# RubyGems


- [CVE-2019-5418](https://insights.sbomify.com/CVE-2019-5418/): Rails Ruby on Rails Path Traversal (high 7.5, exploited in the wild)
- [CVE-2016-0752](https://insights.sbomify.com/CVE-2016-0752/): Ruby on Rails Directory Traversal (high 7.5, exploited in the wild)
- [CVE-2014-0130](https://insights.sbomify.com/CVE-2014-0130/): Ruby on Rails Directory Traversal (high 7.5, exploited in the wild)
- [CVE-2020-11023](https://insights.sbomify.com/CVE-2020-11023/): JQuery Cross-Site Scripting (XSS) (medium 6.9, exploited in the wild)
- [CVE-2026-55107](https://insights.sbomify.com/CVE-2026-55107/): Kobako Vulnerable to Sandbox Escape: guest eval reaches host RCE via method_missing → public_send (any bound Service) (critical 10.0)
- [CVE-2025-68271](https://insights.sbomify.com/CVE-2025-68271/): Unauthenticated Remote Code Execution in openc3-api (critical 10.0)
- [CVE-2011-10019](https://insights.sbomify.com/CVE-2011-10019/): Spreecommerce < 0.60.2 Search Parameter RCE (critical 10.0)
- [CVE-2024-46986](https://insights.sbomify.com/CVE-2024-46986/): Arbitrary file write leading to RCE in Camaleon CMS (critical 10.0)
- [CVE-2024-45409](https://insights.sbomify.com/CVE-2024-45409/): The Ruby SAML library vulnerable to a SAML authentication bypass via Incorrect XPath selector (critical 10.0)
- [CVE-2022-30123](https://insights.sbomify.com/CVE-2022-30123/): Possible shell escape sequence injection vulnerability in Rack (critical 10.0)
- [CVE-2022-24803](https://insights.sbomify.com/CVE-2022-24803/): Command Injection vulnerability in asciidoctor-include-ext (critical 10.0)
- [CVE-2015-7541](https://insights.sbomify.com/CVE-2015-7541/): colorscore Command Injection vulnerability (critical 10.0)

---
From sbomify Insights: https://insights.sbomify.com/ecosystems/rubygems/