Loading...

Sign in Get Started

Browse CVEs by Ecosystem and Severity

744 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.

All ecosystems npm pypi packagist maven go crates.io rubygems nuget

All severities critical high medium low KEV only

Clear all filters

net-imap has quadratic complexity when reading response literals

net-imap vulnerable to STARTTLS stripping via invalid response timing

Avo: Broken Access Control Through Unauthorized Execution of Arbitrary Action Classes Across Resources

ERB has an @_init deserialization guard bypass via def_module / def_method / def_class

OpenC3 COSMOS: Permissions Bypass Provides User Access to Unassigned Administrative Actions via Script Runner Tool

OpenC3 COSMOS has SQL Injection in QuestDB Time-Series Database

OpenC3 COSMOS is Vulnerable to Self-XSS Through the Command Sender

OpenC3 COSMOS allows arbitrary writes to plugins directory via path-traversed config filenames

OpenC3 COSMOS: Hijacked session token can be used to reset password for persistence

yard: Possible arbitrary path traversal and file access via yard server

Buffer Overflow in Zlib::GzipReader ungetc via large input leads to memory corruption

Uncontrolled resource consumption and loop with unreachable exit condition in facil.io and downstream iodine ruby gem

Decidim amendments can be accepted or rejected by anyone

Decidim has a cross-site scripting (XSS) in user name

bsv-sdk ARC broadcaster treats INVALID/MALFORMED/ORPHAN responses as successful broadcasts

bsv-sdk and bsv-wallet persist unverified certifier signatures in acquire_certificate (direct and issuance paths)

Rack::Session::Cookie secrets: decrypt failure fallback enables secretless session forgery and Marshal deserialization

Addressable has a Regular Expression Denial of Service in Addressable templates

rdiscount has an Out-of-bounds Read

Rack::Request accepts invalid Host characters, enabling host allowlist bypass

Rack has Content-Length mismatch in Rack::Files error responses

Rack::Sendfile header-based X-Accel-Mapping regex injection enables unauthorized X-Accel-Redirect

Rack's multipart parsing without Content-Length header allows unbounded chunked file uploads

Rack has a root directory disclosure via unescaped regex interpolation in Rack::Directory

Rack has quadratic complexity in Rack::Utils.select_best_encoding via wildcard Accept-Encoding header

Rack: Forwarded Header semicolon injection enables Host and Scheme spoofing

Rack's improper unfolding of folded multipart headers preserves CRLF in parsed parameter values

Rack's greedy multipart boundary parsing can cause parser differentials and WAF bypass.

Rack's multipart header parsing allows Denial of Service via escape-heavy quoted parameters

Rack's multipart byte range processing allows denial of service via excessive overlapping ranges

Rack:: Static header_rules bypass via URL-encoded paths

Rack::Static prefix matching can expose unintended files under the static root

Ruby LSP has arbitrary code execution through branch setting

MCP Ruby SDK: Insufficient Session Binding Allows SSE Stream Hijacking via Session ID Replay

Rails Active Storage has a possible DoS vulnerability in proxy mode via multi-range requests

iCalendar has ICS injection via unsanitized URI property values

Rails Active Storage has possible glob injection in its DiskService

Rails Active Storage has possible Path Traversal in DiskService

Rails Active Support has a possible DoS vulnerability in its number helpers

Rails Active Storage has a possible DoS vulnerability when in proxy mode via Range requests

Rails Active Storage has possible content type bypass via metadata in direct uploads

Rails Active Support has a possible XSS vulnerability in SafeBuffer#%

Rails Active Support has a possible ReDoS vulnerability in number_to_delimited

Rails has a possible XSS vulnerability in its Action View tag helpers

Rails has a possible XSS vulnerability in its Action Pack debug exceptions

Graphiti Affected by Arbitrary Method Execution via Unvalidated Relationship Names

bcrypt-ruby has an Integer Overflow that Causes Zero Key-Strengthening Iterations at Cost=31 on JRuby

Ruby JSON has a format string injection vulnerability

Avo has a XSS vulnerability on `return_to` param

GHSA-46fp-8f5p-pf2m

Improper detection of disallowed URIs by Loofah `allowed_uri?`

Scan your dependencies for these CVEs