RubyGems vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2025-66568Criticalruby-saml: Ruby-saml allows a Libxml2 Canonicalization error to bypass Digest/Signature validation CVE-2025-66567Criticalruby-saml: Ruby-saml has a SAML authentication bypass due to namespace handling (parser differential)CVE-2025-12790Highmqtt: MQTT does not validate hostnames CVE-2025-64501Highprosemirror_to_html: Cross-Site Scripting (XSS) vulnerability through unescaped HTML attribute values CVE-2025-61921Lowsinatra: Sinatra is vulnerable to ReDoS through ETag header value generation CVE-2025-61919Highrack: Rack is vulnerable to a memory-exhaustion DoS through unbounded URL-encoded body parsing CVE-2025-61780Mediumrack: Rack has a Possible Information Disclosure Vulnerability CVE-2025-61772Highrack: Rack's multipart parser buffers unbounded per-part headers, enabling DoS (memory exhaustion)CVE-2025-61771Highrack: Rack: Multipart parser buffers large non‑file fields entirely in memory, enabling DoS (memory exhaustion)CVE-2025-61770Highrack: Rack's unbounded multipart preamble buffering enables DoS (memory exhaustion)CVE-2025-59830Highrack: Rack has an unsafe default in Rack::QueryParser allows params_limit bypass via semicolon-separated parameters CVE-2025-58767Lowrexml: REXML has DoS condition when parsing malformed XML file CVE-2025-58067Mediumgoogle_sign_in: Google Sign-In for Rails allowed redirect to protocol-relative URI CVE-2025-57821Mediumgoogle_sign_in: Google Sign-In for Rails allowed redirects to malformed URLs CVE-2011-10026Criticalspree: Spree Commerce is vulnerable to RCE through Search API CVE-2025-24293Criticalactivestorage: Active Storage allowed transformation methods that were potentially unsafe CVE-2025-55193Mediumactiverecord: Active Record logging vulnerable to ANSI escape injection CVE-2011-10019Criticalspree: Spree has Remote Command Execution vulnerability in search functionality CVE-2025-54887Criticaljwe: JWE is missing AES-GCM authentication tag validation in encrypted JWE CVE-2025-54572Mediumruby-saml: Ruby SAML DOS vulnerability with large SAML response GHSA-353F-X4GH-CQQ8Criticalnokogiri: Nokogiri patches vendored libxml2 to resolve multiple CVEs GHSA-29G5-M8V7-V564Mediummeasured: Measured is vulnerable to Path Traversal attacks during class initialization CVE-2025-24294Mediumresolv: resolv vulnerable to DoS via insufficient DNS domain name length validation CVE-2025-53623Criticaljob-iteration: Job Iteration API is vulnerable to OS Command Injection attack through its CsvEnumerator class CVE-2025-34075Mediumvagrant: HashiCorp Vagrant has code injection vulnerability through default synced folders

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Browse by ecosystem

Stop the waste.Protect your environment with Kodem.

Stop the waste.
Protect your environment with Kodem.