Browse CVEs by Ecosystem and Severity
321 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.
HIGH
CVE-2020-8184
Rack allows Percent-encoded cookies to overwrite existing prefixed cookie names
HIGH
CVE-2020-4054
Cross-site Scripting in Sanitize
HIGH
CVE-2020-7663
Regular Expression Denial of Service in websocket-extensions (RubyGem)
HIGH
CVE-2020-8162
Circumvention of file size limits in ActiveStorage
HIGH
CVE-2020-8164
Possible Strong Parameters Bypass in ActionPack
HIGH
CVE-2020-11076
HTTP Smuggling via Transfer-Encoding Header in Puma
HIGH
CVE-2020-8151
Information disclosure issue in Active Resource
HIGH
CVE-2020-11052
Improper Restriction of Excessive Authentication Attempts in Sorcery
HIGH
CVE-2020-10187
Exposure of Sensitive Information to an Unauthorized Actor in Doorkeeper
HIGH
CVE-2020-11020
Authentication and extension bypass in Faye
HIGH
CVE-2015-4411
BSON rubygem contains potential denial of service
HIGH
CVE-2020-5257
Sort order SQL injection in Administrate
HIGH
CVE-2020-7595
libxml as used in Nokogiri has an infinite loop in a certain end-of-file situation
HIGH
CVE-2020-5241
XSS/Script injection vulnerability in matestack
HIGH
CVE-2019-18841
Prototype Pollution in chartkick
HIGH
CVE-2019-18848
JSON-jwt Gem lacked element count during splitting of JWE string
HIGH
CVE-2019-18409
Ruby_parser-legacy Incorrect Permission Assignment for Critical Resource
HIGH
CVE-2024-22050
Malicious URL drafting attack against iodines static file server may allow path traversal
HIGH
CVE-2018-20857
samlr XML nodes comment attack
HIGH
CVE-2019-13574
OS Command Injection in MiniMagick
HIGH
CVE-2017-11430
OmniAuth-SAML authentication bypass via incorrect XML canonicalization and DOM traversal
HIGH
CVE-2017-11428
Ruby-SAML Improper Authentication vulnerability
HIGH
CVE-2019-1020001
Path Traversal vulnerability that affects yard
HIGH
CVE-2019-8325
RubyGems Escape sequence injection in errors
HIGH
CVE-2019-8320
RubyGems Delete directory using symlink when decompressing tar
HIGH
CVE-2019-8324
Code injection in RubyGems
HIGH
CVE-2019-8321
RubyGems Escape sequence injection vulnerability in verbose
HIGH
CVE-2019-8322
RubyGems Escape sequence injection vulnerability in gem owner
HIGH
CVE-2019-8323
RubyGems Escape sequence injection vulnerability in api response handling
HIGH
CVE-2015-9284
OmniAuth Ruby gem Cross-site Request Forgery in request phase
HIGH
CVE-2018-6517
Improper Certificate Validation in chloride
HIGH
CVE-2019-5418KEV
Path Traversal in Action View
HIGH
CVE-2019-5419
Denial of Service Vulnerability in Action View
HIGH
CVE-2018-14404
Nokogiri NULL Pointer Dereference
HIGH
CVE-2018-16476
Improper Access Control in activejob
HIGH
CVE-2018-16470
Rack vulnerable to Denial of Service
HIGH
CVE-2018-17567
Jekyll allows attackers to access arbitrary files by specifying a symlink
HIGH
CVE-2015-8806
Denial of service or RCE from libxml2 and libxslt
HIGH
CVE-2018-1000201
Ruby-ffi has a DLL loading issue
HIGH
CVE-2015-4619
Spina gem vulnerable to Cross-site request forgery (CSRF) vulnerability
HIGH
CVE-2016-5697
Ruby-saml allows attackers to perform XML signature wrapping attacks
HIGH
CVE-2016-10345
Phusion Passenger uses a known /tmp filename
HIGH
CVE-2015-8968
git-fastclone permits arbitrary shell command execution from .gitmodules
HIGH
CVE-2018-1000211
Doorkeeper subject to Incorrect Permission Assignment
HIGH
CVE-2016-10522
Cross-site request forgery in rails_admin
HIGH
CVE-2017-5029
Nokogiri implementation of libxslt lacks integer overflow checks
HIGH
CVE-2017-11173
Missing Regex anchor in Rack-Cors allows malicious third party site to perform CORS request
HIGH
CVE-2014-5001
Kcapifony gem for Ruby places database user passwords on the command line
HIGH
CVE-2018-3760
Sprockets path traversal leads to information leak
HIGH
CVE-2018-3740
Sanitize vulnerable to Improper Input Validation and Cross-site Scripting