Login Request a demo
RU
Vendor
ruby-lang
16 products with CVEs on record
132
CVEs
0
On KEV
0
New 30D
Products
RU
Ruby
ruby-lang
9.8
92 CVEs0 on KEV0 new
RE
Rexml
Ruby-lang
7.5
8 CVEs0 on KEV0 new
NE
Net::imap
Ruby-lang
9.8
6 CVEs0 on KEV0 new
CG
Cgi
Ruby-lang
9.8
5 CVEs0 on KEV0 new
WE
Webrick
Ruby-lang
7.5
5 CVEs0 on KEV0 new
UR
Uri
Ruby-lang
7.5
4 CVEs0 on KEV0 new
OP
Openssl
Ruby-lang
9.8
2 CVEs0 on KEV0 new
RD
Rdoc
Ruby-lang
7.0
2 CVEs0 on KEV0 new
DA
Date
Ruby-lang
7.5
1 CVEs0 on KEV0 new
JO
Javascript Object Notation
Ruby-lang
7.5
1 CVEs0 on KEV0 new
JS
Json
Ruby-lang
9.1
1 CVEs0 on KEV0 new
RA
Rake
Ruby-lang
6.4
1 CVEs0 on KEV0 new
RU
Ruby193
Ruby-lang
3.3
1 CVEs0 on KEV0 new
TI
Time
Ruby-lang
5.3
1 CVEs0 on KEV0 new
TR
Trunk
Ruby-lang
5.9
1 CVEs0 on KEV0 new
ZL
Zlib
Ruby-lang
9.8
1 CVEs0 on KEV0 new
Recent CVEs
CVEProductCVSSEPSSPublishedSummary
CVE-2026-46727
RU
Ruby
ruby-lang
8.1
0%
May 22An issue was discovered in Ruby 4 before 4.0.5
CVE-2026-42258
NE
Net::imap
Ruby-lang
5.3
1%
May 9net-imap: Command Injection via unvalidated Symbol inputs
CVE-2026-42257
NE
Net::imap
Ruby-lang
9.8
0%
May 9net-imap: Command Injection via "raw" arguments to multiple commands
CVE-2026-42256
NE
Net::imap
Ruby-lang
6.5
0%
May 9net-imap: Denial of service via high iteration count for `SCRAM-*` authentication
CVE-2026-42245
NE
Net::imap
Ruby-lang
7.5
0%
May 9net-imap: Quadratic complexity when reading response literals
CVE-2026-42246
NE
Net::imap
Ruby-lang
7.4
0%
May 9net-imap vulnerable to STARTTLS stripping via invalid response timing
CVE-2026-27820
ZL
Zlib
Ruby-lang
9.8
1%
Apr 16zlib: Buffer Overflow in Zlib::GzipReader ungetc via large input leads to memory corruption
CVE-2026-33210
JS
Json
Ruby-lang
9.1
1%
Mar 20Ruby JSON has a format string injection vulnerability
CVE-2025-61594
UR
Uri
Ruby-lang
7.5
1%
Dec 30URI is a module providing classes to handle Uniform Resource Identifiers
CVE-2025-58767
RE
Rexml
Ruby-lang
5.3
0%
Sep 17REXML is an XML toolkit for Ruby
CVE-2025-6442
WE
Webrick
Ruby-lang
5.9
0%
Jun 25Ruby WEBrick read_header HTTP Request Smuggling Vulnerability
CVE-2025-43857
NE
Net::imap
Ruby-lang
6.5
0%
Apr 28Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby
CVE-2025-27788
JO
Javascript Object Notation
Ruby-lang
7.5
1%
Mar 12JSON is a JSON implementation for Ruby
CVE-2025-27221
UR
Uri
Ruby-lang
5.3
1%
Mar 4In the URI gem before 1.0.3 for Ruby, the URI handling methods (URI.join, URI#merge, URI#+) have an inadvertent leakage of authentication credentials because userinfo is retained…
CVE-2025-27220
CG
Cgi
Ruby-lang
7.5
1%
Mar 4In the CGI gem before 0.4.2 for Ruby, a Regular Expression Denial of Service (ReDoS) vulnerability exists in the Util#escapeElement method
CVE-2025-27219
CG
Cgi
Ruby-lang
7.5
1%
Mar 4In the CGI gem before 0.4.2 for Ruby, the CGI::Cookie.parse method in the CGI library contains a potential Denial of Service (DoS) vulnerability
CVE-2024-49761
RE
Rexml
Ruby-lang
7.5
1%
Oct 28REXML is an XML toolkit for Ruby
CVE-2024-43398
RE
Rexml
Ruby-lang
5.9
1%
Aug 22REXML is an XML toolkit for Ruby
CVE-2024-41946
RE
Rexml
Ruby-lang
7.5
1%
Aug 1REXML is an XML toolkit for Ruby
CVE-2024-41123
RE
Rexml
Ruby-lang
7.5
1%
Aug 1REXML is an XML toolkit for Ruby
CVE-2024-39908
RE
Rexml
Ruby-lang
4.3
1%
Jul 16REXML is an XML toolkit for Ruby
CVE-2024-35176
RE
Rexml
Ruby-lang
5.3
2%
May 16REXML is an XML toolkit for Ruby
CVE-2023-36617
UR
Uri
Ruby-lang
5.3
2%
Jun 29A ReDoS issue was discovered in the URI component before 0.12.2 for Ruby
CVE-2023-28756
TI
Time
Ruby-lang
5.3
2%
Mar 31A ReDoS issue was discovered in the Time component through 0.2.1 in Ruby through 3.2.1
CVE-2023-28755
UR
Uri
Ruby-lang
5.3
3%
Mar 31A ReDoS issue was discovered in the URI component through 0.12.0 in Ruby through 3.2.1
CVE-2021-33621
CG
Cgi
Ruby-lang
8.8
2%
Nov 18The cgi gem before 0.1.0.2, 0.2.x before 0.2.2, and 0.3.x before 0.3.5 for Ruby allows HTTP response splitting
CVE-2022-28739
RU
Ruby
Ruby-lang
7.5
4%
May 9There is a buffer over-read in Ruby before 2.6.10, 2.7.x before 2.7.6, 3.x before 3.0.4, and 3.1.x before 3.1.2
CVE-2022-28738
RU
Ruby
Ruby-lang
9.8
3%
May 9A double free was found in the Regexp compiler in Ruby 3.x before 3.0.4 and 3.1.x before 3.1.2
CVE-2021-41816
CG
Cgi
Ruby-lang
9.8
5%
Feb 6CGI.escape_html in Ruby before 2.7.5 and 3.x before 3.0.3 has an integer overflow and resultant buffer overflow via a long string on platforms (such as Windows) where size_t and…
CVE-2021-41819
CG
Cgi
Ruby-lang
7.5
3%
Jan 1CGI::Cookie.parse in Ruby through 2.6.8 mishandles security prefixes in cookie names
CVE-2021-41817
DA
Date
Ruby-lang
7.5
3%
Jan 1Date.parse in the date gem through 3.2.0 for Ruby allows ReDoS (regular expression Denial of Service) via a long string
CVE-2021-32066
RU
Ruby
Ruby-lang
7.4
3%
Aug 1An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1
CVE-2021-31799
RD
Rdoc
Ruby-lang
7.0
1%
Jul 30In RDoc 3.11 through 6.x before 6.3.1, as distributed with Ruby through 3.0.1, it is possible to execute arbitrary code via | and tags in a filename
CVE-2021-28966
RU
Ruby
Ruby-lang
7.5
58%
Jul 30In Ruby through 3.0 on Windows, a remote attacker can submit a crafted path when a Web application handles a parameter with TmpDir
CVE-2021-31810
RU
Ruby
Ruby-lang
5.8
3%
Jul 13An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1
CVE-2021-28965
RE
Rexml
Ruby-lang
7.5
5%
Apr 21The REXML gem before 3.2.5 in Ruby before 2.6.7, 2.7.x before 2.7.3, and 3.x before 3.0.1 does not properly address XML round-trip issues
CVE-2020-25613
RU
Ruby
Ruby-lang
7.5
4%
Oct 6An issue was discovered in Ruby through 2.5.8, 2.6.x through 2.6.6, and 2.7.x through 2.7.1
CVE-2020-10933
RU
Ruby
Ruby-lang
5.3
3%
May 4An issue was discovered in Ruby 2.5.x through 2.5.7, 2.6.x through 2.6.5, and 2.7.0
CVE-2020-5247
RU
Ruby
Ruby-lang
7.5
3%
Feb 28In Puma (RubyGem) before 4.3.2 and before 3.12.3, if an application using Puma allows untrusted input in a response header, an attacker can use newline characters (i.e
CVE-2020-8130
RA
Rake
Ruby-lang
6.4
1%
Feb 24There is an OS command injection vulnerability in Ruby Rake < 12.3.3 in Rake::FileList when supplying a filename that begins with the pipe character `|`
CVE-2016-2338
RU
Ruby
Ruby-lang
9.8
5%
Feb 14An exploitable heap overflow vulnerability exists in the Psych::Emitter start_document function of Ruby
CVE-2015-1855
RU
Ruby
Ruby-lang
5.9
3%
Nov 29verify_certificate_identity in the OpenSSL extension in Ruby before 2.0.0 patchlevel 645, 2.1.x before 2.1.6, and 2.2.x before 2.2.2 does not properly validate hostnames, which…
CVE-2019-16255
RU
Ruby
Ruby-lang
8.1
4%
Nov 26Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows code injection if the first argument (aka the "command" argument) to Shell#[] or Shell#test in lib/shell.rb…
CVE-2019-16254
RU
Ruby
Ruby-lang
5.3
5%
Nov 26Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows HTTP Response Splitting
CVE-2019-16201
RU
Ruby
Ruby-lang
7.5
5%
Nov 26WEBrick::HTTPAuth::DigestAuth in Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 has a regular expression Denial of Service cause by looping/backtracking
CVE-2019-15845
RU
Ruby
Ruby-lang
6.5
3%
Nov 26Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 mishandles path checking within File.fnmatch functions
CVE-2011-4121
RU
Ruby
Ruby-lang
9.8
3%
Nov 26The OpenSSL extension of Ruby (Git trunk) versions after 2011-09-01 up to 2011-11-03 always generated an exponent value of '1' to be used for private RSA key generation
CVE-2011-3624
RU
Ruby
Ruby-lang
5.3
2%
Nov 26Various methods in WEBrick::HTTPRequest in Ruby 1.9.2 and 1.8.7 and earlier do not validate the X-Forwarded-For, X-Forwarded-Host and X-Forwarded-Server headers in requests, which…
CVE-2013-1945
RU
Ruby193
Ruby-lang
3.3
0%
Oct 31ruby193 uses an insecure LD_LIBRARY_PATH setting
CVE-2019-11879
WE
Webrick
Ruby-lang
5.5
1%
May 10The WEBrick gem 1.4.2 for Ruby allows directory traversal if the attacker once had local access to create a symlink to a location outside of the web root directory
CVE-2018-16396
RU
Ruby
Ruby-lang
8.1
8%
Nov 16An issue was discovered in Ruby before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.2, and 2.6.x before 2.6.0-preview3
CVE-2018-16395
OP
Openssl
Ruby-lang
9.8
11%
Nov 16An issue was discovered in the OpenSSL library in Ruby before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.2, and 2.6.x before 2.6.0-preview3
CVE-2018-8780
RU
Ruby
Ruby-lang
9.1
10%
Apr 3In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, the Dir.open, Dir.new, Dir.entries and Dir.empty? methods do not check NULL…
CVE-2018-8779
RU
Ruby
Ruby-lang
7.5
7%
Apr 3In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, the UNIXServer.open and UNIXSocket.open methods are not checked for null…
CVE-2018-8778
RU
Ruby
Ruby-lang
7.5
8%
Apr 3In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, an attacker controlling the unpacking format (similar to format string…
CVE-2018-8777
RU
Ruby
Ruby-lang
7.5
4%
Apr 3In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, an attacker can pass a large HTTP request with a crafted header to WEBrick…
CVE-2018-6914
RU
Ruby
Ruby-lang
7.5
10%
Apr 3Directory traversal vulnerability in the Dir.mktmpdir method in the tmpdir library in Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and…
CVE-2017-17742
RU
Ruby
Ruby-lang
5.3
5%
Apr 3Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1 allows an HTTP Response Splitting attack
CVE-2017-17790
RU
Ruby
Ruby-lang
9.8
6%
Dec 20The lazy_initialize function in lib/resolv.rb in Ruby through 2.4.3 uses Kernel#open, which might allow Command Injection attacks, as demonstrated by a Resolv::Hosts::new argument…
CVE-2017-17405
RU
Ruby
Ruby-lang
8.8
74%
Dec 15Ruby before 2.4.3 allows Net::FTP command injection