Loading...

Sign in Get Started

Browse CVEs by Ecosystem and Severity

744 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.

All ecosystems npm pypi packagist maven go crates.io rubygems nuget

All severities critical high medium low KEV only

Clear all filters

pay-rails/pay: non-constant-time HMAC comparison in Paddle Billing webhook signature verifier

YARD static cache reads raw traversal paths before router sanitization

fluent-plugin-opentelemetry Has Denial of Service (DoS) via Large Payloads and Decompression Bombs in `in_opentelemetry`

Fluentd is Vulnerable to Server-Side Request Forgery (SSRF) via Placeholder Expansion in `out_http`

Fluentd is Vulnerable to Denial of Service (DoS) via Gzip Decompression Bomb in `in_http` and `in_forward`

Fluentd is Vulnerable to Exposure of Sensitive Information via Monitor Agent API

Fluentd is Vulnerable to Remote Code Execution (RCE) via Arbitrary File Write in `${tag}` Placeholder

Concurrent Ruby: ReadWriteLock allows wrong-thread write release and stray read-release counter corruption

Concurrent Ruby: `ReentrantReadWriteLock` read-count overflow grants a write lock without exclusivity

Concurrent Ruby : `AtomicReference#update` livelocks when the stored value is `Float::NAN`

Oj: Integer Overflow in Oj.load 2GB String Handling

Oj: Use-After-Free in Oj::Parser SAJ Long Key Callback

Oj: Use-After-Free in Oj::Parser array_class/hash_class GC Marking

Oj: Negative-Size memcpy in Oj::Parser create_id Attribute Handling

Oj: Use-After-Free in Oj::Parser SAJ Callback via Input Mutation

Oj: Use-After-Free in Oj::Doc Iterators via Reentrant Close

Oj: Heap Buffer Overflow in Oj.dump Exception Serialization via Large Indent

Oj: Stack Buffer Overflow in Oj::Doc#each_child via Deeply Nested Input

Oj: intern.c form_attr (uninitialized stack read)

Faraday: Uncontrolled recursion in NestedParamsEncoder allows stack exhaustion DoS via deeply nested query parameters

Oj: Stack Buffer Overflow in Oj.dump via Large Indent

Oj: Use-After-Free in Oj::Parser Symbol Key Cache Toggle

AlchemyCMS: Unauthenticated nested page API leaks restricted & unpublished content

Nokogiri: Possible Use-After-Free when setting an attribute value via `Nokogiri::XML::Attr#value=` or `#content=`

Nokogiri: Possible Use-After-Free when directly using `NokogirI::XML::XPathContext` beyond document lifetime

Nokogiri: Possible Use-After-Free when setting `Document#root=` to an invalid node type

Nokogiri: Possible Out-of-Bounds Read in `Nokogiri::XML::NodeSet#[]`

Nokogiri: Null Pointer Dereference calling methods on uninitialized wrapper classes

Nokogiri: Possible Use-After-Free when `Nokogiri::XML::Document#encoding=` raises an exception

Avo: Missing Authorization in Avo Association Attach Endpoint Allows Unauthorized Relationship Manipulation and Privilege Escalation

katello: missing repository authorization in content_uploads exposes cross-product content existence

Net::IMAP: Command Injection via ID command argument

Net::IMAP: Command Injection via non-synchronizing literal in "raw" argument

Puma PROXY Protocol v1 Accepts Repeated Protocol Headers on Persistent Connections

Puma PROXY Protocol v1 Parser Allows Remote Memory Exhaustion

GHSA-xf4v-w5x5-pv79

Spree: CSV Formula Injection in Customer Export

Doorkeeper Openid Connect: Dynamic Client Registration feature creates public clients with client_secret

CarrierWave has a denylisted_content_type bypass via Unescaped Regex Metacharacters

ruby-jwt: Empty-key HMAC bypass; cross-language sibling of CVE-2026-44351

view_component: System Test Entry Point Path Check Allows Sibling Directory Escape

view_component: Preview Route Can Dispatch Inherited Helper Methods

Devise has an Open Redirect via Unvalidated `request.referrer` in Timeoutable Session Timeout Handler

Sidekiq-cron is vulnerable to a cross-site scripting (xss) vulnerability via crafted URL

katalyst-koi: Session cookies can be replayed after user logout

CSS Parser: Improper Certificate Validation allows MITM injection of remote CSS content

Nokogiri XSLT transform has a memory leak

Nokogiri CSS selector tokenizer has regular expression backtracking

net-imap vulnerable to command Injection via "raw" arguments to multiple commands

net-imap vulnerable to command Injection via unvalidated Symbol inputs

net-imap vulnerable to denial of service via high iteration count for `SCRAM-*` authentication

Scan your dependencies for these CVEs