rubygems
Vulnerability activity for rubygems: what is being exploited, what was published lately, and when the next patch release is due.
Last 30 days
- CVEs
- 4
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 90 days
- CVEs
- 4
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 365 days
- CVEs
- 4
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Exploited now
None of this vendor's CVEs are on CISA's known-exploited list.
Recent
- 8.0HighOct 29, 2026rubygems shopify app Auth bypass / access controlCVE-2026-63414In token-exchange authenticated controllers, `shopify_app` exposes shop context through helpers such as `current_shopify_domain`. Prior to the fix, `current_shopify_domain` could resolve to the sanitized `shop` query parameter instead of the shop identity derived from the verified Shopify ID token or active Shopify session. As a result, a request authenticated for one shop could include a different `shop` query parameter, causing application code to treat the requested shop as the current shop.
- 5.5MediumOct 29, 2026rubygems crass Denial of serviceCVE-2026-61848### Impact When parsing an input containing non-ASCII characters, inefficiencies in how Crass tracks the positions of multi-byte characters result in superlinear parsing time. An attacker-controlled input consisting of many non-ASCII characters could cause excessive CPU consumption and potentially denial of service. ### Patches This is fixed in Crass 1.0.7. ### Workarounds Avoid passing non-ASCII input to Crass. Or cultivate patience.
- 5.5MediumOct 29, 2026rubygems crass Denial of serviceCVE-2026-61847### Impact When the `:preserve_comments` option is not enabled (which is the default behavior), Crass discards CSS comments by recursively consuming the next token. An attacker who provides a stylesheet containing a very large number of adjacent comments can cause excessive recursion and trigger a `SystemStackError`. ### Patches This is fixed in Crass 1.0.7, which no longer recurses when discarding comments. ### Workarounds Set the `:preserve_comments` option to `true` if this is acceptable
- 5.5MediumOct 29, 2026rubygems crass Denial of serviceCVE-2026-61846### Impact Crass recursively parses CSS simple blocks and functions without a depth guard. An attacker-controlled value containing many deeply nested blocks can recurse until Ruby raises `SystemStackError: stack level too deep`, or can cause excessive memory usage. ### Patches This is fixed in Crass 1.0.7, which adds a configurable depth limit with a conservative default. ### Workarounds Add `SystemStackError` handling around Crass calls in your application. Buy more RAM.
Top products
- crass3 CVEs in the last year
- shopify app1 CVE in the last year
Counts cover CVEs and advisories Watch Floor tracks, by the date they became news. Updated every 10 minutes.