Browse CVEs by Ecosystem and Severity
744 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.
MEDIUM
CVE-2015-1828
http vulnerable to Exposure of Sensitive Information to an Unauthorized Actor
MEDIUM
CVE-2018-1000119
rack-protection gem timing attack vulnerability when validating CSRF token
CRITICAL
CVE-2015-4412
bson is vulnerable to denial of service due to incorrect regex validation
HIGH
CVE-2014-5004
brbackup exposes database password to unauthorized users
MEDIUM
CVE-2017-12097
delayed_job_web Cross-site Scripting vulnerability
HIGH
CVE-2017-18076
Omniauth allows POST parameters to be stored in session
HIGH
CVE-2014-5002
lynx doesn't properly sanitize user input and exposes database password to unauthorized users
HIGH
CVE-2014-5000
lawn-login exposes database password to unauthorized users
HIGH
CVE-2016-10707
Denial of Service in jquery
CRITICAL
CVE-2017-0889
paperclip Server-Side Request Forgery vulnerability
MEDIUM
CVE-2017-17718
net-ldap Improper Certificate Validation vulnerability
HIGH
CVE-2017-17042
Arbitrary file read vulnerability in yard server
HIGH
CVE-2017-9050
Out-of-bounds read in nokogiri
CRITICAL
CVE-2017-0905
Recurly gem Server-Side Request Forgery in Resource#find method
CRITICAL
CVE-2017-1000248
redis-store deserializes untrusted data
MEDIUM
CVE-2017-16833
Gemirro Stored XSS in Gemspec "homepage" value
HIGH
CVE-2017-16516
yajl-ruby gem Denial of Service vulnerability
HIGH
CVE-2017-15928
Ox gem crashes due to a crafted input
HIGH
CVE-2014-9489
gollum and gollum-lib allow remote authenticated users to execute arbitrary code
CRITICAL
CVE-2009-2422
rails vulnerable to improper authentication
CRITICAL
CVE-2015-8857
Incorrect Handling of Non-Boolean Comparisons During Minification in uglify-js
HIGH
CVE-2013-7463
Aescrypt does not sufficiently use random values
MEDIUM
CVE-2015-7578
rails-html-sanitizer Cross-site Scripting vulnerability
HIGH
CVE-2014-0130KEV
actionpack Path Traversal vulnerability
CRITICAL
CVE-2015-7541
colorscore Command Injection vulnerability
HIGH
CVE-2015-7581
actionpack is vulnerable to denial of service because of a wildcard controller route
MEDIUM
CVE-2015-7580
rails-html-sanitizer Cross-site Scripting vulnerability
MEDIUM
CVE-2015-7579
rails-html-sanitizer Cross-site Scripting vulnerability
MEDIUM
CVE-2014-2538
rack-ssl Cross-site Scripting vulnerability
CRITICAL
CVE-2016-6582
Doorkeeper is vulnerable to replay attacks
CRITICAL
CVE-2016-10193
espeak-ruby allows arbitrary command execution
CRITICAL
CVE-2017-7540
Safemode Gem Has Incomplete List of Disallowed Inputs
HIGH
CVE-2016-7798
OpenSSL gem for Ruby using inadequate encryption strength
HIGH
CVE-2016-2098
actionpack allows remote code execution via application's unrestricted use of render method
HIGH
CVE-2016-3693
safemode gem allows context-dependent attackers to obtain sensitive information via the inspect method
CRITICAL
CVE-2016-10194
festivaltts4r allows arbitrary command execution
HIGH
CVE-2016-0751
actionpack is vulnerable to denial of service via a crafted HTTP Accept header
CRITICAL
CVE-2017-5946
Directory traversal vulnerability in RubyZip
HIGH
CVE-2016-10173
archive-tar-minitar and minitar vulnerable to Path Traversal
MEDIUM
CVE-2016-7103
jQuery-UI vulnerable to Cross-site Scripting in dialog closeText
MEDIUM
CVE-2016-6316
actionview Cross-site Scripting vulnerability
HIGH
CVE-2016-6317
ActiveRecord in Ruby on Rails allows database-query bypass
MEDIUM
CVE-2016-2097
actionview contains Path Traversal vulnerability
HIGH
CVE-2016-0752KEV
Directory traversal vulnerability in Action View in Ruby on Rails