Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-33635iCalendar has ICS injection via unsanitized URI property valuesRubyGems · icalendar · fixed in 2.12.2
- CVE-2026-33306bcrypt-ruby has an Integer Overflow that Causes Zero Key-Strengthening Iterations at Cost=31 on JRubyRubyGems · bcrypt · fixed in 3.1.22
- CVE-2026-33286Graphiti Affected by Arbitrary Method Execution via Unvalidated Relationship NamesRubyGems · graphiti · fixed in 1.10.2
- CVE-2026-33202Rails Active Storage has possible glob injection in its DiskServiceRubyGems · activestorage · fixed in 8.1.2.1, 8.0.4.1, 7.2.3.1
- CVE-2026-33195Rails Active Storage has possible Path Traversal in DiskServiceRubyGems · activestorage · fixed in 8.1.2.1, 8.0.4.1, 7.2.3.1
- CVE-2026-33176Rails Active Support has a possible DoS vulnerability in its number helpersRubyGems · activesupport · fixed in 8.1.2.1, 8.0.4.1, 7.2.3.1
- CVE-2026-33174Rails Active Storage has a possible DoS vulnerability when in proxy mode via Range requestsRubyGems · activestorage · fixed in 8.1.2.1, 8.0.4.1, 7.2.3.1
- CVE-2026-33173Rails Active Storage has possible content type bypass via metadata in direct uploadsRubyGems · activestorage · fixed in 8.1.2.1, 8.0.4.1, 7.2.3.1
- CVE-2026-33170Rails Active Support has a possible XSS vulnerability in SafeBuffer#%RubyGems · activesupport · fixed in 8.1.2.1, 8.0.4.1, 7.2.3.1
- CVE-2026-33169Rails Active Support has a possible ReDoS vulnerability in number_to_delimitedRubyGems · activesupport · fixed in 8.1.2.1, 8.0.4.1, 7.2.3.1
- CVE-2026-33168Rails has a possible XSS vulnerability in its Action View tag helpersRubyGems · actionview · fixed in 8.1.2.1, 8.0.4.1, 7.2.3.1
- CVE-2026-33167Rails has a possible XSS vulnerability in its Action Pack debug exceptionsRubyGems · actionpack · fixed in 8.1.2.1
- CVE-2026-33210Ruby JSON has a format string injection vulnerabilityRubyGems · json · fixed in 2.19.2, 2.17.1.2, 2.15.2.1
- CVE-2026-33209Avo has a XSS vulnerability on `return_to` paramRubyGems · avo · fixed in 3.30.3
- CVE-2026-32700Devise has a confirmable "change email" race condition that permits user to confirm email they have no access toRubyGems · devise · fixed in 5.0.3
- CVE-2026-4324Rubygem-katello: katello: denial of service and potential information disclosure via sql injectionRubyGems · katello · fixed in 4.19.1
- CVE-2026-31830sigstore-ruby verifier returns success for DSSE bundles with mismatched in-toto subject digestRubyGems · sigstore · fixed in 0.2.3
- CVE-2026-1776Camaleon CMS AWS Uploader Authenticated Path Traversal Arbitrary File ReadRubyGems · camaleon-cms, camaleon_cms
- CVE-2025-10990Rexml: rexml: denial of service via inefficient regex parsingRubyGems · rexml · fixed in 3.3.9
- CVE-2026-0980Rubyipmi: red hat satellite: remote code execution in rubyipmi via malicious bmc usernameRubyGems · rubyipmi · fixed in 0.13.0
- CVE-2026-25500Rack's Stored XSS in Rack::Directory via javascript: filenames rendered into anchor hrefRubyGems · rack · fixed in 2.2.22, 3.1.20, 3.2.5
- CVE-2026-22860Rack has a Directory Traversal via Rack:DirectoryRubyGems · rack · fixed in 2.2.22, 3.1.20, 3.2.5
- CVE-2026-25765Faraday affected by SSRF via protocol-relative URL host override in build_exclusive_urlRubyGems · faraday · fixed in 2.14.1, 1.10.5
- CVE-2026-25757Unauthenticated Spree Commerce users can view completed guest orders by Order IDRubyGems · spree_storefront · fixed in 5.0.8, 5.1.10, 5.2.7 and more
- CVE-2026-25758Spree allows unauthenticated users can access all guest addressesRubyGems · spree_api · fixed in 4.10.3, 5.0.8, 5.1.10 and more
- CVE-2025-65017Decidim's private data exports can lead to data leaksRubyGems · decidim, decidim-core · fixed in 0.30.4
- CVE-2026-1530Fog-kubevirt: fog-kubevirt: man-in-the-middle vulnerability due to disabled certificate validationRubyGems · fog-kubevirt · fixed in 1.5.1
- CVE-2026-1531Foreman-kubevirt: foreman_kubevirt: man-in-the-middle due to insecure default ssl verificationRubyGems · foreman_kubevirt · fixed in 0.4.3
- CVE-2025-24293# Active Storage allowed transformation methods potentially unsafe Active Storage attempts to prevent the use of potentially unsafe imageRubyGems · activestorage · fixed in 8.0.2.1, 7.2.2.2, 7.1.5.2
- CVE-2020-36939Cassandra Web 0.5.0 - Remote File ReadRubyGems · cassandra-web