RubyGems vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-44476Mediumdoorkeeper-openid_connect: Doorkeeper Openid Connect: Dynamic Client Registration feature creates public clients with client_secretCVE-2026-44587Mediumcarrierwave: CarrierWave has a denylisted_content_type bypass via Unescaped Regex MetacharactersCVE-2026-45363Highjwt: ruby-jwt: Empty-key HMAC bypass; cross-language sibling of CVE-2026-44351CVE-2026-33637Lowfaraday: Faraday has a possible incomplete fix for GHSA-33mh-2634-fwr2: protocol-relative URI objects still bypass host scopingCVE-2026-44837Mediumview_component: view_component: System Test Entry Point Path Check Allows Sibling Directory EscapeCVE-2026-44836Mediumview_component: view_component: Preview Route Can Dispatch Inherited Helper MethodsCVE-2026-40295Mediumdevise: Devise has an Open Redirect via Unvalidated `request.referrer` in Timeoutable Session Timeout HandlerCVE-2025-67202Mediumsidekiq-cron: Sidekiq-cron is vulnerable to a cross-site scripting (xss) vulnerability via crafted URLCVE-2026-44511Highkatalyst-koi: katalyst-koi: Session cookies can be replayed after user logoutCVE-2026-44312Mediumcss_parser: CSS Parser: Improper Certificate Validation allows MITM injection of remote CSS contentCVE-2026-79771Mediumnokogiri: Nokogiri XSLT transform has a memory leakCVE-2026-79770Highnokogiri: Nokogiri CSS selector tokenizer has regular expression backtrackingGHSA-3H96-34P3-XM76Mediumgraphql: GraphQL-Ruby's Ruby lexer does not count comment tokens for the purposes of max_query_string_tokensCVE-2026-42257Mediumnet-imap: net-imap vulnerable to command Injection via "raw" arguments to multiple commandsCVE-2026-42258Mediumnet-imap: net-imap vulnerable to command Injection via unvalidated Symbol inputsCVE-2026-42256Mediumnet-imap: net-imap vulnerable to denial of service via high iteration count for `SCRAM-*` authenticationCVE-2026-42245Lownet-imap: net-imap has quadratic complexity when reading response literalsCVE-2026-42246Highnet-imap: net-imap vulnerable to STARTTLS stripping via invalid response timingCVE-2026-42205Highavo: Avo: Broken Access Control Through Unauthorized Execution of Arbitrary Action Classes Across ResourcesCVE-2026-41316Higherb: ERB has an @_init deserialization guard bypass via def_module / def_method / def_classGHSA-2WVH-87G2-89HRCriticalopenc3: OpenC3 COSMOS: Permissions Bypass Provides User Access to Unassigned Administrative Actions via Script Runner ToolCVE-2026-42087Criticalopenc3: OpenC3 COSMOS has SQL Injection in QuestDB Time-Series DatabaseCVE-2026-42086Mediumopenc3: OpenC3 COSMOS is Vulnerable to Self-XSS Through the Command SenderCVE-2026-42085Mediumopenc3: OpenC3 COSMOS allows arbitrary writes to plugins directory via path-traversed config filenamesCVE-2026-42084Highopenc3: OpenC3 COSMOS: Hijacked session token can be used to reset password for persistence

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo