RubyGems vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

GHSA-5W6V-399V-W3CCLownokogiri: Nokogiri updates packaged libxml2 to v2.13.8 to resolve CVE-2025-32414 and CVE-2025-32415 CVE-2024-39311Lowpublify_core: Publify Vulnerable To Cross-Site Scripting (XSS) Via Redirects Requiring User Interaction CVE-2025-30221Mediumpitchfork: Pitchfork HTTP Request/Response Splitting vulnerability GHSA-MRXW-MXHJ-P664Highnokogiri: Nokogiri updates packaged libxslt to v1.1.43 to resolve multiple CVEs CVE-2025-2304Criticalcamaleon_cms: Camaleon CMS Vulnerable to Privilege Escalation through a Mass Assignment CVE-2025-25292Criticalruby-saml: Ruby SAML allows a SAML authentication bypass due to namespace handling (parser differential)CVE-2025-25291Criticalruby-saml: Ruby SAML allows a SAML authentication bypass due to DOCTYPE handling (parser differential)CVE-2025-25293Highruby-saml: Ruby SAML allows remote Denial of Service (DoS) with compressed SAML responses GHSA-HW46-3HMR-X9XVCriticalomniauth-saml: omniauth-saml has dependency on ruby-saml version with Signature Wrapping Attack issue CVE-2025-27407Criticalgraphql: graphql allows remote code execution when loading a crafted GraphQL schema CVE-2025-27788Highjson: Out-of-bounds Read in Ruby JSON Parser CVE-2025-27610Highrack: Local File Inclusion in Rack::Static CVE-2025-27111Mediumrack: Escape Sequence Injection vulnerability in Rack lead to Possible Log Injection CVE-2025-27221Lowuri: URI allows for userinfo Leakage in URI#join, URI#merge, and URI#+CVE-2025-27220Mediumcgi: CGI has Regular Expression Denial of Service (ReDoS) potential in Util#escapeElement CVE-2025-27219Mediumcgi: CGI has Denial of Service (DoS) potential in Cookie.parse CVE-2025-27590Criticaloxidized-web: Oxidized Web RANCID migration page allows unauthenticated user to gain control over Linux user account CVE-2025-26803Mediumpassenger: Phusion Passenger denial of service GHSA-VVFQ-8HWR-QM4MLownokogiri: Nokogiri updates packaged libxml2 to 2.13.6 to resolve CVE-2025-24928 and CVE-2024-56171 CVE-2025-25184Mediumrack: Possible Log Injection in Rack::CommonLogger CVE-2025-25186Mediumnet-imap: Possible DoS by memory exhaustion in net-imap CVE-2024-56733Mediumpwpush: Password Pusher Allows Session Token Interception Leading to Potential Hijacking CVE-2024-54133Lowactionpack: Possible Content Security Policy bypass in Action Dispatch CVE-2024-53989Lowrails-html-sanitizer: rails-html-sanitizer has XSS vulnerability with certain configurations CVE-2024-53987Lowrails-html-sanitizer: rails-html-sanitizer has XSS vulnerability with certain configurations

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Browse by ecosystem

Stop the waste.Protect your environment with Kodem.

Stop the waste.
Protect your environment with Kodem.