# cve.now: RubyGems packages

The newest entries affecting RubyGems packages (up to 200). To check exact package versions, use the MCP check_stack tool or /stack.

- [CVE-2026-116695](https://cve.now/CVE-2026-116695.md): Crass: Incorrect tokenization of bad URLs enables CSS sanitizer bypass (CVSS 5.3, rgrove crass · crass)
- [CVE-2026-107715](https://cve.now/CVE-2026-107715.md): Mechanize sends credential headers to another host after an HTTP redirect (CVSS 6.8, sparklemotion mechanize · mechanize)
- [CVE-2026-107399](https://cve.now/CVE-2026-107399.md): Mechanize sends credential headers to another origin after a meta refresh (CVSS 6.8, sparklemotion mechanize · mechanize)
- [CVE-2026-55107](https://cve.now/CVE-2026-55107.md): Kobako Vulnerable to Sandbox Escape: guest eval reaches host RCE via method\_missing → public\_send (any bound Service) (CVSS 10.0, elct9620 kobako · kobako)
- [CVE-2026-77602](https://cve.now/CVE-2026-77602.md): OpenC3 COSMOS: Authenticated remote code execution via the user-writable config overlay (table definitions, cmd/tlm definitions, and script suites) (CVSS 9.9, OpenC3 cosmos · openc3)
- [CVE-2026-77601](https://cve.now/CVE-2026-77601.md): OpenC3 COSMOS: Authenticated OS command injection via the \`pypi\_url\` setting (CVSS 8.8, OpenC3 cosmos · openc3)
- [CVE-2026-61570](https://cve.now/CVE-2026-61570.md): MPXJ: XXE Vulnerability in MerlinReader (CVSS 7.5, joniles mpxj · net.sf.mpxj:mpxj +5)
- [CVE-2026-65829](https://cve.now/CVE-2026-65829.md): MPXJ: Potential Path Traversal Vulnerability in Primavera P3 PRX and SureTrak STX readers (CVSS 5.3, joniles mpxj · MPXJ.Net +5)
- [CVE-2026-94462](https://cve.now/CVE-2026-94462.md): Spree: Broken Access Control in \`PATCH /api/v3/store/carts/:id/associate\` (IDOR) (CVSS 7.1, spree · spree\_api)
- [CVE-2026-44163](https://cve.now/CVE-2026-44163.md): fluent-plugin-opentelemetry: Denial of Service (DoS) via Large Payloads and Decompression Bombs in \`in\_opentelemetry\` (CVSS 5.3, fluent-plugins-nursery fluent-plugin-opentelemetry · fluent…)
- [CVE-2026-44282](https://cve.now/CVE-2026-44282.md): Election question titles allow stored script execution (CVSS 4.8, decidim · decidim-elections)
- [CVE-2026-44162](https://cve.now/CVE-2026-44162.md): fluent-plugin-s3: Denial of Service (DoS) via Decompression Bomb in \`in\_s3\` (CVSS 2.7, fluent-plugin-s3)
- [CVE-2026-70658](https://cve.now/CVE-2026-70658.md): pay-rails/pay: non-constant-time HMAC comparison in Paddle Billing webhook signature verifier (CVSS 7.4, pay-rails pay · pay)
- [CVE-2026-50276](https://cve.now/CVE-2026-50276.md): dd-trace-rb: Improper parsing of W3C baggage headers may lead to DoS (CVSS 7.5, DataDog dd-trace-rb · datadog)
- [CVE-2026-57579](https://cve.now/CVE-2026-57579.md): Alchemy: Unauthenticated nested page API leaks restricted & unpublished content (CVSS 7.5, AlchemyCMS alchemy\_cms · alchemy\_cms)
- [CVE-2023-46035](https://cve.now/CVE-2023-46035.md): The svg\_optimizer gem before 0.3.0 for Ruby performs entity expansion on untrusted documents. (CVSS 5.9, fnando svg\_optimizer · svg\_optimizer)
- [CVE-2026-53769](https://cve.now/CVE-2026-53769.md): Avo: Direct attachment upload endpoint lacks upload authorization and bypasses field-level upload policy (CVSS 6.5, avo-hq avo · avo)
- [CVE-2026-85396](https://cve.now/CVE-2026-85396.md): rubyzip before 3.4.0 Path Traversal in Zip::Entry#extract via Sibling-Directory Prefix (CVSS 8.7, rubyzip)
- [CVE-2026-63435](https://cve.now/CVE-2026-63435.md): Mail: Email address spoofing via malformed RFC 2047 encoded-words (CVSS 5.3, mikel mail · mail)
- [CVE-2026-44476](https://cve.now/CVE-2026-44476.md): Doorkeeper OpenID Connect: Dynamic Client Registration feature creates public clients with client\_secret (CVSS 6.3, doorkeeper-gem doorkeeper-openid\_connect · doorkeeper-openi…)
- [CVE-2026-79772](https://cve.now/CVE-2026-79772.md): Nokogiri before 1.19.1 Unchecked Return Value canonicalize (CVSS 6.9, sparklemotion nokogiri · nokogiri)
- [CVE-2026-79771](https://cve.now/CVE-2026-79771.md): Nokogiri before 1.19.3 Memory Leak via XSLT Transform (CVSS 6.9, sparklemotion nokogiri · nokogiri)
- [CVE-2026-79770](https://cve.now/CVE-2026-79770.md): Nokogiri before 1.19.3 ReDoS via CSS selector tokenizer (CVSS 8.7, sparklemotion nokogiri · nokogiri)
