Browse CVEs by Ecosystem and Severity
321 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.
HIGH
CVE-2024-22051
Integer overflow in cmark-gfm table parsing extension leads to heap memory corruption
HIGH
CVE-2022-24722
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in view_component
HIGH
CVE-2022-23634
Puma used with Rails may lead to Information Exposure
HIGH
CVE-2022-23633
Exposure of information in Action Pack
HIGH
CVE-2022-0524
Publify Business Logic Errors
HIGH
CVE-2022-23837
Denial of service in sidekiq
HIGH
CVE-2021-41819
Cookie Prefix Spoofing in CGI::Cookie.parse
HIGH
CVE-2021-22569
A potential Denial of Service issue in protobuf-java
HIGH
CVE-2021-28680
Improper Privilege Management in devise_masquerade
HIGH
CVE-2021-43805
ReDos vulnerability on guest checkout email validation
HIGH
CVE-2021-41817
Regular expression denial of service vulnerability (ReDoS) in date
HIGH
CVE-2021-41098
Improper Restriction of XML External Entity Reference (XXE) in Nokogiri on JRuby
HIGH
CVE-2021-23435
Clearance Gem Open Redirect Vulnerability
HIGH
CVE-2021-31799
Arbitrary Code Execution in Rdoc
HIGH
CVE-2021-32740
Regular Expression Denial of Service in Addressable templates
HIGH
CVE-2021-35514
Code injection in Narou
HIGH
CVE-2021-20259
Exposure of Sensitive Information to an Unauthorized Actor in foreman_fog_proxmox
HIGH
CVE-2020-7671
HTTP Request Smuggling in goliath
HIGH
CVE-2020-7659
HTTP Request Smuggling in reel
HIGH
CVE-2020-13482
Improper Certificate Validation in EM-HTTP-Request
HIGH
CVE-2020-36327
Dependency Confusion in Bundler
HIGH
CVE-2020-13163
Improper certificate validation in em-imap
HIGH
CVE-2021-29509
Puma's Keepalive Connections Causing Denial Of Service
HIGH
CVE-2019-3881
Insecure path handling in Bundler
HIGH
CVE-2021-23337EPSS 0.7%
Command Injection in lodash
HIGH
CVE-2021-28966
Tempfile on Windows path traversal vulnerability
HIGH
CVE-2021-22904
Possible DoS Vulnerability in Action Controller Token Authentication
HIGH
CVE-2021-22885
Action Pack contains Information Disclosure / Unintended Method Execution vulnerability
HIGH
CVE-2021-22902
Denial of Service in Action Dispatch
HIGH
CVE-2021-28965
REXML round-trip instability
HIGH
CVE-2021-31671
Pgsync Contains Cleartext Transmission of Sensitive Information
HIGH
CVE-2016-11086
Improper Certificate Validation in oauth ruby gem
HIGH
CVE-2021-29435
Cross-Site Request Forgery (CSRF) in trestle-auth
HIGH
CVE-2021-28834
Remote code execution in Kramdown
HIGH
CVE-2021-22880
Active Record subject to Regular Expression Denial-of-Service (ReDoS)
HIGH
CVE-2021-21305
Code Injection vulnerability in CarrierWave::RMagick
HIGH
CVE-2021-21289
Command Injection Vulnerability in Mechanize
HIGH
CVE-2020-26254
omniauth-apple allows attacker to fake their email address during authentication
HIGH
CVE-2020-26223
Authorization bypass in Spree
HIGH
CVE-2020-26222
Remote code execution in dependabot-core branch names when cloning
HIGH
CVE-2020-15240
Regression in JWT Signature Validation
HIGH
CVE-2020-15269
Ensure that doorkeeper_token is valid when authenticating requests in API v2 calls
HIGH
CVE-2015-4410
Moped Rubygem Data Injection Vulnerability
HIGH
CVE-2020-16253
PgHero gem allows CSRF
HIGH
CVE-2020-15133
Missing TLS certificate verification in faye-websocket
HIGH
CVE-2020-15134
Missing TLS certificate verification
HIGH
CVE-2020-10663
Unsafe object creation in json RubyGem
HIGH
CVE-2020-8203
Prototype Pollution in lodash
HIGH
CVE-2020-8163
Remote code execution via user-provided local names in ActionView
HIGH
CVE-2020-8161
Directory traversal in Rack::Directory app bundled with Rack