12 CVEs affecting Ruby products, 0 known to be exploited (CISA KEV), with EPSS scores. Most affected: Net-Imap, Resolv, JSON, Erb, Fileutils.