Browse CVEs by Ecosystem and Severity
744 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.
HIGH
CVE-2020-7659
HTTP Request Smuggling in reel
HIGH
CVE-2020-13482
Improper Certificate Validation in EM-HTTP-Request
HIGH
CVE-2020-36327
Dependency Confusion in Bundler
HIGH
CVE-2020-13163
Improper certificate validation in em-imap
HIGH
CVE-2021-29509
Puma's Keepalive Connections Causing Denial Of Service
HIGH
CVE-2019-3881
Insecure path handling in Bundler
HIGH
CVE-2021-23337EPSS 0.7%
Command Injection in lodash
HIGH
CVE-2021-28966
Tempfile on Windows path traversal vulnerability
HIGH
CVE-2021-22904
Possible DoS Vulnerability in Action Controller Token Authentication
HIGH
CVE-2021-22885
Action Pack contains Information Disclosure / Unintended Method Execution vulnerability
MEDIUM
CVE-2021-22903
Possible Open Redirect Vulnerability in Action Pack
HIGH
CVE-2021-22902
Denial of Service in Action Dispatch
HIGH
CVE-2021-28965
REXML round-trip instability
MEDIUM
CVE-2020-25739
Gon gem lack of escaping certain input when outputting as JSON
HIGH
CVE-2021-31671
Pgsync Contains Cleartext Transmission of Sensitive Information
HIGH
CVE-2016-11086
Improper Certificate Validation in oauth ruby gem
HIGH
CVE-2021-29435
Cross-Site Request Forgery (CSRF) in trestle-auth
MEDIUM
CVE-2020-24393
Improper Certificate Validation in TweetStream
MEDIUM
CVE-2020-7942
Improper Certificate Validation in Puppet
HIGH
CVE-2021-28834
Remote code execution in Kramdown
MEDIUM
CVE-2020-24392
Improper Certificate Validation in twitter-stream
HIGH
CVE-2021-22880
Active Record subject to Regular Expression Denial-of-Service (ReDoS)
HIGH
CVE-2021-21305
Code Injection vulnerability in CarrierWave::RMagick
HIGH
CVE-2021-21289
Command Injection Vulnerability in Mechanize
MEDIUM
CVE-2020-26298
Injection/XSS in Redcarpet
HIGH
CVE-2020-26254
omniauth-apple allows attacker to fake their email address during authentication
HIGH
CVE-2020-26223
Authorization bypass in Spree
HIGH
CVE-2020-26222
Remote code execution in dependabot-core branch names when cloning
HIGH
CVE-2020-15240
Regression in JWT Signature Validation
HIGH
CVE-2020-15269
Ensure that doorkeeper_token is valid when authenticating requests in API v2 calls
MEDIUM
CVE-2020-15237
Possible timing attack in derivation_endpoint
HIGH
CVE-2015-4410
Moped Rubygem Data Injection Vulnerability
CRITICAL
CVE-2020-14001
Unintended read access in kramdown gem
HIGH
CVE-2020-16253
PgHero gem allows CSRF
MEDIUM
CVE-2020-15109
Ability to change order address without triggering address validations in solidus
HIGH
CVE-2020-15133
Missing TLS certificate verification in faye-websocket
HIGH
CVE-2020-15134
Missing TLS certificate verification
HIGH
CVE-2020-10663
Unsafe object creation in json RubyGem
HIGH
CVE-2020-8203
Prototype Pollution in lodash
HIGH
CVE-2020-8163
Remote code execution via user-provided local names in ActionView
MEDIUM
CVE-2020-8167
CSRF Vulnerability in rails-ujs
HIGH
CVE-2020-8161
Directory traversal in Rack::Directory app bundled with Rack
MEDIUM
CVE-2020-8185
Untrusted users can run pending migrations in production in Rails
HIGH
CVE-2020-8184
Rack allows Percent-encoded cookies to overwrite existing prefixed cookie names
HIGH
CVE-2020-4054
Cross-site Scripting in Sanitize
CRITICAL
CVE-2020-7981
SQL Injection in Geocoder
HIGH
CVE-2020-7663
Regular Expression Denial of Service in websocket-extensions (RubyGem)
HIGH
CVE-2020-8162
Circumvention of file size limits in ActiveStorage
HIGH
CVE-2020-8164
Possible Strong Parameters Bypass in ActionPack
CRITICAL
CVE-2020-8165
ActiveSupport potentially unintended unmarshalling of user-provided objects in MemCacheStore and RedisCacheStore