- [CVE-2026-73426](https://cve.now/CVE-2026-73426.md): Trix: Stored XSS vulnerability through serialized attributes (CVSS 4.6, basecamp trix · action\_text-trix +1)
- [CVE-2026-61666](https://cve.now/CVE-2026-61666.md): websocket-driver: Denial of service via malformed Host header (CVSS 8.9, faye websocket-driver-ruby · websocket-driver)
- [CVE-2026-73428](https://cve.now/CVE-2026-73428.md): Trix: Stored XSS via HTMLParser attribute injection on paste (CVSS 4.6, basecamp trix · trix +1)
- [CVE-2026-73648](https://cve.now/CVE-2026-73648.md): rails-html-sanitizer: Possible XSS vulnerability with certain configurations (CVSS 5.1, rails-html-sanitizer)
- [CVE-2026-73492](https://cve.now/CVE-2026-73492.md): Loofah \`allowed\_uri?\` does not detect \`javascript:\` URIs split by numeric character references without semicolons (CVSS 2.3, flavorjones loofah · loofah)
- [CVE-2026-73491](https://cve.now/CVE-2026-73491.md): Loofah \`allowed\_uri?\` does not detect \`javascript:\` URIs split by named whitespace character references (CVSS 2.3, flavorjones loofah · loofah)
- [CVE-2026-73490](https://cve.now/CVE-2026-73490.md): Loofah: SVG \`href\` attribute bypasses local-reference restriction (CVSS 4.7, flavorjones loofah · loofah)
- [CVE-2026-73427](https://cve.now/CVE-2026-73427.md): Trix: XSS via JSON deserialization bypass in drag-and-drop (Level0InputController) (CVSS 2.1, basecamp trix · trix +1)
- [CVE-2026-71847](https://cve.now/CVE-2026-71847.md): Ruby JSON: JSON::ResumableParser#partial\_value dereferences a freed input buffer and crashes on truncated duplicate-key streams (CVSS 8.7, ruby json · json)
- [CVE-2026-45378](https://cve.now/CVE-2026-45378.md): Decidim: Verification documents can be downloaded through reusable links (CVSS 7.5, decidim · decidim-verifications)
- [CVE-2026-45573](https://cve.now/CVE-2026-45573.md): Decidim: Push subscriptions can be abused for server-side requests (CVSS 6.4, decidim · decidim-core)
- [CVE-2026-45572](https://cve.now/CVE-2026-45572.md): Decidim: HTML content blocks allow stored script execution (CVSS 4.8, decidim · decidim-core)
- [CVE-2026-45415](https://cve.now/CVE-2026-45415.md): Decidim: CSV census record endpoints improper authorization (CVSS 6.0, decidim · decidim-verifications)
- [CVE-2026-45414](https://cve.now/CVE-2026-45414.md): Decidim: JWT-backed authentication can be replayed across organizations (CVSS 8.5, decidim)
- [CVE-2026-45377](https://cve.now/CVE-2026-45377.md): Decidim: Private exports can be downloaded through reusable links (CVSS 6.5, decidim · decidim-core)
- [CVE-2026-45376](https://cve.now/CVE-2026-45376.md): Decidim: Admin user search allows SQL injection through similarity-based sorting (CVSS 5.5, decidim · decidim-admin)
- [CVE-2026-45330](https://cve.now/CVE-2026-45330.md): Decidim: Verification admins can access supplied IDs from other organisations (CVSS 4.9, decidim · decidim-verifications)
- [CVE-2026-45086](https://cve.now/CVE-2026-45086.md): Decidim: Forms admin question editor lacks authorization (CVSS 5.4, decidim · decidim-demographics)
- [CVE-2026-53510](https://cve.now/CVE-2026-53510.md): Savon::Model evaluates WSDL operation names as Ruby source (CVSS 8.1, savonrb savon · savon)
- [CVE-2026-66066](https://cve.now/CVE-2026-66066.md): Action Pack: Possible arbitrary file read and remote code execution in Active Storage variant processing (CVSS 9.5, rails · activestorage)
- [CVE-2026-54522](https://cve.now/CVE-2026-54522.md): MessagePack::Buffer#clear Use-After-Free that Enables Cross-Buffer Disclosure (CVSS 2.1, msgpack-ruby · msgpack)
- [CVE-2026-67432](https://cve.now/CVE-2026-67432.md): MCP Ruby SDK: Unbounded JSON-RPC request body causes uncontrolled memory allocation in StreamableHTTPTransport (CVSS 7.5, modelcontextprotocol ruby-sdk · mcp)
- [CVE-2026-67431](https://cve.now/CVE-2026-67431.md): MCP Ruby SDK: Ruby SSE Session Poisoning (CVSS 8.3, modelcontextprotocol ruby-sdk · mcp)
- [CVE-2026-63119](https://cve.now/CVE-2026-63119.md): MCP Ruby SDK: Unbounded line buffer in stdio transports leads to memory exhaustion (DoS) (CVSS 6.2, modelcontextprotocol ruby-sdk · mcp)
- [CVE-2026-67430](https://cve.now/CVE-2026-67430.md): MCP Ruby SDK: Unbounded session retention in StreamableHTTPTransport allows memory exhaustion via initialize flood (CVSS 5.3, modelcontextprotocol ruby-sdk · mcp)
