Browse CVEs by Ecosystem and Severity
275 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.
MEDIUM
CVE-2018-16887
katello Cross-site Scripting vulnerability
MEDIUM
CVE-2018-1000078
RubyGems Cross-site Scripting vulnerability
MEDIUM
CVE-2017-10689
Tarball permission preservation in puppet
MEDIUM
CVE-2016-10362
Logstash Logs Sensitive Information
MEDIUM
CVE-2017-14506
Gem in a Box vulnerable to Cross-site Scripting
MEDIUM
CVE-2018-14040
Bootstrap vulnerable to Cross-Site Scripting (XSS)
MEDIUM
CVE-2018-18260
Camaleon CMS vulnerable to Stored Cross-site Scripting
MEDIUM
CVE-2013-6460
Nokogiri vulnerable to DoS while parsing XML documents
MEDIUM
CVE-2013-6461
Nokogiri vulnerable to DoS while parsing XML entities
MEDIUM
CVE-2022-27777
XSS Vulnerability in Action View tag helpers
MEDIUM
CVE-2022-22577
Cross-site Scripting Vulnerability in Action Pack
MEDIUM
CVE-2011-1497
Cross site scripting in actionpack Rubygem
MEDIUM
CVE-2020-28500EPSS 0.2%
Regular Expression Denial of Service (ReDoS) in lodash
MEDIUM
CVE-2021-43846
CSRF forgery protection bypass in solidus_frontend
MEDIUM
CVE-2021-44528
actionpack Open Redirect in Host Authorization Middleware
MEDIUM
CVE-2021-43809
Local Code Execution through Argument Injection via dash leading git url parameter in Gemfile.
MEDIUM
CVE-2021-27025
Silent Configuration Failure in Puppet Agent
MEDIUM
CVE-2021-27023
Unsafe HTTP Redirect in Puppet Agent and Puppet Server
MEDIUM
CVE-2021-41263
Rails Multisite secure/signed cookies share secrets between sites in a multi-site application
MEDIUM
CVE-2021-25973
Publify `guest` role users can self-register even when the admin does not allow it
MEDIUM
CVE-2021-41183
XSS in `*Text` options of the Datepicker widget in jquery-ui
MEDIUM
CVE-2021-41184
XSS in the `of` option of the `.position()` util in jquery-ui
MEDIUM
CVE-2021-41182
XSS in the `altField` option of the Datepicker widget in jquery-ui
MEDIUM
CVE-2021-39197
Older releases of better_errors open to Cross-Site Request Forgery attack
MEDIUM
CVE-2021-28833
qiita-markdown Cross-site Scripting vulnerability
MEDIUM
CVE-2021-22903
Possible Open Redirect Vulnerability in Action Pack
MEDIUM
CVE-2020-25739
Gon gem lack of escaping certain input when outputting as JSON
MEDIUM
CVE-2020-24393
Improper Certificate Validation in TweetStream
MEDIUM
CVE-2020-7942
Improper Certificate Validation in Puppet
MEDIUM
CVE-2020-24392
Improper Certificate Validation in twitter-stream
MEDIUM
CVE-2020-26298
Injection/XSS in Redcarpet
MEDIUM
CVE-2020-15237
Possible timing attack in derivation_endpoint
MEDIUM
CVE-2020-15109
Ability to change order address without triggering address validations in solidus
MEDIUM
CVE-2020-8167
CSRF Vulnerability in rails-ujs
MEDIUM
CVE-2020-8185
Untrusted users can run pending migrations in production in Rails
MEDIUM
CVE-2020-11077
HTTP Smuggling via Transfer-Encoding Header in Puma
MEDIUM
CVE-2020-11023KEV
Potential XSS vulnerability in jQuery
MEDIUM
CVE-2020-11022
Potential XSS vulnerability in jQuery
MEDIUM
CVE-2020-5249
HTTP Response Splitting (Early Hints) in Puma
MEDIUM
CVE-2020-5247
HTTP Response Splitting in Puma
MEDIUM
CVE-2020-5243
Denial of Service in uap-core when processing crafted User-Agent strings
MEDIUM
CVE-2019-16782
Possible Information Leak / Session Hijack Vulnerability in Rack
MEDIUM
CVE-2019-16779
In RubyGem excon, interrupted Persistent Connections May Leak Response Data
MEDIUM
CVE-2019-1010266
Regular Expression Denial of Service (ReDoS) in lodash
MEDIUM
CVE-2019-11358
XSS in jQuery as used in Drupal, Backdrop CMS, and other products
MEDIUM
CVE-2019-9837
Doorkeeper-openid_connect contains Open Redirect
MEDIUM
CVE-2019-8331
Bootstrap Vulnerable to Cross-Site Scripting
MEDIUM
CVE-2018-20677
bootstrap Cross-site Scripting vulnerability
MEDIUM
CVE-2018-20676
XSS vulnerability that affects bootstrap
MEDIUM
CVE-2016-10735
Bootstrap Cross-site Scripting vulnerability