTTP Accept Headers Parsing CVE-2024-28103Mediumactionpack: Missing security headers in Action Pack on non-HTML responses CVE-2024-32464Mediumactiontext: ActionText ContentAttachment can Contain Unsanitized HTML CVE-2024-37031Highactiveadmin: activeadmin vulnerable to stored persistent cross-site scripting (XSS) in dynamic form legends CVE-2024-35231Highrack-contrib: rack-contrib vulnerable to Denial of Service due to the unconstrained value of the incoming "profiler_runs" parameter CVE-2024-32978Mediumkaminari: Kaminari Insecure File Permissions Vulnerability CVE-2024-35176Mediumrexml: REXML contains a denial of service vulnerability GHSA-R95H-9X8F-R3F7Lownokogiri: Nokogiri updates packaged libxml2 to v2.12.7 to resolve CVE-2024-34459 CVE-2024-34341Mediumtrix: Trix Editor Arbitrary Code Execution Vulnerability CVE-2024-32970Highphlex: Phlex vulnerable to Cross-site Scripting (XSS) via maliciously formed HTML attribute names and values CVE-2024-32887Mediumsidekiq: Sidekiq vulnerable to a Reflected XSS in Queues Web Page CVE-2024-32463Highphlex: Cross-site Scripting (XSS) possible due to improper sanitisation of `href` attributes on `<a>` tags CVE-2024-29034Mediumcarrierwave: CarrierWave content-Type allowlist bypass vulnerability which possibly leads to XSS remained CVE-2024-27281Lowrdoc: RDoc RCE vulnerability with .rdoc_options CVE-2024-27280Criticalstringio: StringIO buffer overread vulnerability CVE-2024-28862Mediumrotp: ROTP 6.2.2 and 6.2.1 has 0666 permissions for the .rb files.CVE-2024-28181Highturbo_boost-commands: TurboBoost Commands vulnerable to arbitrary method invocation CVE-2023-28102Criticaldiscordrb: discordrb OS Command Injection vulnerability CVE-2024-28121Highstimulus_reflex: StimulusReflex arbitrary method call

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Browse by ecosystem

Stop the waste.Protect your environment with Kodem.

Stop the waste.
Protect your environment with Kodem.