- [CVE-2026-63118](https://cve.now/CVE-2026-63118.md): MCP Ruby SDK: Streamable HTTP transport lacks DNS-rebinding (Host/Origin) protection (CVSS 6.9, modelcontextprotocol ruby-sdk · mcp)
- [CVE-2026-54659](https://cve.now/CVE-2026-54659.md): Pagy I18n locale option is not validated before being used in a file path (CVSS 6.9, ddnexus pagy · pagy)
- [CVE-2026-54603](https://cve.now/CVE-2026-54603.md): OAuth2::Client#request: Protocol-relative redirect Location overrides authority, leaking bearer Authorization to attacker host (CVSS 8.6, ruby-oauth oauth2 · oauth2)
- [CVE-2026-54605](https://cve.now/CVE-2026-54605.md): OAuth: Cross-origin token-request redirects can expose signed request metadata (CVSS 7.2, ruby-oauth oauth · oauth)
- [CVE-2026-54620](https://cve.now/CVE-2026-54620.md): sqlite3-ruby has Use-After-Free in SQLite Aggregate Function Callbacks (CVSS 2.0, sparklemotion sqlite3-ruby · sqlite3-ruby +1)
- [CVE-2026-54619](https://cve.now/CVE-2026-54619.md): sqlite3-ruby has Use-After-Free When Redefining SQLite Functions with Different Arity (CVSS 2.0, sparklemotion sqlite3-ruby · sqlite3-ruby +1)
- [CVE-2026-55518](https://cve.now/CVE-2026-55518.md): Avo: Missing Authorization in Avo Association Attach Endpoint Allows Unauthorized Relationship Manipulation and Privilege Escalation (CVSS 9.6, avo-hq avo · avo)
- [CVE-2026-54498](https://cve.now/CVE-2026-54498.md): view\_component: around\_render HTML-Safety Bypass (CVSS 8.7, ViewComponent view\_component · view\_component)
- [CVE-2026-54497](https://cve.now/CVE-2026-54497.md): view\_component: Reused Component Instances Retain Stale Render Context (CVSS 6.8, ViewComponent view\_component · view\_component)
- [CVE-2026-53727](https://cve.now/CVE-2026-53727.md): css\_parser: SSRF and Local File Disclosure in \`CssParser::Parser#read\_remote\_file\` (CVSS 8.9, premailer css\_parser · css\_parser)
- [CVE-2026-54163](https://cve.now/CVE-2026-54163.md): secure\_headers: CSP directive injection via sandbox, plugin\_types, and report\_to when given untrusted input (CVSS 4.7, github secure\_headers · secure\_headers)
- [CVE-2026-54171](https://cve.now/CVE-2026-54171.md): Excon: redact additional sensitive/risky headers when following redirects (CVSS 6.5, excon)
- [CVE-2026-54465](https://cve.now/CVE-2026-54465.md): websocket-driver: Memory exhaustion in HTTP header parser (CVSS 6.3, faye websocket-driver-ruby · websocket-driver)
- [CVE-2026-54463](https://cve.now/CVE-2026-54463.md): websocket-driver: Memory exhaustion via abuse of protocol length headers (CVSS 6.9, faye websocket-driver-ruby · websocket-driver)
- [CVE-2026-54464](https://cve.now/CVE-2026-54464.md): websocket-driver: Resource limit bypass via message compression (CVSS 6.3, faye websocket-driver-ruby · websocket-driver)
- [CVE-2026-45363](https://cve.now/CVE-2026-45363.md): \`jwt\` (Ruby gem) - empty-key HMAC bypass (CVSS 9.1, ruby-jwt · jwt)
- [CVE-2026-47736](https://cve.now/CVE-2026-47736.md): Puma PROXY Protocol v1 Parser Allows Remote Memory Exhaustion (CVSS 7.5, puma)
- [CVE-2026-47737](https://cve.now/CVE-2026-47737.md): Puma PROXY Protocol v1 Accepts Repeated Protocol Headers on Persistent Connections (CVSS 7.5, puma)
- [CVE-2026-44161](https://cve.now/CVE-2026-44161.md): Fluentd: Server-Side Request Forgery (SSRF) via Placeholder Expansion in \`out\_http\` (CVSS 7.2, fluentd)
- [CVE-2026-44160](https://cve.now/CVE-2026-44160.md): Fluentd: Denial of Service (DoS) via Gzip Decompression Bomb in \`in\_http\` and \`in\_forward\` (CVSS 7.5, fluentd)
- [CVE-2026-44025](https://cve.now/CVE-2026-44025.md): Fluentd: Exposure of Sensitive Information via Monitor Agent API (CVSS 7.5, fluentd)
- [CVE-2026-44024](https://cve.now/CVE-2026-44024.md): Fluentd: Remote Code Execution (RCE) via Arbitrary File Write in \`${tag}\` Placeholder (CVSS 9.8, fluentd)
- [CVE-2026-54903](https://cve.now/CVE-2026-54903.md): Oj: Integer Overflow in Oj.load 2GB String Handling (CVSS 6.3, ohler55 oj · oj)
- [CVE-2026-54902](https://cve.now/CVE-2026-54902.md): Oj: Use-After-Free in Oj::Parser SAJ Long Key Callback (CVSS 6.3, ohler55 oj · oj)
- [CVE-2026-54901](https://cve.now/CVE-2026-54901.md): Oj: Use-After-Free in Oj::Parser array\_class/hash\_class GC Marking (CVSS 6.3, ohler55 oj · oj)
- [CVE-2026-54900](https://cve.now/CVE-2026-54900.md): Oj: Negative-Size memcpy in Oj::Parser create\_id Attribute Handling (CVSS 6.3, ohler55 oj · oj)
