ruby

8 results · Clear filters · Feed

• Critical 10.0
  CVE-2026-110264 Public exploit

  Integer Overflow or Wraparound in GitLab

  An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, could hav…

  GitLab GitLab ruby ruby3.1 Web / CMS Debian Alpine
  Oct 22, 2026
• Critical 10.0
  CVE-2026-97229 Exploited Public exploit EPSS 65%

  Integer Overflow or Wraparound in GitLab

  GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server…

  GitLab GitLab gitlab ruby Web / CMS Debian Ubuntu Alpine
  Oct 13, 2026

  KEV Oct 29, 2026
• High 7.5
  CVE-2020-25613 Public exploit

  WEBRick vulnerable to HTTP Request/Response Smuggling

  An issue was discovered in Ruby through 2.5.8, 2.6.x through 2.6.6, and 2.7.x through 2.7.1. WEBrick, a simple HTTP server bundled with Ruby, had not checked the transfer-encoding header value rigorously. An attacker may potentially exploit this issue to bypa…

  ruby2.3 ruby ruby2.5 ruby2.7 Debian Ubuntu Alpine RubyGems
  Oct 6, 2020
• High 7.5
  CVE-2020-10663 Public exploit

  Unsafe object creation in json RubyGem

  The JSON gem through 2.2.0 for Ruby, as used in Ruby 2.4 through 2.4.9, 2.5 through 2.5.7, and 2.6 through 2.6.5, has an Unsafe Object Creation Vulnerability. This is quite similar to CVE-2013-0269, but does not rely on poor garbage-collection behavior within…

  ruby2.3 ruby ruby2.5 json Debian Ubuntu Alpine RubyGems
  Apr 28, 2020
• Medium 6.1
  CVE-2015-9251 Public exploit EPSS 30%

  Cross-Site Scripting (XSS) in jquery

  jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed.

  ruby jquery-rails org.webjars.npm:jquery jQuery Ubuntu Alpine npm Maven NuGet RubyGems
  Jan 18, 2018
• Medium 6.1
  CVE-2012-6708 Public exploit

  Cross-Site Scripting in jquery

  jQuery before 1.9.0 is vulnerable to Cross-site Scripting (XSS) attacks. The jQuery(strInput) function does not differentiate selectors from HTML in a reliable fashion. In vulnerable versions, jQuery determined whether the input was HTML by looking for the '<…

  ruby jquery-rails jquery org.webjars.npm:jquery Ubuntu Alpine npm Maven NuGet RubyGems
  Jan 18, 2018
• Unscored —
  CVE-2017-17405 Public exploit EPSS 74%

  Ruby before 2.4.3 allows Net::FTP command injection. Net::FTP#get, getbinaryfile, gettextfile, put, putbinaryfile, and …

  ruby2.3 ruby ruby2.0 ruby1.9.1 Ubuntu Alpine
  Dec 15, 2017
• High 7.5
  CVE-2017-0901 Public exploit EPSS 29%

  RubyGems may allow a maliciously crafted gem to overwrite files

  RubyGems version 2.6.12 and earlier fails to validate specification names, allowing a maliciously crafted gem to potentially overwrite any file on the filesystem.

  HackerOne RubyGems ruby2.3 ruby Debian Ubuntu Alpine RubyGems
  Aug 31, 2017