RubyGems CVE feed and alerts
Every new CVE and security advisory affecting RubyGems packages, merged from the CVE List, GitHub, OSV, NVD and CISA KEV into one entry each, with severity, exploitation status and fixed versions. New entries appear within minutes of their source. The feeds are free and need no API key; the newest 200 are listed below.
- Critical
- 12
- High
- 50
- On CISA KEV
- 0
Of the newest 199
- CVE-2026-126366msgpack-java JRuby decoder allocates from declared header counts with no cap: 5-byte message forces multi-GiB OOMmsgpack-ruby · msgpack
- CVE-2026-126354Addressable path traversal via URI normalizationsporkmonger addressable · addressable
- CVE-2026-126352Addressable: Regular Expression Denial of Service in Addressable templates with multiple variablessporkmonger addressable · addressable
- CVE-2026-126351Addressable: Denial of service in URI path normalizationsporkmonger addressable · addressable
- CVE-2026-126350Addressable remote denial of service in URI template matchingsporkmonger addressable · addressable
- CVE-2026-126349Addressable display_uri can show misleading hosts containing bidi and invisible characterssporkmonger addressable · addressable
- CVE-2026-126348Addressable display_uri can show misleading hosts with invalid Punycode A-labelssporkmonger addressable · addressable
- CVE-2026-126209Loofah allowed_uri? treats javascript: alert(1) as safeflavorjones loofah · loofah
- CVE-2026-126208Loofah: SVG `<textPath>` and `<mpath>` bypass local-reference restrictionflavorjones loofah · loofah
- CVE-2026-126207Loofah: CSS url() sanitization bypass via escaped parenthesesflavorjones loofah · loofah
- CVE-2026-126206Loofah allowed_uri? treats data:text/html as safe text/plainflavorjones loofah · loofah
- CVE-2026-126205Loofah: Regular expression denial of service in the SVG local-reference checkflavorjones loofah · loofah
- CVE-2026-126203Loofah: Mutation XSS in the HTML5 scrubbers through unescaped attribute valuesflavorjones loofah · loofah
- CVE-2026-126188Active Storage: Possible local file disclosure in Active Storage video previews and analysisrails · activestorage
- CVE-2026-126186Active Storage: Possible arbitrary file read and remote code execution in Active Storage video previews, analysis and image processingrails · activestorage
- CVE-2026-126085Active Storage: Possible circumvention of file size limits in Active Storage direct uploads to Google Cloud Storagerails · activestorage
- CVE-2026-126084Active Storage: Unsigned Content-Type in Active Storage GCS direct uploads with cache_controlrails · activestorage
- CVE-2026-126083Ruby on Rails client IP spoofing in ActionDispatch RemoteIprails · actionpack
- CVE-2026-126081Action Pack: Possible Strong Parameters bypass in Parameters#each_keyrails · actionpack
- CVE-2026-126080Active Support: Possible DoS vulnerability in Active Support safe_constantizerails · activesupport
- CVE-2026-126079Ruby on Rails cross-site scripting in Action View text helpersrails · actionview
- CVE-2026-126078Action View: Possible XSS vulnerability in Action View highlight helperrails · actionview
- CVE-2026-126077Action Pack: Possible sensitive session information leak in Active Storage proxy moderails · actionpack
- CVE-2026-126076Action Pack: Possible restoration of destroyed sessions in Action Dispatch CacheStorerails · actionpack
- CVE-2026-126075Active Support: Possible XSS vulnerability in Active Support MessagePack serializerrails · activesupport
- CVE-2026-126074Ruby on Rails denial of service in Active Storage filename handlingrails · activestorage
- CVE-2026-126073Action Pack: Possible cache poisoning in Action Pack content negotiationrails · actionpack
- CVE-2026-126072Action Pack: Possible DoS vulnerability in Action Controller Live streamingrails · actionpack
- CVE-2026-126071Ruby on Rails denial of service in Active Storage proxy downloadsrails · activestorage
- CVE-2026-126070Action View: Possible XSS vulnerability in Action View strip_tagsrails · actionview
- CVE-2026-126069Action View: Possible XSS vulnerability in Action View tag helpersrails · actionview
- CVE-2026-126068Action Mailbox: Possible signature replay in Action Mailbox Mailgun ingressrails · actionmailbox
- CVE-2026-126067Ruby on Rails cross-site request forgery via session cookiesrails · actionpack
- CVE-2026-126064Nokogiri: Possible Use-After-Free when setting an attribute value via `Nokogiri::XML::Node#[]=` or `#lang=`sparklemotion nokogiri · nokogiri
- CVE-2026-126063Nokogiri mutation XSS via noscript in HTML5 serializersparklemotion nokogiri · nokogiri
- CVE-2026-126062Nokogiri : Possible SSRF on JRuby when resolving external DTDs or entities with `NONET` setsparklemotion nokogiri · nokogiri
- CVE-2026-125111Rack: Multipart parsing allows DoS via unbounded scan buffer growthrack
- CVE-2026-125110Rack: Rack::Static header_rules bypass via dot-segment normalization mismatchrack
- CVE-2026-125109Rack: Rack::Request#host_with_port (and #base_url / #url) return the raw invalid Host header — incomplete fix of CVE-2026-34835rack
- CVE-2026-125108Rack firewall bypass in multipart boundary parserrack
- CVE-2026-63183OmniAuth: Host Header Injection Vulnerabilityomniauth
- CVE-2026-122006The activestorage gem before 8.1.4.1 for Ruby on Rails, when ImageMagick attachment processing occurs, can allow server read and write…rubyonrails Active Storage · activestorage
- CVE-2026-63414Shopify App: Token exchange shop context confusion may allow cross-shop authorization bypass in affected appsshopify_app
- CVE-2026-61848Crass: Non-ASCII characters cause superlinear CPU consumptionrgrove crass · crass
- CVE-2026-61847Crass: A large number of adjacent CSS comments can trigger a SystemStackErrorrgrove crass · crass
- CVE-2026-61846Crass: Deeply nested CSS blocks and functions can trigger a SystemStackError or excessive memory usagergrove crass · crass
- CVE-2026-116695Crass: Incorrect tokenization of bad URLs enables CSS sanitizer bypassrgrove crass · crass
- CVE-2026-107715Mechanize sends credential headers to another host after an HTTP redirectsparklemotion mechanize · mechanize
- CVE-2026-107399Mechanize sends credential headers to another origin after a meta refreshsparklemotion mechanize · mechanize
- CVE-2026-55107Kobako Vulnerable to Sandbox Escape: guest eval reaches host RCE via method_missing → public_send (any bound Service)elct9620 kobako · kobako
Show all 199 entriesShow fewer entries
- CVE-2026-77602OpenC3 COSMOS: Authenticated remote code execution via the user-writable config overlay (table definitions, cmd/tlm definitions, and script suites)OpenC3 cosmos · openc3
- CVE-2026-77601OpenC3 COSMOS: Authenticated OS command injection via the pypi_url settingOpenC3 cosmos · openc3
- CVE-2026-61570MPXJ: XXE Vulnerability in MerlinReaderjoniles mpxj · net.sf.mpxj:mpxj +5
- CVE-2026-65829MPXJ: Potential Path Traversal Vulnerability in Primavera P3 PRX and SureTrak STX readersjoniles mpxj · mpxj +5
- CVE-2026-94462Spree: Broken Access Control in PATCH /api/v3/store/carts/:id/associate (IDOR)spree · spree_api
- CVE-2026-44163fluent-plugin-opentelemetry: Denial of Service (DoS) via Large Payloads and Decompression Bombs in in_opentelemetryfluent-plugins-nursery fluent-plugin-opentelemetry · fluent…
- CVE-2026-44282Election question titles allow stored script executiondecidim · decidim-elections
- CVE-2026-44162fluent-plugin-s3: Denial of Service (DoS) via Decompression Bomb in in_s3fluent-plugin-s3
