Browse CVEs by Ecosystem and Severity

Mechanize sends credential headers to another origin after a meta refresh

Mechanize sends credential headers to another host after an HTTP redirect

sqlite3-ruby: Use-After-Free in SQLite Aggregate Arguments in Heap-Allocated Argument Array

OpenC3 COSMOS: Authenticated remote code execution via the user-writable config overlay (table definitions, cmd/tlm definitions, and script suites)

OpenC3 COSMOS: Authenticated OS command injection via the `pypi_url` setting

Spree: Broken Access Control in `PATCH /api/v3/store/carts/:id/associate` (IDOR)

MPXJ: Potential Path Traversal Vulnerability in Primavera P3 PRX and SureTrak STX readers

MPXJ: XXE Vulnerability in MerlinReader

decidim-elections: Election question titles allow stored script execution

rubyzip path traversal vulnerability

Mail: Email address spoofing via malformed RFC 2047 encoded-words

kobako Sandbox Escape: guest eval reaches host RCE via method_missing → public_send (any bound Service)

guard-livereload has a directory traversal vulnerability

Savon::Model evaluates WSDL operation names as Ruby source

Active Storage has possible arbitrary file read and remote code execution in Active Storage variant processing

MCP Ruby SDK: Ruby SSE Session Poisoning

MCP Ruby SDK: Unbounded JSON-RPC request body causes uncontrolled memory allocation in StreamableHTTPTransport

MCP Ruby SDK: Unbounded session retention in StreamableHTTPTransport allows memory exhaustion via initialize flood

MCP Ruby SDK: Unbounded line buffer in stdio transports leads to memory exhaustion (DoS)

MCP Ruby SDK: Streamable HTTP transport lacks DNS-rebinding (Host/Origin) protection

Pagy I18n locale option is not validated before being used in a file path

OAuth2::Client#request: Protocol-relative redirect Location overrides authority, leaking bearer Authorization to attacker host

OAuth: Cross-origin token-request redirects can expose signed request metadata

sqlite3-ruby has Use-After-Free in SQLite Aggregate Function Callbacks

sqlite3-ruby has Use-After-Free When Redefining SQLite Functions with Different Arity

Trix: Stored XSS via HTMLParser attribute injection on paste

Rails HTML Sanitizers: Possible XSS vulnerability with certain configurations

Loofah `allowed_uri?` does not detect `javascript:` URIs split by numeric character references without semicolons

Loofah: SVG `href` attribute bypasses local-reference restriction

websocket-driver-ruby: Denial of service via malformed Host header

Loofah `allowed_uri?` does not detect `javascript:` URIs split by named whitespace character references

dd-trace-rb: Improper parsing of W3C baggage headers may lead to DoS

ViewComponent: Reused Component Instances Retain Stale Render Context

ViewComponent: around_render HTML-Safety Bypass

websocket-driver: Memory exhaustion in HTTP header parser

websocket-driver: Resource limit bypass via message compression

websocket-driver: Memory exhaustion via abuse of protocol length headers

Decidim: Push subscriptions can be abused for server-side requests

Decidim: HTML content blocks allow stored script execution

Decidim: CSV census record endpoints improper authorization

Decidim: JWT-backed authentication can be replayed across organizations

Decidim: Verification documents can be downloaded through reusable links

Decidim: Private exports can be downloaded through reusable links

Decidim: Admin user search allows SQL injection through similarity-based sorting

Decidim: Verification admins can access supplied IDs from other organizations

Decidim: Forms admin question editor lacks authorization

Excon does not redact additional sensitive/risky headers when following redirects

Secure Headers: CSP directive injection via sandbox, plugin_types, and report_to when given untrusted input

Avo: Direct attachment upload endpoint lacks upload authorization and bypasses field-level upload policy

Ruby CSS Parser: SSRF and Local File Disclosure in `CssParser::Parser#read_remote_file`