RubyGems vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2018-3769Mediumgrape: grape subject to Cross-site ScriptingCVE-2018-3779Criticalactive-support: active-support impersonates 'activesupport' gemCVE-2015-1819Mediumnokogiri: Nokogiri vulnerable to libxml XML Entity ExpansionCVE-2016-10522Highrails_admin: Cross-site request forgery in rails_adminCVE-2018-3777Criticalrestforce: restforce vulnerable to Improper Input ValidationCVE-2017-5029Highnokogiri: Nokogiri implementation of libxslt lacks integer overflow checksCVE-2017-11173Highrack-cors: Missing Regex anchor in Rack-Cors allows malicious third party site to perform CORS requestCVE-2018-1000539Mediumjson-jwt: Json-jwt did not verify the cryptographic signature for dataCVE-2018-3759Highprivate_address_check: private_address_check contains race conditionCVE-2018-7261Mediumradiant: radiant vulnerable to Cross-site ScriptingCVE-2018-3721Mediumlodash: Prototype Pollution in lodashCVE-2014-5003Mediumciborg: Ciborg gem for Ruby allows local users to write files and gain privileges via SymlinkCVE-2014-5001Highkcapifony: Kcapifony gem for Ruby places database user passwords on the command lineCVE-2018-3760Highsprockets: Sprockets path traversal leads to information leakCVE-2018-11627Mediumsinatra: Sinatra Cross-site Scripting vulnerabilityCVE-2018-3741Mediumrails-html-sanitizer: rails-html-sanitizer Cross-site Scripting vulnerabilityCVE-2017-18258Mediumnokogiri: Uncontrolled resource consumption in nokogiriCVE-2018-8048Mediumloofah: Cross-site Scripting in loofahCVE-2018-3740Highsanitize: Sanitize vulnerable to Improper Input Validation and Cross-site ScriptingCVE-2014-4992Highcap-strap: Cap-Strap gem for Ruby places credentials on the useradd command lineCVE-2018-1000088Mediumdoorkeeper: Doorkeeper is vulnerable to stored XSS and code executionCVE-2015-1828Mediumhttp: http vulnerable to Exposure of Sensitive Information to an Unauthorized ActorCVE-2018-1000119Mediumrack-protection: rack-protection gem timing attack vulnerability when validating CSRF tokenCVE-2015-4412Criticalbson: bson is vulnerable to denial of service due to incorrect regex validationCVE-2017-12098Mediumrails_admin: rails_admin ruby gem XSS

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo