Browse CVEs by Ecosystem and Severity
321 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.
HIGH
CVE-2026-34060
Ruby LSP has arbitrary code execution through branch setting
HIGH
CVE-2026-33946
MCP Ruby SDK: Insufficient Session Binding Allows SSE Stream Hijacking via Session ID Replay
HIGH
CVE-2026-33195
Rails Active Storage has possible Path Traversal in DiskService
HIGH
CVE-2026-33210
Ruby JSON has a format string injection vulnerability
HIGH
CVE-2026-31830
sigstore-ruby verifier returns success for DSSE bundles with mismatched in-toto subject digest
HIGH
CVE-2026-0980
rubyipmi is vulnerable to OS Command Injection through malicious usernames
HIGH
CVE-2026-22860
Rack has a Directory Traversal via Rack:Directory
HIGH
GHSA-w67g-2h6v-vjgq
Phlex XSS protection bypass via attribute splatting, dynamic tags, and href values
HIGH
CVE-2026-25758
Unauthenticated Spree Commerce users can access all guest addresses
HIGH
CVE-2026-25757
Unauthenticated Spree Commerce users can view completed guest orders by Order ID
HIGH
CVE-2025-65017
Decidim's private data exports can lead to data leaks
HIGH
CVE-2026-1531
foreman_kubevirt disables SSL verification if a Certificate Authority (CA) certificate is not explicitly set
HIGH
CVE-2026-1530
fog-kubevirt allows remote attacker to perform MITM attack due to disabled certificate validation
HIGH
CVE-2020-36939
Cassandra Web - Remote File Read
HIGH
GHSA-5qw5-wf2q-f538
ActiveRecord-JDBC-Adapter (AR-JDBC) lib/arjdbc/jdbc/adapter.rb sql.gsub() Function SQL Injection
HIGH
CVE-2026-22589
Spree API has Unauthenticated IDOR - Guest Address
HIGH
GHSA-96qw-h329-v5rg
Shakapacker has environment variable leak via EnvironmentPlugin that exposes secrets to client-side bundles
HIGH
CVE-2025-68696
httparty Has Potential SSRF Vulnerability That Leads to API Key Leakage
HIGH
CVE-2025-12790
MQTT does not validate hostnames
HIGH
CVE-2025-64501
Cross-Site Scripting (XSS) vulnerability through unescaped HTML attribute values
HIGH
CVE-2025-61919
Rack is vulnerable to a memory-exhaustion DoS through unbounded URL-encoded body parsing
HIGH
CVE-2025-61772
Rack's multipart parser buffers unbounded per-part headers, enabling DoS (memory exhaustion)
HIGH
CVE-2025-61771
Rack: Multipart parser buffers large non‑file fields entirely in memory, enabling DoS (memory exhaustion)
HIGH
CVE-2025-61770
Rack's unbounded multipart preamble buffering enables DoS (memory exhaustion)
HIGH
CVE-2025-59830
Rack has an unsafe default in Rack::QueryParser allows params_limit bypass via semicolon-separated parameters
HIGH
CVE-2025-28382
OpenC3 COSMOS Vulnerable to Directory Traversal via openc3-api/tables endpoint
HIGH
CVE-2025-46727
Rack has an Unbounded-Parameter DoS in Rack::QueryParser
HIGH
CVE-2025-71406
Nokogiri updates packaged libxslt to v1.1.43 to resolve multiple CVEs
HIGH
CVE-2025-25293
Ruby SAML allows remote Denial of Service (DoS) with compressed SAML responses
HIGH
CVE-2025-27788
Out-of-bounds Read in Ruby JSON Parser
HIGH
CVE-2025-27610
Local File Inclusion in Rack::Static
HIGH
CVE-2024-43415
Decidim-Awesome has SQL injection in AdminAccountability
HIGH
CVE-2024-49376
Autolab Misconfigured Reset Password Permissions
HIGH
CVE-2024-46977
OpenC3 Path Traversal via screen controller (`GHSL-2024-127`)
HIGH
CVE-2024-41673
Decidim has a cross-site scripting vulnerability in the version control page
HIGH
CVE-2024-46488
Heap-based Buffer Overflow in sqlite-vec
HIGH
CVE-2024-47220
HTTP Request Smuggling in ruby webrick
HIGH
CVE-2024-7254
protobuf-java has potential Denial of Service issue
HIGH
GHSA-7x4w-cj9r-h4v9
Camaleon CMS vulnerable to remote code execution through code injection (GHSL-2024-185)
HIGH
CVE-2024-46987
Camaleon CMS vulnerable to arbitrary path traversal (GHSL-2024-183)
HIGH
CVE-2024-46986
Camaleon CMS affected by arbitrary file write to RCE (GHSL-2024-182)
HIGH
CVE-2024-43398
REXML denial of service vulnerability
HIGH
CVE-2024-37031
activeadmin vulnerable to stored persistent cross-site scripting (XSS) in dynamic form legends
HIGH
CVE-2024-35231
rack-contrib vulnerable to Denial of Service due to the unconstrained value of the incoming "profiler_runs" parameter
HIGH
CVE-2024-32970
Phlex vulnerable to Cross-site Scripting (XSS) via maliciously formed HTML attribute names and values
HIGH
CVE-2024-32463
Cross-site Scripting (XSS) possible due to improper sanitisation of `href` attributes on `<a>` tags
HIGH
CVE-2024-28181
TurboBoost Commands vulnerable to arbitrary method invocation
HIGH
CVE-2024-28121
StimulusReflex arbitrary method call
HIGH
CVE-2024-28199
Cross-site Scripting (XSS) possible with maliciously formed HTML attribute names and values in Phlex
HIGH
CVE-2023-46950
XSS sidekiq-unique-jobs UI server vulnerability