# RubyGems Advisories. Every RubyGems Advisory we hold (Ruby), newest first. ## Records, newest first (an older page) - [Secure Headers: CSP directive injection via sandbox, plugin_types, and report_to when given untrusted input](https://agentprime.io/advisories/GHSA-rqq5-2gf9-4w4q.md) `GHSA-rqq5-2gf9-4w4q`, `CVE-2026-54163` · RubyGems `secure_headers`: affected `<7.3.0`, fixed in `7.3.0` · CVSS 4.7 Medium · Not analysed yet · Published 10 Jul 2026 · Tags: Cross-site scripting (XSS), Other injection - [Avo: Direct attachment upload endpoint lacks upload authorization and bypasses field-level upload policy](https://agentprime.io/advisories/GHSA-pqpw-cvm4-8mv9.md) `GHSA-pqpw-cvm4-8mv9`, `CVE-2026-53769` · RubyGems `avo`: affected `>=2.28.0, <3.32.0`, fixed in `3.32.0` · CVSS 6.5 Medium · Not analysed yet · Published 9 Jul 2026 · Tags: Broken access control - [Ruby CSS Parser: SSRF and Local File Disclosure in \`CssParser::Parser#read_remote_file\`](https://agentprime.io/advisories/GHSA-9pmc-p236-855h.md) `GHSA-9pmc-p236-855h`, `CVE-2026-53727` · RubyGems `css_parser`: affected `<3.0.0`, fixed in `3.0.0` · CVSS 8.9 High · Not analysed yet · Published 9 Jul 2026 · Tags: Server-side request forgery (SSRF) - [pay-rails/pay: non-constant-time HMAC comparison in Paddle Billing webhook signature verifier](https://agentprime.io/advisories/GHSA-mjgf-xj26-9qf9.md) `GHSA-mjgf-xj26-9qf9`, `CVE-2026-70658` · RubyGems `pay`: affected `<=11.6.1`, no fixed version yet · CVSS 7.4 High · Not analysed yet · Published 1 Jul 2026 · Tags: CWE-208 - [YARD static cache reads raw traversal paths before router sanitization](https://agentprime.io/advisories/GHSA-pxcc-8665-phx8.md) `GHSA-pxcc-8665-phx8`, `CVE-2026-49342` · RubyGems `yard`: affected `<0.9.44`, fixed in `0.9.44` · CVSS 5.3 Medium · Not analysed yet · Published 26 Jun 2026 · Tags: Path traversal - [fluent-plugin-opentelemetry Has Denial of Service (DoS) via Large Payloads and Decompression Bombs in \`in_opentelemetry\`](https://agentprime.io/advisories/GHSA-2jc5-xhx8-qj6h.md) `GHSA-2jc5-xhx8-qj6h`, `CVE-2026-44163` · RubyGems `fluent-plugin-opentelemetry`: affected `<0.5.3`, fixed in `0.5.3` · CVSS 5.3 Medium · Not analysed yet · Published 26 Jun 2026 · Tags: Denial of service, CWE-409 - [fluent-plugin-s3 Vulnerable to Denial of Service (DoS) via Decompression Bomb in \`in_s3\`](https://agentprime.io/advisories/GHSA-xv9w-7v6q-hpjh.md) `GHSA-xv9w-7v6q-hpjh`, `CVE-2026-44162` · RubyGems `fluent-plugin-s3`: affected `>=0.7.0, <1.8.5`, fixed in `1.8.5` · CVSS 2.7 Low · Not analysed yet · Published 26 Jun 2026 · Tags: Denial of service, CWE-409 - [Fluentd is Vulnerable to Server-Side Request Forgery (SSRF) via Placeholder Expansion in \`out_http\`](https://agentprime.io/advisories/GHSA-72f5-rr8c-r6gr.md) `GHSA-72f5-rr8c-r6gr`, `BIT-fluentd-2026-44161`, `CVE-2026-44161` · RubyGems `fluentd`: affected `<1.19.3`, fixed in `1.19.3` · CVSS 7.2 High · Not analysed yet · Published 26 Jun 2026 · Tags: Server-side request forgery (SSRF) - [Fluentd is Vulnerable to Denial of Service (DoS) via Gzip Decompression Bomb in \`in_http\` and \`in_forward\`](https://agentprime.io/advisories/GHSA-j9cw-hwqf-85w7.md) `GHSA-j9cw-hwqf-85w7`, `BIT-fluentd-2026-44160`, `CVE-2026-44160` · RubyGems `fluentd`: affected `<1.19.3`, fixed in `1.19.3` · CVSS 7.5 High · Not analysed yet · Published 26 Jun 2026 · Tags: CWE-409 - [Fluentd is Vulnerable to Exposure of Sensitive Information via Monitor Agent API](https://agentprime.io/advisories/GHSA-pr7j-96cj-549h.md) `GHSA-pr7j-96cj-549h`, `BIT-fluentd-2026-44025`, `CVE-2026-44025` · RubyGems `fluentd`: affected `<1.19.3`, fixed in `1.19.3` · CVSS 7.5 High · Not analysed yet · Published 26 Jun 2026 · Tags: Information disclosure, Authentication bypass - [Fluentd is Vulnerable to Remote Code Execution (RCE) via Arbitrary File Write in \`${tag}\` Placeholder](https://agentprime.io/advisories/GHSA-44hj-4m45-frj3.md) `GHSA-44hj-4m45-frj3`, `BIT-fluentd-2026-44024`, `CVE-2026-44024` · RubyGems `fluentd`: affected `<1.19.3`, fixed in `1.19.3` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Jun 2026 · Tags: Path traversal, Code injection - [Concurrent Ruby: ReadWriteLock allows wrong-thread write release and stray read-release counter corruption](https://agentprime.io/advisories/GHSA-6wx8-w4f5-wwcr.md) `GHSA-6wx8-w4f5-wwcr`, `CVE-2026-54906` · RubyGems `concurrent-ruby`: affected `<1.3.7`, fixed in `1.3.7` · CVSS 2.1 Low · Not analysed yet · Published 19 Jun 2026 · Tags: CWE-414, CWE-667 - [Concurrent Ruby: \`ReentrantReadWriteLock\` read-count overflow grants a write lock without exclusivity](https://agentprime.io/advisories/GHSA-wv3x-4vxv-whpp.md) `GHSA-wv3x-4vxv-whpp`, `CVE-2026-54905` · RubyGems `concurrent-ruby`: affected `<1.3.7`, fixed in `1.3.7` · CVSS 2.0 Low · Not analysed yet · Published 19 Jun 2026 · Tags: CWE-128 - [Concurrent Ruby : \`AtomicReference#update\` livelocks when the stored value is \`Float::NAN\`](https://agentprime.io/advisories/GHSA-h8w8-99g7-qmvj.md) `GHSA-h8w8-99g7-qmvj`, `CVE-2026-54904` · RubyGems `concurrent-ruby`: affected `<1.3.7`, fixed in `1.3.7` · CVSS 8.2 High · Not analysed yet · Published 19 Jun 2026 · Tags: Denial of service - [Oj: Integer Overflow in Oj.load 2GB String Handling](https://agentprime.io/advisories/GHSA-475m-ph3x-64gp.md) `GHSA-475m-ph3x-64gp`, `CVE-2026-54903` · RubyGems `oj`: affected `<3.17.3`, fixed in `3.17.3` · CVSS 6.3 Medium · Not analysed yet · Published 19 Jun 2026 · Tags: Memory corruption - [Oj: Use-After-Free in Oj::Parser SAJ Long Key Callback](https://agentprime.io/advisories/GHSA-m578-w5vf-rfcm.md) `GHSA-m578-w5vf-rfcm`, `CVE-2026-54902` · RubyGems `oj`: affected `<3.17.3`, fixed in `3.17.3` · CVSS 6.3 Medium · Not analysed yet · Published 19 Jun 2026 · Tags: Memory corruption - [Oj: Use-After-Free in Oj::Parser array_class/hash_class GC Marking](https://agentprime.io/advisories/GHSA-vwm4-62gf-x745.md) `GHSA-vwm4-62gf-x745`, `CVE-2026-54901` · RubyGems `oj`: affected `<3.17.3`, fixed in `3.17.3` · CVSS 6.3 Medium · Not analysed yet · Published 19 Jun 2026 · Tags: Memory corruption - [Oj: Negative-Size memcpy in Oj::Parser create_id Attribute Handling](https://agentprime.io/advisories/GHSA-9cv6-qcjw-4grx.md) `GHSA-9cv6-qcjw-4grx`, `CVE-2026-54900` · RubyGems `oj`: affected `<3.17.3`, fixed in `3.17.3` · CVSS 6.3 Medium · Not analysed yet · Published 19 Jun 2026 · Tags: Memory corruption - [Oj: Use-After-Free in Oj::Parser SAJ Callback via Input Mutation](https://agentprime.io/advisories/GHSA-q2gm-54r6-8fwm.md) `GHSA-q2gm-54r6-8fwm`, `CVE-2026-54898` · RubyGems `oj`: affected `<3.17.3`, fixed in `3.17.3` · CVSS 2.1 Low · Not analysed yet · Published 19 Jun 2026 · Tags: Memory corruption - [Oj: Use-After-Free in Oj::Doc Iterators via Reentrant Close](https://agentprime.io/advisories/GHSA-9ppp-w3g4-fh4q.md) `GHSA-9ppp-w3g4-fh4q`, `CVE-2026-54897` · RubyGems `oj`: affected `<3.17.3`, fixed in `3.17.3` · CVSS 2.1 Low · Not analysed yet · Published 19 Jun 2026 · Tags: Memory corruption - [Oj: Heap Buffer Overflow in Oj.dump Exception Serialization via Large Indent](https://agentprime.io/advisories/GHSA-35w3-pjm6-wj95.md) `GHSA-35w3-pjm6-wj95`, `CVE-2026-54896` · RubyGems `oj`: affected `<3.17.3`, fixed in `3.17.3` · CVSS 2.1 Low · Not analysed yet · Published 19 Jun 2026 · Tags: Memory corruption - [Oj: Stack Buffer Overflow in Oj::Doc#each_child via Deeply Nested Input](https://agentprime.io/advisories/GHSA-3m6q-jj5j-38c9.md) `GHSA-3m6q-jj5j-38c9`, `CVE-2026-54592` · RubyGems `oj`: affected `<3.17.3`, fixed in `3.17.3` · CVSS 7.5 High · Not analysed yet · Published 19 Jun 2026 · Tags: Memory corruption - [Oj: intern.c form_attr (uninitialized stack read)](https://agentprime.io/advisories/GHSA-fm7p-mprw-wjm9.md) `GHSA-fm7p-mprw-wjm9`, `CVE-2026-54500` · RubyGems `oj`: affected `<3.17.3`, fixed in `3.17.3` · CVSS 5.3 Medium · Not analysed yet · Published 19 Jun 2026 · Tags: Memory corruption - [Faraday: Uncontrolled recursion in NestedParamsEncoder allows stack exhaustion DoS via deeply nested query parameters](https://agentprime.io/advisories/GHSA-98m9-hrrm-r99r.md) `GHSA-98m9-hrrm-r99r`, `CVE-2026-54297` · RubyGems `faraday`: affected `>=1.0.0, <1.10.6 || >=2.0.0, <2.14.3`, fixed in `1.10.6`, `2.14.3` · CVSS 7.5 High · Not analysed yet · Published 19 Jun 2026 · Tags: Denial of service - [Oj: Stack Buffer Overflow in Oj.dump via Large Indent](https://agentprime.io/advisories/GHSA-3v45-f3vh-wg7m.md) `GHSA-3v45-f3vh-wg7m`, `CVE-2026-54502` · RubyGems `oj`: affected `<3.17.3`, fixed in `3.17.3` · CVSS 6.3 Medium · Not analysed yet · Published 19 Jun 2026 · Tags: Memory corruption - [Oj: Use-After-Free in Oj::Parser Symbol Key Cache Toggle](https://agentprime.io/advisories/GHSA-2cw7-v8ff-p88r.md) `GHSA-2cw7-v8ff-p88r`, `CVE-2026-54899` · RubyGems `oj`: affected `<3.17.2`, fixed in `3.17.2` · CVSS 6.3 Medium · Not analysed yet · Published 19 Jun 2026 · Tags: Memory corruption - [AlchemyCMS: Unauthenticated nested page API leaks restricted & unpublished content](https://agentprime.io/advisories/GHSA-mqq5-j7w8-2hgh.md) `GHSA-mqq5-j7w8-2hgh`, `CVE-2026-57579` · RubyGems `alchemy_cms`: affected `<7.4.15 || >=8.0.0.a, <8.0.15 || >=8.1.0, <8.1.14 || >=8.2.0, <8.2.6`, fixed in `7.4.15`, `8.0.15`, `8.1.14`, `8.2.6` · CVSS 7.5 High · Not analysed yet · Published 19 Jun 2026 · Tags: Broken access control - [Nokogiri: Possible Use-After-Free when setting an attribute value via \`Nokogiri::XML::Attr#value=\` or \`#content=\`](https://agentprime.io/advisories/GHSA-phwj-rprq-35pp.md) `GHSA-phwj-rprq-35pp`, `CVE-2026-57435` · RubyGems `nokogiri`: affected `<1.19.4`, fixed in `1.19.4` · CVSS 1.7 Low · Not analysed yet · Published 19 Jun 2026 · Tags: Memory corruption - [Nokogiri: Possible Use-After-Free in XInclude Processing](https://agentprime.io/advisories/GHSA-wfpw-mmfh-qq69.md) `GHSA-wfpw-mmfh-qq69`, `CVE-2026-57438` · RubyGems `nokogiri`: affected `<1.19.4`, fixed in `1.19.4` · CVSS 2.2 Low · Not analysed yet · Published 19 Jun 2026 · Tags: Memory corruption - [Nokogiri: Possible Use-After-Free when directly using \`NokogirI::XML::XPathContext\` beyond document lifetime](https://agentprime.io/advisories/GHSA-p67v-3w7g-wjg7.md) `GHSA-p67v-3w7g-wjg7`, `CVE-2026-57437` · RubyGems `nokogiri`: affected `<1.19.4`, fixed in `1.19.4` · CVSS 1.7 Low · Not analysed yet · Published 19 Jun 2026 · Tags: Memory corruption - [Nokogiri: Possible Use-After-Free when setting \`Document#root=\` to an invalid node type](https://agentprime.io/advisories/GHSA-wjv4-x9w8-wm3h.md) `GHSA-wjv4-x9w8-wm3h`, `CVE-2026-57436` · RubyGems `nokogiri`: affected `<1.19.4`, fixed in `1.19.4` · CVSS 1.7 Low · Not analysed yet · Published 19 Jun 2026 · Tags: Memory corruption - [Nokogiri: Possible Out-of-Bounds Read in \`Nokogiri::XML::NodeSet#\[\]\`](https://agentprime.io/advisories/GHSA-5prr-v3j2-97mh.md) `GHSA-5prr-v3j2-97mh`, `CVE-2026-57235` · RubyGems `nokogiri`: affected `<1.19.4`, fixed in `1.19.4` · CVSS 6.3 Medium · Not analysed yet · Published 19 Jun 2026 · Tags: Memory corruption - [Nokogiri: Null Pointer Dereference calling methods on uninitialized wrapper classes](https://agentprime.io/advisories/GHSA-9cv2-cfxc-v4v2.md) `GHSA-9cv2-cfxc-v4v2`, `CVE-2026-57434` · RubyGems `nokogiri`: affected `<1.19.4`, fixed in `1.19.4` · CVSS 1.7 Low · Not analysed yet · Published 19 Jun 2026 · Tags: Memory corruption - [Nokogiri: XML::Schema on JRuby allows network requests when NONET is set, bypassing CVE-2020-26247](https://agentprime.io/advisories/GHSA-8678-w3jw-xfc2.md) `GHSA-8678-w3jw-xfc2`, `CVE-2026-57234` · RubyGems `nokogiri`: affected `<1.19.4`, fixed in `1.19.4` · CVSS 2.6 Low · Not analysed yet · Published 19 Jun 2026 · Tags: XML external entities (XXE), CWE-178, CWE-184 - [Nokogiri: Possible Use-After-Free when \`Nokogiri::XML::Document#encoding=\` raises an exception](https://agentprime.io/advisories/GHSA-5v8h-3h3q-446p.md) `GHSA-5v8h-3h3q-446p`, `CVE-2026-57236` · RubyGems `nokogiri`: affected `<1.19.4`, fixed in `1.19.4` · CVSS 1.7 Low · Not analysed yet · Published 19 Jun 2026 · Tags: Memory corruption - [Avo: Missing Authorization in Avo Association Attach Endpoint Allows Unauthorized Relationship Manipulation and