Browse CVEs by Ecosystem and Severity
744 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.
MEDIUM
CVE-2020-11077
HTTP Smuggling via Transfer-Encoding Header in Puma
HIGH
CVE-2020-11076
HTTP Smuggling via Transfer-Encoding Header in Puma
HIGH
CVE-2020-8151
Information disclosure issue in Active Resource
CRITICAL
CVE-2020-8159
Arbitrary file write in actionpack-page_caching gem
HIGH
CVE-2020-11052
Improper Restriction of Excessive Authentication Attempts in Sorcery
HIGH
CVE-2020-10187
Exposure of Sensitive Information to an Unauthorized Actor in Doorkeeper
MEDIUM
CVE-2020-11023KEV
Potential XSS vulnerability in jQuery
MEDIUM
CVE-2020-11022
Potential XSS vulnerability in jQuery
HIGH
CVE-2020-11020
Authentication and extension bypass in Faye
HIGH
CVE-2015-4411
BSON rubygem contains potential denial of service
HIGH
CVE-2020-5257
Sort order SQL injection in Administrate
MEDIUM
CVE-2020-5249
HTTP Response Splitting (Early Hints) in Puma
MEDIUM
CVE-2020-5247
HTTP Response Splitting in Puma
HIGH
CVE-2020-7595
libxml as used in Nokogiri has an infinite loop in a certain end-of-file situation
MEDIUM
CVE-2020-5243
Denial of Service in uap-core when processing crafted User-Agent strings
CRITICAL
CVE-2019-10780
BibTeX-Ruby vulnerable to OS command injection
HIGH
CVE-2020-5241
XSS/Script injection vulnerability in matestack
CRITICAL
CVE-2019-19919
Prototype Pollution in handlebars
MEDIUM
CVE-2019-16782
Possible Information Leak / Session Hijack Vulnerability in Rack
MEDIUM
CVE-2019-16779
In RubyGem excon, interrupted Persistent Connections May Leak Response Data
HIGH
CVE-2019-18841
Prototype Pollution in chartkick
HIGH
CVE-2019-18848
JSON-jwt Gem lacked element count during splitting of JWE string
HIGH
CVE-2019-18409
Ruby_parser-legacy Incorrect Permission Assignment for Critical Resource
CRITICAL
CVE-2019-17383
netaddr before 1.5.3 and 2.0.4 has Incorrect Default Permissions
HIGH
CVE-2024-22050
Malicious URL drafting attack against iodines static file server may allow path traversal
CRITICAL
CVE-2019-16676
Improper Input Validation in simple_form
CRITICAL
CVE-2019-16377
Consul gem insufficient authentication check - Multiple powers in one controller are not always checked correctly
CRITICAL
CVE-2019-16060
Airbrake keys not being filtered
CRITICAL
CVE-2019-15224
rest-client Gem Contains Malicious Code
CRITICAL
CVE-2019-5477
Nokogiri Command Injection Vulnerability
HIGH
CVE-2018-20857
samlr XML nodes comment attack
CRITICAL
CVE-2019-14281
datagrid contains code Injection backdoor
CRITICAL
CVE-2019-14282
Code backdoor in simple_captcha2
CRITICAL
CVE-2019-1010191
SQL Injection in marginalia
MEDIUM
CVE-2019-1010266
Regular Expression Denial of Service (ReDoS) in lodash
HIGH
CVE-2019-13574
OS Command Injection in MiniMagick
CRITICAL
CVE-2019-13589
paranoid2 gem Code backdoor
CRITICAL
CVE-2019-1010306
Slanger Arbitrary command execution
CRITICAL
CVE-2019-10744
Prototype Pollution in lodash
CRITICAL
CVE-2019-13354
strong_password Ruby gem malicious version causing Remote Code Execution vulnerability
HIGH
CVE-2017-11430
OmniAuth-SAML authentication bypass via incorrect XML canonicalization and DOM traversal
HIGH
CVE-2017-11428
Ruby-SAML Improper Authentication vulnerability
HIGH
CVE-2019-1020001
Path Traversal vulnerability that affects yard
HIGH
CVE-2019-8325
RubyGems Escape sequence injection in errors
HIGH
CVE-2019-8320
RubyGems Delete directory using symlink when decompressing tar
HIGH
CVE-2019-8324
Code injection in RubyGems
HIGH
CVE-2019-8321
RubyGems Escape sequence injection vulnerability in verbose
HIGH
CVE-2019-8322
RubyGems Escape sequence injection vulnerability in gem owner
HIGH
CVE-2019-8323
RubyGems Escape sequence injection vulnerability in api response handling
CRITICAL
CVE-2019-11027
ruby-openid SSRF via claimed_id request