- [CVE-2026-54898](https://cve.now/CVE-2026-54898.md): Oj: Use-After-Free in Oj::Parser SAJ Callback via Input Mutation (CVSS 2.1, ohler55 oj · oj)
- [CVE-2026-54897](https://cve.now/CVE-2026-54897.md): Oj : Use-After-Free in Oj::Doc Iterators via Reentrant Close (CVSS 2.1, ohler55 oj · oj)
- [CVE-2026-54896](https://cve.now/CVE-2026-54896.md): Oj: Heap Buffer Overflow in Oj.dump Exception Serialization via Large Indent (CVSS 2.1, ohler55 oj · oj)
- [CVE-2026-54592](https://cve.now/CVE-2026-54592.md): Oj: Stack Buffer Overflow in Oj::Doc#each\_child via Deeply Nested Input (CVSS 7.5, ohler55 oj · oj)
- [CVE-2026-54502](https://cve.now/CVE-2026-54502.md): Oj: Stack Buffer Overflow in Oj.dump via Large Indent (CVSS 6.3, ohler55 oj · oj)
- [CVE-2026-54500](https://cve.now/CVE-2026-54500.md): Oj: intern.c form\_attr has an uninitialized stack read (CVSS 5.3, ohler55 oj · oj)
- [CVE-2026-54899](https://cve.now/CVE-2026-54899.md): Oj: Use-After-Free in Oj::Parser Symbol Key Cache Toggle (CVSS 6.3, ohler55 oj · oj)
- [CVE-2026-54696](https://cve.now/CVE-2026-54696.md): Ruby JSON: JSON generator heap buffer overflow when streaming to an IO (CVSS 3.7, ruby json · json)
- [CVE-2026-57438](https://cve.now/CVE-2026-57438.md): Nokogiri: Possible Use-After-Free in XInclude Processing (CVSS 2.2, sparklemotion nokogiri · nokogiri)
- [CVE-2026-57437](https://cve.now/CVE-2026-57437.md): Nokogiri: Possible Use-After-Free when directly using \`NokogirI::XML::XPathContext\` beyond document lifetime (CVSS 1.7, sparklemotion nokogiri · nokogiri)
- [CVE-2026-57436](https://cve.now/CVE-2026-57436.md): Nokogiri: Possible Use-After-Free when setting \`Document#root=\` to an invalid node type (CVSS 1.7, sparklemotion nokogiri · nokogiri)
- [CVE-2026-57435](https://cve.now/CVE-2026-57435.md): Nokogiri: Possible Use-After-Free when setting an attribute value via \`Nokogiri::XML::Attr#value=\` or \`#content=\` (CVSS 1.7, sparklemotion nokogiri · nokogiri)
- [CVE-2026-57434](https://cve.now/CVE-2026-57434.md): Nokogiri: Null Pointer Dereference calling methods on uninitialized wrapper classes (CVSS 1.7, sparklemotion nokogiri · nokogiri)
- [CVE-2026-57235](https://cve.now/CVE-2026-57235.md): Nokogiri: Possible Out-of-Bounds Read in \`Nokogiri::XML::NodeSet#\[\]\` (CVSS 6.3, sparklemotion nokogiri · nokogiri)
- [CVE-2026-57234](https://cve.now/CVE-2026-57234.md): Nokogiri: XML::Schema on JRuby allows network requests when NONET is set, bypassing CVE-2020-26247 (CVSS 2.6, sparklemotion nokogiri · nokogiri)
- [CVE-2026-57236](https://cve.now/CVE-2026-57236.md): Nokogiri: Possible Use-After-Free when \`Nokogiri::XML::Document#encoding=\` raises an exception (CVSS 1.7, sparklemotion nokogiri · nokogiri)
- [CVE-2026-54297](https://cve.now/CVE-2026-54297.md): Faraday: Uncontrolled recursion in NestedParamsEncoder allows stack exhaustion DoS via deeply nested query parameters (CVSS 7.5, lostisland faraday · faraday)
- [CVE-2026-54906](https://cve.now/CVE-2026-54906.md): concurrent-ruby: ReadWriteLock allows wrong-thread write release and stray read-release counter corruption (CVSS 2.1, ruby-concurrency concurrent-ruby · concurrent-ruby)
- [CVE-2026-54904](https://cve.now/CVE-2026-54904.md): concurrent-ruby: \`AtomicReference#update\` livelocks when the stored value is \`Float::NAN\` (CVSS 8.2, ruby-concurrency concurrent-ruby · concurrent-ruby)
- [CVE-2026-54905](https://cve.now/CVE-2026-54905.md): concurrent-ruby: \`ReentrantReadWriteLock\` read-count overflow grants a write lock without exclusivity (CVSS 2.0, ruby-concurrency concurrent-ruby · concurrent-ruby)
- [CVE-2026-47242](https://cve.now/CVE-2026-47242.md): Net::IMAP: Command Injection via ID command argument (CVSS 5.8, ruby net-imap · net-imap)
- [CVE-2026-47240](https://cve.now/CVE-2026-47240.md): Net::IMAP: Command Injection via non-synchronizing literal in "raw" argument (CVSS 5.8, ruby net-imap · net-imap)
- [CVE-2026-47241](https://cve.now/CVE-2026-47241.md): Net::IMAP: Denial of Service via incomplete raw argument validation (CVSS 2.1, ruby net-imap · net-imap)
- [CVE-2026-49342](https://cve.now/CVE-2026-49342.md): YARD static cache reads raw traversal paths before router sanitization (CVSS 5.3, lsegal yard · yard)
- [CVE-2026-12515](https://cve.now/CVE-2026-12515.md): Katello: missing repository authorization in content\_uploads exposes cross-product content existence (CVSS 4.3, Red Hat Satellite 6.16 for RHEL · Red Hat Satellite 6.17… +5)
- [CVE-2026-44587](https://cve.now/CVE-2026-44587.md): CarrierWave has a denylisted\_content\_type bypass via Unescaped Regex Metacharacters (CVSS 4.7, carrierwaveuploader carrierwave · carrierwave)
- [CVE-2026-44836](https://cve.now/CVE-2026-44836.md): view\_component: Preview Route Can Dispatch Inherited Helper Methods (CVSS 6.5, ViewComponent view\_component · view\_component)
- [CVE-2026-44837](https://cve.now/CVE-2026-44837.md): view\_component: System Test Entry Point Path Check Allows Sibling Directory Escape (CVSS 5.9, ViewComponent view\_component · view\_component)
- [CVE-2026-40295](https://cve.now/CVE-2026-40295.md): Devise: Open Redirect via Unvalidated \`request.referrer\` in Timeoutable Session Timeout Handler (CVSS 6.1, heartcombo devise · devise)
- [CVE-2026-33637](https://cve.now/CVE-2026-33637.md): Faraday: Protocol-relative URI objects still bypass host scoping (possible incomplete fix for GHSA-33mh-2634-fwr2) (CVSS 0.0, lostisland faraday · faraday)
- [CVE-2026-44511](https://cve.now/CVE-2026-44511.md): Katalyst Koi: Session cookies can be replayed after user logout (CVSS 7.4, katalyst koi · katalyst-koi)
- [CVE-2026-44312](https://cve.now/CVE-2026-44312.md): css\_parser allows to MITM included https css urls (CVSS 5.8, premailer css\_parser · css\_parser)
- [CVE-2026-42258](https://cve.now/CVE-2026-42258.md): net-imap: Command Injection via unvalidated Symbol inputs (CVSS 5.8, ruby net-imap · net-imap)
- [CVE-2026-42257](https://cve.now/CVE-2026-42257.md): net-imap: Command Injection via "raw" arguments to multiple commands (CVSS 5.8, ruby net-imap · net-imap)
- [CVE-2026-42256](https://cve.now/CVE-2026-42256.md): net-imap: Denial of service via high iteration count for \`SCRAM-\*\` authentication (CVSS 6.0, ruby net-imap · net-imap)
- [CVE-2026-42245](https://cve.now/CVE-2026-42245.md): net-imap: Quadratic complexity when reading response literals (CVSS 2.3, ruby net-imap · net-imap)
- [CVE-2026-42246](https://cve.now/CVE-2026-42246.md): net-imap vulnerable to STARTTLS stripping via invalid response timing (CVSS 7.6, ruby net-imap · net-imap)
- [CVE-2026-42205](https://cve.now/CVE-2026-42205.md): Avo: Broken Access Control: Unauthorized Execution of Arbitrary Action Classes Across Resources (CVSS 8.8, avo-hq avo · avo)
- [CVE-2026-41493](https://cve.now/CVE-2026-41493.md): yard: Possible arbitrary path traversal and file access via yard server (CVSS 6.9, lsegal yard · yard)
- [CVE-2025-67202](https://cve.now/CVE-2025-67202.md): Sidekiq-cron thru 2.3.1, an open-source scheduling add-on for Sidekiq, is vulnerable to a cross-site scripting (xss) vulnerability via craft (CVSS 6.1, sidekiq-cron)
- [CVE-2026-42088](https://cve.now/CVE-2026-42088.md): OpenC3 COSMOS: Administrative Actions via the Script Runner Tool (CVSS 9.6, OpenC3 cosmos · openc3)
- [CVE-2026-42087](https://cve.now/CVE-2026-42087.md): OpenC3 COSMOS: SQL Injection in QuestDB Time-Series Data Base (CVSS 9.6, OpenC3 cosmos · openc3)
- [CVE-2026-42086](https://cve.now/CVE-2026-42086.md): OpenC3 COSMOS: Self-XSS in the Command Sender (CVSS 4.6, OpenC3 cosmos · openc3)
- [CVE-2026-42085](https://cve.now/CVE-2026-42085.md): OpenC3 COSMOS: Arbitrary write to plugins directory via path-traversed config filenames (CVSS 4.3, OpenC3 cosmos · openc3)
- [CVE-2026-42084](https://cve.now/CVE-2026-42084.md): OpenC3 COSMOS: Hijacked session token can be used to reset password for persistence (CVSS 8.1, OpenC3 cosmos · openc3)
- [CVE-2026-41316](https://cve.now/CVE-2026-41316.md): ERB has an @\_init deserialization guard bypass via def\_module / def\_method / def\_class (CVSS 8.1, ruby erb · erb)
- [CVE-2026-41146](https://cve.now/CVE-2026-41146.md): facil.io and downstream iodine ruby gem vulnerable to uncontrolled resource consumption and loop with unreachable exit condition (CVSS 8.7, boazsegev facil.io · boazsegev iodine +1)
- [CVE-2026-40869](https://cve.now/CVE-2026-40869.md): Decidim amendments can be accepted or rejected by anyone (CVSS 7.5, decidim · decidim-core)
- [CVE-2026-27820](https://cve.now/CVE-2026-27820.md): zlib: Buffer Overflow in Zlib::GzipReader ungetc via large input leads to memory corruption (CVSS 1.7, ruby zlib · zlib)
- [CVE-2026-23891](https://cve.now/CVE-2026-23891.md): Decidim has a Cross-site scripting (XSS) vulnerability via user name field (CVSS 9.3, decidim · decidim-core)
- [CVE-2026-40070](https://cve.now/CVE-2026-40070.md): bsv-sdk and bsv-wallet persist unverified certifier signatures in acquire\_certificate (direct and issuance paths) (CVSS 8.1, sgbett bsv-ruby-sdk · sgbett bsv-sdk +3)
- [CVE-2026-40069](https://cve.now/CVE-2026-40069.md): bsv-sdk ARC broadcaster treats INVALID/MALFORMED/ORPHAN responses as successful broadcasts (CVSS 7.5, sgbett bsv-ruby-sdk · bsv-sdk)
- [CVE-2026-39324](https://cve.now/CVE-2026-39324.md): Rack::Session::Cookie secrets: decrypt failure fallback enables secretless session forgery and Marshal deserialization (CVSS 9.3, rack-session)
- [CVE-2026-35611](https://cve.now/CVE-2026-35611.md): Addressable has a Regular Expression Denial of Service in Addressable templates (CVSS 7.5, sporkmonger addressable · addressable)
- [CVE-2026-35201](https://cve.now/CVE-2026-35201.md): Discount has an Out-of-bounds Read in rdiscount (CVSS 5.9, davidfstr rdiscount · rdiscount)
- [CVE-2026-26962](https://cve.now/CVE-2026-26962.md): Rack: Header injection in multipart requests (CVSS 4.8, rack)
- [CVE-2026-34835](https://cve.now/CVE-2026-34835.md): Rack: \`Rack::Request\` accepts invalid Host characters, enabling host allowlist bypass. (CVSS 4.8, rack)
- [CVE-2026-34827](https://cve.now/CVE-2026-34827.md): Rack: Algorithmic-Complexity DoS in Rack::Multipart::Parser (CVSS 7.5, rack)
- [CVE-2026-32762](https://cve.now/CVE-2026-32762.md): Rack: Forwarded Header semicolon injection enables Host and Scheme spoofing (CVSS 4.8, rack)
- [CVE-2026-34830](https://cve.now/CVE-2026-34830.md): Rack: Rack::Sendfile regex injection via HTTP\_X\_ACCEL\_MAPPING header allows arbitrary file reads through nginx (CVSS 5.9, rack)
- [CVE-2026-34829](https://cve.now/CVE-2026-34829.md): Rack: Denial of Service via Unbounded Multipart File Upload Without Content-Length (CVSS 7.5, rack)
- [CVE-2026-34826](https://cve.now/CVE-2026-34826.md): Rack: Unbounded Range Count in get\_byte\_ranges Enables DoS (CVSS 5.3, rack)
- [CVE-2026-34786](https://cve.now/CVE-2026-34786.md): Rack: Rack::Static header\_rules bypass via URL-encoded paths (CVSS 5.3, rack)
- [CVE-2026-34785](https://cve.now/CVE-2026-34785.md): Rack: Local file inclusion in \`Rack::Static\` via URL Prefix Matching (CVSS 7.5, rack)
- [CVE-2026-34763](https://cve.now/CVE-2026-34763.md): Rack: Rack::Directory info disclosure and DoS via unescaped regex interpolation (CVSS 5.3, rack)
- [CVE-2026-34831](https://cve.now/CVE-2026-34831.md): Rack: Content-Length mismatch in Rack::Files error responses (CVSS 4.8, rack)
- [CVE-2026-26961](https://cve.now/CVE-2026-26961.md): Rack: Multipart Boundary Parsing Ambiguity allowing WAF Bypass (CVSS 3.7, rack)
- [CVE-2026-34230](https://cve.now/CVE-2026-34230.md): Rack: Quadratic complexity in Rack::Utils.select\_best\_encoding via wildcard Accept-Encoding header (CVSS 5.3, rack)
- [CVE-2026-34060](https://cve.now/CVE-2026-34060.md): Ruby LSP has arbitrary code execution through branch setting (CVSS 7.1, Shopify ruby-lsp · Shopify.ruby-lsp +1)
- [CVE-2026-33946](https://cve.now/CVE-2026-33946.md): MCP Ruby SDK: Insufficient Session Binding Allows SSE Stream Hijacking via Session ID Replay (CVSS 8.2, modelcontextprotocol ruby-sdk · mcp)
- [CVE-2026-33658](https://cve.now/CVE-2026-33658.md): Rails Active Storage has a possible DoS vulnerability in proxy mode via multi-range requests (CVSS 2.3, rails activestorage · activestorage)
- [CVE-2026-33635](https://cve.now/CVE-2026-33635.md): iCalendar has ICS injection via unsanitized URI property values (CVSS 4.3, icalendar)
- [CVE-2026-33306](https://cve.now/CVE-2026-33306.md): bcrypt-ruby has an Integer Overflow that Causes Zero Key-Strengthening Iterations at Cost=31 on JRuby (CVSS 4.5, bcrypt-ruby · bcrypt)
- [CVE-2026-33286](https://cve.now/CVE-2026-33286.md): Graphiti Affected by Arbitrary Method Execution via Unvalidated Relationship Names (CVSS 9.1, graphiti-api graphiti · graphiti)
- [CVE-2026-33202](https://cve.now/CVE-2026-33202.md): Rails Active Storage has possible glob injection in its DiskService (CVSS 6.6, rails activestorage · activestorage)
- [CVE-2026-33195](https://cve.now/CVE-2026-33195.md): Rails Active Storage has possible Path Traversal in DiskService (CVSS 8.0, rails activestorage · activestorage)
- [CVE-2026-33176](https://cve.now/CVE-2026-33176.md): Rails Active Support has a possible DoS vulnerability in its number helpers (CVSS 6.6, rails activesupport · activesupport)
- [CVE-2026-33174](https://cve.now/CVE-2026-33174.md): Rails Active Storage has a possible DoS vulnerability when in proxy mode via Range requests (CVSS 6.6, rails activestorage · activestorage)
- [CVE-2026-33173](https://cve.now/CVE-2026-33173.md): Rails Active Storage has possible content type bypass via metadata in direct uploads (CVSS 5.3, rails activestorage · activestorage)
- [CVE-2026-33170](https://cve.now/CVE-2026-33170.md): Rails Active Support has a possible XSS vulnerability in SafeBuffer#% (CVSS 5.3, rails activesupport · activesupport)
- [CVE-2026-33169](https://cve.now/CVE-2026-33169.md): Rails Active Support has a possible ReDoS vulnerability in number\_to\_delimited (CVSS 6.9, rails activesupport · activesupport)
- [CVE-2026-33168](https://cve.now/CVE-2026-33168.md): Rails has a possible XSS vulnerability in its Action View tag helpers (CVSS 2.3, rails actionview · actionview)
- [CVE-2026-33167](https://cve.now/CVE-2026-33167.md): Rails has a possible XSS vulnerability in its Action Pack debug exceptions (CVSS 1.3, rails actionpack · actionpack)
- [CVE-2026-33210](https://cve.now/CVE-2026-33210.md): Ruby JSON has a format string injection vulnerability (CVSS 8.3, ruby json · json)
- [CVE-2026-33209](https://cve.now/CVE-2026-33209.md): Avo has a XSS vulnerability on \`return\_to\` param (CVSS 5.3, avo-hq avo · avo)
- [CVE-2026-32700](https://cve.now/CVE-2026-32700.md): Devise has a confirmable "change email" race condition that permits user to confirm email they have no access to (CVSS 6.0, heartcombo devise · devise)
- [CVE-2026-4324](https://cve.now/CVE-2026-4324.md): Rubygem-katello: katello: denial of service and potential information disclosure via sql injection (CVSS 5.4, Red Hat Satellite 6.17 for RHEL · Red Hat Satellite 6.18… +3)
- [CVE-2026-31830](https://cve.now/CVE-2026-31830.md): sigstore-ruby verifier returns success for DSSE bundles with mismatched in-toto subject digest (CVSS 7.5, sigstore-ruby · sigstore)
- [CVE-2026-1776](https://cve.now/CVE-2026-1776.md): Camaleon CMS AWS Uploader Authenticated Path Traversal Arbitrary File Read (CVSS 6.0, owen2345 Camaleon CMS · camaleon\_cms)
- [CVE-2025-10990](https://cve.now/CVE-2025-10990.md): Rexml: rexml: denial of service via inefficient regex parsing (CVSS 7.5, Red Hat Satellite · rexml)
- [CVE-2026-0980](https://cve.now/CVE-2026-0980.md): Rubyipmi: red hat satellite: remote code execution in rubyipmi via malicious bmc username (CVSS 8.3, Red Hat Satellite 6.16 for RHEL · Red Hat Satellite 6.17… +3)
- [CVE-2026-25500](https://cve.now/CVE-2026-25500.md): Rack's Stored XSS in Rack::Directory via javascript: filenames rendered into anchor href (CVSS 5.4, rack)
- [CVE-2026-22860](https://cve.now/CVE-2026-22860.md): Rack has a Directory Traversal via Rack:Directory (CVSS 7.5, rack)
- [CVE-2026-25765](https://cve.now/CVE-2026-25765.md): Faraday affected by SSRF via protocol-relative URL host override in build\_exclusive\_url (CVSS 5.8, lostisland faraday · faraday)
- [CVE-2026-25757](https://cve.now/CVE-2026-25757.md): Unauthenticated Spree Commerce users can view completed guest orders by Order ID (CVSS 7.7, spree · spree\_storefront)
- [CVE-2026-25758](https://cve.now/CVE-2026-25758.md): Spree allows unauthenticated users can access all guest addresses (CVSS 7.7, spree · spree\_api)
- [CVE-2025-65017](https://cve.now/CVE-2025-65017.md): Decidim's private data exports can lead to data leaks (CVSS 8.2, decidim · decidim-core)
- [CVE-2026-1530](https://cve.now/CVE-2026-1530.md): Fog-kubevirt: fog-kubevirt: man-in-the-middle vulnerability due to disabled certificate validation (CVSS 8.1, Red Hat Satellite 6.16 for RHEL · Red Hat Satellite 6.17… +2)
- [CVE-2026-1531](https://cve.now/CVE-2026-1531.md): Foreman-kubevirt: foreman\_kubevirt: man-in-the-middle due to insecure default ssl verification (CVSS 8.1, Red Hat Satellite 6.16 for RHEL · Red Hat Satellite 6.17… +3)
- [CVE-2025-24293](https://cve.now/CVE-2025-24293.md): # Active Storage allowed transformation methods potentially unsafe Active Storage attempts to prevent the use of potentially unsafe image (CVSS 9.2, Rails activestorage · activestorage)
