rubygems rubygems

Name: rubygems rubygems
Brand: rubygems

productUS

cpe:2.3:a:rubygems:rubygems:*:*:*:*:*:*:*:*

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

KEV-listed

by severity

3critical13high9medium0low

updated 2026-10-27

vulnerabilities (25)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2017-0901US	high7.5	29.4% (98th)	Exploit	no fix	2017-08-31	≤ 2.6.12
CVE-2017-0903US	critical9.8	15.9% (97th)	—	no fix	2017-10-11	67 versions
CVE-2017-0899US	critical9.8	11.1% (96th)	—	no fix	2017-08-31	≤ 2.6.12
CVE-2015-3900US	medium5.0	8.87% (95th)	—	no fix	2015-06-24	27 versions
CVE-2017-0900US	high7.5	8.49% (95th)	—	no fix	2017-08-31	≤ 2.6.12
CVE-2018-1000073US	high7.5	4.91% (92nd)	—	no fix	2018-03-13	4 versions
CVE-2017-0902US	high8.1	4.75% (92nd)	—	no fix	2017-08-31	≤ 2.6.12
CVE-2018-1000075US	high7.5	4.74% (92nd)	—	no fix	2018-03-13	4 versions
CVE-2019-8320US	high7.4	4.19% (91st)	—	no fix	2019-06-06	2.7.6 → 3.0.2
CVE-2018-1000077US	medium5.3	3.60% (89th)	—	no fix	2018-03-13	4 versions
CVE-2015-4020US	medium4.3	3.46% (89th)	—	no fix	2015-08-25	30 versions
CVE-2013-4287US	medium4.3	3.33% (89th)	—	no fix	2013-10-17	35 versions
CVE-2019-8323US	high7.5	3.28% (88th)	—	no fix	2019-06-17	2.6.0 → 3.0.2
CVE-2019-8322US	high7.5	3.28% (88th)	—	no fix	2019-06-17	2.6.0 → 3.0.2
CVE-2019-8321US	high7.5	3.28% (88th)	—	no fix	2019-06-17	2.6.0 → 3.0.2
CVE-2019-8325US	high7.5	3.28% (88th)	—	no fix	2019-06-17	2.6.0 → 3.0.2
CVE-2019-8324US	high8.8	3.22% (88th)	—	no fix	2019-06-17	2.6.0 → 3.0.2
CVE-2018-1000076US	critical9.8	2.93% (87th)	—	no fix	2018-03-13	4 versions
CVE-2018-1000074US	high7.8	2.88% (87th)	—	no fix	2018-03-13	4 versions
CVE-2018-1000079US	medium5.5	2.78% (86th)	—	no fix	2018-03-13	4 versions
CVE-2018-1000078US	medium6.1	2.75% (86th)	—	no fix	2018-03-13	4 versions
CVE-2012-2125US	medium5.8	2.47% (84th)	—	no fix	2013-10-01	23 versions
CVE-2013-4363US	medium4.3	1.69% (77th)	—	no fix	2013-10-17	42 versions
CVE-2012-2126US	medium4.3	1.36% (72nd)	—	no fix	2013-10-01	23 versions
CVE-2022-36073US	high8.8	1.02% (63rd)	—	2022-08-31	2022-09-07	< 2022-08-31

weaknesses (8)

The flaw types (CWEs) most of these CVEs share.

CWE-20Improper Input Validation5 CVEs
CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')4 CVEs
CWE-88Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')4 CVEs
CWE-310CWE-3103 CVEs
CWE-74Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')3 CVEs
CWE-350Reliance on Reverse DNS Resolution for a Security-Critical Action2 CVEs
CWE-502Deserialization of Untrusted Data2 CVEs
CWE-94Improper Control of Generation of Code ('Code Injection')2 CVEs

sources (1)

Which sources assert this record, and when.

USNVD / CVE25 CVEs

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan