Browse CVEs by Ecosystem and Severity
275 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.
MEDIUM
CVE-2025-25186
Possible DoS by memory exhaustion in net-imap
MEDIUM
CVE-2024-56733
Password Pusher Allows Session Token Interception Leading to Potential Hijacking
MEDIUM
CVE-2024-45594
decidim-meetings Cross-site scripting vulnerability in the online or hybrid meeting embeds
MEDIUM
CVE-2024-21510
Sinatra vulnerable to Reliance on Untrusted Inputs in a Security Decision
MEDIUM
CVE-2024-49771
MPXJ has a Potential Path Traversal Vulnerability
MEDIUM
CVE-2024-49761
REXML ReDoS vulnerability
MEDIUM
CVE-2024-48652
camaleon_cms affected by cross site scripting
MEDIUM
CVE-2024-47889
Possible ReDoS vulnerability in block_format in Action Mailer
MEDIUM
CVE-2024-47888
Possible ReDoS vulnerability in plain_text_for_blockquote_node in Action Text
MEDIUM
CVE-2024-47887
Possible ReDoS vulnerability in HTTP Token authentication in Action Controller
MEDIUM
CVE-2024-41128
Possible ReDoS vulnerability in query parameter filtering in Action Dispatch
MEDIUM
CVE-2024-47529
OpenC3 stores passwords in clear text (`GHSL-2024-129`)
MEDIUM
CVE-2024-43795
OpenC3 Cross-site Scripting in Login functionality (`GHSL-2024-128`)
MEDIUM
CVE-2024-45614
Puma's header normalization allows for client to clobber proxy set headers
MEDIUM
CVE-2024-8796
Devise-Two-Factor Authentication Uses Insufficient Default OTP Shared Secret Length
MEDIUM
CVE-2024-39910
Decidim::Admin vulnerable to cross-site scripting (XSS) in the admin panel with QuillJS WYSWYG editor
MEDIUM
CVE-2024-32034
Decidim::Admin vulnerable to cross-site scripting (XSS) in the admin activity log
MEDIUM
CVE-2024-43791
request_store has Incorrect Default Permissions
MEDIUM
CVE-2024-43380
fugit parse and parse_nat stall on lengthy input
MEDIUM
CVE-2024-41946
REXML DoS vulnerability
MEDIUM
CVE-2024-41123
REXML DoS vulnerability
MEDIUM
CVE-2024-27095
Decidim cross-site scripting (XSS) in the admin panel
MEDIUM
CVE-2024-32469
Decidim cross-site scripting (XSS) in the pagination
MEDIUM
CVE-2024-27090
Decidim vulnerable to data disclosure through the embed feature
MEDIUM
CVE-2024-39308
RailsAdmin Cross-site Scripting vulnerability in the list view
MEDIUM
CVE-2024-39316
Rack ReDoS Vulnerability in HTTP Accept Headers Parsing
MEDIUM
CVE-2024-28103
Missing security headers in Action Pack on non-HTML responses
MEDIUM
CVE-2024-32464
ActionText ContentAttachment can Contain Unsanitized HTML
MEDIUM
CVE-2024-32978
Kaminari Insecure File Permissions Vulnerability
MEDIUM
CVE-2024-35176
REXML contains a denial of service vulnerability
MEDIUM
CVE-2024-34341
Trix Editor Arbitrary Code Execution Vulnerability
MEDIUM
CVE-2024-32887
Sidekiq vulnerable to a Reflected XSS in Queues Web Page
MEDIUM
CVE-2024-29034
CarrierWave content-Type allowlist bypass vulnerability which possibly leads to XSS remained
MEDIUM
CVE-2024-28862
ROTP 6.2.2 and 6.2.1 has 0666 permissions for the .rb files.
MEDIUM
CVE-2024-25126
Rack vulnerable to ReDoS in content type parsing (2nd degree polynomial)
MEDIUM
CVE-2024-27285
YARD's default template vulnerable to Cross-site Scripting in generated frames.html
MEDIUM
CVE-2024-26144
Rails has possible Sensitive Session Information Leak in Active Storage
MEDIUM
CVE-2024-26143
Rails has possible XSS Vulnerability in Action Controller
MEDIUM
CVE-2023-51447
Cross-site scripting (XSS) in the dynamic file uploads
MEDIUM
CVE-2023-48220
Possibility to circumvent the invitation token expiry period
MEDIUM
CVE-2024-22411
Cross-site scripting (XSS) in Action messages on Avo
MEDIUM
CVE-2024-21647
Puma HTTP Request/Response Smuggling vulnerability
MEDIUM
CVE-2024-21636
view_component Cross-site Scripting vulnerability
MEDIUM
CVE-2023-51763
ActiveAdmin CSV Injection leading to sensitive information disclosure
MEDIUM
CVE-2023-50724
Resque vulnerable to Reflected Cross Site Scripting through pathnames
MEDIUM
CVE-2023-50725
Resque vulnerable to reflected XSS in resque-web failed and queues lists
MEDIUM
CVE-2023-50727
Resque vulnerable to reflected XSS in Queue Endpoint
MEDIUM
CVE-2022-44303
Resque Scheduler Reflected XSS In Delayed Jobs View
MEDIUM
CVE-2023-26154
pubnub Insufficient Entropy vulnerability
MEDIUM
CVE-2023-49090
CarrierWave Content-Type allowlist bypass vulnerability, possibly leading to XSS