Browse CVEs by Ecosystem and Severity
744 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.
HIGH
CVE-2024-21632
Omniauth::MicrosoftGraph Account takeover (nOAuth)
MEDIUM
CVE-2023-51763
ActiveAdmin CSV Injection leading to sensitive information disclosure
MEDIUM
CVE-2023-50724
Resque vulnerable to Reflected Cross Site Scripting through pathnames
MEDIUM
CVE-2023-50725
Resque vulnerable to reflected XSS in resque-web failed and queues lists
MEDIUM
CVE-2023-50727
Resque vulnerable to reflected XSS in Queue Endpoint
MEDIUM
CVE-2022-44303
Resque Scheduler Reflected XSS In Delayed Jobs View
HIGH
CVE-2023-50448
Potential CSV export data leak
MEDIUM
CVE-2023-26154
pubnub Insufficient Entropy vulnerability
MEDIUM
CVE-2023-49090
CarrierWave Content-Type allowlist bypass vulnerability, possibly leading to XSS
MEDIUM
CVE-2023-5349
memory leak flaw was found in ruby-magick
HIGH
CVE-2024-0241
encoded_id-rails potential DOS vulnerability due to URIs with extremely long encoded IDs
CRITICAL
CVE-2023-5214
Puppet Bolt privilege escalation vulnerability
CRITICAL
CVE-2023-26153
geokit-rails Command Injection vulnerability
HIGH
CVE-2023-36465
Decidim has broken access control in templates
MEDIUM
CVE-2023-26141
sidekiq Denial of Service vulnerability
HIGH
CVE-2023-4785
Denial of Service Vulnerability in gRPC TCP Server (Posix-compatible platforms)
MEDIUM
CVE-2023-38037
Active Support Possibly Discloses Locally Encrypted Files
CRITICAL
CVE-2023-40175
Puma HTTP Request/Response Smuggling vulnerability
HIGH
CVE-2023-33953
Excessive Iteration in gRPC
MEDIUM
CVE-2023-38697
protocol-http1 HTTP Request/Response Smuggling vulnerability
HIGH
CVE-2023-38337
rswag vulnerable to arbitrary JSON and YAML file read via directory traversal
MEDIUM
CVE-2023-32693
Decidim Cross-site Scripting vulnerability in the external link redirections
HIGH
CVE-2023-34089
Decidim Cross-site Scripting vulnerability in the processes filter
HIGH
CVE-2023-34090
Decidim vulnerable to sensitive data disclosure
HIGH
CVE-2023-1428
gRPC Reachable Assertion issue
HIGH
CVE-2023-36823
Sanitize vulnerable to Cross-site Scripting via insufficient neutralization of `style` element content
HIGH
CVE-2023-32731
Connection confusion in gRPC
MEDIUM
CVE-2023-36617
URI gem has ReDoS vulnerability
MEDIUM
CVE-2023-23913
rails-ujs vulnerable to DOM Based Cross-site Scripting contenteditable HTML Elements
MEDIUM
CVE-2023-27531
Kredis JSON Possible Deserialization of Untrusted Data Vulnerability
HIGH
CVE-2023-31606
RedCloth Regular Expression Denial of Service issue
HIGH
CVE-2023-34102
avo possible unsafe reflection / partial DoS vulnerability
HIGH
CVE-2023-34103
avo vulnerable to Stored XSS (Cross Site Scripting) in html content based fields
CRITICAL
CVE-2015-20108
ruby-saml vulnerable to XPath injection
CRITICAL
CVE-2023-30145
Server-Side Template Injection in Camaleon CMS
MEDIUM
CVE-2023-25309
Cross Site Scripting (XSS) Vulnerability in Fetlife rollout-ui gem
CRITICAL
CVE-2022-37454
Buffer overflow in sponge queue functions
HIGH
CVE-2023-1892
sidekiq vulnerable to cross-site scripting
HIGH
CVE-2023-30614
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in Pay
HIGH
CVE-2020-21514
Fluent Fluentd and Fluent-ui use default password
HIGH
CVE-2023-28756
Ruby Time component ReDoS issue
HIGH
CVE-2023-28755
Ruby URI component ReDoS issue
MEDIUM
CVE-2023-28846
unpoly-rails Denial of Service vulnerability
MEDIUM
CVE-2023-28120
Possible XSS Security Vulnerability in SafeBuffer#bytesplice
HIGH
CVE-2023-27530
Rack has possible DoS Vulnerability in Multipart MIME parsing
CRITICAL
CVE-2022-36231
Code injection in pdf_info
MEDIUM
CVE-2023-25015
Clockwork Web contains a Cross-Site Request Forgery Vulnerability with Rails < 5.2
MEDIUM
CVE-2023-0569
Publify contains Weak Password Requirements
MEDIUM
CVE-2023-23627
Improper neutralization of `noscript` element content may allow XSS in Sanitize
CRITICAL
CVE-2013-2513
flash_tool Gem for Ruby File Download Handling Arbitrary Command Execution