Privilege Escalation](https://agentprime.io/advisories/GHSA-8fq9-273g-6mrg.md) `GHSA-8fq9-273g-6mrg`, `CVE-2026-55518` · RubyGems `avo`: affected `<3.32.1 || >=4.0.0.beta.1, <4.0.0.beta.51`, fixed in `3.32.1`, `4.0.0.beta.51` · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Jun 2026 · Tags: Broken access control - [katello: missing repository authorization in content_uploads exposes cross-product content existence](https://agentprime.io/advisories/GHSA-c43c-rf7g-5xpg.md) `GHSA-c43c-rf7g-5xpg`, `CVE-2026-12515` · RubyGems `katello`: affected `<4.21.0.rc1`, fixed in `4.21.0.rc1` · CVSS 4.3 Medium · Not analysed yet · Published 17 Jun 2026 · Tags: Broken access control - [Net::IMAP: Command Injection via ID command argument](https://agentprime.io/advisories/GHSA-46q3-7gv7-qmgg.md) `GHSA-46q3-7gv7-qmgg`, `CVE-2026-47242` · RubyGems `net-imap`: affected `<0.5.15 || >=0.6.0, <0.6.4.1`, fixed in `0.5.15`, `0.6.4.1` · CVSS 5.8 Medium · Not analysed yet · Published 9 Jun 2026 · Tags: Command injection, Other injection - [Net::IMAP: Denial of Service via incomplete raw argument validation](https://agentprime.io/advisories/GHSA-c4fp-cxrr-mj66.md) `GHSA-c4fp-cxrr-mj66`, `CVE-2026-47241` · RubyGems `net-imap`: affected `<0.5.15 || >=0.6.0, <0.6.4.1`, fixed in `0.5.15`, `0.6.4.1` · CVSS 2.1 Low · Not analysed yet · Published 9 Jun 2026 · Tags: CWE-162, CWE-182, CWE-186 - [Net::IMAP: Command Injection via non-synchronizing literal in "raw" argument](https://agentprime.io/advisories/GHSA-8p34-64r3-mwg8.md) `GHSA-8p34-64r3-mwg8`, `CVE-2026-47240` · RubyGems `net-imap`: affected `<0.5.15 || >=0.6.0, <0.6.4.1`, fixed in `0.5.15`, `0.6.4.1` · CVSS 5.8 Medium · Not analysed yet · Published 9 Jun 2026 · Tags: Command injection, Other injection - [Puma PROXY Protocol v1 Accepts Repeated Protocol Headers on Persistent Connections](https://agentprime.io/advisories/GHSA-2vqw-3mp8-cgmx.md) `GHSA-2vqw-3mp8-cgmx`, `CVE-2026-47737` · RubyGems `puma`: affected `>=5.5.0, <7.2.1 || >=8.0.0, <8.0.2`, fixed in `7.2.1`, `8.0.2` · CVSS 7.5 High · Not analysed yet · Published 9 Jun 2026 · Tags: Authentication bypass, CWE-345 - [Puma PROXY Protocol v1 Parser Allows Remote Memory Exhaustion](https://agentprime.io/advisories/GHSA-qpgp-93vx-g8v8.md) `GHSA-qpgp-93vx-g8v8`, `CVE-2026-47736` · RubyGems `puma`: affected `>=5.5.0, <7.2.1 || >=8.0.0, <8.0.2`, fixed in `7.2.1`, `8.0.2` · CVSS 7.5 High · Not analysed yet · Published 8 Jun 2026 · Tags: Denial of service - [Spree: CSV Formula Injection in Customer Export](https://agentprime.io/advisories/GHSA-xf4v-w5x5-pv79.md) `GHSA-xf4v-w5x5-pv79` · RubyGems `spree`: affected `>=5.2.0, <5.2.8 || >=5.3.0, <5.3.6 || >=5.4.0, <5.4.3`, fixed in `5.2.8`, `5.3.6`, `5.4.3` · CVSS 4.0, no score published · Not analysed yet · Published 4 Jun 2026 · Tags: Other injection - [Doorkeeper Openid Connect: Dynamic Client Registration feature creates public clients with client_secret](https://agentprime.io/advisories/GHSA-m6vc-f87m-cc2h.md) `GHSA-m6vc-f87m-cc2h`, `CVE-2026-44476` · RubyGems `doorkeeper-openid_connect`: affected `>=1.9.0, <1.10.0`, fixed in `1.10.0` · CVSS 6.3 Medium · Not analysed yet · Published 4 Jun 2026 · Tags: Authentication bypass - [CarrierWave has a denylisted_content_type bypass via Unescaped Regex Metacharacters](https://agentprime.io/advisories/GHSA-7g26-2qgj-chfg.md) `GHSA-7g26-2qgj-chfg`, `CVE-2026-44587` · RubyGems `carrierwave`: affected `<2.2.7 || >=3.0.0.beta, <3.1.3`, fixed in `2.2.7`, `3.1.3` · CVSS 4.7 Medium · Not analysed yet · Published 27 May 2026 · Tags: Cross-site scripting (XSS), CWE-116, CWE-184, CWE-625 - [ruby-jwt: Empty-key HMAC bypass; cross-language sibling of CVE-2026-44351](https://agentprime.io/advisories/GHSA-c32j-vqhx-rx3x.md) `GHSA-c32j-vqhx-rx3x`, `CVE-2026-45363` · RubyGems `jwt`: affected `<2.10.3 || >=3.0.0, <3.2.0`, fixed in `2.10.3`, `3.2.0` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 May 2026 · Tags: Authentication bypass, Weak cryptography or TLS, Hard-coded credentials - [Faraday has a possible incomplete fix for GHSA-33mh-2634-fwr2: protocol-relative URI objects still bypass host scoping](https://agentprime.io/advisories/GHSA-5rv5-xj5j-3484.md) `GHSA-5rv5-xj5j-3484`, `CVE-2026-33637` · RubyGems `faraday`: affected `>=2.0.0, <2.14.2`, fixed in `2.14.2` · CVSS 0.0 None · Not analysed yet · Published 18 May 2026 · Tags: Server-side request forgery (SSRF) - [view_component: System Test Entry Point Path Check Allows Sibling Directory Escape](https://agentprime.io/advisories/GHSA-hg3h-g7xc-f7vp.md) `GHSA-hg3h-g7xc-f7vp`, `CVE-2026-44837` · RubyGems `view_component`: affected `>=3.0.0, <4.9.0`, fixed in `4.9.0` · CVSS 5.9 Medium · Not analysed yet · Published 8 May 2026 · Tags: Path traversal, CWE-187 - [view_component: Preview Route Can Dispatch Inherited Helper Methods](https://agentprime.io/advisories/GHSA-7f3r-gwc9-2995.md) `GHSA-7f3r-gwc9-2995`, `CVE-2026-44836` · RubyGems `view_component`: affected `>=3.0.0, <4.9.0`, fixed in `4.9.0` · CVSS 6.5 Medium · Not analysed yet · Published 8 May 2026 · Tags: CWE-277, CWE-749 - [Devise has an Open Redirect via Unvalidated \`request.referrer\` in Timeoutable Session Timeout Handler](https://agentprime.io/advisories/GHSA-jp94-3292-c3xv.md) `GHSA-jp94-3292-c3xv`, `CVE-2026-40295` · RubyGems `devise`: affected `<5.0.4`, fixed in `5.0.4` · CVSS 6.1 Medium · Not analysed yet · Published 8 May 2026 · Tags: Open redirect - [Sidekiq-cron is vulnerable to a cross-site scripting (xss) vulnerability via crafted URL](https://agentprime.io/advisories/GHSA-xv9c-mjw8-79gf.md) `GHSA-xv9c-mjw8-79gf`, `CVE-2025-67202` · RubyGems `sidekiq-cron`: affected `<2.4.0`, fixed in `2.4.0` · CVSS 6.1 Medium · Not analysed yet · Published 7 May 2026 · Tags: Cross-site scripting (XSS) - [katalyst-koi: Session cookies can be replayed after user logout](https://agentprime.io/advisories/GHSA-4cx3-3c38-j9vv.md) `GHSA-4cx3-3c38-j9vv`, `CVE-2026-44511` · RubyGems `katalyst-koi`: affected `<4.20.0 || >=5.0.0, <5.6.0`, fixed in `4.20.0`, `5.6.0` · CVSS 7.4 High · Not analysed yet · Published 7 May 2026 · Tags: Authentication bypass - [CSS Parser: Improper Certificate Validation allows MITM injection of remote CSS content](https://agentprime.io/advisories/GHSA-ff6c-w6qf-7xqc.md) `GHSA-ff6c-w6qf-7xqc`, `CVE-2026-44312` · RubyGems `css_parser`: affected `<1.22.0 || >=2.0.0, <2.1.0`, fixed in `1.22.0`, `2.1.0` · CVSS 5.8 Medium · Not analysed yet · Published 7 May 2026 · Tags: Weak cryptography or TLS, CWE-829 - [Nokogiri XSLT transform has a memory leak](https://agentprime.io/advisories/GHSA-v2fc-qm4h-8hqv.md) `GHSA-v2fc-qm4h-8hqv`, `CVE-2026-79771` · RubyGems `nokogiri`: affected `<1.19.3`, fixed in `1.19.3` · CVSS 6.9 Medium · Not analysed yet · Published 6 May 2026 · Tags: Denial of service - [Nokogiri CSS selector tokenizer has regular expression backtracking](https://agentprime.io/advisories/GHSA-c4rq-3m3g-8wgx.md) `GHSA-c4rq-3m3g-8wgx`, `CVE-2026-79770` · RubyGems `nokogiri`: affected `<1.19.3`, fixed in `1.19.3` · CVSS 8.7 High · Not analysed yet · Published 6 May 2026 · Tags: Denial of service - [GraphQL-Ruby's Ruby lexer does not count comment tokens for the purposes of max_query_string_tokens](https://agentprime.io/advisories/GHSA-3h96-34p3-xm76.md) `GHSA-3h96-34p3-xm76` · RubyGems `graphql`: affected `>=2.3.1, <2.3.23 || >=2.4.0, <2.4.18 || >=2.5.0, <2.5.26 || >=2.6.0, <2.6.1`, fixed in `2.3.23`, `2.4.18`, `2.5.26`, `2.6.1` · CVSS 5.3 Medium · Not analysed yet · Published 5 May 2026 · Tags: Denial of service - [net-imap vulnerable to command Injection via "raw" arguments to multiple commands](https://agentprime.io/advisories/GHSA-hm49-wcqc-g2xg.md) `GHSA-hm49-wcqc-g2xg`, `CVE-2026-42257` · RubyGems `net-imap`: affected `<0.4.24 || >=0.5.0, <0.5.14 || >=0.6.0, <0.6.4`, fixed in `0.4.24`, `0.5.14`, `0.6.4` · CVSS 5.8 Medium · Not analysed yet · Published 4 May 2026 · Tags: Command injection, Other injection - [net-imap vulnerable to command Injection via unvalidated Symbol inputs](https://agentprime.io/advisories/GHSA-75xq-5h9v-w6px.md) `GHSA-75xq-5h9v-w6px`, `CVE-2026-42258` · RubyGems `net-imap`: affected `<0.4.24 || >=0.5.0, <0.5.14 || >=0.6.0, <0.6.4`, fixed in `0.4.24`, `0.5.14`, `0.6.4` · CVSS 5.8 Medium · Not analysed yet · Published 4 May 2026 · Tags: Command injection, Other injection - [net-imap vulnerable to denial of service via high iteration count for \`SCRAM-\*\` authentication](https://agentprime.io/advisories/GHSA-87pf-fpwv-p7m7.md) `GHSA-87pf-fpwv-p7m7`, `CVE-2026-42256` · RubyGems `net-imap`: affected `>=0.4.0, <0.4.24 || >=0.5.0, <0.5.14 || >=0.6.0, <0.6.4`, fixed in `0.4.24`, `0.5.14`, `0.6.4` · CVSS 6.0 Medium · Not analysed yet · Published 4 May 2026 · Tags: Denial of service, CWE-1322 - [net-imap has quadratic complexity when reading response literals](https://agentprime.io/advisories/GHSA-q2mw-fvj9-vvcw.md) `GHSA-q2mw-fvj9-vvcw`, `CVE-2026-42245` · RubyGems `net-imap`: affected `<0.4.24 || >=0.5.0, <0.5.14 || >=0.6.0, <0.6.4`, fixed in `0.4.24`, `0.5.14`, `0.6.4` · CVSS 2.3 Low · Not analysed yet · Published 4 May 2026 · Tags: Denial of service Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .