More alarming than vulnerable gems is the the number oh high severity vulnerability found in Rails itself: http://www.cvedetails.com/product/22568/Rubyonrails-Ruby-On-.... Compare this to Django (http://www.cvedetails.com/vulnerability-list/vendor_id-10199...) per year.