R
Ruby
Security Risk Profile
37
/100
lowSecurity Risk Score
Comprehensive risk assessment based on 86 vulnerabilities, EPSS scores, exploitation status, and remediation availability.
📅 Data spans from October 1, 2007 to present
86
Total CVEs
9
Critical+High
0
Exploited
6
Unpatched
Threat Assessment
Avg CVSS
4.2
Base severity
Avg EPSS
0%
Exploit probability
Unpatched
6
Critical/High
Risk Level
37/100
low
🆕 1Fresh (<7d)📈 3 in Last 30 Days
Severity Distribution
Critical
2High
7Medium
29Low
13Exploit Likelihood
>50% chance
020-50%
05-20%
0<5%
5Age Distribution
Common Weaknesses (CWE)
1
Buffer Overflow
3
2
Race Condition
3
3
Command Injection
2
4
Use After Free
2
5
Infoleak
1
Most Affected Products
1. Ruby Ruby51
2. Ruby WEBrick6
3. Ruby REXML5
4. debian/ruby3.35
5. debian/ruby3.14
Recent Vulnerabilities
See more →https://reddit.com/r/sysadmin/comments/1xjyfns/gitlab_cve202697229_cvss_100_went_into_cisa_kev/
unknown
GitLab CVE-2026-97229 (CVSS 10.0) went into CISA KEV on Oct 29, due Nov 1. If your GitLab runs on a system Ruby, the GitLab upgrade alone does not fix it
Oct 31, 2026🔧 No Patch
https://seclists.org/oss-sec/2026/q4/360
unknown
Ruby gexp compilation fixes lated to GitLab's CVE's
Oct 23, 2026🔧 No Patch
CVE-2026-67989
CVSS 7.5high
Oct 2, 2026🔧 No Patch
CVE-2026-63435
CVSS 5.3medium
Mail: Email address spoofing via malformed RFC 2047 encoded-words
Sep 1, 2026
CVE-2026-67991
CVSS 7.5high
Aug 13, 2026🔧 No Patch
CVE-2026-54696
CVSS 3.7low
Ruby JSON: JSON generator heap buffer overflow when streaming to an IO
Jun 30, 2026
CVE-2026-47389
CVSS 8.6high
Mastodon: SSRF protection bypass on older Ruby versions
Jun 24, 2026🔧 No Patch
REDHAT-BUG-2492252
CVSS 7.0high
Jun 24, 2026🔧 No Patch
REDHAT-BUG-2491519
CVSS 4.0medium
Jun 22, 2026🔧 No Patch
REDHAT-BUG-2491523
CVSS 4.0medium
Jun 22, 2026🔧 No Patch
Monitor Ruby in Real-Time
Get instant alerts when new vulnerabilities are discovered. Stay ahead of security threats with SecAlerts.