Browse CVEs by Ecosystem and Severity
321 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.
HIGH
CVE-2014-4992
Cap-Strap gem for Ruby places credentials on the useradd command line
HIGH
CVE-2014-5004
brbackup exposes database password to unauthorized users
HIGH
CVE-2017-18076
Omniauth allows POST parameters to be stored in session
HIGH
CVE-2014-5002
lynx doesn't properly sanitize user input and exposes database password to unauthorized users
HIGH
CVE-2014-5000
lawn-login exposes database password to unauthorized users
HIGH
CVE-2016-10707
Denial of Service in jquery
HIGH
CVE-2017-17042
Arbitrary file read vulnerability in yard server
HIGH
CVE-2017-9050
Out-of-bounds read in nokogiri
HIGH
CVE-2017-16516
yajl-ruby gem Denial of Service vulnerability
HIGH
CVE-2017-15928
Ox gem crashes due to a crafted input
HIGH
CVE-2014-9489
gollum and gollum-lib allow remote authenticated users to execute arbitrary code
HIGH
CVE-2013-7463
Aescrypt does not sufficiently use random values
HIGH
CVE-2014-0130KEV
actionpack Path Traversal vulnerability
HIGH
CVE-2015-7581
actionpack is vulnerable to denial of service because of a wildcard controller route
HIGH
CVE-2016-7798
OpenSSL gem for Ruby using inadequate encryption strength
HIGH
CVE-2016-2098
actionpack allows remote code execution via application's unrestricted use of render method
HIGH
CVE-2016-3693
safemode gem allows context-dependent attackers to obtain sensitive information via the inspect method
HIGH
CVE-2016-0751
actionpack is vulnerable to denial of service via a crafted HTTP Accept header
HIGH
CVE-2016-10173
archive-tar-minitar and minitar vulnerable to Path Traversal
HIGH
CVE-2016-6317
ActiveRecord in Ruby on Rails allows database-query bypass
HIGH
CVE-2016-0752KEV
Directory traversal vulnerability in Action View in Ruby on Rails