RubyGems vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-54898Highoj: Oj: Use-After-Free in Oj::Parser SAJ Callback via Input MutationCVE-2026-54897Highoj: Oj: Use-After-Free in Oj::Doc Iterators via Reentrant CloseCVE-2026-54896Highoj: Oj: Heap Buffer Overflow in Oj.dump Exception Serialization via Large IndentCVE-2026-54592Highoj: Oj: Stack Buffer Overflow in Oj::Doc#each_child via Deeply Nested InputCVE-2026-54500Mediumoj: Oj: intern.c form_attr (uninitialized stack read)CVE-2026-54297Highfaraday: Faraday: Uncontrolled recursion in NestedParamsEncoder allows stack exhaustion DoS via deeply nested query parametersCVE-2026-54502Highoj: Oj: Stack Buffer Overflow in Oj.dump via Large IndentCVE-2026-54899Highoj: Oj: Use-After-Free in Oj::Parser Symbol Key Cache ToggleGHSA-MQQ5-J7W8-2HGHHighalchemy_cms: AlchemyCMS: Unauthenticated nested page API leaks restricted & unpublished contentGHSA-PHWJ-RPRQ-35PPLownokogiri: Nokogiri: Possible Use-After-Free when setting an attribute value via `Nokogiri::XML::Attr#value=` or `#content=`GHSA-WFPW-MMFH-QQ69Lownokogiri: Nokogiri: Possible Use-After-Free in XInclude ProcessingGHSA-P67V-3W7G-WJG7Lownokogiri: Nokogiri: Possible Use-After-Free when directly using `NokogirI::XML::XPathContext` beyond document lifetimeGHSA-WJV4-X9W8-WM3HLownokogiri: Nokogiri: Possible Use-After-Free when setting `Document#root=` to an invalid node typeGHSA-5PRR-V3J2-97MHMediumnokogiri: Nokogiri: Possible Out-of-Bounds Read in `Nokogiri::XML::NodeSet#[]`GHSA-9CV2-CFXC-V4V2Lownokogiri: Nokogiri: Null Pointer Dereference calling methods on uninitialized wrapper classesGHSA-8678-W3JW-XFC2Lownokogiri: Nokogiri: XML::Schema on JRuby allows network requests when NONET is set, bypassing CVE-2020-26247GHSA-5V8H-3H3Q-446PLownokogiri: Nokogiri: Possible Use-After-Free when `Nokogiri::XML::Document#encoding=` raises an exceptionCVE-2026-55518Criticalavo: Avo: Missing Authorization in Avo Association Attach Endpoint Allows Unauthorized Relationship Manipulation and Privilege EscalationCVE-2026-12515Mediumkatello: katello: missing repository authorization in content_uploads exposes cross-product content existenceCVE-2026-47242Mediumnet-imap: Net::IMAP: Command Injection via ID command argumentCVE-2026-47241Lownet-imap: Net::IMAP: Denial of Service via incomplete raw argument validationCVE-2026-47240Mediumnet-imap: Net::IMAP: Command Injection via non-synchronizing literal in "raw" argumentCVE-2026-47737Highpuma: Puma PROXY Protocol v1 Accepts Repeated Protocol Headers on Persistent ConnectionsCVE-2026-47736Highpuma: Puma PROXY Protocol v1 Parser Allows Remote Memory Exhaustion GHSA-XF4V-W5X5-PV79Mediumspree: Spree: CSV Formula Injection in Customer Export

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo