Loading...

Sign in Get Started

Browse CVEs by Ecosystem and Severity

275 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.

All ecosystems npm pypi packagist maven go crates.io rubygems nuget

All severities critical high medium low KEV only

Clear all filters

Buffer Overflow in Zlib::GzipReader ungetc via large input leads to memory corruption

rdiscount has an Out-of-bounds Read

Rack::Request accepts invalid Host characters, enabling host allowlist bypass

Rack has Content-Length mismatch in Rack::Files error responses

Rack::Sendfile header-based X-Accel-Mapping regex injection enables unauthorized X-Accel-Redirect

Rack has a root directory disclosure via unescaped regex interpolation in Rack::Directory

Rack: Forwarded Header semicolon injection enables Host and Scheme spoofing

Rack's improper unfolding of folded multipart headers preserves CRLF in parsed parameter values

Rack's greedy multipart boundary parsing can cause parser differentials and WAF bypass.

Rack's multipart byte range processing allows denial of service via excessive overlapping ranges

Rack:: Static header_rules bypass via URL-encoded paths

iCalendar has ICS injection via unsanitized URI property values

Rails Active Storage has possible glob injection in its DiskService

Rails Active Support has a possible DoS vulnerability in its number helpers

Rails Active Storage has a possible DoS vulnerability when in proxy mode via Range requests

Rails Active Storage has possible content type bypass via metadata in direct uploads

Rails Active Support has a possible XSS vulnerability in SafeBuffer#%

Rails Active Support has a possible ReDoS vulnerability in number_to_delimited

bcrypt-ruby has an Integer Overflow that Causes Zero Key-Strengthening Iterations at Cost=31 on JRuby

Avo has a XSS vulnerability on `return_to` param

Devise has a confirmable "change email" race condition permits user to confirm email they have no access to

Katello: Denial of Service and potential information disclosure via SQL injection

Trix has a Stored XSS vulnerability through serialized attributes

Camaleon CMS vulnerable to Path Traversal through AWS S3 uploader implementation

Nokogiri does not check the return value from xmlC14NExecute

Stored XSS in Rack::Directory via javascript: filenames rendered into anchor href

Faraday affected by SSRF via protocol-relative URL host override in build_exclusive_url

AlchemyCMS: Authenticated Remote Code Execution (RCE) via eval injection in ResourcesHelper

GHSA-mpwp-4h2m-765c

Active Job - Object injection security vulnerability

Spree API has Authenticated Insecure Direct Object Reference (IDOR) via Order Modification

AWS SDK for Ruby's S3 Encryption Client has a Key Commitment Issue

ALTCHA Proof-of-Work Vulnerable to Challenge Splicing and Replay

Rack has a Possible Information Disclosure Vulnerability

Google Sign-In for Rails allowed redirect to protocol-relative URI

Google Sign-In for Rails allowed redirects to malformed URLs

Active Record logging vulnerable to ANSI escape injection

Ruby SAML DOS vulnerability with large SAML response

resolv vulnerable to DoS via insufficient DNS domain name length validation

HashiCorp Vagrant has code injection vulnerability through default synced folders

Ruby WEBrick read_headers method can lead to HTTP Request/Response Smuggling

ReDoS Vulnerability in Rack::Multipart handle_mime_head

Insufficient input sanitization in ejson2env

JRuby-OpenSSL has hostname verification disabled by default

net-imap rubygem vulnerable to possible DoS by memory exhaustion

Pitchfork HTTP Request/Response Splitting vulnerability

Escape Sequence Injection vulnerability in Rack lead to Possible Log Injection

CGI has Regular Expression Denial of Service (ReDoS) potential in Util#escapeElement

CGI has Denial of Service (DoS) potential in Cookie.parse

Phusion Passenger denial of service

Possible Log Injection in Rack::CommonLogger

Scan your dependencies for these CVEs