Browse CVEs by Ecosystem and Severity
744 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.
MEDIUM
CVE-2024-45614
Puma's header normalization allows for client to clobber proxy set headers
HIGH
CVE-2024-7254
protobuf-java has potential Denial of Service issue
HIGH
GHSA-7x4w-cj9r-h4v9
Camaleon CMS vulnerable to remote code execution through code injection (GHSL-2024-185)
HIGH
CVE-2024-46987
Camaleon CMS vulnerable to arbitrary path traversal (GHSL-2024-183)
HIGH
CVE-2024-46986
Camaleon CMS affected by arbitrary file write to RCE (GHSL-2024-182)
MEDIUM
CVE-2024-8796
Devise-Two-Factor Authentication Uses Insufficient Default OTP Shared Secret Length
MEDIUM
CVE-2024-39910
Decidim::Admin vulnerable to cross-site scripting (XSS) in the admin panel with QuillJS WYSWYG editor
MEDIUM
CVE-2024-32034
Decidim::Admin vulnerable to cross-site scripting (XSS) in the admin activity log
CRITICAL
GHSA-cvp8-5r8g-fhvq
omniauth-saml vulnerable to Improper Verification of Cryptographic Signature
CRITICAL
CVE-2024-45409
SAML authentication bypass via Incorrect XPath selector
MEDIUM
CVE-2024-43791
request_store has Incorrect Default Permissions
HIGH
CVE-2024-43398
REXML denial of service vulnerability
MEDIUM
CVE-2024-43380
fugit parse and parse_nat stall on lengthy input
CRITICAL
CVE-2024-42360
Command Injection in sequenceserver
MEDIUM
CVE-2024-41946
REXML DoS vulnerability
MEDIUM
CVE-2024-41123
REXML DoS vulnerability
MEDIUM
CVE-2024-27095
Decidim cross-site scripting (XSS) in the admin panel
MEDIUM
CVE-2024-32469
Decidim cross-site scripting (XSS) in the pagination
MEDIUM
CVE-2024-27090
Decidim vulnerable to data disclosure through the embed feature
MEDIUM
CVE-2024-39308
RailsAdmin Cross-site Scripting vulnerability in the list view
MEDIUM
CVE-2024-39316
Rack ReDoS Vulnerability in HTTP Accept Headers Parsing
MEDIUM
CVE-2024-28103
Missing security headers in Action Pack on non-HTML responses
MEDIUM
CVE-2024-32464
ActionText ContentAttachment can Contain Unsanitized HTML
HIGH
CVE-2024-37031
activeadmin vulnerable to stored persistent cross-site scripting (XSS) in dynamic form legends
HIGH
CVE-2024-35231
rack-contrib vulnerable to Denial of Service due to the unconstrained value of the incoming "profiler_runs" parameter
MEDIUM
CVE-2024-32978
Kaminari Insecure File Permissions Vulnerability
MEDIUM
CVE-2024-35176
REXML contains a denial of service vulnerability
MEDIUM
CVE-2024-34341
Trix Editor Arbitrary Code Execution Vulnerability
HIGH
CVE-2024-32970
Phlex vulnerable to Cross-site Scripting (XSS) via maliciously formed HTML attribute names and values
MEDIUM
CVE-2024-32887
Sidekiq vulnerable to a Reflected XSS in Queues Web Page
HIGH
CVE-2024-32463
Cross-site Scripting (XSS) possible due to improper sanitisation of `href` attributes on `<a>` tags
MEDIUM
CVE-2024-29034
CarrierWave content-Type allowlist bypass vulnerability which possibly leads to XSS remained
LOW
CVE-2024-27281
RDoc RCE vulnerability with .rdoc_options
CRITICAL
CVE-2024-27280
StringIO buffer overread vulnerability
MEDIUM
CVE-2024-28862
ROTP 6.2.2 and 6.2.1 has 0666 permissions for the .rb files.
HIGH
CVE-2024-28181
TurboBoost Commands vulnerable to arbitrary method invocation
CRITICAL
CVE-2023-28102
discordrb OS Command Injection vulnerability
HIGH
CVE-2024-28121
StimulusReflex arbitrary method call
HIGH
CVE-2024-28199
Cross-site Scripting (XSS) possible with maliciously formed HTML attribute names and values in Phlex
MEDIUM
CVE-2024-25126
Rack vulnerable to ReDoS in content type parsing (2nd degree polynomial)
MEDIUM
CVE-2024-27285
YARD's default template vulnerable to Cross-site Scripting in generated frames.html
MEDIUM
CVE-2024-26144
Rails has possible Sensitive Session Information Leak in Active Storage
MEDIUM
CVE-2024-26143
Rails has possible XSS Vulnerability in Action Controller
MEDIUM
CVE-2023-51447
Cross-site scripting (XSS) in the dynamic file uploads
MEDIUM
CVE-2023-48220
Possibility to circumvent the invitation token expiry period
HIGH
CVE-2023-46950
XSS sidekiq-unique-jobs UI server vulnerability
MEDIUM
CVE-2024-22411
Cross-site scripting (XSS) in Action messages on Avo
HIGH
CVE-2024-22191
avo vulnerable to stored cross-site scripting (XSS) in key_value field
MEDIUM
CVE-2024-21647
Puma HTTP Request/Response Smuggling vulnerability
MEDIUM
CVE-2024-21636
view_component Cross-site Scripting vulnerability