Browse CVEs by Ecosystem and Severity
744 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.
HIGH
CVE-2013-2516
Fileutils Command Injection vulnerability
CRITICAL
CVE-2018-12026
Phusion Passenger SpawningKit Contains Arbitrary Read/Write Vulnerability
HIGH
CVE-2018-12029
Phusion Passenger Race Condition Allows Privilege Escalation
HIGH
CVE-2016-3072
Katello SQL Injection vulnerabilities
HIGH
CVE-2017-0900
RubyGems Improper Input Validation vulnerability
MEDIUM
CVE-2018-16887
katello Cross-site Scripting vulnerability
CRITICAL
CVE-2018-1000076
RubyGems Improper Verification of Cryptographic Signature vulnerability
HIGH
CVE-2018-1000074
RubyGems Deserialization of Untrusted Data vulnerability
MEDIUM
CVE-2018-1000078
RubyGems Cross-site Scripting vulnerability
HIGH
CVE-2014-4326
Elasticsearch Logstash allows remote attackers to execute arbitrary commands
HIGH
CVE-2016-1000221
Logstash Logs Sensitive Information
CRITICAL
CVE-2016-7954
Bundler allows attacker to inject arbitrary code via secondary Gem source
CRITICAL
CVE-2013-3221
Active Record component in Ruby on Rails has a data-type injection vulnerability
HIGH
CVE-2018-18385
Asciidoctor Infinite Loop vulnerability
CRITICAL
CVE-2018-16395
Ruby Openssl Allows Incorrect Value Comparison
HIGH
CVE-2018-12028
Incorrect Access Control in Phusion Passenger
HIGH
CVE-2018-12027
Insecure Permissions in Phusion Passenger
HIGH
CVE-2018-1000075
RubyGems Infinite Loop vulnerability
MEDIUM
CVE-2017-10689
Tarball permission preservation in puppet
MEDIUM
CVE-2016-10362
Logstash Logs Sensitive Information
CRITICAL
CVE-2017-0903
RubyGems vulnerable to Deserialization of Untrusted Data
HIGH
CVE-2017-0901
RubyGems may allow a maliciously crafted gem to overwrite files
HIGH
CVE-2017-0902
RubyGems has Origin Validation Error vulnerability
CRITICAL
CVE-2017-0899
RubyGems Code Injection vulnerability
HIGH
CVE-2017-2667
hammer_cli_foreman Improper Certificate Validation vulnerability
MEDIUM
CVE-2017-14506
Gem in a Box vulnerable to Cross-site Scripting
HIGH
CVE-2017-14683
Gem in a Box vulnerable to Cross-site Request Forgery
CRITICAL
CVE-2019-11068
Nokogiri vulnerable to libxslt protection mechanism bypass
HIGH
CVE-2018-1000073
RubyGems Link Following vulnerability
CRITICAL
CVE-2017-2096
smalruby and smalruby-editor vulnerable to OS Command Injection
HIGH
CVE-2015-3649
open-uri-cached Gem for Ruby Unsafe Temporary File Creation Enables Code Execution
HIGH
CVE-2017-1000026
mixlib-archive Path Traversal vulnerability
MEDIUM
CVE-2018-14040
Bootstrap vulnerable to Cross-Site Scripting (XSS)
CRITICAL
CVE-2017-10906
Fluentd Escape Sequence Injection Vulnerability
CRITICAL
CVE-2016-2785
Puppet Improper Access Control
MEDIUM
CVE-2018-18260
Camaleon CMS vulnerable to Stored Cross-site Scripting
HIGH
CVE-2017-16932
Nokogiri gem, via libxml, is affected by DoS vulnerabilities
CRITICAL
CVE-2013-1607
PDFKit Improper Input Validation vulnerability
HIGH
CVE-2013-4593
omniauth-facebook Improper Authentication vulnerability
CRITICAL
CVE-2013-2095
RubyGem openshift-origin-controller is vulnerable to command injection
MEDIUM
CVE-2013-6460
Nokogiri vulnerable to DoS while parsing XML documents
MEDIUM
CVE-2013-6461
Nokogiri vulnerable to DoS while parsing XML entities
CRITICAL
CVE-2022-28481
CSV-Safe improperly filters special characters potentially leading to CSV injection
HIGH
CVE-2022-29970
sinatra does not validate expanded path matches
MEDIUM
CVE-2022-27777
XSS Vulnerability in Action View tag helpers
MEDIUM
CVE-2022-22577
Cross-site Scripting Vulnerability in Action Pack
CRITICAL
CVE-2022-27311
Server side request forgery in gibbon
HIGH
CVE-2012-6685
Nokogiri is vulnerable to XML External Entity (XXE) attack
HIGH
CVE-2012-6135
RubyGems passenger gem allows remote attackers to delete files
MEDIUM
CVE-2011-1497
Cross site scripting in actionpack Rubygem