Browse CVEs by Ecosystem and Severity
744 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.
HIGH
CVE-2015-8314
Devise Gem for Ruby Unauthorized Access Using "Remember Me" Cookie
MEDIUM
CVE-2015-2179
xaviershay-dm-rails Gem for Ruby exposes sensitive information via the process table
HIGH
GHSA-q95h-cqrv-8jv5
ExifTool vulnerable to arbitrary code execution
HIGH
CVE-2009-4123
jruby-openssl gem for JRuby fails to do proper certificate validation
MEDIUM
CVE-2023-22797
Open Redirect Vulnerability in Action Pack
HIGH
CVE-2022-44566
Denial of Service Vulnerability in ActiveRecord's PostgreSQL adapter
HIGH
CVE-2023-22794
SQL Injection Vulnerability via ActiveRecord comments
HIGH
CVE-2022-44570
Denial of service via header parsing in Rack
HIGH
CVE-2022-47318
Code injection in ruby git
CRITICAL
CVE-2015-10053
curupira is vulnerable to SQL injection
CRITICAL
CVE-2022-1812
Integer overflow in publify_core
MEDIUM
CVE-2022-2815
Publify Core does not strip metadata from images
CRITICAL
CVE-2023-0299
Publify Improper Input Validation vulnerability
HIGH
CVE-2022-46648
ruby-git has potential remote code execution vulnerability
MEDIUM
CVE-2020-36644
Inline SVG vulnerable to Cross-site Scripting
HIGH
CVE-2023-22626
PgHero Allows Information Disclosure Through EXPLAIN Feature
MEDIUM
CVE-2024-22049
httparty has multipart/form-data request tampering vulnerability
MEDIUM
CVE-2017-20159
keynote Cross-site Scripting vulnerability
MEDIUM
CVE-2019-25088
Oxidized Web vulnerable to Cross-site Scripting
MEDIUM
CVE-2020-36624
text_helpers uses web link to untrusted target with window.opener access
HIGH
CVE-2021-4250
active_attr Improper Resource Shutdown or Release vulnerability
MEDIUM
CVE-2022-23520
Possible XSS vulnerability with certain configurations of rails-html-sanitizer
MEDIUM
CVE-2022-23519
Possible XSS vulnerability with certain configurations of rails-html-sanitizer
MEDIUM
CVE-2022-23518
Improper neutralization of data URIs may allow XSS in rails-html-sanitizer
HIGH
CVE-2022-23517
Inefficient Regular Expression Complexity in rails-html-sanitizer
HIGH
CVE-2022-23516
Uncontrolled Recursion in Loofah
MEDIUM
CVE-2022-23515
Improper neutralization of data URIs may allow XSS in Loofah
HIGH
CVE-2022-23514
Inefficient Regular Expression Complexity in Loofah
HIGH
CVE-2022-23476
Unchecked return value from xmlTextReaderExpand
HIGH
CVE-2022-45442
Sinatra vulnerable to Reflected File Download attack
HIGH
CVE-2021-33621
HTTP response splitting in CGI
MEDIUM
CVE-2022-39281
Fat Free CRM vulnerable to Remote Denial of Service via Tasks endpoint
MEDIUM
CVE-2022-3171
protobuf-java has a potential Denial of Service issue
HIGH
CVE-2022-39224
arr-pm vulnerable to arbitrary shell execution when extracting or listing files contained in a malicious rpm.
CRITICAL
CVE-2022-25765
PDFKit vulnerable to Command Injection
CRITICAL
CVE-2020-36599
OmniAuth's `lib/omniauth/failure_endpoint.rb` does not escape `message_key` value
MEDIUM
CVE-2022-35956
update_by_case before 0.1.3 can be vulnerable to sql injection
MEDIUM
CVE-2016-3098
administrate vulnerable to Cross-Site Request Forgery
HIGH
CVE-2022-31163
TZInfo relative path traversal vulnerability allows loading of arbitrary files
MEDIUM
CVE-2022-31160
jQuery UI vulnerable to XSS when refreshing a checkboxradio with an HTML-like initial text label
MEDIUM
CVE-2020-35305
Gollum Cross-site Scripting vulnerability via filename parameter to New Page dialog
CRITICAL
CVE-2022-32224
Active Record RCE bug with Serialized Columns
HIGH
CVE-2022-31115
opensearch-ruby 2.x before 2.0.2 vulnerable to unsafe YAML deserialization
MEDIUM
CVE-2013-4170
Ember.js Potential XSS Exploit When Binding `tagName` to User-Supplied Data
CRITICAL
CVE-2014-0156
OS Command Injection in awesome spawn
MEDIUM
CVE-2021-3779
Externally Controlled Reference to a Resource in Another Sphere in ruby-mysql
MEDIUM
CVE-2022-32209
Rails::Html::Sanitizer vulnerable to Cross-site Scripting
CRITICAL
CVE-2022-33127
Improper handling of double quotes in file name in Diffy in Windows environment
MEDIUM
CVE-2022-31033
Mechanize before v2.8.5 vulnerable to authorization header leak on port redirect
CRITICAL
CVE-2022-32511
JMESPath for Ruby uses unsafe JSON.load when safe JSON.parse is preferable