Browse CVEs by Ecosystem and Severity
121 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.
CRITICAL
CVE-2022-1811
Publify vulnerable to cross site scripting
CRITICAL
CVE-2012-3503
Katello uses hard coded credential
CRITICAL
CVE-2014-10075
karo Metacharacter Handling Remote Command Execution
CRITICAL
CVE-2018-12026
Phusion Passenger SpawningKit Contains Arbitrary Read/Write Vulnerability
CRITICAL
CVE-2018-1000076
RubyGems Improper Verification of Cryptographic Signature vulnerability
CRITICAL
CVE-2016-7954
Bundler allows attacker to inject arbitrary code via secondary Gem source
CRITICAL
CVE-2013-3221
Active Record component in Ruby on Rails has a data-type injection vulnerability
CRITICAL
CVE-2018-16395
Ruby Openssl Allows Incorrect Value Comparison
CRITICAL
CVE-2017-0903
RubyGems vulnerable to Deserialization of Untrusted Data
CRITICAL
CVE-2017-0899
RubyGems Code Injection vulnerability
CRITICAL
CVE-2019-11068
Nokogiri vulnerable to libxslt protection mechanism bypass
CRITICAL
CVE-2017-2096
smalruby and smalruby-editor vulnerable to OS Command Injection
CRITICAL
CVE-2017-10906
Fluentd Escape Sequence Injection Vulnerability
CRITICAL
CVE-2016-2785
Puppet Improper Access Control
CRITICAL
CVE-2013-1607
PDFKit Improper Input Validation vulnerability
CRITICAL
CVE-2013-2095
RubyGem openshift-origin-controller is vulnerable to command injection
CRITICAL
CVE-2022-28481
CSV-Safe improperly filters special characters potentially leading to CSV injection
CRITICAL
CVE-2022-27311
Server side request forgery in gibbon
CRITICAL
CVE-2022-25648
Command injection in ruby-git
CRITICAL
CVE-2022-24803
Command Injection vulnerability in asciidoctor-include-ext
CRITICAL
CVE-2022-24790
Puma vulnerable to HTTP Request Smuggling
CRITICAL
CVE-2022-21831
Possible code injection vulnerability in Rails / Active Storage
CRITICAL
CVE-2022-24720
Remote shell execution vulnerability in image_processing
CRITICAL
CVE-2021-41816
Buffer overrun in CGI.escape_html
CRITICAL
CVE-2021-41275
Spree Auth Devise vulnerability allows for authentication bypass through CSRF weakness
CRITICAL
GHSA-5629-8855-gf4g
Authentication Bypass by CSRF Weakness
CRITICAL
CVE-2021-41274
Authentication Bypass by CSRF Weakness
CRITICAL
CVE-2013-2512
OS Command Injection in ftpd
CRITICAL
CVE-2021-33575
Remote code execution in ruby-jss
CRITICAL
CVE-2021-33564
Dragonfly contains remote code execution vulnerability
CRITICAL
CVE-2020-14001
Unintended read access in kramdown gem
CRITICAL
CVE-2020-7981
SQL Injection in Geocoder
CRITICAL
CVE-2020-8165
ActiveSupport potentially unintended unmarshalling of user-provided objects in MemCacheStore and RedisCacheStore
CRITICAL
CVE-2020-8159
Arbitrary file write in actionpack-page_caching gem
CRITICAL
CVE-2019-10780
BibTeX-Ruby vulnerable to OS command injection
CRITICAL
CVE-2019-19919
Prototype Pollution in handlebars
CRITICAL
CVE-2019-17383
netaddr before 1.5.3 and 2.0.4 has Incorrect Default Permissions
CRITICAL
CVE-2019-16676
Improper Input Validation in simple_form
CRITICAL
CVE-2019-16377
Consul gem insufficient authentication check - Multiple powers in one controller are not always checked correctly
CRITICAL
CVE-2019-16060
Airbrake keys not being filtered
CRITICAL
CVE-2019-15224
rest-client Gem Contains Malicious Code
CRITICAL
CVE-2019-5477
Nokogiri Command Injection Vulnerability
CRITICAL
CVE-2019-14281
datagrid contains code Injection backdoor
CRITICAL
CVE-2019-14282
Code backdoor in simple_captcha2
CRITICAL
CVE-2019-1010191
SQL Injection in marginalia
CRITICAL
CVE-2019-13589
paranoid2 gem Code backdoor
CRITICAL
CVE-2019-1010306
Slanger Arbitrary command execution
CRITICAL
CVE-2019-10744
Prototype Pollution in lodash
CRITICAL
CVE-2019-13354
strong_password Ruby gem malicious version causing Remote Code Execution vulnerability
CRITICAL
CVE-2019-11027
ruby-openid SSRF via claimed_id request