RubyGems vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-41493Mediumyard: yard: Possible arbitrary path traversal and file access via yard serverCVE-2026-27820Mediumzlib: Buffer Overflow in Zlib::GzipReader ungetc via large input leads to memory corruptionCVE-2026-41146Highiodine: Uncontrolled resource consumption and loop with unreachable exit condition in facil.io and downstream iodine ruby gemCVE-2026-40870Highdecidim-comments: Decidim's comments API allows access to all commentable resourcesCVE-2026-40869Highdecidim-core: Decidim amendments can be accepted or rejected by anyoneGHSA-9PM8-VWC5-W2HMLowfat_free_crm: Fat Free CRM has BOLA in DELETE /emails/:id - Any authenticated user can hit this endpoint and delete emails by IDCVE-2026-23891Criticaldecidim-core: Decidim has a cross-site scripting (XSS) in user nameCVE-2026-40069Highbsv-sdk: bsv-sdk ARC broadcaster treats INVALID/MALFORMED/ORPHAN responses as successful broadcastsCVE-2026-40070Highbsv-sdk: bsv-sdk and bsv-wallet persist unverified certifier signatures in acquire_certificate (direct and issuance paths)CVE-2026-39324Criticalrack-session: Rack::Session::Cookie secrets: decrypt failure fallback enables secretless session forgery and Marshal deserializationCVE-2026-35611Highaddressable: Addressable has a Regular Expression Denial of Service in Addressable templatesCVE-2026-35201Mediumrdiscount: rdiscount has an Out-of-bounds ReadCVE-2026-34835Mediumrack: Rack::Request accepts invalid Host characters, enabling host allowlist bypassCVE-2026-34831Mediumrack: Rack has Content-Length mismatch in Rack::Files error responsesCVE-2026-34830Mediumrack: Rack::Sendfile header-based X-Accel-Mapping regex injection enables unauthorized X-Accel-RedirectCVE-2026-34829Highrack: Rack's multipart parsing without Content-Length header allows unbounded chunked file uploadsCVE-2026-34763Mediumrack: Rack has a root directory disclosure via unescaped regex interpolation in Rack::DirectoryCVE-2026-34230Highrack: Rack has quadratic complexity in Rack::Utils.select_best_encoding via wildcard Accept-Encoding headerCVE-2026-32762Mediumrack: Rack: Forwarded Header semicolon injection enables Host and Scheme spoofingCVE-2026-26962Mediumrack: Rack's improper unfolding of folded multipart headers preserves CRLF in parsed parameter valuesCVE-2026-26961Mediumrack: Rack's greedy multipart boundary parsing can cause parser differentials and WAF bypass.CVE-2026-34827Highrack: Rack's multipart header parsing allows Denial of Service via escape-heavy quoted parametersCVE-2026-34826Mediumrack: Rack's multipart byte range processing allows denial of service via excessive overlapping rangesCVE-2026-34786Mediumrack: Rack:: Static header_rules bypass via URL-encoded pathsCVE-2026-34785Highrack: Rack::Static prefix matching can expose unintended files under the static root

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo