# cve.now: RubyGems packages

The newest entries affecting RubyGems packages (up to 200). To check exact package versions, use the MCP stack.check operation or /stack.

- [CVE-2026-126366](https://cve.now/CVE-2026-126366.md): msgpack-java JRuby decoder allocates from declared header counts with no cap: 5-byte message forces multi-GiB OOM (CVSS 7.5, msgpack-ruby · msgpack)
- [CVE-2026-126354](https://cve.now/CVE-2026-126354.md): Addressable path traversal via URI normalization (CVSS 4.8, sporkmonger addressable · addressable)
- [CVE-2026-126352](https://cve.now/CVE-2026-126352.md): Addressable: Regular Expression Denial of Service in Addressable templates with multiple variables (CVSS 5.9, sporkmonger addressable · addressable)
- [CVE-2026-126351](https://cve.now/CVE-2026-126351.md): Addressable: Denial of service in URI path normalization (CVSS 5.9, sporkmonger addressable · addressable)
- [CVE-2026-126350](https://cve.now/CVE-2026-126350.md): Addressable remote denial of service in URI template matching (CVSS 5.9, sporkmonger addressable · addressable)
- [CVE-2026-126349](https://cve.now/CVE-2026-126349.md): Addressable display\_uri can show misleading hosts containing bidi and invisible characters (CVSS 3.1, sporkmonger addressable · addressable)
- [CVE-2026-126348](https://cve.now/CVE-2026-126348.md): Addressable display\_uri can show misleading hosts with invalid Punycode A-labels (CVSS 4.3, sporkmonger addressable · addressable)
- [CVE-2026-126209](https://cve.now/CVE-2026-126209.md): Loofah allowed\_uri? treats javascript&#x3a alert(1) as safe (CVSS 5.3, flavorjones loofah · loofah)
- [CVE-2026-126208](https://cve.now/CVE-2026-126208.md): Loofah: SVG \`\<textPath\>\` and \`\<mpath\>\` bypass local-reference restriction (CVSS 4.7, flavorjones loofah · loofah)
- [CVE-2026-126207](https://cve.now/CVE-2026-126207.md): Loofah: CSS url() sanitization bypass via escaped parentheses (CVSS 4.7, flavorjones loofah · loofah)
- [CVE-2026-126206](https://cve.now/CVE-2026-126206.md): Loofah allowed\_uri? treats data:text&sol;html as safe text/plain (CVSS 5.3, flavorjones loofah · loofah)
- [CVE-2026-126205](https://cve.now/CVE-2026-126205.md): Loofah: Regular expression denial of service in the SVG local-reference check (CVSS 5.3, flavorjones loofah · loofah)
- [CVE-2026-126203](https://cve.now/CVE-2026-126203.md): Loofah: Mutation XSS in the HTML5 scrubbers through unescaped attribute values (CVSS 6.1, flavorjones loofah · loofah)
- [CVE-2026-126188](https://cve.now/CVE-2026-126188.md): Active Storage: Possible local file disclosure in Active Storage video previews and analysis (CVSS 3.7, rails · activestorage)
- [CVE-2026-126186](https://cve.now/CVE-2026-126186.md): Active Storage: Possible arbitrary file read and remote code execution in Active Storage video previews, analysis and image processing (CVSS 8.8, rails · activestorage)
- [CVE-2026-126085](https://cve.now/CVE-2026-126085.md): Active Storage: Possible circumvention of file size limits in Active Storage direct uploads to Google Cloud Storage (CVSS 5.3, rails · activestorage)
- [CVE-2026-126084](https://cve.now/CVE-2026-126084.md): Active Storage: Unsigned Content-Type in Active Storage GCS direct uploads with cache\_control (CVSS 4.7, rails · activestorage)
- [CVE-2026-126083](https://cve.now/CVE-2026-126083.md): Ruby on Rails client IP spoofing in ActionDispatch RemoteIp (CVSS 7.4, rails · actionpack)
- [CVE-2026-126081](https://cve.now/CVE-2026-126081.md): Action Pack: Possible Strong Parameters bypass in Parameters#each\_key (CVSS 7.5, rails · actionpack)
- [CVE-2026-126080](https://cve.now/CVE-2026-126080.md): Active Support: Possible DoS vulnerability in Active Support safe\_constantize (CVSS 7.5, rails · activesupport)
- [CVE-2026-126079](https://cve.now/CVE-2026-126079.md): Ruby on Rails cross-site scripting in Action View text helpers (CVSS 6.1, rails · actionview)
- [CVE-2026-126078](https://cve.now/CVE-2026-126078.md): Action View: Possible XSS vulnerability in Action View highlight helper (CVSS 6.1, rails · actionview)
- [CVE-2026-126077](https://cve.now/CVE-2026-126077.md): Action Pack: Possible sensitive session information leak in Active Storage proxy mode (CVSS 6.8, rails · actionpack)
- [CVE-2026-126076](https://cve.now/CVE-2026-126076.md): Action Pack: Possible restoration of destroyed sessions in Action Dispatch CacheStore (CVSS 4.2, rails · actionpack)
- [CVE-2026-126075](https://cve.now/CVE-2026-126075.md): Active Support: Possible XSS vulnerability in Active Support MessagePack serializer (CVSS 4.7, rails · activesupport)
- [CVE-2026-126074](https://cve.now/CVE-2026-126074.md): Ruby on Rails denial of service in Active Storage filename handling (CVSS 4.3, rails · activestorage)
- [CVE-2026-126073](https://cve.now/CVE-2026-126073.md): Action Pack: Possible cache poisoning in Action Pack content negotiation (CVSS 4.8, rails · actionpack)
- [CVE-2026-126072](https://cve.now/CVE-2026-126072.md): Action Pack: Possible DoS vulnerability in Action Controller Live streaming (CVSS 5.9, rails · actionpack)
- [CVE-2026-126071](https://cve.now/CVE-2026-126071.md): Ruby on Rails denial of service in Active Storage proxy downloads (CVSS 5.3, rails · activestorage)
- [CVE-2026-126070](https://cve.now/CVE-2026-126070.md): Action View: Possible XSS vulnerability in Action View strip\_tags (CVSS 6.1, rails · actionview)
- [CVE-2026-126069](https://cve.now/CVE-2026-126069.md): Action View: Possible XSS vulnerability in Action View tag helpers (CVSS 4.7, rails · actionview)
- [CVE-2026-126068](https://cve.now/CVE-2026-126068.md): Action Mailbox: Possible signature replay in Action Mailbox Mailgun ingress (CVSS 3.7, rails · actionmailbox)
- [CVE-2026-126067](https://cve.now/CVE-2026-126067.md): Ruby on Rails cross-site request forgery via session cookies (CVSS 3.1, rails · actionpack)
- [CVE-2026-126064](https://cve.now/CVE-2026-126064.md): Nokogiri: Possible Use-After-Free when setting an attribute value via \`Nokogiri::XML::Node#\[\]=\` or \`#lang=\` (CVSS 2.0, sparklemotion nokogiri · nokogiri)
- [CVE-2026-126063](https://cve.now/CVE-2026-126063.md): Nokogiri mutation XSS via noscript in HTML5 serializer (CVSS 2.3, sparklemotion nokogiri · nokogiri)
- [CVE-2026-126062](https://cve.now/CVE-2026-126062.md): Nokogiri : Possible SSRF on JRuby when resolving external DTDs or entities with \`NONET\` set (CVSS 3.7, sparklemotion nokogiri · nokogiri)
- [CVE-2026-125111](https://cve.now/CVE-2026-125111.md): Rack: Multipart parsing allows DoS via unbounded scan buffer growth (CVSS 7.5, rack)
- [CVE-2026-125110](https://cve.now/CVE-2026-125110.md): Rack: Rack::Static header\_rules bypass via dot-segment normalization mismatch (CVSS 5.3, rack)
- [CVE-2026-125109](https://cve.now/CVE-2026-125109.md): Rack: Rack::Request#host\_with\_port (and #base\_url / #url) return the raw invalid Host header — incomplete fix of CVE-2026-34835 (CVSS 4.8, rack)
- [CVE-2026-125108](https://cve.now/CVE-2026-125108.md): Rack firewall bypass in multipart boundary parser (CVSS 3.7, rack)
- [CVE-2026-63183](https://cve.now/CVE-2026-63183.md): OmniAuth: Host Header Injection Vulnerability (CVSS 6.9, omniauth)
- [CVE-2026-122006](https://cve.now/CVE-2026-122006.md): The activestorage gem before 8.1.4.1 for Ruby on Rails, when ImageMagick attachment processing occurs, can allow server read and write… (CVSS 9.8, rubyonrails Active Storage · activestorage)
- [CVE-2026-63414](https://cve.now/CVE-2026-63414.md): Shopify App: Token exchange shop context confusion may allow cross-shop authorization bypass in affected apps (CVSS 7.6, shopify\_app)
- [CVE-2026-61848](https://cve.now/CVE-2026-61848.md): Crass: Non-ASCII characters cause superlinear CPU consumption (CVSS 6.3, rgrove crass · crass)
- [CVE-2026-61847](https://cve.now/CVE-2026-61847.md): Crass: A large number of adjacent CSS comments can trigger a SystemStackError (CVSS 6.3, rgrove crass · crass)
- [CVE-2026-61846](https://cve.now/CVE-2026-61846.md): Crass: Deeply nested CSS blocks and functions can trigger a SystemStackError or excessive memory usage (CVSS 6.3, rgrove crass · crass)
- [CVE-2026-116695](https://cve.now/CVE-2026-116695.md): Crass: Incorrect tokenization of bad URLs enables CSS sanitizer bypass (CVSS 5.3, rgrove crass · crass)
- [CVE-2026-107715](https://cve.now/CVE-2026-107715.md): Mechanize sends credential headers to another host after an HTTP redirect (CVSS 6.8, sparklemotion mechanize · mechanize)
- [CVE-2026-107399](https://cve.now/CVE-2026-107399.md): Mechanize sends credential headers to another origin after a meta refresh (CVSS 6.8, sparklemotion mechanize · mechanize)
- [CVE-2026-55107](https://cve.now/CVE-2026-55107.md): Kobako Vulnerable to Sandbox Escape: guest eval reaches host RCE via method\_missing → public\_send (any bound Service) (CVSS 10.0, elct9620 kobako · kobako)
- [CVE-2026-77602](https://cve.now/CVE-2026-77602.md): OpenC3 COSMOS: Authenticated remote code execution via the user-writable config overlay (table definitions, cmd/tlm definitions, and script suites) (CVSS 9.9, OpenC3 cosmos · openc3)
- [CVE-2026-77601](https://cve.now/CVE-2026-77601.md): OpenC3 COSMOS: Authenticated OS command injection via the pypi\_url setting (CVSS 8.8, OpenC3 cosmos · openc3)
- [CVE-2026-61570](https://cve.now/CVE-2026-61570.md): MPXJ: XXE Vulnerability in MerlinReader (CVSS 7.5, joniles mpxj · net.sf.mpxj:mpxj +5)
- [CVE-2026-65829](https://cve.now/CVE-2026-65829.md): MPXJ: Potential Path Traversal Vulnerability in Primavera P3 PRX and SureTrak STX readers (CVSS 5.3, joniles mpxj · mpxj +5)
- [CVE-2026-94462](https://cve.now/CVE-2026-94462.md): Spree: Broken Access Control in PATCH /api/v3/store/carts/:id/associate (IDOR) (CVSS 7.1, spree · spree\_api)
- [CVE-2026-44163](https://cve.now/CVE-2026-44163.md): fluent-plugin-opentelemetry: Denial of Service (DoS) via Large Payloads and Decompression Bombs in in\_opentelemetry (CVSS 5.3, fluent-plugins-nursery fluent-plugin-opentelemetry · fluent…)
- [CVE-2026-44282](https://cve.now/CVE-2026-44282.md): Election question titles allow stored script execution (CVSS 4.8, decidim · decidim-elections)
- [CVE-2026-44162](https://cve.now/CVE-2026-44162.md): fluent-plugin-s3: Denial of Service (DoS) via Decompression Bomb in in\_s3 (CVSS 2.7, fluent-plugin-s3)
- [CVE-2026-70658](https://cve.now/CVE-2026-70658.md): pay-rails/pay: non-constant-time HMAC comparison in Paddle Billing webhook signature verifier (CVSS 7.4, pay-rails pay · pay)
- [CVE-2026-50276](https://cve.now/CVE-2026-50276.md): dd-trace-rb: Improper parsing of W3C baggage headers may lead to DoS (CVSS 7.5, DataDog dd-trace-rb · datadog)
- [CVE-2026-57579](https://cve.now/CVE-2026-57579.md): Alchemy: Unauthenticated nested page API leaks restricted & unpublished content (CVSS 7.5, AlchemyCMS alchemy\_cms · alchemy\_cms)
- [CVE-2023-46035](https://cve.now/CVE-2023-46035.md): The svg\_optimizer gem before 0.3.0 for Ruby performs entity expansion on untrusted documents (CVSS 5.9, fnando svg\_optimizer · svg\_optimizer)
- [CVE-2026-86100](https://cve.now/CVE-2026-86100.md): Camaleon CMS 2.7.5 through 2.9.1 SSRF via HTTP Redirect in Upload from URL (CVSS 5.3, owen2345 camaleon\_cms)
- [CVE-2026-53769](https://cve.now/CVE-2026-53769.md): Avo: Direct attachment upload endpoint lacks upload authorization and bypasses field-level upload policy (CVSS 6.5, avo-hq avo · avo)
- [CVE-2026-85396](https://cve.now/CVE-2026-85396.md): rubyzip before 3.4.0 Path Traversal in Zip::Entry#extract via Sibling-Directory Prefix (CVSS 8.7, rubyzip)
- [CVE-2026-63435](https://cve.now/CVE-2026-63435.md): Mail: Email address spoofing via malformed RFC 2047 encoded-words (CVSS 5.3, mikel mail · mail)
- [CVE-2026-44476](https://cve.now/CVE-2026-44476.md): Doorkeeper OpenID Connect: Dynamic Client Registration feature creates public clients with client\_secret (CVSS 6.3, doorkeeper-gem doorkeeper-openid\_connect · doorkeeper-openi…)
- [CVE-2026-79772](https://cve.now/CVE-2026-79772.md): Nokogiri before 1.19.1 Unchecked Return Value canonicalize (CVSS 6.9, sparklemotion nokogiri · nokogiri)
- [CVE-2026-79771](https://cve.now/CVE-2026-79771.md): Nokogiri before 1.19.3 Memory Leak via XSLT Transform (CVSS 6.9, sparklemotion nokogiri · nokogiri)
- [CVE-2026-79770](https://cve.now/CVE-2026-79770.md): Nokogiri before 1.19.3 ReDoS via CSS selector tokenizer (CVSS 8.7, sparklemotion nokogiri · nokogiri)
- [CVE-2026-73426](https://cve.now/CVE-2026-73426.md): Trix: Stored XSS vulnerability through serialized attributes (CVSS 4.6, basecamp trix · action\_text-trix +1)
- [CVE-2026-61666](https://cve.now/CVE-2026-61666.md): websocket-driver: Denial of service via malformed Host header (CVSS 8.9, faye websocket-driver-ruby · websocket-driver)
- [CVE-2026-73428](https://cve.now/CVE-2026-73428.md): Trix: Stored XSS via HTMLParser attribute injection on paste (CVSS 4.6, basecamp trix · trix +1)
- [CVE-2026-73648](https://cve.now/CVE-2026-73648.md): rails-html-sanitizer: Possible XSS vulnerability with certain configurations (CVSS 5.1, rails-html-sanitizer)
- [CVE-2026-73492](https://cve.now/CVE-2026-73492.md): Loofah allowed\_uri? does not detect javascript: URIs split by numeric character references without semicolons (CVSS 2.3, flavorjones loofah · loofah)
- [CVE-2026-73491](https://cve.now/CVE-2026-73491.md): Loofah allowed\_uri? does not detect javascript: URIs split by named whitespace character references (CVSS 2.3, flavorjones loofah · loofah)
- [CVE-2026-73490](https://cve.now/CVE-2026-73490.md): Loofah: SVG href attribute bypasses local-reference restriction (CVSS 4.7, flavorjones loofah · loofah)
- [CVE-2026-73427](https://cve.now/CVE-2026-73427.md): Trix: XSS via JSON deserialization bypass in drag-and-drop (Level0InputController) (CVSS 2.1, basecamp trix · trix +1)
- [CVE-2026-71847](https://cve.now/CVE-2026-71847.md): Ruby JSON: JSON::ResumableParser#partial\_value dereferences a freed input buffer and crashes on truncated duplicate-key streams (CVSS 8.7, ruby json · json)
- [CVE-2026-45378](https://cve.now/CVE-2026-45378.md): Decidim: Verification documents can be downloaded through reusable links (CVSS 7.5, decidim · decidim-verifications)
- [CVE-2026-45573](https://cve.now/CVE-2026-45573.md): Decidim: Push subscriptions can be abused for server-side requests (CVSS 6.4, decidim · decidim-core)
- [CVE-2026-45572](https://cve.now/CVE-2026-45572.md): Decidim: HTML content blocks allow stored script execution (CVSS 4.8, decidim · decidim-core)
- [CVE-2026-45415](https://cve.now/CVE-2026-45415.md): Decidim: CSV census record endpoints improper authorization (CVSS 6.0, decidim · decidim-verifications)
- [CVE-2026-45414](https://cve.now/CVE-2026-45414.md): Decidim: JWT-backed authentication can be replayed across organizations (CVSS 8.5, decidim)
- [CVE-2026-45377](https://cve.now/CVE-2026-45377.md): Decidim: Private exports can be downloaded through reusable links (CVSS 6.5, decidim · decidim-core)
- [CVE-2026-45376](https://cve.now/CVE-2026-45376.md): Decidim: Admin user search allows SQL injection through similarity-based sorting (CVSS 5.5, decidim · decidim-admin)
- [CVE-2026-45330](https://cve.now/CVE-2026-45330.md): Decidim: Verification admins can access supplied IDs from other organisations (CVSS 4.9, decidim · decidim-verifications)
- [CVE-2026-45086](https://cve.now/CVE-2026-45086.md): Decidim: Forms admin question editor lacks authorization (CVSS 5.4, decidim · decidim-demographics)
- [CVE-2026-53510](https://cve.now/CVE-2026-53510.md): Savon::Model evaluates WSDL operation names as Ruby source (CVSS 8.1, savonrb savon · savon)
- [CVE-2026-66066](https://cve.now/CVE-2026-66066.md): Action Pack: Possible arbitrary file read and remote code execution in Active Storage variant processing (CVSS 9.5, rails · activestorage)
- [CVE-2026-54522](https://cve.now/CVE-2026-54522.md): MessagePack::Buffer#clear Use-After-Free that Enables Cross-Buffer Disclosure (CVSS 2.1, msgpack-ruby · msgpack)
- [CVE-2026-67432](https://cve.now/CVE-2026-67432.md): MCP Ruby SDK: Unbounded JSON-RPC request body causes uncontrolled memory allocation in StreamableHTTPTransport (CVSS 7.5, modelcontextprotocol ruby-sdk · mcp)
- [CVE-2026-67431](https://cve.now/CVE-2026-67431.md): MCP Ruby SDK: Ruby SSE Session Poisoning (CVSS 8.3, modelcontextprotocol ruby-sdk · mcp)
- [CVE-2026-63119](https://cve.now/CVE-2026-63119.md): MCP Ruby SDK: Unbounded line buffer in stdio transports leads to memory exhaustion (DoS) (CVSS 6.2, modelcontextprotocol ruby-sdk · mcp)
- [CVE-2026-67430](https://cve.now/CVE-2026-67430.md): MCP Ruby SDK: Unbounded session retention in StreamableHTTPTransport allows memory exhaustion via initialize flood (CVSS 5.3, modelcontextprotocol ruby-sdk · mcp)
- [CVE-2026-63118](https://cve.now/CVE-2026-63118.md): MCP Ruby SDK: Streamable HTTP transport lacks DNS-rebinding (Host/Origin) protection (CVSS 6.9, modelcontextprotocol ruby-sdk · mcp)
- [CVE-2026-54659](https://cve.now/CVE-2026-54659.md): Pagy I18n locale option is not validated before being used in a file path (CVSS 6.9, ddnexus pagy · pagy)
- [CVE-2026-54603](https://cve.now/CVE-2026-54603.md): OAuth2::Client#request: Protocol-relative redirect Location overrides authority, leaking bearer Authorization to attacker host (CVSS 8.6, ruby-oauth oauth2 · oauth2)
- [CVE-2026-54605](https://cve.now/CVE-2026-54605.md): OAuth: Cross-origin token-request redirects can expose signed request metadata (CVSS 7.2, ruby-oauth oauth · oauth)
- [CVE-2026-54620](https://cve.now/CVE-2026-54620.md): sqlite3-ruby has Use-After-Free in SQLite Aggregate Function Callbacks (CVSS 2.0, sparklemotion sqlite3-ruby · sqlite3-ruby +1)
- [CVE-2026-54619](https://cve.now/CVE-2026-54619.md): sqlite3-ruby has Use-After-Free When Redefining SQLite Functions with Different Arity (CVSS 2.0, sparklemotion sqlite3-ruby · sqlite3-ruby +1)
- [CVE-2026-55518](https://cve.now/CVE-2026-55518.md): Avo: Missing Authorization in Avo Association Attach Endpoint Allows Unauthorized Relationship Manipulation and Privilege Escalation (CVSS 9.6, avo-hq avo · avo)
- [CVE-2026-54498](https://cve.now/CVE-2026-54498.md): view\_component: around\_render HTML-Safety Bypass (CVSS 8.7, ViewComponent view\_component · view\_component)
- [CVE-2026-54497](https://cve.now/CVE-2026-54497.md): view\_component: Reused Component Instances Retain Stale Render Context (CVSS 6.8, ViewComponent view\_component · view\_component)
- [CVE-2026-53727](https://cve.now/CVE-2026-53727.md): css\_parser: SSRF and Local File Disclosure in CssParser::Parser#read\_remote\_file (CVSS 8.9, premailer css\_parser · css\_parser)
- [CVE-2026-54163](https://cve.now/CVE-2026-54163.md): secure\_headers: CSP directive injection via sandbox, plugin\_types, and report\_to when given untrusted input (CVSS 4.7, github secure\_headers · secure\_headers)
- [CVE-2026-54171](https://cve.now/CVE-2026-54171.md): Excon: redact additional sensitive/risky headers when following redirects (CVSS 6.5, excon)
- [CVE-2026-54465](https://cve.now/CVE-2026-54465.md): websocket-driver: Memory exhaustion in HTTP header parser (CVSS 6.3, faye websocket-driver-ruby · websocket-driver)
- [CVE-2026-54463](https://cve.now/CVE-2026-54463.md): websocket-driver: Memory exhaustion via abuse of protocol length headers (CVSS 6.9, faye websocket-driver-ruby · websocket-driver)
- [CVE-2026-54464](https://cve.now/CVE-2026-54464.md): websocket-driver: Resource limit bypass via message compression (CVSS 6.3, faye websocket-driver-ruby · websocket-driver)
- [CVE-2026-45363](https://cve.now/CVE-2026-45363.md): jwt (Ruby gem) - empty-key HMAC bypass (CVSS 9.1, ruby-jwt · jwt)
- [CVE-2026-47736](https://cve.now/CVE-2026-47736.md): Puma PROXY Protocol v1 Parser Allows Remote Memory Exhaustion (CVSS 7.5, puma)
- [CVE-2026-47737](https://cve.now/CVE-2026-47737.md): Puma PROXY Protocol v1 Accepts Repeated Protocol Headers on Persistent Connections (CVSS 7.5, puma)
- [CVE-2026-44161](https://cve.now/CVE-2026-44161.md): Fluentd: Server-Side Request Forgery (SSRF) via Placeholder Expansion in out\_http (CVSS 7.2, fluentd)
- [CVE-2026-44160](https://cve.now/CVE-2026-44160.md): Fluentd: Denial of Service (DoS) via Gzip Decompression Bomb in in\_http and in\_forward (CVSS 7.5, fluentd)
- [CVE-2026-44025](https://cve.now/CVE-2026-44025.md): Fluentd: Exposure of Sensitive Information via Monitor Agent API (CVSS 7.5, fluentd)
- [CVE-2026-44024](https://cve.now/CVE-2026-44024.md): Fluentd: Remote Code Execution (RCE) via Arbitrary File Write in ${tag} Placeholder (CVSS 9.8, fluentd)
- [CVE-2026-54903](https://cve.now/CVE-2026-54903.md): Oj: Integer Overflow in Oj.load 2GB String Handling (CVSS 6.3, ohler55 oj · oj)
- [CVE-2026-54902](https://cve.now/CVE-2026-54902.md): Oj: Use-After-Free in Oj::Parser SAJ Long Key Callback (CVSS 6.3, ohler55 oj · oj)
- [CVE-2026-54901](https://cve.now/CVE-2026-54901.md): Oj: Use-After-Free in Oj::Parser array\_class/hash\_class GC Marking (CVSS 6.3, ohler55 oj · oj)
- [CVE-2026-54900](https://cve.now/CVE-2026-54900.md): Oj: Negative-Size memcpy in Oj::Parser create\_id Attribute Handling (CVSS 6.3, ohler55 oj · oj)
- [CVE-2026-54898](https://cve.now/CVE-2026-54898.md): Oj: Use-After-Free in Oj::Parser SAJ Callback via Input Mutation (CVSS 2.1, ohler55 oj · oj)
- [CVE-2026-54897](https://cve.now/CVE-2026-54897.md): Oj : Use-After-Free in Oj::Doc Iterators via Reentrant Close (CVSS 2.1, ohler55 oj · oj)
- [CVE-2026-54896](https://cve.now/CVE-2026-54896.md): Oj: Heap Buffer Overflow in Oj.dump Exception Serialization via Large Indent (CVSS 2.1, ohler55 oj · oj)
- [CVE-2026-54592](https://cve.now/CVE-2026-54592.md): Oj: Stack Buffer Overflow in Oj::Doc#each\_child via Deeply Nested Input (CVSS 7.5, ohler55 oj · oj)
- [CVE-2026-54502](https://cve.now/CVE-2026-54502.md): Oj: Stack Buffer Overflow in Oj.dump via Large Indent (CVSS 6.3, ohler55 oj · oj)
- [CVE-2026-54500](https://cve.now/CVE-2026-54500.md): Oj: intern.c form\_attr has an uninitialized stack read (CVSS 5.3, ohler55 oj · oj)
- [CVE-2026-54899](https://cve.now/CVE-2026-54899.md): Oj: Use-After-Free in Oj::Parser Symbol Key Cache Toggle (CVSS 6.3, ohler55 oj · oj)
- [CVE-2026-54696](https://cve.now/CVE-2026-54696.md): Ruby JSON: JSON generator heap buffer overflow when streaming to an IO (CVSS 3.7, ruby json · json)
- [CVE-2026-57438](https://cve.now/CVE-2026-57438.md): Nokogiri: Possible Use-After-Free in XInclude Processing (CVSS 2.2, sparklemotion nokogiri · nokogiri)
- [CVE-2026-57437](https://cve.now/CVE-2026-57437.md): Nokogiri: Possible Use-After-Free when directly using \`NokogirI::XML::XPathContext\` beyond document lifetime (CVSS 1.7, sparklemotion nokogiri · nokogiri)
- [CVE-2026-57436](https://cve.now/CVE-2026-57436.md): Nokogiri: Possible Use-After-Free when setting \`Document#root=\` to an invalid node type (CVSS 1.7, sparklemotion nokogiri · nokogiri)
- [CVE-2026-57435](https://cve.now/CVE-2026-57435.md): Nokogiri: Possible Use-After-Free when setting an attribute value via \`Nokogiri::XML::Attr#value=\` or \`#content=\` (CVSS 1.7, sparklemotion nokogiri · nokogiri)
- [CVE-2026-57434](https://cve.now/CVE-2026-57434.md): Nokogiri: Null Pointer Dereference calling methods on uninitialized wrapper classes (CVSS 1.7, sparklemotion nokogiri · nokogiri)
- [CVE-2026-57235](https://cve.now/CVE-2026-57235.md): Nokogiri: Possible Out-of-Bounds Read in \`Nokogiri::XML::NodeSet#\[\]\` (CVSS 6.3, sparklemotion nokogiri · nokogiri)
- [CVE-2026-57234](https://cve.now/CVE-2026-57234.md): Nokogiri: XML::Schema on JRuby allows network requests when NONET is set, bypassing CVE-2020-26247 (CVSS 2.6, sparklemotion nokogiri · nokogiri)
- [CVE-2026-57236](https://cve.now/CVE-2026-57236.md): Nokogiri: Possible Use-After-Free when \`Nokogiri::XML::Document#encoding=\` raises an exception (CVSS 1.7, sparklemotion nokogiri · nokogiri)
- [CVE-2026-54297](https://cve.now/CVE-2026-54297.md): Faraday: Uncontrolled recursion in NestedParamsEncoder allows stack exhaustion DoS via deeply nested query parameters (CVSS 7.5, lostisland faraday · faraday)
- [CVE-2026-54906](https://cve.now/CVE-2026-54906.md): concurrent-ruby: ReadWriteLock allows wrong-thread write release and stray read-release counter corruption (CVSS 2.1, ruby-concurrency concurrent-ruby · concurrent-ruby)
- [CVE-2026-54904](https://cve.now/CVE-2026-54904.md): concurrent-ruby: AtomicReference#update livelocks when the stored value is Float::NAN (CVSS 8.2, ruby-concurrency concurrent-ruby · concurrent-ruby)
- [CVE-2026-54905](https://cve.now/CVE-2026-54905.md): concurrent-ruby: \`ReentrantReadWriteLock\` read-count overflow grants a write lock without exclusivity (CVSS 2.0, ruby-concurrency concurrent-ruby · concurrent-ruby)
- [CVE-2026-47242](https://cve.now/CVE-2026-47242.md): Net::IMAP: Command Injection via ID command argument (CVSS 5.8, ruby net-imap · net-imap)
- [CVE-2026-47240](https://cve.now/CVE-2026-47240.md): Net::IMAP: Command Injection via non-synchronizing literal in "raw" argument (CVSS 5.8, ruby net-imap · net-imap)
- [CVE-2026-47241](https://cve.now/CVE-2026-47241.md): Net::IMAP: Denial of Service via incomplete raw argument validation (CVSS 2.1, ruby net-imap · net-imap)
- [CVE-2026-49342](https://cve.now/CVE-2026-49342.md): YARD static cache reads raw traversal paths before router sanitization (CVSS 5.3, lsegal yard · yard)
- [CVE-2026-12515](https://cve.now/CVE-2026-12515.md): Katello: missing repository authorization in content\_uploads exposes cross-product content existence (CVSS 4.3, Red Hat Satellite 6.16 for RHEL · Red Hat Satellite 6.17… +5)
- [CVE-2026-44587](https://cve.now/CVE-2026-44587.md): CarrierWave has a denylisted\_content\_type bypass via Unescaped Regex Metacharacters (CVSS 4.7, carrierwaveuploader carrierwave · carrierwave)
- [CVE-2026-44836](https://cve.now/CVE-2026-44836.md): view\_component: Preview Route Can Dispatch Inherited Helper Methods (CVSS 6.5, ViewComponent view\_component · view\_component)
- [CVE-2026-44837](https://cve.now/CVE-2026-44837.md): view\_component: System Test Entry Point Path Check Allows Sibling Directory Escape (CVSS 5.9, ViewComponent view\_component · view\_component)
- [CVE-2026-40295](https://cve.now/CVE-2026-40295.md): Devise: Open Redirect via Unvalidated request.referrer in Timeoutable Session Timeout Handler (CVSS 6.1, heartcombo devise · devise)
- [CVE-2026-33637](https://cve.now/CVE-2026-33637.md): Faraday: Protocol-relative URI objects still bypass host scoping (possible incomplete fix for GHSA-33mh-2634-fwr2) (CVSS 0.0, lostisland faraday · faraday)
- [CVE-2026-44511](https://cve.now/CVE-2026-44511.md): Katalyst Koi: Session cookies can be replayed after user logout (CVSS 7.4, katalyst koi · katalyst-koi)
- [CVE-2026-44312](https://cve.now/CVE-2026-44312.md): css\_parser allows to MITM included https css urls (CVSS 5.8, premailer css\_parser · css\_parser)
- [CVE-2026-42258](https://cve.now/CVE-2026-42258.md): net-imap: Command Injection via unvalidated Symbol inputs (CVSS 5.8, ruby net-imap · net-imap)
- [CVE-2026-42257](https://cve.now/CVE-2026-42257.md): net-imap: Command Injection via "raw" arguments to multiple commands (CVSS 5.8, ruby net-imap · net-imap)
- [CVE-2026-42256](https://cve.now/CVE-2026-42256.md): net-imap: Denial of service via high iteration count for SCRAM- authentication (CVSS 6.0, ruby net-imap · net-imap)
- [CVE-2026-42245](https://cve.now/CVE-2026-42245.md): net-imap: Quadratic complexity when reading response literals (CVSS 2.3, ruby net-imap · net-imap)
- [CVE-2026-42246](https://cve.now/CVE-2026-42246.md): net-imap vulnerable to STARTTLS stripping via invalid response timing (CVSS 7.6, ruby net-imap · net-imap)
- [CVE-2026-42205](https://cve.now/CVE-2026-42205.md): Avo: Broken Access Control: Unauthorized Execution of Arbitrary Action Classes Across Resources (CVSS 8.8, avo-hq avo · avo)
- [CVE-2026-41493](https://cve.now/CVE-2026-41493.md): yard: Possible arbitrary path traversal and file access via yard server (CVSS 6.9, lsegal yard · yard)
- [CVE-2025-67202](https://cve.now/CVE-2025-67202.md): Sidekiq-cron thru 2.3.1, an open-source scheduling add-on for Sidekiq, is vulnerable to a cross-site scripting (xss) vulnerability via crafted URL being rended from cron.erb (CVSS 6.1, sidekiq-cron)
- [CVE-2026-42088](https://cve.now/CVE-2026-42088.md): OpenC3 COSMOS: Administrative Actions via the Script Runner Tool (CVSS 9.6, OpenC3 cosmos · openc3)
- [CVE-2026-42087](https://cve.now/CVE-2026-42087.md): OpenC3 COSMOS: SQL Injection in QuestDB Time-Series Data Base (CVSS 9.6, OpenC3 cosmos · openc3)
- [CVE-2026-42086](https://cve.now/CVE-2026-42086.md): OpenC3 COSMOS: Self-XSS in the Command Sender (CVSS 4.6, OpenC3 cosmos · openc3)
- [CVE-2026-42085](https://cve.now/CVE-2026-42085.md): OpenC3 COSMOS: Arbitrary write to plugins directory via path-traversed config filenames (CVSS 4.3, OpenC3 cosmos · openc3)
- [CVE-2026-42084](https://cve.now/CVE-2026-42084.md): OpenC3 COSMOS: Hijacked session token can be used to reset password for persistence (CVSS 8.1, OpenC3 cosmos · openc3)
- [CVE-2026-41316](https://cve.now/CVE-2026-41316.md): ERB has an @\_init deserialization guard bypass via def\_module / def\_method / def\_class (CVSS 8.1, ruby erb · erb)
- [CVE-2026-41146](https://cve.now/CVE-2026-41146.md): facil.io and downstream iodine ruby gem vulnerable to uncontrolled resource consumption and loop with unreachable exit condition (CVSS 8.7, boazsegev facil.io · boazsegev iodine +1)
- [CVE-2026-40869](https://cve.now/CVE-2026-40869.md): Decidim amendments can be accepted or rejected by anyone (CVSS 7.5, decidim · decidim-core)
- [CVE-2026-27820](https://cve.now/CVE-2026-27820.md): zlib: Buffer Overflow in Zlib::GzipReader ungetc via large input leads to memory corruption (CVSS 1.7, ruby zlib · zlib)
- [CVE-2026-23891](https://cve.now/CVE-2026-23891.md): Decidim has a Cross-site scripting (XSS) vulnerability via user name field (CVSS 9.3, decidim · decidim-core)
- [CVE-2026-40070](https://cve.now/CVE-2026-40070.md): bsv-sdk and bsv-wallet persist unverified certifier signatures in acquire\_certificate (direct and issuance paths) (CVSS 8.1, sgbett bsv-ruby-sdk · sgbett bsv-sdk +3)
- [CVE-2026-40069](https://cve.now/CVE-2026-40069.md): bsv-sdk ARC broadcaster treats INVALID/MALFORMED/ORPHAN responses as successful broadcasts (CVSS 7.5, sgbett bsv-ruby-sdk · bsv-sdk)
- [CVE-2026-39324](https://cve.now/CVE-2026-39324.md): Rack::Session::Cookie secrets: decrypt failure fallback enables secretless session forgery and Marshal deserialization (CVSS 9.3, rack-session)
- [CVE-2026-35611](https://cve.now/CVE-2026-35611.md): Addressable has a Regular Expression Denial of Service in Addressable templates (CVSS 7.5, sporkmonger addressable · addressable)
- [CVE-2026-35201](https://cve.now/CVE-2026-35201.md): Discount has an Out-of-bounds Read in rdiscount (CVSS 5.9, davidfstr rdiscount · rdiscount)
- [CVE-2026-26962](https://cve.now/CVE-2026-26962.md): Rack: Header injection in multipart requests (CVSS 4.8, rack)
- [CVE-2026-34835](https://cve.now/CVE-2026-34835.md): Rack is a modular Ruby web server interface (CVSS 4.8, rack)
- [CVE-2026-34827](https://cve.now/CVE-2026-34827.md): Rack: Algorithmic-Complexity DoS in Rack::Multipart::Parser (CVSS 7.5, rack)
- [CVE-2026-32762](https://cve.now/CVE-2026-32762.md): Rack: Forwarded Header semicolon injection enables Host and Scheme spoofing (CVSS 4.8, rack)
- [CVE-2026-34830](https://cve.now/CVE-2026-34830.md): Rack: Rack::Sendfile regex injection via HTTP\_X\_ACCEL\_MAPPING header allows arbitrary file reads through nginx (CVSS 5.9, rack)
- [CVE-2026-34829](https://cve.now/CVE-2026-34829.md): Rack: Denial of Service via Unbounded Multipart File Upload Without Content-Length (CVSS 7.5, rack)
- [CVE-2026-34826](https://cve.now/CVE-2026-34826.md): Rack: Unbounded Range Count in get\_byte\_ranges Enables DoS (CVSS 5.3, rack)
- [CVE-2026-34786](https://cve.now/CVE-2026-34786.md): Rack: Rack::Static header\_rules bypass via URL-encoded paths (CVSS 5.3, rack)
- [CVE-2026-34785](https://cve.now/CVE-2026-34785.md): Rack: Local file inclusion in Rack::Static via URL Prefix Matching (CVSS 7.5, rack)
- [CVE-2026-34763](https://cve.now/CVE-2026-34763.md): Rack: Rack::Directory info disclosure and DoS via unescaped regex interpolation (CVSS 5.3, rack)
- [CVE-2026-34831](https://cve.now/CVE-2026-34831.md): Rack: Content-Length mismatch in Rack::Files error responses (CVSS 4.8, rack)
- [CVE-2026-26961](https://cve.now/CVE-2026-26961.md): Rack: Multipart Boundary Parsing Ambiguity allowing WAF Bypass (CVSS 3.7, rack)
- [CVE-2026-34230](https://cve.now/CVE-2026-34230.md): Rack: Quadratic complexity in Rack::Utils.select\_best\_encoding via wildcard Accept-Encoding header (CVSS 5.3, rack)
- [CVE-2026-34060](https://cve.now/CVE-2026-34060.md): Ruby LSP has arbitrary code execution through branch setting (CVSS 7.1, Shopify ruby-lsp · Shopify.ruby-lsp +1)
- [CVE-2026-33946](https://cve.now/CVE-2026-33946.md): MCP Ruby SDK: Insufficient Session Binding Allows SSE Stream Hijacking via Session ID Replay (CVSS 8.2, modelcontextprotocol ruby-sdk · mcp)
- [CVE-2026-33658](https://cve.now/CVE-2026-33658.md): Rails Active Storage has a possible DoS vulnerability in proxy mode via multi-range requests (CVSS 2.3, rails activestorage · activestorage)
- [CVE-2026-33635](https://cve.now/CVE-2026-33635.md): iCalendar has ICS injection via unsanitized URI property values (CVSS 4.3, icalendar)
- [CVE-2026-33306](https://cve.now/CVE-2026-33306.md): bcrypt-ruby has an Integer Overflow that Causes Zero Key-Strengthening Iterations at Cost=31 on JRuby (CVSS 4.5, bcrypt-ruby · bcrypt)
- [CVE-2026-33286](https://cve.now/CVE-2026-33286.md): Graphiti Affected by Arbitrary Method Execution via Unvalidated Relationship Names (CVSS 9.1, graphiti-api graphiti · graphiti)
- [CVE-2026-33202](https://cve.now/CVE-2026-33202.md): Rails Active Storage has possible glob injection in its DiskService (CVSS 6.6, rails activestorage · activestorage)
- [CVE-2026-33195](https://cve.now/CVE-2026-33195.md): Rails Active Storage has possible Path Traversal in DiskService (CVSS 8.0, rails activestorage · activestorage)
- [CVE-2026-33176](https://cve.now/CVE-2026-33176.md): Rails Active Support has a possible DoS vulnerability in its number helpers (CVSS 6.6, rails activesupport · activesupport)
- [CVE-2026-33174](https://cve.now/CVE-2026-33174.md): Rails Active Storage has a possible DoS vulnerability when in proxy mode via Range requests (CVSS 6.6, rails activestorage · activestorage)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/rubygems
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.