Browse CVEs by Ecosystem and Severity
744 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.
HIGH
CVE-2015-9284
OmniAuth Ruby gem Cross-site Request Forgery in request phase
MEDIUM
CVE-2019-11358
XSS in jQuery as used in Drupal, Backdrop CMS, and other products
CRITICAL
CVE-2019-10842
Bootstrap-sass contains code execution backdoor
HIGH
CVE-2018-6517
Improper Certificate Validation in chloride
MEDIUM
CVE-2019-9837
Doorkeeper-openid_connect contains Open Redirect
CRITICAL
CVE-2019-5420
Use of Insufficiently Random Values in Railties Allows Remote Code Execution
HIGH
CVE-2019-5418KEV
Path Traversal in Action View
HIGH
CVE-2019-5419
Denial of Service Vulnerability in Action View
MEDIUM
CVE-2019-8331
Bootstrap Vulnerable to Cross-Site Scripting
HIGH
CVE-2018-14404
Nokogiri NULL Pointer Dereference
MEDIUM
CVE-2018-20677
bootstrap Cross-site Scripting vulnerability
MEDIUM
CVE-2018-20676
XSS vulnerability that affects bootstrap
MEDIUM
CVE-2016-10735
Bootstrap Cross-site Scripting vulnerability
MEDIUM
CVE-2018-1000855
Cross Site Scripting (XSS) vulnerability in easymon
MEDIUM
CVE-2018-1000842
Fat Free CRM vulnerable to Cross-site Scripting
HIGH
CVE-2018-16476
Improper Access Control in activejob
MEDIUM
CVE-2018-16477
Exposure of Sensitive Information to an Unauthorized Actor in activestorage
HIGH
CVE-2018-16470
Rack vulnerable to Denial of Service
MEDIUM
CVE-2017-1000043
Content Injection via TileJSON Name in mapbox.js
MEDIUM
CVE-2017-1000042
Content Injection via TileJSON attribute in mapbox.js
CRITICAL
CVE-2018-18476
mysql-bunuuid-rails vulnerable to SQL injection
CRITICAL
CVE-2018-14643
smart_proxy_dynflow gem authentication bypass in Foreman remote execution feature
HIGH
CVE-2018-17567
Jekyll allows attackers to access arbitrary files by specifying a symlink
HIGH
CVE-2015-8806
Denial of service or RCE from libxml2 and libxslt
MEDIUM
CVE-2018-14042
Bootstrap Cross-site Scripting vulnerability
MEDIUM
CVE-2018-14041
Bootstrap Cross-site Scripting vulnerability
CRITICAL
CVE-2018-1000544
Rubyzip gem contains a Directory Traversal vulnerability in zip file component
HIGH
CVE-2018-1000201
Ruby-ffi has a DLL loading issue
MEDIUM
CVE-2015-1866
ember-source vulnerable to Cross-site Scripting
HIGH
CVE-2015-4619
Spina gem vulnerable to Cross-site request forgery (CSRF) vulnerability
MEDIUM
CVE-2015-7565
ember-source Cross-site Scripting vulnerability
CRITICAL
CVE-2016-4658
Nokogiri does not forbid namespace nodes in XPointer ranges
HIGH
CVE-2016-5697
Ruby-saml allows attackers to perform XML signature wrapping attacks
HIGH
CVE-2016-10345
Phusion Passenger uses a known /tmp filename
CRITICAL
CVE-2015-8969
Git-fastclone passes user modifiable strings directly to a shell command
HIGH
CVE-2015-8968
git-fastclone permits arbitrary shell command execution from .gitmodules
CRITICAL
CVE-2015-1820
rest-client Gem Vulnerable to Session Fixation
HIGH
CVE-2018-1000211
Doorkeeper subject to Incorrect Permission Assignment
HIGH
CVE-2016-10522
Cross-site request forgery in rails_admin
CRITICAL
CVE-2018-3777
restforce vulnerable to Improper Input Validation
HIGH
CVE-2017-5029
Nokogiri implementation of libxslt lacks integer overflow checks
HIGH
CVE-2017-11173
Missing Regex anchor in Rack-Cors allows malicious third party site to perform CORS request
HIGH
CVE-2014-5001
Kcapifony gem for Ruby places database user passwords on the command line
HIGH
CVE-2018-3760
Sprockets path traversal leads to information leak
MEDIUM
CVE-2018-11627
Sinatra Cross-site Scripting vulnerability
MEDIUM
CVE-2018-3741
rails-html-sanitizer Cross-site Scripting vulnerability
MEDIUM
CVE-2017-18258
Uncontrolled resource consumption in nokogiri
HIGH
CVE-2018-3740
Sanitize vulnerable to Improper Input Validation and Cross-site Scripting
HIGH
CVE-2014-4992
Cap-Strap gem for Ruby places credentials on the useradd command line
MEDIUM
CVE-2018-1000088
Doorkeeper is vulnerable to stored XSS and code execution