RubyGems package vulnerabilities
The newest vulnerabilities affecting RubyGems packages, up to 200. Subscribe by RSS.
- CVE-2026-116695Crass: Incorrect tokenization of bad URLs enables CSS sanitizer bypassrgrove crass · crass
- CVE-2026-107715Mechanize sends credential headers to another host after an HTTP redirectsparklemotion mechanize · mechanize
- CVE-2026-107399Mechanize sends credential headers to another origin after a meta refreshsparklemotion mechanize · mechanize
- CVE-2026-55107Kobako Vulnerable to Sandbox Escape: guest eval reaches host RCE via method_missing → public_send (any bound Service)elct9620 kobako · kobako
- CVE-2026-77602OpenC3 COSMOS: Authenticated remote code execution via the user-writable config overlay (table definitions, cmd/tlm definitions, and script suites)OpenC3 cosmos · openc3
- CVE-2026-77601OpenC3 COSMOS: Authenticated OS command injection via the `pypi_url` settingOpenC3 cosmos · openc3
- CVE-2026-61570MPXJ: XXE Vulnerability in MerlinReaderjoniles mpxj · net.sf.mpxj:mpxj +5
- CVE-2026-65829MPXJ: Potential Path Traversal Vulnerability in Primavera P3 PRX and SureTrak STX readersjoniles mpxj · MPXJ.Net +5
- CVE-2026-94462Spree: Broken Access Control in `PATCH /api/v3/store/carts/:id/associate` (IDOR)spree · spree_api
- CVE-2026-44163fluent-plugin-opentelemetry: Denial of Service (DoS) via Large Payloads and Decompression Bombs in `in_opentelemetry`fluent-plugins-nursery fluent-plugin-opentelemetry · fluent…
- CVE-2026-44282Election question titles allow stored script executiondecidim · decidim-elections
- CVE-2026-44162fluent-plugin-s3: Denial of Service (DoS) via Decompression Bomb in `in_s3`fluent-plugin-s3
- CVE-2026-70658pay-rails/pay: non-constant-time HMAC comparison in Paddle Billing webhook signature verifierpay-rails pay · pay
- CVE-2026-50276dd-trace-rb: Improper parsing of W3C baggage headers may lead to DoSDataDog dd-trace-rb · datadog
- CVE-2026-57579Alchemy: Unauthenticated nested page API leaks restricted & unpublished contentAlchemyCMS alchemy_cms · alchemy_cms
- CVE-2023-46035The svg_optimizer gem before 0.3.0 for Ruby performs entity expansion on untrusted documents.fnando svg_optimizer · svg_optimizer
- CVE-2026-53769Avo: Direct attachment upload endpoint lacks upload authorization and bypasses field-level upload policyavo-hq avo · avo
- CVE-2026-85396rubyzip before 3.4.0 Path Traversal in Zip::Entry#extract via Sibling-Directory Prefixrubyzip
- CVE-2026-63435Mail: Email address spoofing via malformed RFC 2047 encoded-wordsmikel mail · mail
- CVE-2026-44476Doorkeeper OpenID Connect: Dynamic Client Registration feature creates public clients with client_secretdoorkeeper-gem doorkeeper-openid_connect · doorkeeper-openi…
- CVE-2026-79772Nokogiri before 1.19.1 Unchecked Return Value canonicalizesparklemotion nokogiri · nokogiri
- CVE-2026-79771Nokogiri before 1.19.3 Memory Leak via XSLT Transformsparklemotion nokogiri · nokogiri
- CVE-2026-79770Nokogiri before 1.19.3 ReDoS via CSS selector tokenizersparklemotion nokogiri · nokogiri
- CVE-2026-73426Trix: Stored XSS vulnerability through serialized attributesbasecamp trix · action_text-trix +1
- CVE-2026-61666websocket-driver: Denial of service via malformed Host headerfaye websocket-driver-ruby · websocket-driver
- CVE-2026-73428Trix: Stored XSS via HTMLParser attribute injection on pastebasecamp trix · trix +1
- CVE-2026-73648rails-html-sanitizer: Possible XSS vulnerability with certain configurationsrails-html-sanitizer
- CVE-2026-73492Loofah `allowed_uri?` does not detect `javascript:` URIs split by numeric character references without semicolonsflavorjones loofah · loofah
- CVE-2026-73491Loofah `allowed_uri?` does not detect `javascript:` URIs split by named whitespace character referencesflavorjones loofah · loofah
- CVE-2026-73490Loofah: SVG `href` attribute bypasses local-reference restrictionflavorjones loofah · loofah
- CVE-2026-73427Trix: XSS via JSON deserialization bypass in drag-and-drop (Level0InputController)basecamp trix · trix +1
- CVE-2026-71847Ruby JSON: JSON::ResumableParser#partial_value dereferences a freed input buffer and crashes on truncated duplicate-key streamsruby json · json
- CVE-2026-45378Decidim: Verification documents can be downloaded through reusable linksdecidim · decidim-verifications
- CVE-2026-45573Decidim: Push subscriptions can be abused for server-side requestsdecidim · decidim-core
- CVE-2026-45572Decidim: HTML content blocks allow stored script executiondecidim · decidim-core
- CVE-2026-45415Decidim: CSV census record endpoints improper authorizationdecidim · decidim-verifications
- CVE-2026-45414Decidim: JWT-backed authentication can be replayed across organizationsdecidim
- CVE-2026-45377Decidim: Private exports can be downloaded through reusable linksdecidim · decidim-core
- CVE-2026-45376Decidim: Admin user search allows SQL injection through similarity-based sortingdecidim · decidim-admin
- CVE-2026-45330Decidim: Verification admins can access supplied IDs from other organisationsdecidim · decidim-verifications
- CVE-2026-45086Decidim: Forms admin question editor lacks authorizationdecidim · decidim-demographics
- CVE-2026-53510Savon::Model evaluates WSDL operation names as Ruby sourcesavonrb savon · savon
- CVE-2026-66066Action Pack: Possible arbitrary file read and remote code execution in Active Storage variant processingrails · activestorage
- CVE-2026-54522MessagePack::Buffer#clear Use-After-Free that Enables Cross-Buffer Disclosuremsgpack-ruby · msgpack
- CVE-2026-67432MCP Ruby SDK: Unbounded JSON-RPC request body causes uncontrolled memory allocation in StreamableHTTPTransportmodelcontextprotocol ruby-sdk · mcp
- CVE-2026-67431MCP Ruby SDK: Ruby SSE Session Poisoningmodelcontextprotocol ruby-sdk · mcp
- CVE-2026-63119MCP Ruby SDK: Unbounded line buffer in stdio transports leads to memory exhaustion (DoS)modelcontextprotocol ruby-sdk · mcp
- CVE-2026-67430MCP Ruby SDK: Unbounded session retention in StreamableHTTPTransport allows memory exhaustion via initialize floodmodelcontextprotocol ruby-sdk · mcp
- CVE-2026-63118MCP Ruby SDK: Streamable HTTP transport lacks DNS-rebinding (Host/Origin) protectionmodelcontextprotocol ruby-sdk · mcp
- CVE-2026-54659Pagy I18n locale option is not validated before being used in a file pathddnexus pagy · pagy
- CVE-2026-54603OAuth2::Client#request: Protocol-relative redirect Location overrides authority, leaking bearer Authorization to attacker hostruby-oauth oauth2 · oauth2
- CVE-2026-54605OAuth: Cross-origin token-request redirects can expose signed request metadataruby-oauth oauth · oauth
- CVE-2026-54620sqlite3-ruby has Use-After-Free in SQLite Aggregate Function Callbackssparklemotion sqlite3-ruby · sqlite3-ruby +1
- CVE-2026-54619sqlite3-ruby has Use-After-Free When Redefining SQLite Functions with Different Aritysparklemotion sqlite3-ruby · sqlite3-ruby +1
- CVE-2026-55518Avo: Missing Authorization in Avo Association Attach Endpoint Allows Unauthorized Relationship Manipulation and Privilege Escalationavo-hq avo · avo
- CVE-2026-54498view_component: around_render HTML-Safety BypassViewComponent view_component · view_component
- CVE-2026-54497view_component: Reused Component Instances Retain Stale Render ContextViewComponent view_component · view_component
- CVE-2026-53727css_parser: SSRF and Local File Disclosure in `CssParser::Parser#read_remote_file`premailer css_parser · css_parser
- CVE-2026-54163secure_headers: CSP directive injection via sandbox, plugin_types, and report_to when given untrusted inputgithub secure_headers · secure_headers
- CVE-2026-54171Excon: redact additional sensitive/risky headers when following redirectsexcon
- CVE-2026-54465websocket-driver: Memory exhaustion in HTTP header parserfaye websocket-driver-ruby · websocket-driver
- CVE-2026-54463websocket-driver: Memory exhaustion via abuse of protocol length headersfaye websocket-driver-ruby · websocket-driver
- CVE-2026-54464websocket-driver: Resource limit bypass via message compressionfaye websocket-driver-ruby · websocket-driver
- CVE-2026-45363`jwt` (Ruby gem) - empty-key HMAC bypassruby-jwt · jwt
- CVE-2026-47736Puma PROXY Protocol v1 Parser Allows Remote Memory Exhaustionpuma
- CVE-2026-47737Puma PROXY Protocol v1 Accepts Repeated Protocol Headers on Persistent Connectionspuma
- CVE-2026-44161Fluentd: Server-Side Request Forgery (SSRF) via Placeholder Expansion in `out_http`fluentd
- CVE-2026-44160Fluentd: Denial of Service (DoS) via Gzip Decompression Bomb in `in_http` and `in_forward`fluentd
- CVE-2026-44025Fluentd: Exposure of Sensitive Information via Monitor Agent APIfluentd
- CVE-2026-44024Fluentd: Remote Code Execution (RCE) via Arbitrary File Write in `${tag}` Placeholderfluentd
- CVE-2026-54903Oj: Integer Overflow in Oj.load 2GB String Handlingohler55 oj · oj
- CVE-2026-54902Oj: Use-After-Free in Oj::Parser SAJ Long Key Callbackohler55 oj · oj
- CVE-2026-54901Oj: Use-After-Free in Oj::Parser array_class/hash_class GC Markingohler55 oj · oj
- CVE-2026-54900Oj: Negative-Size memcpy in Oj::Parser create_id Attribute Handlingohler55 oj · oj
- CVE-2026-54898Oj: Use-After-Free in Oj::Parser SAJ Callback via Input Mutationohler55 oj · oj
- CVE-2026-54897Oj : Use-After-Free in Oj::Doc Iterators via Reentrant Closeohler55 oj · oj
- CVE-2026-54896Oj: Heap Buffer Overflow in Oj.dump Exception Serialization via Large Indentohler55 oj · oj
- CVE-2026-54592Oj: Stack Buffer Overflow in Oj::Doc#each_child via Deeply Nested Inputohler55 oj · oj
- CVE-2026-54502Oj: Stack Buffer Overflow in Oj.dump via Large Indentohler55 oj · oj
- CVE-2026-54500Oj: intern.c form_attr has an uninitialized stack readohler55 oj · oj
- CVE-2026-54899Oj: Use-After-Free in Oj::Parser Symbol Key Cache Toggleohler55 oj · oj
- CVE-2026-54696Ruby JSON: JSON generator heap buffer overflow when streaming to an IOruby json · json
- CVE-2026-57438Nokogiri: Possible Use-After-Free in XInclude Processingsparklemotion nokogiri · nokogiri
- CVE-2026-57437Nokogiri: Possible Use-After-Free when directly using `NokogirI::XML::XPathContext` beyond document lifetimesparklemotion nokogiri · nokogiri
- CVE-2026-57436Nokogiri: Possible Use-After-Free when setting `Document#root=` to an invalid node typesparklemotion nokogiri · nokogiri
- CVE-2026-57435Nokogiri: Possible Use-After-Free when setting an attribute value via `Nokogiri::XML::Attr#value=` or `#content=`sparklemotion nokogiri · nokogiri
- CVE-2026-57434Nokogiri: Null Pointer Dereference calling methods on uninitialized wrapper classessparklemotion nokogiri · nokogiri
- CVE-2026-57235Nokogiri: Possible Out-of-Bounds Read in `Nokogiri::XML::NodeSet#[]`sparklemotion nokogiri · nokogiri
- CVE-2026-57234Nokogiri: XML::Schema on JRuby allows network requests when NONET is set, bypassing CVE-2020-26247sparklemotion nokogiri · nokogiri
- CVE-2026-57236Nokogiri: Possible Use-After-Free when `Nokogiri::XML::Document#encoding=` raises an exceptionsparklemotion nokogiri · nokogiri
- CVE-2026-54297Faraday: Uncontrolled recursion in NestedParamsEncoder allows stack exhaustion DoS via deeply nested query parameterslostisland faraday · faraday
- CVE-2026-54906concurrent-ruby: ReadWriteLock allows wrong-thread write release and stray read-release counter corruptionruby-concurrency concurrent-ruby · concurrent-ruby
- CVE-2026-54904concurrent-ruby: `AtomicReference#update` livelocks when the stored value is `Float::NAN`ruby-concurrency concurrent-ruby · concurrent-ruby
- CVE-2026-54905concurrent-ruby: `ReentrantReadWriteLock` read-count overflow grants a write lock without exclusivityruby-concurrency concurrent-ruby · concurrent-ruby
- CVE-2026-47242Net::IMAP: Command Injection via ID command argumentruby net-imap · net-imap
- CVE-2026-47240Net::IMAP: Command Injection via non-synchronizing literal in "raw" argumentruby net-imap · net-imap
- CVE-2026-47241Net::IMAP: Denial of Service via incomplete raw argument validationruby net-imap · net-imap
- CVE-2026-49342YARD static cache reads raw traversal paths before router sanitizationlsegal yard · yard
- CVE-2026-12515Katello: missing repository authorization in content_uploads exposes cross-product content existenceRed Hat Satellite 6.16 for RHEL · Red Hat Satellite 6.17… +5
- CVE-2026-44587CarrierWave has a denylisted_content_type bypass via Unescaped Regex Metacharacterscarrierwaveuploader carrierwave · carrierwave
- CVE-2026-44836view_component: Preview Route Can Dispatch Inherited Helper MethodsViewComponent view_component · view_component
- CVE-2026-44837view_component: System Test Entry Point Path Check Allows Sibling Directory EscapeViewComponent view_component · view_component
- CVE-2026-40295Devise: Open Redirect via Unvalidated `request.referrer` in Timeoutable Session Timeout Handlerheartcombo devise · devise
- CVE-2026-33637Faraday: Protocol-relative URI objects still bypass host scoping (possible incomplete fix for GHSA-33mh-2634-fwr2)lostisland faraday · faraday
- CVE-2026-44511Katalyst Koi: Session cookies can be replayed after user logoutkatalyst koi · katalyst-koi
- CVE-2026-44312css_parser allows to MITM included https css urlspremailer css_parser · css_parser
- CVE-2026-42258net-imap: Command Injection via unvalidated Symbol inputsruby net-imap · net-imap
- CVE-2026-42257net-imap: Command Injection via "raw" arguments to multiple commandsruby net-imap · net-imap
- CVE-2026-42256net-imap: Denial of service via high iteration count for `SCRAM-*` authenticationruby net-imap · net-imap
- CVE-2026-42245net-imap: Quadratic complexity when reading response literalsruby net-imap · net-imap
- CVE-2026-42246net-imap vulnerable to STARTTLS stripping via invalid response timingruby net-imap · net-imap
- CVE-2026-42205Avo: Broken Access Control: Unauthorized Execution of Arbitrary Action Classes Across Resourcesavo-hq avo · avo
- CVE-2026-41493yard: Possible arbitrary path traversal and file access via yard serverlsegal yard · yard
- CVE-2025-67202Sidekiq-cron thru 2.3.1, an open-source scheduling add-on for Sidekiq, is vulnerable to a cross-site scripting (xss) vulnerability via craftsidekiq-cron
- CVE-2026-42088OpenC3 COSMOS: Administrative Actions via the Script Runner ToolOpenC3 cosmos · openc3
- CVE-2026-42087OpenC3 COSMOS: SQL Injection in QuestDB Time-Series Data BaseOpenC3 cosmos · openc3
- CVE-2026-42086OpenC3 COSMOS: Self-XSS in the Command SenderOpenC3 cosmos · openc3
- CVE-2026-42085OpenC3 COSMOS: Arbitrary write to plugins directory via path-traversed config filenamesOpenC3 cosmos · openc3
- CVE-2026-42084OpenC3 COSMOS: Hijacked session token can be used to reset password for persistenceOpenC3 cosmos · openc3
- CVE-2026-41316ERB has an @_init deserialization guard bypass via def_module / def_method / def_classruby erb · erb
- CVE-2026-41146facil.io and downstream iodine ruby gem vulnerable to uncontrolled resource consumption and loop with unreachable exit conditionboazsegev facil.io · boazsegev iodine +1
- CVE-2026-40869Decidim amendments can be accepted or rejected by anyonedecidim · decidim-core
- CVE-2026-27820zlib: Buffer Overflow in Zlib::GzipReader ungetc via large input leads to memory corruptionruby zlib · zlib
- CVE-2026-23891Decidim has a Cross-site scripting (XSS) vulnerability via user name fielddecidim · decidim-core
- CVE-2026-40070bsv-sdk and bsv-wallet persist unverified certifier signatures in acquire_certificate (direct and issuance paths)sgbett bsv-ruby-sdk · sgbett bsv-sdk +3
- CVE-2026-40069bsv-sdk ARC broadcaster treats INVALID/MALFORMED/ORPHAN responses as successful broadcastssgbett bsv-ruby-sdk · bsv-sdk
- CVE-2026-39324Rack::Session::Cookie secrets: decrypt failure fallback enables secretless session forgery and Marshal deserializationrack-session
- CVE-2026-35611Addressable has a Regular Expression Denial of Service in Addressable templatessporkmonger addressable · addressable
- CVE-2026-35201Discount has an Out-of-bounds Read in rdiscountdavidfstr rdiscount · rdiscount
- CVE-2026-26962Rack: Header injection in multipart requestsrack
- CVE-2026-34835Rack: `Rack::Request` accepts invalid Host characters, enabling host allowlist bypass.rack
- CVE-2026-34827Rack: Algorithmic-Complexity DoS in Rack::Multipart::Parserrack
- CVE-2026-32762Rack: Forwarded Header semicolon injection enables Host and Scheme spoofingrack
- CVE-2026-34830Rack: Rack::Sendfile regex injection via HTTP_X_ACCEL_MAPPING header allows arbitrary file reads through nginxrack
- CVE-2026-34829Rack: Denial of Service via Unbounded Multipart File Upload Without Content-Lengthrack
- CVE-2026-34826Rack: Unbounded Range Count in get_byte_ranges Enables DoSrack
- CVE-2026-34786Rack: Rack::Static header_rules bypass via URL-encoded pathsrack
- CVE-2026-34785Rack: Local file inclusion in `Rack::Static` via URL Prefix Matchingrack
- CVE-2026-34763Rack: Rack::Directory info disclosure and DoS via unescaped regex interpolationrack
- CVE-2026-34831Rack: Content-Length mismatch in Rack::Files error responsesrack
- CVE-2026-26961Rack: Multipart Boundary Parsing Ambiguity allowing WAF Bypassrack
- CVE-2026-34230Rack: Quadratic complexity in Rack::Utils.select_best_encoding via wildcard Accept-Encoding headerrack
- CVE-2026-34060Ruby LSP has arbitrary code execution through branch settingShopify ruby-lsp · Shopify.ruby-lsp +1
- CVE-2026-33946MCP Ruby SDK: Insufficient Session Binding Allows SSE Stream Hijacking via Session ID Replaymodelcontextprotocol ruby-sdk · mcp
- CVE-2026-33658Rails Active Storage has a possible DoS vulnerability in proxy mode via multi-range requestsrails activestorage · activestorage
- CVE-2026-33635iCalendar has ICS injection via unsanitized URI property valuesicalendar
- CVE-2026-33306bcrypt-ruby has an Integer Overflow that Causes Zero Key-Strengthening Iterations at Cost=31 on JRubybcrypt-ruby · bcrypt
- CVE-2026-33286Graphiti Affected by Arbitrary Method Execution via Unvalidated Relationship Namesgraphiti-api graphiti · graphiti
- CVE-2026-33202Rails Active Storage has possible glob injection in its DiskServicerails activestorage · activestorage
- CVE-2026-33195Rails Active Storage has possible Path Traversal in DiskServicerails activestorage · activestorage
- CVE-2026-33176Rails Active Support has a possible DoS vulnerability in its number helpersrails activesupport · activesupport
- CVE-2026-33174Rails Active Storage has a possible DoS vulnerability when in proxy mode via Range requestsrails activestorage · activestorage
- CVE-2026-33173Rails Active Storage has possible content type bypass via metadata in direct uploadsrails activestorage · activestorage
- CVE-2026-33170Rails Active Support has a possible XSS vulnerability in SafeBuffer#%rails activesupport · activesupport
- CVE-2026-33169Rails Active Support has a possible ReDoS vulnerability in number_to_delimitedrails activesupport · activesupport
- CVE-2026-33168Rails has a possible XSS vulnerability in its Action View tag helpersrails actionview · actionview
- CVE-2026-33167Rails has a possible XSS vulnerability in its Action Pack debug exceptionsrails actionpack · actionpack
- CVE-2026-33210Ruby JSON has a format string injection vulnerabilityruby json · json
- CVE-2026-33209Avo has a XSS vulnerability on `return_to` paramavo-hq avo · avo
- CVE-2026-32700Devise has a confirmable "change email" race condition that permits user to confirm email they have no access toheartcombo devise · devise
- CVE-2026-4324Rubygem-katello: katello: denial of service and potential information disclosure via sql injectionRed Hat Satellite 6.17 for RHEL · Red Hat Satellite 6.18… +3
- CVE-2026-31830sigstore-ruby verifier returns success for DSSE bundles with mismatched in-toto subject digestsigstore-ruby · sigstore
- CVE-2026-1776Camaleon CMS AWS Uploader Authenticated Path Traversal Arbitrary File Readowen2345 Camaleon CMS · camaleon_cms
- CVE-2025-10990Rexml: rexml: denial of service via inefficient regex parsingRed Hat Satellite · rexml
- CVE-2026-0980Rubyipmi: red hat satellite: remote code execution in rubyipmi via malicious bmc usernameRed Hat Satellite 6.16 for RHEL · Red Hat Satellite 6.17… +3
- CVE-2026-25500Rack's Stored XSS in Rack::Directory via javascript: filenames rendered into anchor hrefrack
- CVE-2026-22860Rack has a Directory Traversal via Rack:Directoryrack
- CVE-2026-25765Faraday affected by SSRF via protocol-relative URL host override in build_exclusive_urllostisland faraday · faraday
- CVE-2026-25757Unauthenticated Spree Commerce users can view completed guest orders by Order IDspree · spree_storefront
- CVE-2026-25758Spree allows unauthenticated users can access all guest addressesspree · spree_api
- CVE-2025-65017Decidim's private data exports can lead to data leaksdecidim · decidim-core
- CVE-2026-1530Fog-kubevirt: fog-kubevirt: man-in-the-middle vulnerability due to disabled certificate validationRed Hat Satellite 6.16 for RHEL · Red Hat Satellite 6.17… +2
- CVE-2026-1531Foreman-kubevirt: foreman_kubevirt: man-in-the-middle due to insecure default ssl verificationRed Hat Satellite 6.16 for RHEL · Red Hat Satellite 6.17… +3
- CVE-2025-24293# Active Storage allowed transformation methods potentially unsafe Active Storage attempts to prevent the use of potentially unsafe imageRails activestorage · activestorage
- CVE-2020-36939Cassandra Web 0.5.0 - Remote File Readavalanche123 Cassandra Web · cassandra-web
- CVE-2026-23885AlchemyCMS has Authenticated Remote Code Execution (RCE) via eval injection in ResourcesHelperAlchemyCMS alchemy_cms · alchemy_cms
- CVE-2025-68271Unauthenticated Remote Code Execution in openc3-apiOpenC3 cosmos · openc3
- CVE-2026-22589Spree API has Unauthenticated IDOR - Guest Addressspree · spree_core
- CVE-2026-22588Spree API has Authenticated Insecure Direct Object Reference (IDOR) via Order Modificationspree · spree_api
- CVE-2025-61594URI Credential Leakage Bypass over CVE-2025-27221ruby uri · uri
- CVE-2025-68696httparty Has Potential SSRF Vulnerability That Leads to API Key Leakagejnunemaker httparty · httparty
- CVE-2025-14762Missing cryptographic key commitment in the AWS SDK for Ruby may allow a user with write access to the S3 bucket to introduce a new EDK thatAWS SDK for Ruby · aws-sdk-s3
- CVE-2025-68113ALTCHA Proof-of-Work Vulnerable to Challenge Splicing and Replayaltcha-org altcha-lib · altcha-lib +4
- CVE-2025-66568ruby-saml Libxml2 Canonicalization errors can bypass Digest/Signature validationSAML-Toolkits ruby-saml · ruby-saml
- CVE-2025-66567ruby-saml has a SAML authentication bypass due to namespace handling (parser differential)SAML-Toolkits ruby-saml · ruby-saml
- CVE-2025-64501ProsemirrorToHtml: Cross-Site Scripting vulnerability through unescaped HTML attribute valuesetaminstudio prosemirror_to_html · prosemirror_to_html
- CVE-2025-12790Rubygem-mqtt: rubygem-mqtt hostname validationNicholas J Humfrey ruby-mqtt · Red Hat Satellite +1
- CVE-2025-61921Sinatra has ReDoS vulnerability in ETag header value generationsinatra
- CVE-2025-61919Rack is vulnerable to a memory-exhaustion DoS through unbounded URL-encoded body parsingrack
- CVE-2025-61780Rack has Possible Information Disclosure Vulnerabilityrack
- CVE-2025-61772Rack's multipart parser buffers unbounded per-part headers, enabling DoS (memory exhaustion)rack
- CVE-2025-61771Rack's multipart parser buffers large non‑file fields entirely in memory, enabling DoS (memory exhaustion)rack
- CVE-2025-61770Rack's unbounded multipart preamble buffering enables DoS (memory exhaustion)rack
- CVE-2025-59830Rack QueryParser has an unsafe default allowing params_limit bypass via semicolon-separated parametersrack
- CVE-2025-58767REXML has a DoS condition when parsing malformed XML fileruby rexml · rexml
- CVE-2025-58067Basecamp's Google Sign-In for Rails allowed redirects to protocol-relative URIbasecamp google_sign_in · google_sign_in
- CVE-2025-57821Basecamp's Google Sign-In for Rails allowed redirects to a malformed URLbasecamp google_sign_in · google_sign_in
- CVE-2011-10026Spreecommerce < 0.50.x API RCESpreecommerce · spree +1
- CVE-2025-55193Active Record logging vulnerable to ANSI escape injectionrails · activerecord
- CVE-2011-10019Spreecommerce < 0.60.2 Search Parameter RCESpreecommerce · spree