Loading...

Sign in Get Started

Browse CVEs by Ecosystem and Severity

744 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.

All ecosystems npm pypi packagist maven go crates.io rubygems nuget

All severities critical high medium low KEV only

Clear all filters

Devise has a confirmable "change email" race condition permits user to confirm email they have no access to

Katello: Denial of Service and potential information disclosure via SQL injection

Trix has a Stored XSS vulnerability through serialized attributes

sigstore-ruby verifier returns success for DSSE bundles with mismatched in-toto subject digest

Camaleon CMS vulnerable to Path Traversal through AWS S3 uploader implementation

rubyipmi is vulnerable to OS Command Injection through malicious usernames

Nokogiri does not check the return value from xmlC14NExecute

Stored XSS in Rack::Directory via javascript: filenames rendered into anchor href

Rack has a Directory Traversal via Rack:Directory

Faraday affected by SSRF via protocol-relative URL host override in build_exclusive_url

GHSA-w67g-2h6v-vjgq

Phlex XSS protection bypass via attribute splatting, dynamic tags, and href values

Unauthenticated Spree Commerce users can access all guest addresses

Unauthenticated Spree Commerce users can view completed guest orders by Order ID

Decidim's private data exports can lead to data leaks

foreman_kubevirt disables SSL verification if a Certificate Authority (CA) certificate is not explicitly set

fog-kubevirt allows remote attacker to perform MITM attack due to disabled certificate validation

Cassandra Web - Remote File Read

AlchemyCMS: Authenticated Remote Code Execution (RCE) via eval injection in ResourcesHelper

GHSA-mpwp-4h2m-765c

Active Job - Object injection security vulnerability

GHSA-5qw5-wf2q-f538

ActiveRecord-JDBC-Adapter (AR-JDBC) lib/arjdbc/jdbc/adapter.rb sql.gsub() Function SQL Injection

openc3-api Vulnerable to Unauthenticated Remote Code Execution

Spree API has Unauthenticated IDOR - Guest Address

Spree API has Authenticated Insecure Direct Object Reference (IDOR) via Order Modification

GHSA-96qw-h329-v5rg

Shakapacker has environment variable leak via EnvironmentPlugin that exposes secrets to client-side bundles

URI Credential Leakage Bypass over CVE-2025-27221

httparty Has Potential SSRF Vulnerability That Leads to API Key Leakage

AWS SDK for Ruby's S3 Encryption Client has a Key Commitment Issue

ALTCHA Proof-of-Work Vulnerable to Challenge Splicing and Replay

Ruby-saml allows a Libxml2 Canonicalization error to bypass Digest/Signature validation

Ruby-saml has a SAML authentication bypass due to namespace handling (parser differential)

MQTT does not validate hostnames

Cross-Site Scripting (XSS) vulnerability through unescaped HTML attribute values

Sinatra is vulnerable to ReDoS through ETag header value generation

Rack is vulnerable to a memory-exhaustion DoS through unbounded URL-encoded body parsing

Rack has a Possible Information Disclosure Vulnerability

Rack's multipart parser buffers unbounded per-part headers, enabling DoS (memory exhaustion)

Rack: Multipart parser buffers large non‑file fields entirely in memory, enabling DoS (memory exhaustion)

Rack's unbounded multipart preamble buffering enables DoS (memory exhaustion)

Rack has an unsafe default in Rack::QueryParser allows params_limit bypass via semicolon-separated parameters

Google Sign-In for Rails allowed redirect to protocol-relative URI

Google Sign-In for Rails allowed redirects to malformed URLs

Spree Commerce is vulnerable to RCE through Search API

Active Storage allowed transformation methods that were potentially unsafe

Active Record logging vulnerable to ANSI escape injection

Spree has Remote Command Execution vulnerability in search functionality

JWE is missing AES-GCM authentication tag validation in encrypted JWE

Ruby SAML DOS vulnerability with large SAML response

resolv vulnerable to DoS via insufficient DNS domain name length validation

Job Iteration API is vulnerable to OS Command Injection attack through its CsvEnumerator class

HashiCorp Vagrant has code injection vulnerability through default synced folders

Scan your dependencies for these CVEs