- CVE-2026-70658pay-rails/pay: non-constant-time HMAC comparison in Paddle Billing webhook signature verifierpay-rails pay · pay
- CVE-2026-50276dd-trace-rb: Improper parsing of W3C baggage headers may lead to DoSDataDog dd-trace-rb · datadog
- CVE-2026-57579Alchemy: Unauthenticated nested page API leaks restricted & unpublished contentAlchemyCMS alchemy_cms · alchemy_cms
- CVE-2023-46035The svg_optimizer gem before 0.3.0 for Ruby performs entity expansion on untrusted documentsfnando svg_optimizer · svg_optimizer
- CVE-2026-86100Camaleon CMS 2.7.5 through 2.9.1 SSRF via HTTP Redirect in Upload from URLowen2345 camaleon_cms
- CVE-2026-53769Avo: Direct attachment upload endpoint lacks upload authorization and bypasses field-level upload policyavo-hq avo · avo
- CVE-2026-85396rubyzip before 3.4.0 Path Traversal in Zip::Entry#extract via Sibling-Directory Prefixrubyzip
- CVE-2026-63435Mail: Email address spoofing via malformed RFC 2047 encoded-wordsmikel mail · mail
- CVE-2026-44476Doorkeeper OpenID Connect: Dynamic Client Registration feature creates public clients with client_secretdoorkeeper-gem doorkeeper-openid_connect · doorkeeper-openi…
- CVE-2026-79772Nokogiri before 1.19.1 Unchecked Return Value canonicalizesparklemotion nokogiri · nokogiri
- CVE-2026-79771Nokogiri before 1.19.3 Memory Leak via XSLT Transformsparklemotion nokogiri · nokogiri
- CVE-2026-79770Nokogiri before 1.19.3 ReDoS via CSS selector tokenizersparklemotion nokogiri · nokogiri
- CVE-2026-73426Trix: Stored XSS vulnerability through serialized attributesbasecamp trix · action_text-trix +1
- CVE-2026-61666websocket-driver: Denial of service via malformed Host headerfaye websocket-driver-ruby · websocket-driver
- CVE-2026-73428Trix: Stored XSS via HTMLParser attribute injection on pastebasecamp trix · trix +1
- CVE-2026-73648rails-html-sanitizer: Possible XSS vulnerability with certain configurationsrails-html-sanitizer
- CVE-2026-73492Loofah allowed_uri? does not detect javascript: URIs split by numeric character references without semicolonsflavorjones loofah · loofah
- CVE-2026-73491Loofah allowed_uri? does not detect javascript: URIs split by named whitespace character referencesflavorjones loofah · loofah
- CVE-2026-73490Loofah: SVG href attribute bypasses local-reference restrictionflavorjones loofah · loofah
- CVE-2026-73427Trix: XSS via JSON deserialization bypass in drag-and-drop (Level0InputController)basecamp trix · trix +1
- CVE-2026-71847Ruby JSON: JSON::ResumableParser#partial_value dereferences a freed input buffer and crashes on truncated duplicate-key streamsruby json · json
- CVE-2026-45378Decidim: Verification documents can be downloaded through reusable linksdecidim · decidim-verifications
- CVE-2026-45573Decidim: Push subscriptions can be abused for server-side requestsdecidim · decidim-core
- CVE-2026-45572Decidim: HTML content blocks allow stored script executiondecidim · decidim-core
- CVE-2026-45415Decidim: CSV census record endpoints improper authorizationdecidim · decidim-verifications
- CVE-2026-45414Decidim: JWT-backed authentication can be replayed across organizationsdecidim
- CVE-2026-45377Decidim: Private exports can be downloaded through reusable linksdecidim · decidim-core
- CVE-2026-45376Decidim: Admin user search allows SQL injection through similarity-based sortingdecidim · decidim-admin
- CVE-2026-45330Decidim: Verification admins can access supplied IDs from other organisationsdecidim · decidim-verifications
- CVE-2026-45086Decidim: Forms admin question editor lacks authorizationdecidim · decidim-demographics
- CVE-2026-53510Savon::Model evaluates WSDL operation names as Ruby sourcesavonrb savon · savon
- CVE-2026-66066Action Pack: Possible arbitrary file read and remote code execution in Active Storage variant processingrails · activestorage
- CVE-2026-54522MessagePack::Buffer#clear Use-After-Free that Enables Cross-Buffer Disclosuremsgpack-ruby · msgpack
- CVE-2026-67432MCP Ruby SDK: Unbounded JSON-RPC request body causes uncontrolled memory allocation in StreamableHTTPTransportmodelcontextprotocol ruby-sdk · mcp
- CVE-2026-67431MCP Ruby SDK: Ruby SSE Session Poisoningmodelcontextprotocol ruby-sdk · mcp
- CVE-2026-63119MCP Ruby SDK: Unbounded line buffer in stdio transports leads to memory exhaustion (DoS)modelcontextprotocol ruby-sdk · mcp
- CVE-2026-67430MCP Ruby SDK: Unbounded session retention in StreamableHTTPTransport allows memory exhaustion via initialize floodmodelcontextprotocol ruby-sdk · mcp
- CVE-2026-63118MCP Ruby SDK: Streamable HTTP transport lacks DNS-rebinding (Host/Origin) protectionmodelcontextprotocol ruby-sdk · mcp
- CVE-2026-54659Pagy I18n locale option is not validated before being used in a file pathddnexus pagy · pagy
- CVE-2026-54603OAuth2::Client#request: Protocol-relative redirect Location overrides authority, leaking bearer Authorization to attacker hostruby-oauth oauth2 · oauth2
- CVE-2026-54605OAuth: Cross-origin token-request redirects can expose signed request metadataruby-oauth oauth · oauth
- CVE-2026-54620sqlite3-ruby has Use-After-Free in SQLite Aggregate Function Callbackssparklemotion sqlite3-ruby · sqlite3-ruby +1
- CVE-2026-54619sqlite3-ruby has Use-After-Free When Redefining SQLite Functions with Different Aritysparklemotion sqlite3-ruby · sqlite3-ruby +1
- CVE-2026-55518Avo: Missing Authorization in Avo Association Attach Endpoint Allows Unauthorized Relationship Manipulation and Privilege Escalationavo-hq avo · avo
- CVE-2026-54498view_component: around_render HTML-Safety BypassViewComponent view_component · view_component
- CVE-2026-54497view_component: Reused Component Instances Retain Stale Render ContextViewComponent view_component · view_component
- CVE-2026-53727css_parser: SSRF and Local File Disclosure in CssParser::Parser#read_remote_filepremailer css_parser · css_parser
- CVE-2026-54163secure_headers: CSP directive injection via sandbox, plugin_types, and report_to when given untrusted inputgithub secure_headers · secure_headers
- CVE-2026-54171Excon: redact additional sensitive/risky headers when following redirectsexcon
- CVE-2026-54465websocket-driver: Memory exhaustion in HTTP header parserfaye websocket-driver-ruby · websocket-driver
- CVE-2026-54463websocket-driver: Memory exhaustion via abuse of protocol length headersfaye websocket-driver-ruby · websocket-driver
- CVE-2026-54464websocket-driver: Resource limit bypass via message compressionfaye websocket-driver-ruby · websocket-driver
- CVE-2026-45363jwt (Ruby gem) - empty-key HMAC bypassruby-jwt · jwt
- CVE-2026-47736Puma PROXY Protocol v1 Parser Allows Remote Memory Exhaustionpuma
- CVE-2026-47737Puma PROXY Protocol v1 Accepts Repeated Protocol Headers on Persistent Connectionspuma
- CVE-2026-44161Fluentd: Server-Side Request Forgery (SSRF) via Placeholder Expansion in out_httpfluentd
- CVE-2026-44160Fluentd: Denial of Service (DoS) via Gzip Decompression Bomb in in_http and in_forwardfluentd
- CVE-2026-44025Fluentd: Exposure of Sensitive Information via Monitor Agent APIfluentd
- CVE-2026-44024Fluentd: Remote Code Execution (RCE) via Arbitrary File Write in ${tag} Placeholderfluentd
- CVE-2026-54903Oj: Integer Overflow in Oj.load 2GB String Handlingohler55 oj · oj
- CVE-2026-54902Oj: Use-After-Free in Oj::Parser SAJ Long Key Callbackohler55 oj · oj
- CVE-2026-54901Oj: Use-After-Free in Oj::Parser array_class/hash_class GC Markingohler55 oj · oj
- CVE-2026-54900Oj: Negative-Size memcpy in Oj::Parser create_id Attribute Handlingohler55 oj · oj
- CVE-2026-54898Oj: Use-After-Free in Oj::Parser SAJ Callback via Input Mutationohler55 oj · oj
- CVE-2026-54897Oj : Use-After-Free in Oj::Doc Iterators via Reentrant Closeohler55 oj · oj
- CVE-2026-54896Oj: Heap Buffer Overflow in Oj.dump Exception Serialization via Large Indentohler55 oj · oj
- CVE-2026-54592Oj: Stack Buffer Overflow in Oj::Doc#each_child via Deeply Nested Inputohler55 oj · oj
- CVE-2026-54502Oj: Stack Buffer Overflow in Oj.dump via Large Indentohler55 oj · oj
- CVE-2026-54500Oj: intern.c form_attr has an uninitialized stack readohler55 oj · oj
- CVE-2026-54899Oj: Use-After-Free in Oj::Parser Symbol Key Cache Toggleohler55 oj · oj
- CVE-2026-54696Ruby JSON: JSON generator heap buffer overflow when streaming to an IOruby json · json
- CVE-2026-57438Nokogiri: Possible Use-After-Free in XInclude Processingsparklemotion nokogiri · nokogiri
- CVE-2026-57437Nokogiri: Possible Use-After-Free when directly using `NokogirI::XML::XPathContext` beyond document lifetimesparklemotion nokogiri · nokogiri
- CVE-2026-57436Nokogiri: Possible Use-After-Free when setting `Document#root=` to an invalid node typesparklemotion nokogiri · nokogiri
- CVE-2026-57435Nokogiri: Possible Use-After-Free when setting an attribute value via `Nokogiri::XML::Attr#value=` or `#content=`sparklemotion nokogiri · nokogiri
- CVE-2026-57434Nokogiri: Null Pointer Dereference calling methods on uninitialized wrapper classessparklemotion nokogiri · nokogiri
- CVE-2026-57235Nokogiri: Possible Out-of-Bounds Read in `Nokogiri::XML::NodeSet#[]`sparklemotion nokogiri · nokogiri
- CVE-2026-57234Nokogiri: XML::Schema on JRuby allows network requests when NONET is set, bypassing CVE-2020-26247sparklemotion nokogiri · nokogiri
- CVE-2026-57236Nokogiri: Possible Use-After-Free when `Nokogiri::XML::Document#encoding=` raises an exceptionsparklemotion nokogiri · nokogiri
- CVE-2026-54297Faraday: Uncontrolled recursion in NestedParamsEncoder allows stack exhaustion DoS via deeply nested query parameterslostisland faraday · faraday
- CVE-2026-54906concurrent-ruby: ReadWriteLock allows wrong-thread write release and stray read-release counter corruptionruby-concurrency concurrent-ruby · concurrent-ruby
- CVE-2026-54904concurrent-ruby: AtomicReference#update livelocks when the stored value is Float::NANruby-concurrency concurrent-ruby · concurrent-ruby
- CVE-2026-54905concurrent-ruby: `ReentrantReadWriteLock` read-count overflow grants a write lock without exclusivityruby-concurrency concurrent-ruby · concurrent-ruby
- CVE-2026-47242Net::IMAP: Command Injection via ID command argumentruby net-imap · net-imap
- CVE-2026-47240Net::IMAP: Command Injection via non-synchronizing literal in "raw" argumentruby net-imap · net-imap
- CVE-2026-47241Net::IMAP: Denial of Service via incomplete raw argument validationruby net-imap · net-imap
- CVE-2026-49342YARD static cache reads raw traversal paths before router sanitizationlsegal yard · yard
- CVE-2026-12515Katello: missing repository authorization in content_uploads exposes cross-product content existenceRed Hat Satellite 6.16 for RHEL · Red Hat Satellite 6.17… +5
- CVE-2026-44587CarrierWave has a denylisted_content_type bypass via Unescaped Regex Metacharacterscarrierwaveuploader carrierwave · carrierwave
- CVE-2026-44836view_component: Preview Route Can Dispatch Inherited Helper MethodsViewComponent view_component · view_component
- CVE-2026-44837view_component: System Test Entry Point Path Check Allows Sibling Directory EscapeViewComponent view_component · view_component
- CVE-2026-40295Devise: Open Redirect via Unvalidated request.referrer in Timeoutable Session Timeout Handlerheartcombo devise · devise
- CVE-2026-33637Faraday: Protocol-relative URI objects still bypass host scoping (possible incomplete fix for GHSA-33mh-2634-fwr2)lostisland faraday · faraday
- CVE-2026-44511Katalyst Koi: Session cookies can be replayed after user logoutkatalyst koi · katalyst-koi
- CVE-2026-44312css_parser allows to MITM included https css urlspremailer css_parser · css_parser
- CVE-2026-42258net-imap: Command Injection via unvalidated Symbol inputsruby net-imap · net-imap
- CVE-2026-42257net-imap: Command Injection via "raw" arguments to multiple commandsruby net-imap · net-imap
- CVE-2026-42256net-imap: Denial of service via high iteration count for SCRAM- authenticationruby net-imap · net-imap
- CVE-2026-42245net-imap: Quadratic complexity when reading response literalsruby net-imap · net-imap
- CVE-2026-42246net-imap vulnerable to STARTTLS stripping via invalid response timingruby net-imap · net-imap
- CVE-2026-42205Avo: Broken Access Control: Unauthorized Execution of Arbitrary Action Classes Across Resourcesavo-hq avo · avo
- CVE-2026-41493yard: Possible arbitrary path traversal and file access via yard serverlsegal yard · yard
- CVE-2025-67202Sidekiq-cron thru 2.3.1, an open-source scheduling add-on for Sidekiq, is vulnerable to a cross-site scripting (xss) vulnerability via crafted URL being rended from cron.erbsidekiq-cron
- CVE-2026-42088OpenC3 COSMOS: Administrative Actions via the Script Runner ToolOpenC3 cosmos · openc3
- CVE-2026-42087OpenC3 COSMOS: SQL Injection in QuestDB Time-Series Data BaseOpenC3 cosmos · openc3
- CVE-2026-42086OpenC3 COSMOS: Self-XSS in the Command SenderOpenC3 cosmos · openc3
- CVE-2026-42085OpenC3 COSMOS: Arbitrary write to plugins directory via path-traversed config filenamesOpenC3 cosmos · openc3
- CVE-2026-42084OpenC3 COSMOS: Hijacked session token can be used to reset password for persistenceOpenC3 cosmos · openc3
- CVE-2026-41316ERB has an @_init deserialization guard bypass via def_module / def_method / def_classruby erb · erb
- CVE-2026-41146facil.io and downstream iodine ruby gem vulnerable to uncontrolled resource consumption and loop with unreachable exit conditionboazsegev facil.io · boazsegev iodine +1
- CVE-2026-40869Decidim amendments can be accepted or rejected by anyonedecidim · decidim-core
- CVE-2026-27820zlib: Buffer Overflow in Zlib::GzipReader ungetc via large input leads to memory corruptionruby zlib · zlib
- CVE-2026-23891Decidim has a Cross-site scripting (XSS) vulnerability via user name fielddecidim · decidim-core
- CVE-2026-40070bsv-sdk and bsv-wallet persist unverified certifier signatures in acquire_certificate (direct and issuance paths)sgbett bsv-ruby-sdk · sgbett bsv-sdk +3
- CVE-2026-40069bsv-sdk ARC broadcaster treats INVALID/MALFORMED/ORPHAN responses as successful broadcastssgbett bsv-ruby-sdk · bsv-sdk
- CVE-2026-39324Rack::Session::Cookie secrets: decrypt failure fallback enables secretless session forgery and Marshal deserializationrack-session
- CVE-2026-35611Addressable has a Regular Expression Denial of Service in Addressable templatessporkmonger addressable · addressable
- CVE-2026-35201Discount has an Out-of-bounds Read in rdiscountdavidfstr rdiscount · rdiscount
- CVE-2026-26962Rack: Header injection in multipart requestsrack
- CVE-2026-34835Rack is a modular Ruby web server interfacerack
- CVE-2026-34827Rack: Algorithmic-Complexity DoS in Rack::Multipart::Parserrack
- CVE-2026-32762Rack: Forwarded Header semicolon injection enables Host and Scheme spoofingrack
- CVE-2026-34830Rack: Rack::Sendfile regex injection via HTTP_X_ACCEL_MAPPING header allows arbitrary file reads through nginxrack
- CVE-2026-34829Rack: Denial of Service via Unbounded Multipart File Upload Without Content-Lengthrack
- CVE-2026-34826Rack: Unbounded Range Count in get_byte_ranges Enables DoSrack
- CVE-2026-34786Rack: Rack::Static header_rules bypass via URL-encoded pathsrack
- CVE-2026-34785Rack: Local file inclusion in Rack::Static via URL Prefix Matchingrack
- CVE-2026-34763Rack: Rack::Directory info disclosure and DoS via unescaped regex interpolationrack
- CVE-2026-34831Rack: Content-Length mismatch in Rack::Files error responsesrack
- CVE-2026-26961Rack: Multipart Boundary Parsing Ambiguity allowing WAF Bypassrack
- CVE-2026-34230Rack: Quadratic complexity in Rack::Utils.select_best_encoding via wildcard Accept-Encoding headerrack
- CVE-2026-34060Ruby LSP has arbitrary code execution through branch settingShopify ruby-lsp · Shopify.ruby-lsp +1
- CVE-2026-33946MCP Ruby SDK: Insufficient Session Binding Allows SSE Stream Hijacking via Session ID Replaymodelcontextprotocol ruby-sdk · mcp
- CVE-2026-33658Rails Active Storage has a possible DoS vulnerability in proxy mode via multi-range requestsrails activestorage · activestorage
- CVE-2026-33635iCalendar has ICS injection via unsanitized URI property valuesicalendar
- CVE-2026-33306bcrypt-ruby has an Integer Overflow that Causes Zero Key-Strengthening Iterations at Cost=31 on JRubybcrypt-ruby · bcrypt
- CVE-2026-33286Graphiti Affected by Arbitrary Method Execution via Unvalidated Relationship Namesgraphiti-api graphiti · graphiti
- CVE-2026-33202Rails Active Storage has possible glob injection in its DiskServicerails activestorage · activestorage
- CVE-2026-33195Rails Active Storage has possible Path Traversal in DiskServicerails activestorage · activestorage
- CVE-2026-33176Rails Active Support has a possible DoS vulnerability in its number helpersrails activesupport · activesupport
- CVE-2026-33174Rails Active Storage has a possible DoS vulnerability when in proxy mode via Range requestsrails activestorage · activestorage
Get alerts for new RubyGems CVEs
Only want the packages you use? Check a lockfile to get a feed for your stack.
https://cve.now/feed?ecosystem=rubygems
Paste into Feedly or any RSS reader, or run /feed subscribe https://cve.now/feed?ecosystem=rubygems in Slack. For email alerts, give it to an RSS-to-email service.
https://cve.now/feed?ecosystem=rubygems&format=atom
The same entries as Atom, for readers that prefer it.
https://cve.now/feed?ecosystem=rubygems&format=json
The same entries as JSON Feed 1.1, for scripts and readers that support it.
Frequently asked questions
What are the latest RubyGems packages CVEs?
The newest are CVE-2026-126366 (msgpack-java JRuby decoder allocates from declared header counts with no cap: 5-byte message forces multi-GiB OOM); CVE-2026-126354 (Addressable path traversal via URI normalization); CVE-2026-126352 (Addressable: Regular Expression Denial of Service in Addressable templates with multiple variables).
Are any RubyGems packages CVEs being exploited?
None of the 199 newest RubyGems packages vulnerabilities are on CISA's Known Exploited Vulnerabilities list.
How many critical RubyGems packages CVEs are there?
12 of the 199 newest are rated critical (CVSS 9.0 or higher, or rated critical by their source when they have no score): CVE-2026-122006, CVE-2026-55107, CVE-2026-77602, CVE-2026-66066, CVE-2026-55518 and more.
How do I get alerts for new RubyGems packages CVEs?
Subscribe to this page's RSS, Atom or JSON feed, or connect a coding agent to the cve.now MCP server. Each new entry appears within minutes of its source.
Is there an RSS feed of RubyGems CVEs?
Yes: https://cve.now/feed?ecosystem=rubygems. Add format=atom or format=json for Atom or JSON Feed. It is free and needs no account or API key.
How do I get RubyGems CVEs in Slack or by email?
In Slack, run /feed subscribe https://cve.now/feed?ecosystem=rubygems. For email, give the RSS URL to any RSS-to-email service.