- [CVE-2020-36939](https://cve.now/CVE-2020-36939.md): Cassandra Web 0.5.0 - Remote File Read (CVSS 8.7, avalanche123 Cassandra Web · cassandra-web)
- [CVE-2026-23885](https://cve.now/CVE-2026-23885.md): AlchemyCMS has Authenticated Remote Code Execution (RCE) via eval injection in ResourcesHelper (CVSS 6.4, AlchemyCMS alchemy\_cms · alchemy\_cms)
- [CVE-2025-68271](https://cve.now/CVE-2025-68271.md): Unauthenticated Remote Code Execution in openc3-api (CVSS 10.0, OpenC3 cosmos · openc3)
- [CVE-2026-22589](https://cve.now/CVE-2026-22589.md): Spree API has Unauthenticated IDOR - Guest Address (CVSS 7.5, spree · spree\_core)
- [CVE-2026-22588](https://cve.now/CVE-2026-22588.md): Spree API has Authenticated Insecure Direct Object Reference (IDOR) via Order Modification (CVSS 6.5, spree · spree\_api)
- [CVE-2025-61594](https://cve.now/CVE-2025-61594.md): URI Credential Leakage Bypass over CVE-2025-27221 (CVSS 2.1, ruby uri · uri)
- [CVE-2025-68696](https://cve.now/CVE-2025-68696.md): httparty Has Potential SSRF Vulnerability That Leads to API Key Leakage (CVSS 7.8, jnunemaker httparty · httparty)
- [CVE-2025-14762](https://cve.now/CVE-2025-14762.md): Missing cryptographic key commitment in the AWS SDK for Ruby may allow a user with write access to the S3 bucket to introduce a new EDK that (CVSS 5.3, AWS SDK for Ruby · aws-sdk-s3)
- [CVE-2025-68113](https://cve.now/CVE-2025-68113.md): ALTCHA Proof-of-Work Vulnerable to Challenge Splicing and Replay (CVSS 6.5, altcha-org altcha-lib · altcha-lib +4)
- [CVE-2025-66568](https://cve.now/CVE-2025-66568.md): ruby-saml Libxml2 Canonicalization errors can bypass Digest/Signature validation (CVSS 9.3, SAML-Toolkits ruby-saml · ruby-saml)
- [CVE-2025-66567](https://cve.now/CVE-2025-66567.md): ruby-saml has a SAML authentication bypass due to namespace handling (parser differential) (CVSS 9.3, SAML-Toolkits ruby-saml · ruby-saml)
- [CVE-2025-64501](https://cve.now/CVE-2025-64501.md): ProsemirrorToHtml: Cross-Site Scripting vulnerability through unescaped HTML attribute values (CVSS 7.6, etaminstudio prosemirror\_to\_html · prosemirror\_to\_html)
- [CVE-2025-12790](https://cve.now/CVE-2025-12790.md): Rubygem-mqtt: rubygem-mqtt hostname validation (CVSS 7.4, Nicholas J Humfrey ruby-mqtt · Red Hat Satellite +1)
- [CVE-2025-61921](https://cve.now/CVE-2025-61921.md): Sinatra has ReDoS vulnerability in ETag header value generation (CVSS 2.7, sinatra)
- [CVE-2025-61919](https://cve.now/CVE-2025-61919.md): Rack is vulnerable to a memory-exhaustion DoS through unbounded URL-encoded body parsing (CVSS 7.5, rack)
- [CVE-2025-61780](https://cve.now/CVE-2025-61780.md): Rack has Possible Information Disclosure Vulnerability (CVSS 5.8, rack)
- [CVE-2025-61772](https://cve.now/CVE-2025-61772.md): Rack's multipart parser buffers unbounded per-part headers, enabling DoS (memory exhaustion) (CVSS 7.5, rack)
- [CVE-2025-61771](https://cve.now/CVE-2025-61771.md): Rack's multipart parser buffers large non‑file fields entirely in memory, enabling DoS (memory exhaustion) (CVSS 7.5, rack)
- [CVE-2025-61770](https://cve.now/CVE-2025-61770.md): Rack's unbounded multipart preamble buffering enables DoS (memory exhaustion) (CVSS 7.5, rack)
- [CVE-2025-59830](https://cve.now/CVE-2025-59830.md): Rack QueryParser has an unsafe default allowing params\_limit bypass via semicolon-separated parameters (CVSS 7.5, rack)
- [CVE-2025-58767](https://cve.now/CVE-2025-58767.md): REXML has a DoS condition when parsing malformed XML file (CVSS 1.2, ruby rexml · rexml)
- [CVE-2025-58067](https://cve.now/CVE-2025-58067.md): Basecamp's Google Sign-In for Rails allowed redirects to protocol-relative URI (CVSS 4.2, basecamp google\_sign\_in · google\_sign\_in)
- [CVE-2025-57821](https://cve.now/CVE-2025-57821.md): Basecamp's Google Sign-In for Rails allowed redirects to a malformed URL (CVSS 4.2, basecamp google\_sign\_in · google\_sign\_in)
- [CVE-2011-10026](https://cve.now/CVE-2011-10026.md): Spreecommerce \< 0.50.x API RCE (CVSS 9.3, Spreecommerce · spree +1)
- [CVE-2025-55193](https://cve.now/CVE-2025-55193.md): Active Record logging vulnerable to ANSI escape injection (CVSS 2.7, rails · activerecord)
- [CVE-2011-10019](https://cve.now/CVE-2011-10019.md): Spreecommerce \< 0.60.2 Search Parameter RCE (CVSS 10.0, Spreecommerce · spree)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/ecosystem/rubygems
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.