RubyGems vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2019-5477Criticalnokogiri: Nokogiri Command Injection Vulnerability CVE-2018-20857Highsamlr: samlr XML nodes comment attack CVE-2019-14281Criticaldatagrid: datagrid contains code Injection backdoor CVE-2019-14282Criticalsimple_captcha2: Code backdoor in simple_captcha2 CVE-2019-1010191Criticalmarginalia: SQL Injection in marginalia CVE-2019-1010266Mediumlodash: Regular Expression Denial of Service (ReDoS) in lodash CVE-2019-13574Highmini_magick: OS Command Injection in MiniMagick CVE-2019-13146Mediumfield_test: field_test gem contains injection vulnerability CVE-2019-13589Criticalparanoid2: paranoid2 gem Code backdoor CVE-2019-1010306Criticalslanger: Slanger Arbitrary command execution CVE-2019-10744Criticallodash: Prototype Pollution in lodash CVE-2019-13354Criticalstrong_password: strong_password Ruby gem malicious version causing Remote Code Execution vulnerability CVE-2017-11430Highomniauth-saml: OmniAuth-SAML authentication bypass via incorrect XML canonicalization and DOM traversal CVE-2017-11428Highruby-saml: Ruby-SAML Improper Authentication vulnerability CVE-2019-1020001Highyard: Path Traversal vulnerability that affects yard CVE-2019-8325Highrubygems-update: RubyGems Escape sequence injection in errors CVE-2019-8320Highrubygems-update: RubyGems Delete directory using symlink when decompressing tar CVE-2019-8324Highrubygems-update: Code injection in RubyGems CVE-2019-8321Highrubygems-update: RubyGems Escape sequence injection vulnerability in verbose CVE-2019-8322Highrubygems-update: RubyGems Escape sequence injection vulnerability in gem owner CVE-2019-8323Highrubygems-update: RubyGems Escape sequence injection vulnerability in api response handling CVE-2019-11027Criticalruby-openid: ruby-openid SSRF via claimed_id request CVE-2019-12732Mediumchartkick: Cross-site Scripting in Chartkick CVE-2015-9284Highomniauth: OmniAuth Ruby gem Cross-site Request Forgery in request phase CVE-2019-11358Mediumjquery-rails: XSS in jQuery as used in Drupal, Backdrop CMS, and other products

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Browse by ecosystem

Stop the waste.Protect your environment with Kodem.

Stop the waste.
Protect your environment with Kodem.