Browse CVEs by Ecosystem and Severity
121 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.
CRITICAL
CVE-2019-10842
Bootstrap-sass contains code execution backdoor
CRITICAL
CVE-2019-5420
Use of Insufficiently Random Values in Railties Allows Remote Code Execution
CRITICAL
CVE-2018-18476
mysql-bunuuid-rails vulnerable to SQL injection
CRITICAL
CVE-2018-14643
smart_proxy_dynflow gem authentication bypass in Foreman remote execution feature
CRITICAL
CVE-2018-1000544
Rubyzip gem contains a Directory Traversal vulnerability in zip file component
CRITICAL
CVE-2016-4658
Nokogiri does not forbid namespace nodes in XPointer ranges
CRITICAL
CVE-2015-8969
Git-fastclone passes user modifiable strings directly to a shell command
CRITICAL
CVE-2015-1820
rest-client Gem Vulnerable to Session Fixation
CRITICAL
CVE-2018-3777
restforce vulnerable to Improper Input Validation
CRITICAL
CVE-2015-4412
bson is vulnerable to denial of service due to incorrect regex validation
CRITICAL
CVE-2017-0889
paperclip Server-Side Request Forgery vulnerability
CRITICAL
CVE-2017-0905
Recurly gem Server-Side Request Forgery in Resource#find method
CRITICAL
CVE-2017-1000248
redis-store deserializes untrusted data
CRITICAL
CVE-2009-2422
rails vulnerable to improper authentication
CRITICAL
CVE-2015-8857
Incorrect Handling of Non-Boolean Comparisons During Minification in uglify-js
CRITICAL
CVE-2015-7541
colorscore Command Injection vulnerability
CRITICAL
CVE-2016-6582
Doorkeeper is vulnerable to replay attacks
CRITICAL
CVE-2016-10193
espeak-ruby allows arbitrary command execution
CRITICAL
CVE-2017-7540
Safemode Gem Has Incomplete List of Disallowed Inputs
CRITICAL
CVE-2016-10194
festivaltts4r allows arbitrary command execution
CRITICAL
CVE-2017-5946
Directory traversal vulnerability in RubyZip