RubyGems vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2024-28199Highphlex: Cross-site Scripting (XSS) possible with maliciously formed HTML attribute names and values in PhlexCVE-2023-46950Mediumsidekiq-unique-jobs: Cross Site Scripting vulnerability in Contribsys Sidekiq CVE-2023-51774Mediumjson-jwt: json-jwt allows bypass of identity checks via a sign/encryption confusion attackCVE-2024-25126Mediumrack: Rack vulnerable to ReDoS in content type parsing (2nd degree polynomial)CVE-2024-26141Lowrack: Rack has possible DoS Vulnerability with Range HeaderCVE-2024-26146Lowrack: Rack Header Parsing leads to Possible Denial of Service VulnerabilityCVE-2024-27285Mediumyard: YARD's default template vulnerable to Cross-site Scripting in generated frames.htmlCVE-2024-26144Mediumactivestorage: Rails has possible Sensitive Session Information Leak in Active StorageCVE-2024-26143Mediumactionpack: Rails has possible XSS Vulnerability in Action ControllerCVE-2024-26142Lowactionpack: Rails has possible ReDoS vulnerability in Accept header parsing in Action DispatchCVE-2024-27456Mediumrack-cors: Rack CORS Middleware has Insecure File PermissionsCVE-2023-51447Mediumdecidim: Cross-site scripting (XSS) in the dynamic file uploadsCVE-2023-48220Mediumdecidim: Possibility to circumvent the invitation token expiry periodCVE-2023-47635Mediumdecidim-templates: Possible CSRF attack at questionnaire templates previewCVE-2023-47634Lowdecidim: Race condition in EndorsementsCVE-2024-25122Highsidekiq-unique-jobs: XSS sidekiq-unique-jobs UI server vulnerabilityGHSA-XC9X-JJ77-9P9JMediumnokogiri: Nokogiri update packaged libxml2 to v2.12.5 to resolve CVE-2024-25062CVE-2024-22411Mediumavo: Cross-site scripting (XSS) in Action messages on AvoCVE-2024-22191Highavo: avo vulnerable to stored cross-site scripting (XSS) in key_value fieldCVE-2024-21647Mediumpuma: Puma HTTP Request/Response Smuggling vulnerabilityCVE-2024-21636Mediumview_component: view_component Cross-site Scripting vulnerabilityCVE-2024-21632Highomniauth-microsoft_graph: Omniauth::MicrosoftGraph Account takeover (nOAuth)CVE-2023-51763Mediumactiveadmin: ActiveAdmin CSV Injection leading to sensitive information disclosureCVE-2023-50724Mediumresque: Resque vulnerable to Reflected Cross Site Scripting through pathnamesCVE-2023-50725Mediumresque: Resque vulnerable to reflected XSS in resque-web failed and queues lists

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo