RubyGems vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2018-16476Highactivejob: Improper Access Control in activejobCVE-2018-16477Mediumactivestorage: Exposure of Sensitive Information to an Unauthorized Actor in activestorageCVE-2018-16471Mediumrack: Rack vulnerable to Cross-site ScriptingCVE-2018-16470Highrack: Rack vulnerable to Denial of ServiceCVE-2017-1000043Mediummapbox.js: Content Injection via TileJSON Name in mapbox.jsCVE-2017-1000042Mediummapbox.js: Content Injection via TileJSON attribute in mapbox.jsCVE-2018-16468Mediumloofah: Loofah Cross-site Scripting vulnerabilityCVE-2018-18476Criticalmysql-binuuid-rails: mysql-bunuuid-rails vulnerable to SQL injectionCVE-2014-1832Lowpassenger: Insecure use of temporary files in Phusion passengerCVE-2014-1831Lowpassenger: Insecure use of temporary files in passengerCVE-2015-7519Lowpassenger: Phusion Passenger allows remote attackers to spoof headersCVE-2018-14643Criticalsmart_proxy_dynflow: smart_proxy_dynflow gem authentication bypass in Foreman remote execution featureCVE-2018-17567Highjekyll: Jekyll allows attackers to access arbitrary files by specifying a symlinkCVE-2015-7499Mediumnokogiri: Heap-based buffer overflow in nokogiriCVE-2014-8144Mediumdoorkeeper: Doorkeeper vulnerable to Cross-site Request ForgeryCVE-2015-8806Highnokogiri: Denial of service or RCE from libxml2 and libxsltCVE-2018-14042Mediumbootstrap: Bootstrap Cross-site Scripting vulnerabilityCVE-2018-14041Mediumbootstrap: Bootstrap Cross-site Scripting vulnerabilityCVE-2018-1000544Criticalrubyzip: Rubyzip gem contains a Directory Traversal vulnerability in zip file componentCVE-2018-1000201Highffi: Ruby-ffi has a DLL loading issue CVE-2015-1866Mediumember-source: ember-source vulnerable to Cross-site ScriptingCVE-2015-4619Highspina: Spina gem vulnerable to Cross-site request forgery (CSRF) vulnerabilityCVE-2015-7225Mediumdevise-two-factor: Tinfoil Devise-two-factor does not "burn" a successfully validated one-time password (OTP)CVE-2015-7314Mediumgollum: Gollum Exposure of Sensitive InformationCVE-2014-0046Lowember-source: ember-source Cross-site Scripting vulnerability

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo