# RubyGems Advisories. Every RubyGems Advisory we hold (Ruby), newest first. ## Records, newest first (an older page) - [Publify Vulnerable To Cross-Site Scripting (XSS) Via Redirects Requiring User Interaction](https://agentprime.io/advisories/GHSA-8fm5-gg2f-f66q.md) `GHSA-8fm5-gg2f-f66q`, `CVE-2024-39311` · RubyGems `publify_core`: affected `<10.0.2`, fixed in `10.0.2` · CVSS 1.8 Low · Not analysed yet · Published 28 Mar 2025 · Tags: Cross-site scripting (XSS) - [Pitchfork HTTP Request/Response Splitting vulnerability](https://agentprime.io/advisories/GHSA-pfqj-w6r6-g86v.md) `GHSA-pfqj-w6r6-g86v`, `CVE-2025-30221` · RubyGems `pitchfork`: affected `<0.11.0`, fixed in `0.11.0` · CVSS 4.3 Medium · Not analysed yet · Published 27 Mar 2025 · Tags: Other injection - [Nokogiri updates packaged libxslt to v1.1.43 to resolve multiple CVEs](https://agentprime.io/advisories/GHSA-mrxw-mxhj-p664.md) `GHSA-mrxw-mxhj-p664`, `CVE-2025-71406` · RubyGems `nokogiri`: affected `<1.18.4`, fixed in `1.18.4` · CVSS 7.8 High · Not analysed yet · Published 14 Mar 2025 · Tags: Memory corruption, CWE-1395 - [Camaleon CMS Vulnerable to Privilege Escalation through a Mass Assignment](https://agentprime.io/advisories/GHSA-rp28-mvq3-wf8j.md) `GHSA-rp28-mvq3-wf8j`, `CVE-2025-2304` · RubyGems `camaleon_cms`: affected `<2.9.1`, fixed in `2.9.1` · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Mar 2025 · Tags: Broken access control - [Ruby SAML allows a SAML authentication bypass due to namespace handling (parser differential)](https://agentprime.io/advisories/GHSA-754f-8gm6-c4r2.md) `GHSA-754f-8gm6-c4r2`, `BIT-gitlab-2025-25292`, `CVE-2025-25292` · RubyGems `ruby-saml`: affected `<1.12.4 || >=1.13.0, <1.18.0`, fixed in `1.12.4`, `1.18.0` · CVSS 9.3 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.65 · Not analysed yet · Published 12 Mar 2025 · Tags: Weak cryptography or TLS, CWE-436 - [Ruby SAML allows a SAML authentication bypass due to DOCTYPE handling (parser differential)](https://agentprime.io/advisories/GHSA-4vc4-m8qh-g8jm.md) `GHSA-4vc4-m8qh-g8jm`, `BIT-gitlab-2025-25291`, `CVE-2025-25291` · RubyGems `ruby-saml`: affected `<1.12.4 || >=1.13.0, <1.18.0`, fixed in `1.12.4`, `1.18.0` · CVSS 9.3 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.21 · Not analysed yet · Published 12 Mar 2025 · Tags: Weak cryptography or TLS, CWE-436 - [Ruby SAML allows remote Denial of Service (DoS) with compressed SAML responses](https://agentprime.io/advisories/GHSA-92rq-c8cf-prrq.md) `GHSA-92rq-c8cf-prrq`, `BIT-gitlab-2025-25293`, `CVE-2025-25293` · RubyGems `ruby-saml`: affected `<1.12.4 || >=1.13.0, <1.18.0`, fixed in `1.12.4`, `1.18.0` · CVSS 7.7 High · Not analysed yet · Published 12 Mar 2025 · Tags: Denial of service - [omniauth-saml has dependency on ruby-saml version with Signature Wrapping Attack issue](https://agentprime.io/advisories/GHSA-hw46-3hmr-x9xv.md) `GHSA-hw46-3hmr-x9xv` · RubyGems `omniauth-saml`: affected `<1.10.6 || >=2.0.0, <2.1.3 || >=2.2.0, <2.2.3`, fixed in `1.10.6`, `2.1.3`, `2.2.3` · No CVSS score · Not analysed yet · Published 12 Mar 2025 · Tags: Weak cryptography or TLS - [graphql allows remote code execution when loading a crafted GraphQL schema](https://agentprime.io/advisories/GHSA-q92j-grw3-h492.md) `GHSA-q92j-grw3-h492`, `CVE-2025-27407` · RubyGems `graphql`: affected `>=1.11.5, <1.11.11 || >=1.12.0, <1.12.25 || >=1.13.0, <1.13.24 || >=2.0.0, <2.0.32 || >=2.1.0, <2.1.15 || >=2.2.0, <2.2.17 || >=2.3.0, <2.3.21 || >=2.4.0, <2.4.13`, fixed in `1.11.11`, `1.12.25`, `1.13.24`, `2.0.32`, `2.1.15`, `2.2.17`, `2.3.21`, `2.4.13` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 Mar 2025 · Tags: Code injection - [Out-of-bounds Read in Ruby JSON Parser](https://agentprime.io/advisories/GHSA-9m3q-rhmv-5q44.md) `GHSA-9m3q-rhmv-5q44`, `CVE-2025-27788` · RubyGems `json`: affected `>=2.10.0, <2.10.2`, fixed in `2.10.2` · CVSS 7.5 High · Not analysed yet · Published 12 Mar 2025 · Tags: Memory corruption - [Local File Inclusion in Rack::Static](https://agentprime.io/advisories/GHSA-7wqh-767x-r66v.md) `GHSA-7wqh-767x-r66v`, `CVE-2025-27610` · RubyGems `rack`: affected `<2.2.13 || >=3.0, <3.0.14 || >=3.1, <3.1.12`, fixed in `2.2.13`, `3.0.14`, `3.1.12` · CVSS 7.5 High · Not analysed yet · Published 10 Mar 2025 · Tags: Path traversal - [Escape Sequence Injection vulnerability in Rack lead to Possible Log Injection](https://agentprime.io/advisories/GHSA-8cgq-6mh2-7j6v.md) `GHSA-8cgq-6mh2-7j6v`, `CVE-2025-27111` · RubyGems `rack`: affected `<2.2.12 || >=3.0, <3.0.13 || >=3.1, <3.1.11`, fixed in `2.2.12`, `3.0.13`, `3.1.11` · CVSS 6.9 Medium · Not analysed yet · Published 4 Mar 2025 · Tags: Other injection - [URI allows for userinfo Leakage in URI#join, URI#merge, and URI#+](https://agentprime.io/advisories/GHSA-22h5-pq3x-2gf2.md) `GHSA-22h5-pq3x-2gf2`, `CVE-2025-27221` · RubyGems `uri`: affected `<0.11.3 || >=0.12.0, <0.12.4 || >=0.13.0, <0.13.2 || >=1.0.0, <1.0.3`, fixed in `0.11.3`, `0.12.4`, `0.13.2`, `1.0.3` · CVSS 3.2 Low · Not analysed yet · Published 3 Mar 2025 · Tags: Information disclosure, CWE-212 - [CGI has Regular Expression Denial of Service (ReDoS) potential in Util#escapeElement](https://agentprime.io/advisories/GHSA-mhwm-jh88-3gjf.md) `GHSA-mhwm-jh88-3gjf`, `CVE-2025-27220` · RubyGems `cgi`: affected `<0.3.5.1 || >=0.3.6, <0.3.7 || >=0.4.0, <0.4.2`, fixed in `0.3.5.1`, `0.3.7`, `0.4.2` · CVSS 4.0 Medium · Not analysed yet · Published 3 Mar 2025 · Tags: Denial of service - [CGI has Denial of Service (DoS) potential in Cookie.parse](https://agentprime.io/advisories/GHSA-gh9q-2xrm-x6qv.md) `GHSA-gh9q-2xrm-x6qv`, `CVE-2025-27219` · RubyGems `cgi`: affected `<0.3.5.1 || >=0.3.6, <0.3.7 || >=0.4.0, <0.4.2`, fixed in `0.3.5.1`, `0.3.7`, `0.4.2` · CVSS 5.8 Medium · Not analysed yet · Published 3 Mar 2025 · Tags: Denial of service - [Oxidized Web RANCID migration page allows unauthenticated user to gain control over Linux user account](https://agentprime.io/advisories/GHSA-jx6p-9c26-g373.md) `GHSA-jx6p-9c26-g373`, `CVE-2025-27590` · RubyGems `oxidized-web`: affected `<0.15.0`, fixed in `0.15.0` · CVSS 9.0 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.28 · Not analysed yet · Published 3 Mar 2025 · Tags: Path traversal - [Phusion Passenger denial of service](https://agentprime.io/advisories/GHSA-2cj2-qqxj-5m3r.md) `GHSA-2cj2-qqxj-5m3r`, `BIT-passenger-2025-26803`, `BIT-passenger-apache-module-2025-26803`, `BIT-passenger-nginx-module-2025-26803`, `CVE-2025-26803` · RubyGems `passenger`: affected `>=6.0.21, <6.0.26`, fixed in `6.0.26` · CVSS 5.3 Medium · Not analysed yet · Published 24 Feb 2025 · Tags: Memory corruption - [Duplicate Advisory: Nokogiri updates packaged libxml2 to 2.13.6 to resolve CVE-2025-24928 and CVE-2024-56171](https://agentprime.io/advisories/GHSA-5mwf-688x-mr7x.md) `GHSA-5mwf-688x-mr7x` · RubyGems `nokogiri`: affected `<1.18.3`, fixed in `1.18.3` · No CVSS score · Withdrawn · Not analysed yet · Published 19 Feb 2025 · Tags: CWE-1395 - [Nokogiri updates packaged libxml2 to 2.13.6 to resolve CVE-2025-24928 and CVE-2024-56171](https://agentprime.io/advisories/GHSA-vvfq-8hwr-qm4m.md) `GHSA-vvfq-8hwr-qm4m`, `CVE-2025-71407` · RubyGems `nokogiri`: affected `<1.18.3`, fixed in `1.18.3` · No CVSS score · Not analysed yet · Published 18 Feb 2025 · Tags: Memory corruption, CWE-1395 - [Possible Log Injection in Rack::CommonLogger](https://agentprime.io/advisories/GHSA-7g2v-jj9q-g3rg.md) `GHSA-7g2v-jj9q-g3rg`, `CVE-2025-25184` · RubyGems `rack`: affected `<2.2.11 || >=3.0, <3.0.12 || >=3.1, <3.1.10`, fixed in `2.2.11`, `3.0.12`, `3.1.10` · CVSS 5.7 Medium · Not analysed yet · Published 12 Feb 2025 · Tags: Other injection - [Possible DoS by memory exhaustion in net-imap](https://agentprime.io/advisories/GHSA-7fc5-f82f-cx69.md) `GHSA-7fc5-f82f-cx69`, `CVE-2025-25186` · RubyGems `net-imap`: affected `>=0.3.2, <0.3.8 || >=0.4.0, <0.4.19 || >=0.5.0, <0.5.6`, fixed in `0.3.8`, `0.4.19`, `0.5.6` · CVSS 6.5 Medium · Not analysed yet · Published 10 Feb 2025 · Tags: Denial of service, CWE-405, CWE-409, CWE-1287 - [Password Pusher Allows Session Token Interception Leading to Potential Hijacking](https://agentprime.io/advisories/GHSA-4fwj-m62q-pp47.md) `GHSA-4fwj-m62q-pp47`, `CVE-2024-56733` · RubyGems `pwpush`: affected `<=1.50.3`, no fixed version yet · CVSS 5.7 Medium · Not analysed yet · Published 30 Dec 2024 · Tags: Authentication bypass - [Possible Content Security Policy bypass in Action Dispatch](https://agentprime.io/advisories/GHSA-vfm5-rmrh-j26v.md) `GHSA-vfm5-rmrh-j26v`, `BIT-rails-2024-54133`, `CVE-2024-54133` · RubyGems `actionpack`: affected `>=5.2.0, <7.0.8.7 || >=7.1.0, <7.1.5.1 || >=7.2.0, <7.2.2.1 || >=8.0.0, <8.0.0.1`, fixed in `7.0.8.7`, `7.1.5.1`, `7.2.2.1`, `8.0.0.1` · CVSS 2.3 Low · Not analysed yet · Published 10 Dec 2024 · Tags: Cross-site scripting (XSS) - [rails-html-sanitizer has XSS vulnerability with certain configurations](https://agentprime.io/advisories/GHSA-rxv5-gxqc-xx8g.md) `GHSA-rxv5-gxqc-xx8g`, `CVE-2024-53989` · RubyGems `rails-html-sanitizer`: affected `>=1.6.0, <1.6.1`, fixed in `1.6.1` · CVSS 2.3 Low · Not analysed yet · Published 2 Dec 2024 · Tags: Cross-site scripting (XSS) - [rails-html-sanitizer has XSS vulnerability with certain configurations](https://agentprime.io/advisories/GHSA-2x5m-9ch4-qgrr.md) `GHSA-2x5m-9ch4-qgrr`, `CVE-2024-53987` · RubyGems `rails-html-sanitizer`: affected `>=1.6.0, <1.6.1`, fixed in `1.6.1` · CVSS 2.3 Low · Not analysed yet · Published 2 Dec 2024 · Tags: Cross-site scripting (XSS) - [rails-html-sanitizer has XSS vulnerability with certain configurations](https://agentprime.io/advisories/GHSA-cfjx-w229-hgx5.md) `GHSA-cfjx-w229-hgx5`, `CVE-2024-53988` · RubyGems `rails-html-sanitizer`: affected `>=1.6.0, <1.6.1`, fixed in `1.6.1` · CVSS 2.3 Low · Not analysed yet · Published 2 Dec 2024 · Tags: Cross-site scripting (XSS) - [rails-html-sanitizer has XSS vulnerability with certain configurations](https://agentprime.io/advisories/GHSA-638j-pmjw-jq48.md) `GHSA-638j-pmjw-jq48`, `CVE-2024-53986` · RubyGems `rails-html-sanitizer`: affected `>=1.6.0, <1.6.1`, fixed in `1.6.1` · CVSS 2.3 Low · Not analysed yet · Published 2 Dec 2024 · Tags: Cross-site scripting (XSS) - [rails-html-sanitize has XSS vulnerability with certain configurations](https://agentprime.io/advisories/GHSA-w8gc-x259-rc7x.md) `GHSA-w8gc-x259-rc7x`, `CVE-2024-53985` · RubyGems `rails-html-sanitizer`: affected `>=1.6.0, <1.6.1`, fixed in `1.6.1` · CVSS 2.3 Low · Not analysed yet · Published 2 Dec 2024 · Tags: Cross-site scripting (XSS) - [Password Pusher rate limiter can be bypassed by forging proxy headers](https://agentprime.io/advisories/GHSA-ffp2-8p2h-4m5j.md) `GHSA-ffp2-8p2h-4m5j`, `CVE-2024-52796` · RubyGems `pwpush`: affected `<1.49.0`, fixed in `1.49.0` · CVSS 5.3 Medium · Not analysed yet · Published 20 Nov 2024 · Tags: Denial of service - [decidim-meetings Cross-site scripting vulnerability in the online or hybrid meeting embeds](https://agentprime.io/advisories/GHSA-j4h6-gcj7-7v9v.md) `GHSA-j4h6-gcj7-7v9v`, `CVE-2024-45594` · RubyGems `decidim-meetings`: affected `>=0.28.0, <0.28.3`, fixed in `0.28.3` · CVSS 7.7 High · Not analysed yet · Published 13 Nov 2024 · Tags: Cross-site scripting (XSS) - [Decidim-Awesome has SQL injection in AdminAccountability](https://agentprime.io/advisories/GHSA-cxwf-qc32-375f.md) `GHSA-cxwf-qc32-375f`, `CVE-2024-43415` · RubyGems `decidim-decidim_awesome`: affected `>=0.9.1, <0.10.3 || >=0.11.0, <0.11.2`, fixed in `0.10.3`, `0.11.2` · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 Nov 2024 · Tags: SQL injection - [Sinatra vulnerable to Reliance on Untrusted Inputs in a Security Decision](https://agentprime.io/advisories/GHSA-hxx2-7vcw-mqr3.md) `GHSA-hxx2-7vcw-mqr3`, `CVE-2024-21510` · RubyGems `sinatra`: affected `<4.1.0`, fixed in `4.1.0` · CVSS 5.4 Medium · Not analysed yet · Published 1 Nov 2024 · Tags: CWE-807 - [MPXJ has a Potential Path Traversal Vulnerability](https://agentprime.io/advisories/GHSA-j945-c44v-97g6.md) `GHSA-j945-c44v-97g6`, `CVE-2024-49771`, `PYSEC-2026-1681` · Maven `net.sf.mpxj:mpxj` and 6 more: affected `>=8.3.5, <13.5.1`, fixed in `13.5.1` · CVSS 5.3 Medium · Not analysed yet · Published 28 Oct 2024 · Tags: Path traversal - [REXML ReDoS vulnerability](https://agentprime.io/advisories/GHSA-2rxp-v6pw-ch6m.md) `GHSA-2rxp-v6pw-ch6m`, `CVE-2024-49761`, `CVE-2025-10990` · RubyGems `rexml`: affected `<3.3.9`, fixed in `3.3.9` · CVSS 6.6 Medium · Not analysed yet · Published 28 Oct 2024 · Tags: Denial of service - [Autolab Misconfigured Reset Password Permissions](https://agentprime.io/advisories/GHSA-v46j-h43h-rwrm.md) `GHSA-v46j-h43h-rwrm`, `CVE-2024-49376` · RubyGems `Autolab`: affected `>=3.0.0, <3.0.1`, fixed in `3.0.1` · CVSS 7.1 High · Not analysed yet · Published 25 Oct 2024 · Tags: Authentication bypass, Broken access control - [camaleon_cms affected by cross site scripting](https://agentprime.io/advisories/GHSA-hhxg-rvc9-8726.md) `GHSA-hhxg-rvc9-8726`, `CVE-2024-48652` · RubyGems `camaleon_cms`: affected `<=2.7.5`, no fixed version yet · CVSS 4.8 Medium · Not analysed yet · Published 23 Oct 2024 · Tags: Cross-site scripting (XSS) - [Possible ReDoS vulnerability in block_format in Action Mailer](https://agentprime.io/advisories/GHSA-h47h-mwp9-c6q6.md) `GHSA-h47h-mwp9-c6q6`, `BIT-rails-2024-47889`, `CVE-2024-47889` · RubyGems `actionmailer`: affected `>=3.0.0, <6.1.7.9 || >=7.0.0, <7.0.8.5 || >=7.1.0, <7.1.4.1 || >=7.2.0, <7.2.1.1`, fixed in `6.1.7.9`, `7.0.8.5`, `7.1.4.1`, `7.2.1.1` · CVSS 6.6 Medium · Not analysed yet · Published 15 Oct 2024 · Tags: Denial of service - [Possible ReDoS vulnerability in plain_text_for_blockquote_node in Action Text](https://agentprime.io/advisories/GHSA-wwhv-wxv9-rpgw.md) `GHSA-wwhv-wxv9-rpgw`, `BIT-rails-2024-47888`, `CVE-2024-47888` · RubyGems `actiontext`: affected `>=6.0.0, <6.1.7.9 || >=7.0.0, <7.0.8.5 || >=7.1.0, <7.1.4.1 || >=7.2.0, <7.2.1.1`, fixed in `6.1.7.9`, `7.0.8.5`, `7.1.4.1`, `7.2.1.1` · CVSS 6.6 Medium · Not analysed yet · Published 15 Oct 2024 · Tags: Denial of service - [Possible ReDoS vulnerability in HTTP Token authentication in Action Controller](https://agentprime.io/advisories/GHSA-vfg9-r3fq-jvx4.md) `GHSA-vfg9-r3fq-jvx4`, `BIT-rails-2024-47887`, `CVE-2024-47887` · RubyGems `actionpack`: affected `>=4.0.0, <6.1.7.9 || >=7.0.0, <7.0.8.5 || >=7.1.0, <7.1.4.1 || >=7.2.0, <7.2.1.1`, fixed in `6.1.7.9`, `7.0.8.5`, `7.1.4.1`, `7.2.1.1` · CVSS 6.6 Medium · Not analysed yet · Published 15 Oct 2024 · Tags: Denial of service - [Possible ReDoS vulnerability in query parameter filtering in Action Dispatch](https://agentprime.io/advisories/GHSA-x76w-6vjr-8xgj.md) `GHSA-x76w-6vjr-8xgj`, `BIT-rails-2024-41128`, `CVE-2024-41128` · RubyGems `actionpack`: affected `>=3.1.0, <6.1.7.9 || >=7.0.0, <7.0.8.5 || >=7.1.0, <7.1.4.1 || >=7.2.0, <7.2.1.1`, fixed in `6.1.7.9`, `7.0.8.5`, `7.1.4.1`, `7.2.1.1` · CVSS 6.6 Medium · Not analysed yet · Published 15 Oct 2024 · Tags: Denial of service - [OpenC3 stores passwords in clear text (\`GHSL-2024-129\`)](https://agentprime.io/advisories/GHSA-4xqv-47rm-37mm.md) `GHSA-4xqv-47rm-37mm`, `CVE-2024-47529`, `PYSEC-2024-121` · npm `@openc3/tool-common` and 2 more: affected `<5.19.0`, fixed in `5.19.0` · CVSS 4.8 Medium · Not analysed yet · Published 2 Oct 2024 · Tags: Information disclosure, Hard-coded credentials - [OpenC3 Path Traversal via screen controller (\`GHSL-2024-127\`)](https://agentprime.io/advisories/GHSA-8jxr-mccc-mwg8.md) `GHSA-8jxr-mccc-mwg8`, `CVE-2024-46977`, `PYSEC-2024-101` · PyPI `openc3` and 1 more: affected `<5.19.0`, fixed in `5.19.0` · CVSS 5.3 Medium · Not analysed yet · Published 2 Oct 2024 · Tags: Path traversal - [OpenC3 Cross-site Scripting in Login functionality (\`GHSL-2024-128\`)](https://agentprime.io/advisories/GHSA-vfj8-5pj7-2f9g.md) `GHSA-vfj8-5pj7-2f9g`, `CVE-2024-43795`, `PYSEC-2024-100` · npm `@openc3/tool-common` and 2 more: affected `<5.19.0`, fixed in `5.19.0` · CVSS 5.1 Medium · Not analysed yet · Published 2 Oct 2024 · Tags: Cross-site scripting (XSS) - [Decidim has a cross-site scripting vulnerability in the version control page](https://agentprime.io/advisories/GHSA-cc4g-m3g7-xmw8.md) `GHSA-cc4g-m3g7-xmw8`, `CVE-2024-41673` · RubyGems `decidim`: affected `<0.27.8`, fixed in `0.27.8` · CVSS 7.1 High · Not analysed yet · Published 1 Oct 2024 · Tags: Cross-site scripting (XSS) - [Camaleon CMS vulnerable to stored XSS through user file upload (GHSL-2024-184)](https://agentprime.io/advisories/GHSA-75j2-9gmc-m855.md) `GHSA-75j2-9gmc-m855` · RubyGems `camaleon_cms`: affected `>=2.8.0, <2.8.2`, fixed in `2.8.2` · CVSS 5.4 Medium · Not analysed yet · Published 25 Sept 2024 · Tags: Cross-site scripting (XSS) - [Heap-based Buffer Overflow in sqlite-vec](https://agentprime.io/advisories/GHSA-vrcx-gx3g-j3h8.md) `GHSA-vrcx-gx3g-j3h8`, `CVE-2024-46488`, `PYSEC-2026-1938` · crates.io `sqlite-vec` and 3 more: affected `<0.1.3`, fixed in `0.1.3` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Sept 2024 · Tags: Memory corruption - [Camaleon CMS vulnerable to stored XSS through user file upload (GHSL-2024-184)](https://agentprime.io/advisories/GHSA-8fx8-3rg2-79xw.md) `GHSA-8fx8-3rg2-79xw` · RubyGems `camaleon_cms`: affected `<2.8.1`, fixed in `2.8.1` · CVSS 5.4 Medium · Not analysed yet · Published 23 Sept 2024 · Tags: Cross-site scripting (XSS) - [Duplicate Advisory: Camaleon CMS vulnerable to remote code execution through code injection (GHSL-2024-185)](https://agentprime.io/advisories/GHSA-3hp8-6j24-m5gm.md) `GHSA-3hp8-6j24-m5gm` · RubyGems `camaleon_cms`: affected `<2.8.1`, fixed in `2.8.1` · No CVSS score · Withdrawn · Not analysed yet · Published 23 Sept 2024 - [HTTP Request Smuggling in ruby webrick](https://agentprime.io/advisories/GHSA-6f62-3596-g6w7.md) `GHSA-6f62-3596-g6w7`, `CVE-2024-47220` · RubyGems `webrick`: affected `<1.8.2`, fixed in `1.8.2` · CVSS 7.5 High · Not analysed yet · Published 22 Sept 2024 · Tags: HTTP request smuggling - [Puma's header normalization allows for client to clobber proxy set headers](https://agentprime.io/advisories/GHSA-9hf4-67fc-4vf4.md) `GHSA-9hf4-67fc-4vf4`, `CVE-2024-45614` · RubyGems `puma`: affected `<5.6.9 || >=6.0.0, <6.4.3`, fixed in `5.6.9`, `6.4.3` · CVSS 5.4 Medium · Not analysed yet · Published 20 Sept 2024 · Tags: HTTP request smuggling, Broken access control - [protobuf-java has potential Denial of Service issue](https://agentprime.io/advisories/GHSA-735f-pc8j-v9w8.md) `GHSA-735f-pc8j-v9w8`, `CVE-2024-7254` · Maven `com.google.protobuf:protobuf-java` and 4 more: affected `<3.25.5 || >=4.0.0-RC1, <4.27.5 || >=4.28.0-RC1, <4.28.2`, fixed in `3.25.5`, `4.27.5`, `4.28.2` · CVSS 8.7 High · Not analysed yet · Published 19 Sept 2024 · Tags: Denial of service, Memory corruption, CWE-20 - [Camaleon CMS vulnerable to remote code execution through code injection (GHSL-2024-185)](https://agentprime.io/advisories/GHSA-7x4w-cj9r-h4v9.md) `GHSA-7x4w-cj9r-h4v9` · RubyGems `camaleon_cms`: affected `<2.8.1`, fixed in `2.8.1` · CVSS 7.2 High · Not analysed yet · Published 18 Sept 2024 · Tags: Path traversal - [Camaleon CMS vulnerable to stored XSS through user file upload (GHSL-2024-184)](https://agentprime.io/advisories/GHSA-r9cr-qmfw-pmrc.md) `GHSA-r9cr-qmfw-pmrc` · RubyGems `camaleon_cms`: affected `<2.8.1`, fixed in `2.8.1` · CVSS 5.4 Medium · Not analysed yet · Published 18 Sept 2024 · Tags: Cross-site scripting (XSS) - [Camaleon CMS vulnerable to arbitrary path traversal (GHSL-2024-183)](https://agentprime.io/advisories/GHSA-cp65-5m9r-vc2c.md) `GHSA-cp65-5m9r-vc2c`, `CVE-2024-46987` · RubyGems `camaleon_cms`: affected `<2.8.1`, fixed in `2.8.1` · CVSS 7.7 High · Critical (CVSS 7+ and EPSS) · EPSS 0.15 · Not analysed yet · Published 18 Sept 2024 · Tags: Path traversal, Information disclosure - [Camaleon CMS affected by arbitrary file write to RCE (GHSL-2024-182)](https://agentprime.io/advisories/GHSA-wmjg-vqhv-q5p5.md) `GHSA-wmjg-vqhv-q5p5`, `CVE-2024-46986` · RubyGems `camaleon_cms`: affected `>=2.8.0, <2.8.1`, fixed in `2.8.1` · CVSS 10.0 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.37 · Not analysed yet · Published 18 Sept 2024 · Tags: Path traversal, Other injection - [Devise-Two-Factor Authentication Uses Insufficient Default OTP Shared Secret Length](https://agentprime.io/advisories/GHSA-qjxf-mc72-wjr2.md) `GHSA-qjxf-mc72-wjr2`, `CVE-2024-8796` · RubyGems `devise-two-factor`: affected `>=4.0.0, <6.0.0`, fixed in `6.0.0` · CVSS 6.0 Medium · Not analysed yet · Published 17 Sept 2024 · Tags: CWE-331 - [Decidim::Admin vulnerable to cross-site scripting (XSS) in the admin panel with QuillJS WYSWYG editor](https://agentprime.io/advisories/GHSA-vvqw-fqwx-mqmm.md) `GHSA-vvqw-fqwx-mqmm`, `CVE-2024-39910` · RubyGems `decidim`: affected `<0.27.7`, fixed in `0.27.7` · CVSS 5.4 Medium · Not analysed yet · Published 16 Sept 2024 · Tags: Cross-site scripting (XSS) - [Decidim::Admin vulnerable to cross-site scripting (XSS) in the admin activity log](https://agentprime.io/advisories/GHSA-rx9f-5ggv-5rh6.md) `GHSA-rx9f-5ggv-5rh6`, `CVE-2024-32034` · RubyGems `decidim-admin`: affected `<0.27.7 || >=0.28.0, <0.28.2`, fixed in `0.27.7`, `0.28.2` · CVSS 6.8 Medium · Not analysed yet · Published 16 Sept 2024 · Tags: Cross-site scripting (XSS) - [omniauth-saml vulnerable to Improper Verification of Cryptographic Signature](https://agentprime.io/advisories/GHSA-cvp8-5r8g-fhvq.md) `GHSA-cvp8-5r8g-fhvq` · RubyGems `omniauth-saml`: affected `<1.10.5 || >=2.0.0, <2.1.2 || >=2.2.0, <2.2.1`, fixed in `1.10.5`, `2.1.2`, `2.2.1` · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2024 · Tags: Weak cryptography or TLS - [SAML authentication bypass via Incorrect XPath selector](https://agentprime.io/advisories/GHSA-jw9c-mfg7-9rx2.md) `GHSA-jw9c-mfg7-9rx2`, `BIT-gitlab-2024-45409`, `CVE-2024-45409` · RubyGems `ruby-saml`: affected `<1.12.3 || >=1.13.0, <1.17.0`, fixed in `1.12.3`, `1.17.0` · CVSS 10.0 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.11 · Not analysed yet · Published 10 Sept 2024 · Tags: Weak cryptography or TLS Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .