RubyGems vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2023-50727Mediumresque: Resque vulnerable to reflected XSS in Queue EndpointCVE-2022-44303Mediumresque-scheduler: Resque Scheduler Reflected XSS In Delayed Jobs ViewCVE-2023-50448Highactiveadmin: Potential CSV export data leakCVE-2023-26154Mediumpubnub: pubnub Insufficient Entropy vulnerabilityCVE-2023-49090Mediumcarrierwave: CarrierWave Content-Type allowlist bypass vulnerability, possibly leading to XSSCVE-2023-5349Mediumrmagick: memory leak flaw was found in ruby-magickCVE-2024-0241Highencoded_id-rails: encoded_id-rails potential DOS vulnerability due to URIs with extremely long encoded IDsCVE-2023-46035Mediumsvg_optimizer: svg_optimizer rubygem external XML entity (XXE) vulnerabilityCVE-2023-5214Criticalbolt: Puppet Bolt privilege escalation vulnerabilityCVE-2023-26153Criticalgeokit-rails: geokit-rails Command Injection vulnerabilityCVE-2023-36465Highdecidim: Decidim has broken access control in templatesCVE-2023-26141Mediumsidekiq: sidekiq Denial of Service vulnerabilityCVE-2023-4785Highgrpc: Denial of Service Vulnerability in gRPC TCP Server (Posix-compatible platforms)CVE-2023-38037Mediumactivesupport: Active Support Possibly Discloses Locally Encrypted FilesCVE-2023-40175Criticalpuma: Puma HTTP Request/Response Smuggling vulnerabilityCVE-2023-33953Highgrpcio: Excessive Iteration in gRPCGHSA-7VH7-FW88-WJ87Mediumcommonmarker: Several quadratic complexity bugs may lead to denial of service in CommonmarkerCVE-2023-38697Mediumprotocol-http1: protocol-http1 HTTP Request/Response Smuggling vulnerabilityCVE-2023-38337Highrswag: rswag vulnerable to arbitrary JSON and YAML file read via directory traversalCVE-2023-32693Mediumdecidim-core: Decidim Cross-site Scripting vulnerability in the external link redirectionsCVE-2023-34089Highdecidim: Decidim Cross-site Scripting vulnerability in the processes filterCVE-2023-34090Highdecidim: Decidim vulnerable to sensitive data disclosureCVE-2023-32732Mediumio.grpc:grpc-protobuf: gRPC connection termination issueCVE-2023-1428Highio.grpc:grpc-protobuf: gRPC Reachable Assertion issueCVE-2023-36823Highsanitize: Sanitize vulnerable to Cross-site Scripting via insufficient neutralization of `style` element content

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo