Every known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in w002yardprobe (RubyGems) MAL-2026-18599 | Malicious | Not scored | 4 hours ago | RubyGems w002yardprobe |
Malicious release: Malicious code in brida-frida-hooks (RubyGems) MAL-2026-18598 | Malicious | Not scored | 4 hours ago | RubyGems brida-frida-hooks |
Malicious release: Malicious code in dopc-client (RubyGems) MAL-2026-18518 | Malicious | Not scored | 1 day ago | RubyGems dopc-client |
Malicious release: Malicious code in intercom-react-native-example-e2e-tests (RubyGems) MAL-2026-18462 | Malicious | Not scored | 1 day ago | RubyGems intercom-react-native-example-e2e-tests |
Malicious release: Malicious code in shoaib-unity (RubyGems) MAL-2026-18461 | Malicious | Not scored | 1 day ago | RubyGems shoaib-unity |
Malicious release: Malicious code in macs-shoaibs-pro17 (RubyGems) MAL-2026-18436 | Malicious | Not scored | 2 days ago | RubyGems macs-shoaibs-pro17 |
Shopify App: Token exchange shop context confusion may allow cross-shop authorization bypass in affected apps CVE-2026-63414, GHSA-6j52-38f8-qhxr | High | Not scored | 5 days ago | RubyGems shopify_app |
Crass: Non-ASCII characters cause superlinear CPU consumption CVE-2026-61848, GHSA-8vfg-2r28-hvhj | Medium | Not scored | 5 days ago | RubyGems crass |
Crass: A large number of adjacent CSS comments can trigger a SystemStackError CVE-2026-61847, GHSA-wwpr-jff3-395c | Medium | Not scored | 5 days ago | RubyGems crass |
Crass: Deeply nested CSS blocks and functions can trigger a SystemStackError or excessive memory usage CVE-2026-61846, GHSA-6jxj-px6v-747w | Medium | Not scored | 5 days ago | RubyGems crass |
Crass: Incorrect tokenization of bad URLs enables CSS sanitizer bypass CVE-2026-116695, GHSA-pq4g-8rxf-4g29 | Medium | Not scored | 6 days ago | RubyGems crass |