Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2025-28382An issue in the openc3-api/tables endpoint of OpenC3 COSMOS before 6.1.0 allows attackers to execute a directory traversal.RubyGems · openc3-cosmos-tool-iframe
- CVE-2025-28384An issue in the /script-api/scripts/ endpoint of OpenC3 COSMOS before 6.1.0 allows attackers to execute a directory traversal.RubyGems · openc3-cosmos-tool-iframe
- CVE-2025-49007ReDoS Vulnerability in Rack::Multipart handle_mime_headRubyGems · rack · fixed in 3.1.16
- CVE-2025-48069ejson2env has insufficient input sanitizationRubyGems · ejson2env · fixed in 2.0.8
- CVE-2025-46336Rack session gets restored after deletionRubyGems · rack-session · fixed in 2.1.1
- CVE-2025-46727Unbounded-Parameter DoS in Rack::QueryParserRubyGems · rack · fixed in 2.2.14, 3.0.16, 3.1.14
- CVE-2025-32441Rack session gets restored after deletionRubyGems · rack · fixed in 2.2.14
- CVE-2025-46551JRuby-OpenSSL has hostname verification disabled by defaultRubyGems · jruby-openssl · fixed in 0.15.4
- CVE-2025-43857net-imap rubygem vulnerable to possible DoS by memory exhaustionRubyGems · net-imap · fixed in 0.5.7, 0.4.20, 0.3.9 and more
- CVE-2024-39311Publify Vulnerable To Cross-Site Scripting (XSS) Via Redirects Requiring User InteractionRubyGems · publify_core · fixed in 10.0.2
- CVE-2025-30221Pitchfork HTTP Request/Response Splitting vulnerabilityRubyGems · pitchfork · fixed in 0.11.0
- CVE-2025-2304Camaleon CMS Privilege EscalationRubyGems · camaleon_cms · fixed in 2.9.1
- CVE-2025-25292Ruby SAML vulnerable to SAML authentication bypass due to namespace handling (parser differential)RubyGems · ruby-saml · fixed in 1.18.0, 1.12.4
- CVE-2025-25291ruby-saml vulnerable to SAML authentication bypass due to DOCTYPE handling (parser differential)RubyGems · ruby-saml · fixed in 1.12.4, 1.18.0
- CVE-2025-25293ruby-saml vulnerable to Remote Denial of Service (DoS) with compressed SAML responsesRubyGems · ruby-saml · fixed in 1.12.4, 1.18.0
- CVE-2025-27407Remote code execution when loading a crafted GraphQL schemaRubyGems · graphql · fixed in 2.4.13, 2.3.21, 2.2.17 and more
- CVE-2025-27788Ruby JSON Parser has Out-of-bounds ReadRubyGems · json · fixed in 2.10.2
- CVE-2025-27610Local File Inclusion in Rack::StaticRubyGems · rack · fixed in 2.2.13, 3.0.14, 3.1.12
- CVE-2025-27111Escape Sequence Injection vulnerability in Rack lead to Possible Log InjectionRubyGems · rack · fixed in 2.2.12, 3.0.13, 3.1.11
- CVE-2025-27219In the CGI gem before 0.4.2 for Ruby, the CGI::Cookie.parse method in the CGI library contains a potential Denial of Service (DoS) vulnerabiRubyGems · cgi · fixed in 0.3.5.1, 0.3.7, 0.4.2
- CVE-2025-27220In the CGI gem before 0.4.2 for Ruby, a Regular Expression Denial of Service (ReDoS) vulnerability exists in the Util#escapeElement method.RubyGems · cgi · fixed in 0.3.5.1, 0.3.7, 0.4.2
- CVE-2025-27221In the URI gem before 1.0.3 for Ruby, the URI handling methods (URI.join, URI#merge, URI#+) have an inadvertent leakage of authentication crRubyGems · uri · fixed in 0.11.3, 0.12.4, 0.13.2 and more
- CVE-2025-27590In oxidized-web (aka Oxidized Web) before 0.15.0, the RANCID migration page allows an unauthenticated user to gain control over the Linux usRubyGems · oxidized-web · fixed in 0.15.0
- CVE-2025-26803The http parser in Phusion Passenger 6.0.21 through 6.0.25 before 6.0.26 allows a denial of service during parsing of a request with an invaRubyGems · passenger · fixed in 6.0.26
- CVE-2025-25184Possible Log Injection in Rack::CommonLoggerRubyGems · rack · fixed in 2.2.11, 3.0.12, 3.1.10
- CVE-2025-25186Net::IMAP vulnerable to possible DoS by memory exhaustionRubyGems · net-imap · fixed in 0.3.8, 0.4.19, 0.5.6
- CVE-2023-23913There is a potential DOM based cross-site scripting issue in rails-ujs which leverages the Clipboard API to target HTML elements that are asRubyGems · actionview · fixed in 6.1.7.3, 7.0.4.3
- CVE-2023-27531There is a deserialization of untrusted data vulnerability in the Kredis JSON deserialization codeRubyGems · kredis · fixed in 1.3.0.1
- CVE-2023-27539There is a denial of service vulnerability in the header parsing component of Rack.RubyGems · rack · fixed in 2.2.6.4, 3.0.6.1
- CVE-2023-28362The redirect_to method in Rails allows provided values to contain characters which are not legal in an HTTP header value.RubyGems · actionpack · fixed in 6.1.7.4, 7.0.5.1