Browse CVEs by Ecosystem and Severity
744 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.
MEDIUM
CVE-2025-6442
Ruby WEBrick read_headers method can lead to HTTP Request/Response Smuggling
HIGH
CVE-2025-28382
OpenC3 COSMOS Vulnerable to Directory Traversal via openc3-api/tables endpoint
CRITICAL
CVE-2025-28384
OpenC3 COSMOS Vulnerable to Directory Traversal via /script-api/scripts/ endpoint
MEDIUM
CVE-2025-49007
ReDoS Vulnerability in Rack::Multipart handle_mime_head
MEDIUM
CVE-2025-48069
Insufficient input sanitization in ejson2env
HIGH
CVE-2025-46727
Rack has an Unbounded-Parameter DoS in Rack::QueryParser
MEDIUM
CVE-2025-46551
JRuby-OpenSSL has hostname verification disabled by default
MEDIUM
CVE-2025-43857
net-imap rubygem vulnerable to possible DoS by memory exhaustion
LOW
CVE-2024-39311
Publify Vulnerable To Cross-Site Scripting (XSS) Via Redirects Requiring User Interaction
MEDIUM
CVE-2025-30221
Pitchfork HTTP Request/Response Splitting vulnerability
HIGH
CVE-2025-71406
Nokogiri updates packaged libxslt to v1.1.43 to resolve multiple CVEs
CRITICAL
CVE-2025-2304
Camaleon CMS Vulnerable to Privilege Escalation through a Mass Assignment
CRITICAL
CVE-2025-25292
Ruby SAML allows a SAML authentication bypass due to namespace handling (parser differential)
CRITICAL
CVE-2025-25291
Ruby SAML allows a SAML authentication bypass due to DOCTYPE handling (parser differential)
HIGH
CVE-2025-25293
Ruby SAML allows remote Denial of Service (DoS) with compressed SAML responses
CRITICAL
CVE-2025-27407
graphql allows remote code execution when loading a crafted GraphQL schema
HIGH
CVE-2025-27788
Out-of-bounds Read in Ruby JSON Parser
HIGH
CVE-2025-27610
Local File Inclusion in Rack::Static
MEDIUM
CVE-2025-27111
Escape Sequence Injection vulnerability in Rack lead to Possible Log Injection
MEDIUM
CVE-2025-27220
CGI has Regular Expression Denial of Service (ReDoS) potential in Util#escapeElement
MEDIUM
CVE-2025-27219
CGI has Denial of Service (DoS) potential in Cookie.parse
CRITICAL
CVE-2025-27590
Oxidized Web RANCID migration page allows unauthenticated user to gain control over Linux user account
MEDIUM
CVE-2025-26803
Phusion Passenger denial of service
MEDIUM
CVE-2025-25184
Possible Log Injection in Rack::CommonLogger
MEDIUM
CVE-2025-25186
Possible DoS by memory exhaustion in net-imap
MEDIUM
CVE-2024-56733
Password Pusher Allows Session Token Interception Leading to Potential Hijacking
LOW
CVE-2024-54133
Possible Content Security Policy bypass in Action Dispatch
LOW
CVE-2024-53989
rails-html-sanitizer has XSS vulnerability with certain configurations
LOW
CVE-2024-53987
rails-html-sanitizer has XSS vulnerability with certain configurations
LOW
CVE-2024-53988
rails-html-sanitizer has XSS vulnerability with certain configurations
LOW
CVE-2024-53986
rails-html-sanitizer has XSS vulnerability with certain configurations
LOW
CVE-2024-53985
rails-html-sanitize has XSS vulnerability with certain configurations
LOW
CVE-2024-52796
Password Pusher rate limiter can be bypassed by forging proxy headers
MEDIUM
CVE-2024-45594
decidim-meetings Cross-site scripting vulnerability in the online or hybrid meeting embeds
HIGH
CVE-2024-43415
Decidim-Awesome has SQL injection in AdminAccountability
MEDIUM
CVE-2024-21510
Sinatra vulnerable to Reliance on Untrusted Inputs in a Security Decision
MEDIUM
CVE-2024-49771
MPXJ has a Potential Path Traversal Vulnerability
MEDIUM
CVE-2024-49761
REXML ReDoS vulnerability
HIGH
CVE-2024-49376
Autolab Misconfigured Reset Password Permissions
MEDIUM
CVE-2024-48652
camaleon_cms affected by cross site scripting
MEDIUM
CVE-2024-47889
Possible ReDoS vulnerability in block_format in Action Mailer
MEDIUM
CVE-2024-47888
Possible ReDoS vulnerability in plain_text_for_blockquote_node in Action Text
MEDIUM
CVE-2024-47887
Possible ReDoS vulnerability in HTTP Token authentication in Action Controller
MEDIUM
CVE-2024-41128
Possible ReDoS vulnerability in query parameter filtering in Action Dispatch
MEDIUM
CVE-2024-47529
OpenC3 stores passwords in clear text (`GHSL-2024-129`)
HIGH
CVE-2024-46977
OpenC3 Path Traversal via screen controller (`GHSL-2024-127`)
MEDIUM
CVE-2024-43795
OpenC3 Cross-site Scripting in Login functionality (`GHSL-2024-128`)
HIGH
CVE-2024-41673
Decidim has a cross-site scripting vulnerability in the version control page
HIGH
CVE-2024-46488
Heap-based Buffer Overflow in sqlite-vec
HIGH
CVE-2024-47220
HTTP Request Smuggling in ruby webrick