Loading...

Sign in Get Started

Browse CVEs by Ecosystem and Severity

321 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.

All ecosystems npm pypi packagist maven go crates.io rubygems nuget

All severities critical high medium low KEV only

Clear all filters

OpenC3 COSMOS: Authenticated OS command injection via the `pypi_url` setting

Spree: Broken Access Control in `PATCH /api/v3/store/carts/:id/associate` (IDOR)

MPXJ: XXE Vulnerability in MerlinReader

rubyzip path traversal vulnerability

Savon::Model evaluates WSDL operation names as Ruby source

MCP Ruby SDK: Ruby SSE Session Poisoning

MCP Ruby SDK: Unbounded JSON-RPC request body causes uncontrolled memory allocation in StreamableHTTPTransport

OAuth2::Client#request: Protocol-relative redirect Location overrides authority, leaking bearer Authorization to attacker host

OAuth: Cross-origin token-request redirects can expose signed request metadata

websocket-driver-ruby: Denial of service via malformed Host header

dd-trace-rb: Improper parsing of W3C baggage headers may lead to DoS

ViewComponent: around_render HTML-Safety Bypass

Decidim: JWT-backed authentication can be replayed across organizations

Decidim: Verification documents can be downloaded through reusable links

Ruby CSS Parser: SSRF and Local File Disclosure in `CssParser::Parser#read_remote_file`

pay-rails/pay: non-constant-time HMAC comparison in Paddle Billing webhook signature verifier

Fluentd is Vulnerable to Server-Side Request Forgery (SSRF) via Placeholder Expansion in `out_http`

Fluentd is Vulnerable to Denial of Service (DoS) via Gzip Decompression Bomb in `in_http` and `in_forward`

Fluentd is Vulnerable to Exposure of Sensitive Information via Monitor Agent API

Concurrent Ruby : `AtomicReference#update` livelocks when the stored value is `Float::NAN`

Oj: Integer Overflow in Oj.load 2GB String Handling

Oj: Use-After-Free in Oj::Parser SAJ Long Key Callback

Oj: Use-After-Free in Oj::Parser array_class/hash_class GC Marking

Oj: Negative-Size memcpy in Oj::Parser create_id Attribute Handling

Oj: Use-After-Free in Oj::Parser SAJ Callback via Input Mutation

Oj: Use-After-Free in Oj::Doc Iterators via Reentrant Close

Oj: Heap Buffer Overflow in Oj.dump Exception Serialization via Large Indent

Oj: Stack Buffer Overflow in Oj::Doc#each_child via Deeply Nested Input

Faraday: Uncontrolled recursion in NestedParamsEncoder allows stack exhaustion DoS via deeply nested query parameters

Oj: Stack Buffer Overflow in Oj.dump via Large Indent

Oj: Use-After-Free in Oj::Parser Symbol Key Cache Toggle

AlchemyCMS: Unauthenticated nested page API leaks restricted & unpublished content

Puma PROXY Protocol v1 Accepts Repeated Protocol Headers on Persistent Connections

Puma PROXY Protocol v1 Parser Allows Remote Memory Exhaustion

ruby-jwt: Empty-key HMAC bypass; cross-language sibling of CVE-2026-44351

katalyst-koi: Session cookies can be replayed after user logout

Nokogiri CSS selector tokenizer has regular expression backtracking

net-imap vulnerable to STARTTLS stripping via invalid response timing

Avo: Broken Access Control Through Unauthorized Execution of Arbitrary Action Classes Across Resources

ERB has an @_init deserialization guard bypass via def_module / def_method / def_class

OpenC3 COSMOS: Hijacked session token can be used to reset password for persistence

Uncontrolled resource consumption and loop with unreachable exit condition in facil.io and downstream iodine ruby gem

Decidim amendments can be accepted or rejected by anyone

bsv-sdk ARC broadcaster treats INVALID/MALFORMED/ORPHAN responses as successful broadcasts

bsv-sdk and bsv-wallet persist unverified certifier signatures in acquire_certificate (direct and issuance paths)

Addressable has a Regular Expression Denial of Service in Addressable templates

Rack's multipart parsing without Content-Length header allows unbounded chunked file uploads

Rack has quadratic complexity in Rack::Utils.select_best_encoding via wildcard Accept-Encoding header

Rack's multipart header parsing allows Denial of Service via escape-heavy quoted parameters

Rack::Static prefix matching can expose unintended files under the static root

Scan your dependencies for these CVEs