R
Vendor security profile
rubygems
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs43
Critical3
CISA KEV0
Public exploit10
Patch rate%70
Avg. CVSS6.7
12-month vulnerability rate
0
0
1
0
0
0
0
2
19
10
9
2
CVE KEV
CVE severity distribution
43toplam CVE
Critical3 (7%)
High17 (40%)
Medium19 (44%)
Low4 (9%)
Patch and exploitation view
%70
Verified patch
%0
CISA KEV
%23
Public exploit
30Patch available
0Partial
0Workaround
0Vendor: no patch
13Unknown
Latest vulnerabilities
6.8
CVE-2026-107715
Mechanize sends credential headers to another host after an HTTP redirect
S
Patch status unknownEPSS %0
6.8
CVE-2026-107399
Mechanize sends credential headers to another origin after a meta refresh
S
Patch status unknownEPSS %0
10.0
CVE-2026-55107
Kobako Vulnerable to Sandbox Escape: guest eval reaches host RCE via method_missing → public_send (any bound Service)
E
Patch verifiedEPSS %1
9.9
CVE-2026-77602
OpenC3 COSMOS: Authenticated remote code execution via the user-writable config overlay (table definitions, cmd/tlm definitions, and script suites)
O
Patch status unknownEPSS %1
8.8
CVE-2026-77601
OpenC3 COSMOS: Authenticated OS command injection via the `pypi_url` setting
O
Patch status unknownEPSS %1
7.5
CVE-2026-61570
MPXJ: XXE Vulnerability in MerlinReader
J
Patch status unknownEPSS %0
5.3
CVE-2026-65829
MPXJ: Potential Path Traversal Vulnerability in Primavera P3 PRX and SureTrak STX readers
J
Patch status unknownEPSS %0
7.1
CVE-2026-94462
Spree: Broken Access Control in `PATCH /api/v3/store/carts/:id/associate` (IDOR)
S
Patch status unknownEPSS %0
4.8
CVE-2026-44282
Election question titles allow stored script execution
D
Patch verifiedEPSS %0
7.5
CVE-2026-85396
Path traversal
R
Patch status unknownEPSS %1