RubyGems vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-0980Highrubyipmi: rubyipmi is vulnerable to OS Command Injection through malicious usernamesCVE-2026-79772Mediumnokogiri: Nokogiri does not check the return value from xmlC14NExecuteCVE-2026-25500Mediumrack: Stored XSS in Rack::Directory via javascript: filenames rendered into anchor hrefCVE-2026-22860Highrack: Rack has a Directory Traversal via Rack:DirectoryGHSA-Q66H-M87M-J2Q6Lowbitcoinrb: Bitcoinrb Vulnerable to Command injection via RPC CVE-2026-25765Mediumfaraday: Faraday affected by SSRF via protocol-relative URL host override in build_exclusive_urlGHSA-W67G-2H6V-VJGQHighphlex: Phlex XSS protection bypass via attribute splatting, dynamic tags, and href valuesCVE-2026-25758Highspree_api: Unauthenticated Spree Commerce users can access all guest addressesCVE-2026-25757Highspree_storefront: Unauthenticated Spree Commerce users can view completed guest orders by Order IDCVE-2025-65017Highdecidim-core: Decidim's private data exports can lead to data leaksCVE-2026-1530Highfog-kubevirt: fog-kubevirt allows remote attacker to perform MITM attack due to disabled certificate validationCVE-2026-1531Highforeman_kubevirt: foreman_kubevirt disables SSL verification if a Certificate Authority (CA) certificate is not explicitly setCVE-2020-36939Highcassandra-web: Cassandra Web - Remote File ReadCVE-2026-23885Mediumalchemy_cms: AlchemyCMS: Authenticated Remote Code Execution (RCE) via eval injection in ResourcesHelperGHSA-MPWP-4H2M-765CMediumactivejob: Active Job - Object injection security vulnerabilityGHSA-5QW5-WF2Q-F538Highactiverecord-jdbc-adapter: ActiveRecord-JDBC-Adapter (AR-JDBC) lib/arjdbc/jdbc/adapter.rb sql.gsub() Function SQL InjectionCVE-2025-68271Criticalopenc3: openc3-api Vulnerable to Unauthenticated Remote Code ExecutionCVE-2026-22589Highspree_core: Spree API has Unauthenticated IDOR - Guest AddressCVE-2026-22588Mediumspree_api: Spree API has Authenticated Insecure Direct Object Reference (IDOR) via Order ModificationGHSA-96QW-H329-V5RGHighshakapacker: Shakapacker has environment variable leak via EnvironmentPlugin that exposes secrets to client-side bundlesGHSA-G9JG-W8VM-G96VMediumtrix: Trix has a stored XSS vulnerability through its attachment attributeCVE-2025-61594Lowuri: URI Credential Leakage Bypass over CVE-2025-27221CVE-2025-68696Highhttparty: httparty Has Potential SSRF Vulnerability That Leads to API Key LeakageCVE-2025-14762Mediumaws-sdk-s3: AWS SDK for Ruby's S3 Encryption Client has a Key Commitment IssueCVE-2025-68113Mediumaltcha-lib: ALTCHA Proof-of-Work Vulnerable to Challenge Splicing and Replay

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo