Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-23885AlchemyCMS has Authenticated Remote Code Execution (RCE) via eval injection in ResourcesHelperRubyGems · alchemy_cms · fixed in 7.4.12, 8.0.3
- CVE-2025-68271Unauthenticated Remote Code Execution in openc3-apiRubyGems · openc3 · fixed in 6.10.2
- CVE-2026-22589Spree API has Unauthenticated IDOR - Guest AddressRubyGems · spree_core · fixed in 4.10.2, 5.0.7, 5.1.9 and more
- CVE-2026-22588Spree API has Authenticated Insecure Direct Object Reference (IDOR) via Order ModificationRubyGems · spree_api · fixed in 4.10.2, 5.0.7, 5.1.9 and more
- CVE-2025-61594URI Credential Leakage Bypass over CVE-2025-27221RubyGems · uri · fixed in 0.12.5, 0.13.3, 1.0.4
- CVE-2025-68696httparty Has Potential SSRF Vulnerability That Leads to API Key LeakageRubyGems · httparty · fixed in 0.24.0
- CVE-2025-14762Missing cryptographic key commitment in the AWS SDK for Ruby may allow a user with write access to the S3 bucket to introduce a new EDK thatRubyGems · aws-sdk-s3 · fixed in 1.208.0
- CVE-2025-68113ALTCHA Proof-of-Work Vulnerable to Challenge Splicing and ReplayRubyGems · altcha · fixed in 1.0.0
- CVE-2025-66568ruby-saml Libxml2 Canonicalization errors can bypass Digest/Signature validationRubyGems · ruby-saml · fixed in 1.18.0
- CVE-2025-66567ruby-saml has a SAML authentication bypass due to namespace handling (parser differential)RubyGems · ruby-saml · fixed in 1.18.0
- CVE-2025-64501ProsemirrorToHtml: Cross-Site Scripting vulnerability through unescaped HTML attribute valuesRubyGems · prosemirror_to_html · fixed in 0.2.1
- CVE-2025-12790Rubygem-mqtt: rubygem-mqtt hostname validationRubyGems · mqtt · fixed in 0.7.0
- CVE-2025-61921Sinatra has ReDoS vulnerability in ETag header value generationRubyGems · sinatra · fixed in 4.2.0
- CVE-2025-61919Rack is vulnerable to a memory-exhaustion DoS through unbounded URL-encoded body parsingRubyGems · rack · fixed in 2.2.20, 3.1.18, 3.2.3
- CVE-2025-61780Rack has Possible Information Disclosure VulnerabilityRubyGems · rack · fixed in 2.2.20, 3.1.18, 3.2.3
- CVE-2025-61772Rack's multipart parser buffers unbounded per-part headers, enabling DoS (memory exhaustion)RubyGems · rack · fixed in 2.2.19, 3.1.17, 3.2.2
- CVE-2025-61771Rack's multipart parser buffers large non‑file fields entirely in memory, enabling DoS (memory exhaustion)RubyGems · rack · fixed in 2.2.19, 3.1.17, 3.2.2
- CVE-2025-61770Rack's unbounded multipart preamble buffering enables DoS (memory exhaustion)RubyGems · rack · fixed in 2.2.19, 3.1.17, 3.2.2
- CVE-2025-59830Rack QueryParser has an unsafe default allowing params_limit bypass via semicolon-separated parametersRubyGems · rack · fixed in 2.2.18
- CVE-2025-58767REXML has a DoS condition when parsing malformed XML fileRubyGems · rexml · fixed in 3.4.2
- CVE-2025-58067Basecamp's Google Sign-In for Rails allowed redirects to protocol-relative URIRubyGems · google_sign_in · fixed in 1.3.1
- CVE-2025-57821Basecamp's Google Sign-In for Rails allowed redirects to a malformed URLRubyGems · google_sign_in · fixed in 1.3.0
- CVE-2011-10026Spreecommerce < 0.50.x API RCERubyGems · rd_searchlogic, spree · fixed in 0.50.0
- CVE-2025-55193Active Record logging vulnerable to ANSI escape injectionRubyGems · activerecord · fixed in 8.0.2.1, 7.2.2.2, 7.1.5.2
- CVE-2011-10019Spreecommerce < 0.60.2 Search Parameter RCERubyGems · spree · fixed in 0.60.2
- CVE-2025-54887jwe: Missing AES-GCM authentication tag validation in encrypted JWEsRubyGems · jwe · fixed in 1.1.1
- CVE-2025-54572Ruby SAML DOS vulnerability with large SAML responseRubyGems · ruby-saml · fixed in 1.18.1
- CVE-2025-53623Job Iteration API is vulnerable to OS Command Injection attack through its CsvEnumerator classRubyGems · job-iteration · fixed in 1.11
- CVE-2025-24294The attack vector is a potential Denial of Service (DoS).RubyGems · resolv · fixed in 0.2.3, 0.6.2, 0.3.1
- CVE-2025-6442Ruby WEBrick read_header HTTP Request Smuggling VulnerabilityRubyGems · webrick · fixed in 1.8.2