Skip to content
OpenAdvisories

Ecosystem

RubyGems

1,115 known vulnerabilities.

Most affected packages

actionpack 66 nokogiri 60 rack 54 rubygems-update 25 activerecord 23 puppet 23 activesupport 19 publify_core 15 camaleon_cms 15 activestorage 15 rails-html-sanitizer 15 passenger 14 puma 14 decidim 13 actionview 13 openc3 11 fat_free_crm 11 rails 11 loofah 11 oj 11 ruby-saml 10 net-imap 10 jquery-rails 9 decidim-core 9 katello 8 avo 8 spree 8 rexml 8 lodash-rails 7 fluentd 7 bootstrap 7 bootstrap-sass 7 jquery-ui-rails 7 webrick 6 json 6 doorkeeper 6 ember-source 6 mcp 6 devise 6 view_component 6
All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • Medium 6.9
    CVE-2020-11023 Exploited Public exploit EPSS 85%

    Potential XSS vulnerability in jQuery

    In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute unt…

    jquery jQuery drupal7 cacti Debian Ubuntu Alpine npm Packagist Maven NuGet RubyGems
    KEV Jan 23, 2025
  • High 7.5
    CVE-2019-5418 Exploited Public exploit EPSS 99%

    Path Traversal in Action View

    There is a File Content Disclosure vulnerability in Action View <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 and v3 where specially crafted accept headers can cause contents of arbitrary files on the target system's filesystem to be exposed.

    rails https://github.com/rails/rails rails rails Debian Ubuntu RubyGems
    KEV Jul 7, 2025
  • High 7.5
    CVE-2016-0752 Exploited Public exploit EPSS 96%

    Directory traversal vulnerability in Action View in Ruby on Rails

    Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 allows remote attackers to read arbitrary files by leveraging an application's unrestricted …

    rails actionpack actionview Debian RubyGems
    KEV Mar 25, 2022
  • High 7.5
    CVE-2014-0130 Exploited Public exploit EPSS 54%

    actionpack Path Traversal vulnerability

    Directory traversal vulnerability in actionpack/lib/abstract_controller/base.rb in the implicit-render implementation in Ruby on Rails before 3.2.18, 4.0.x before 4.0.5, and 4.1.x before 4.1.1, when certain route globbing configurations are enabled, allows re…

    actionpack RubyGems
    KEV Mar 25, 2022