Login Request a demo
RU
Product
Ruby
by ruby-lang · last CVE May 22, 2026
92
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities92In the news0Timeline
Severity mix
Critical 13High 25Medium 10Low 0
Severity
All severities92Critical13High25Medium10Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add Ruby to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2012-5380
6.7
1%
Oct 11
Untrusted search path vulnerability in the installation functionality in Ruby 1.9.3-p194, when installed in the top-level C:\ directory, might allow local users to gain privileges…
Affected: 1.9.3
CVE-2019-15845
6.5
3%
Nov 26
Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 mishandles path checking within File.fnmatch functions
Affected: 2.4.0 through 2.4.7; 2.5.0 through 2.5.6; 2.6.0 through 2.6.4
CVE-2015-9096
6.1
4%
Jun 12
Net::SMTP in Ruby before 2.4.0 is vulnerable to SMTP command injection via CRLF sequences in a RCPT TO or MAIL FROM command, as demonstrated by CRLF sequences immediately before…
Affected: through 2.4.0
CVE-2015-1855
5.9
3%
Nov 29
verify_certificate_identity in the OpenSSL extension in Ruby before 2.0.0 patchlevel 645, 2.1.x before 2.1.6, and 2.2.x before 2.2.2 does not properly validate hostnames, which…
Affected: 2.1.0 before 2.1.6; 2.2.0 before 2.2.2; 2.0.0; 2.0.0; 2.0.0; 2.0.0; +7 more
CVE-2021-31810
5.8
3%
Jul 13
An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1
Affected: through 2.6.7; 2.7.0 through 2.7.3; 3.0.0 through 3.0.1
CVE-2023-28756
5.3
2%
Mar 31
A ReDoS issue was discovered in the Time component through 0.2.1 in Ruby through 3.2.1
Affected: through 2.7.7
CVE-2020-10933
5.3
3%
May 4
An issue was discovered in Ruby 2.5.x through 2.5.7, 2.6.x through 2.6.5, and 2.7.0
Affected: 2.5.0 through 2.5.7; 2.6.0 through 2.6.5; 2.7.0
CVE-2019-16254
5.3
5%
Nov 26
Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows HTTP Response Splitting
Affected: through 2.3.0; 2.4.0 through 2.4.7; 2.5.0 through 2.5.6; 2.6.0 through 2.6.4
CVE-2011-3624
5.3
2%
Nov 26
Various methods in WEBrick::HTTPRequest in Ruby 1.9.2 and 1.8.7 and earlier do not validate the X-Forwarded-For, X-Forwarded-Host and X-Forwarded-Server headers in requests, which…
Affected: 1.8.7; 1.9.2
CVE-2017-17742
5.3
5%
Apr 3
Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1 allows an HTTP Response Splitting attack
Affected: 2.2.0 before 2.2.10; 2.3.0 before 2.3.7; 2.4.0 before 2.4.4; 2.5.0 before 2.5.1; 2.6.0
Showing 10