RubyGems vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2021-20259Highforeman_fog_proxmox: Exposure of Sensitive Information to an Unauthorized Actor in foreman_fog_proxmox CVE-2021-33564Criticaldragonfly: Dragonfly contains remote code execution vulnerability CVE-2020-7671Highgoliath: HTTP Request Smuggling in goliath CVE-2020-7659Highreel: HTTP Request Smuggling in reel CVE-2020-13482Highem-http-request: Improper Certificate Validation in EM-HTTP-Request CVE-2020-36327Highbundler: Dependency Confusion in Bundler CVE-2020-13163Highem-imap: Improper certificate validation in em-imap CVE-2021-29509Highpuma: Puma's Keepalive Connections Causing Denial Of Service GHSA-7RRM-V45F-JP64Mediumnokogiri: Nokogiri updates packaged dependency on libxml2 from 2.9.10 to 2.9.12 CVE-2019-3881Highbundler: Insecure path handling in Bundler CVE-2021-23337Highlodash: Command Injection in lodash CVE-2021-28966Hightmpdir: Tempfile on Windows path traversal vulnerability CVE-2021-22904Highactionpack: Possible DoS Vulnerability in Action Controller Token Authentication CVE-2021-22885Highactionpack: Action Pack contains Information Disclosure / Unintended Method Execution vulnerability CVE-2021-22903Mediumactionpack: Possible Open Redirect Vulnerability in Action Pack CVE-2021-22902Highactionpack: Denial of Service in Action Dispatch CVE-2021-28965Highrexml: REXML round-trip instability CVE-2020-25739Mediumgon: Gon gem lack of escaping certain input when outputting as JSON CVE-2021-31671Highpgsync: Pgsync Contains Cleartext Transmission of Sensitive Information CVE-2016-11086Highoauth: Improper Certificate Validation in oauth ruby gem CVE-2021-29435Hightrestle-auth: Cross-Site Request Forgery (CSRF) in trestle-auth CVE-2020-24393Mediumtweetstream: Improper Certificate Validation in TweetStream CVE-2020-7942Mediumpuppet: Improper Certificate Validation in Puppet CVE-2020-8264Mediumactionpack: Cross-site scripting in actionpack CVE-2021-28834Highkramdown: Remote code execution in Kramdown

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo