RubyGems vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2023-36465Highdecidim: Decidim has broken access control in templates CVE-2023-26141Mediumsidekiq: sidekiq Denial of Service vulnerability CVE-2023-4785Highgrpc: Denial of Service Vulnerability in gRPC TCP Server (Posix-compatible platforms)CVE-2023-38037Mediumactivesupport: Active Support Possibly Discloses Locally Encrypted Files CVE-2023-40175Criticalpuma: Puma HTTP Request/Response Smuggling vulnerability CVE-2023-33953Highgrpcio: Excessive Iteration in gRPC GHSA-7VH7-FW88-WJ87Mediumcommonmarker: Several quadratic complexity bugs may lead to denial of service in Commonmarker CVE-2023-38697Mediumprotocol-http1: protocol-http1 HTTP Request/Response Smuggling vulnerability CVE-2023-38337Highrswag: rswag vulnerable to arbitrary JSON and YAML file read via directory traversal CVE-2023-32693Mediumdecidim-core: Decidim Cross-site Scripting vulnerability in the external link redirections CVE-2023-34089Highdecidim: Decidim Cross-site Scripting vulnerability in the processes filter CVE-2023-34090Highdecidim: Decidim vulnerable to sensitive data disclosure CVE-2023-32732Mediumio.grpc:grpc-protobuf: gRPC connection termination issue CVE-2023-1428Highio.grpc:grpc-protobuf: gRPC Reachable Assertion issue CVE-2023-36823Highsanitize: Sanitize vulnerable to Cross-site Scripting via insufficient neutralization of `style` element content CVE-2023-32731Highio.grpc:grpc-protobuf: Connection confusion in gRPC CVE-2023-36617Mediumuri: URI gem has ReDoS vulnerability CVE-2023-28362Mediumactionpack: Actionpack has possible cross-site scripting vulnerability via User Supplied Values to redirect_to CVE-2023-3445Lowspina: Spina Cross-site Scripting vulnerability CVE-2023-34246Mediumdoorkeeper: Doorkeeper Improper Authentication vulnerability CVE-2023-23913Mediumactionview: rails-ujs vulnerable to DOM Based Cross-site Scripting contenteditable HTML Elements CVE-2023-27531Mediumkredis: Kredis JSON Possible Deserialization of Untrusted Data Vulnerability CVE-2023-31606HighRedCloth: RedCloth Regular Expression Denial of Service issue CVE-2023-34102Highavo: avo possible unsafe reflection / partial DoS vulnerability CVE-2023-34103Highavo: avo vulnerable to Stored XSS (Cross Site Scripting) in html content based fields

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo