RubyGems vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
GHSA-2QC6-MCVW-92CWMediumnokogiri: Update bundled libxml2 to v2.10.3 to resolve multiple CVEsCVE-2022-39281Mediumfat_free_crm: Fat Free CRM vulnerable to Remote Denial of Service via Tasks endpointCVE-2022-3171Mediumcom.google.protobuf:protobuf-java: protobuf-java has a potential Denial of Service issueGHSA-MGVV-5MXP-XQ67Lowsqlite3: SQLite3 addresses vulnerability in packaged version of libsqliteGHSA-4QW4-JPP4-8GVPMediumcommonmarker: Unbounded resource exhaustion in cmark-gfm autolink extension may lead to denial of serviceCVE-2022-39224Higharr-pm: arr-pm vulnerable to arbitrary shell execution when extracting or listing files contained in a malicious rpm.GHSA-QCQV-38JG-2R43Highpageflow: Pageflow vulnerable to insecure direct object reference in membership update endpointGHSA-WRRW-CRP8-979QHighpageflow: Pageflow vulnerable to sensitive user data extraction via Ransack query injectionCVE-2022-25765Criticalpdfkit: PDFKit vulnerable to Command InjectionCVE-2020-36599Criticalomniauth: OmniAuth's `lib/omniauth/failure_endpoint.rb` does not escape `message_key` valueCVE-2022-35956Mediumupdate_by_case: update_by_case before 0.1.3 can be vulnerable to sql injectionCVE-2016-3098Mediumadministrate: administrate vulnerable to Cross-Site Request ForgeryCVE-2022-31163Hightzinfo: TZInfo relative path traversal vulnerability allows loading of arbitrary filesCVE-2022-31160Mediumjquery-ui: jQuery UI vulnerable to XSS when refreshing a checkboxradio with an HTML-like initial text labelCVE-2020-35305Mediumgollum: Gollum Cross-site Scripting vulnerability via filename parameter to New Page dialogCVE-2022-32224Criticalactiverecord: Active Record RCE bug with Serialized ColumnsCVE-2022-31115Highopensearch-ruby: opensearch-ruby 2.x before 2.0.2 vulnerable to unsafe YAML deserializationCVE-2013-4170Mediumember-source: Ember.js Potential XSS Exploit When Binding `tagName` to User-Supplied DataCVE-2014-0156Criticalawesome_spawn: OS Command Injection in awesome spawnCVE-2021-3779Mediumruby-mysql: Externally Controlled Reference to a Resource in Another Sphere in ruby-mysqlCVE-2022-32209Mediumrails-html-sanitizer: Rails::Html::Sanitizer vulnerable to Cross-site ScriptingCVE-2022-33127Criticaldiffy: Improper handling of double quotes in file name in Diffy in Windows environmentCVE-2022-31072Lowoctokit: Octokit gem published with world-writable filesCVE-2022-31071Lowoctopoller: Octopoller gem published with world-writable filesCVE-2022-31033Mediummechanize: Mechanize before v2.8.5 vulnerable to authorization header leak on port redirect

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo