Browse CVEs by Ecosystem and Severity
27 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.
LOW
CVE-2026-54620
sqlite3-ruby has Use-After-Free in SQLite Aggregate Function Callbacks
LOW
CVE-2026-54619
sqlite3-ruby has Use-After-Free When Redefining SQLite Functions with Different Arity
LOW
CVE-2026-73492
Loofah `allowed_uri?` does not detect `javascript:` URIs split by numeric character references without semicolons
LOW
CVE-2026-73491
Loofah `allowed_uri?` does not detect `javascript:` URIs split by named whitespace character references
LOW
CVE-2026-54906
Concurrent Ruby: ReadWriteLock allows wrong-thread write release and stray read-release counter corruption
LOW
CVE-2026-54905
Concurrent Ruby: `ReentrantReadWriteLock` read-count overflow grants a write lock without exclusivity
LOW
CVE-2026-57435
Nokogiri: Possible Use-After-Free when setting an attribute value via `Nokogiri::XML::Attr#value=` or `#content=`
LOW
CVE-2026-57437
Nokogiri: Possible Use-After-Free when directly using `NokogirI::XML::XPathContext` beyond document lifetime
LOW
CVE-2026-57436
Nokogiri: Possible Use-After-Free when setting `Document#root=` to an invalid node type
LOW
CVE-2026-57434
Nokogiri: Null Pointer Dereference calling methods on uninitialized wrapper classes
LOW
CVE-2026-57236
Nokogiri: Possible Use-After-Free when `Nokogiri::XML::Document#encoding=` raises an exception
LOW
CVE-2026-42245
net-imap has quadratic complexity when reading response literals
LOW
CVE-2026-33658
Rails Active Storage has a possible DoS vulnerability in proxy mode via multi-range requests
LOW
CVE-2026-33168
Rails has a possible XSS vulnerability in its Action View tag helpers
LOW
CVE-2026-33167
Rails has a possible XSS vulnerability in its Action Pack debug exceptions
LOW
GHSA-46fp-8f5p-pf2m
Improper detection of disallowed URIs by Loofah `allowed_uri?`
LOW
CVE-2025-61594
URI Credential Leakage Bypass over CVE-2025-27221
LOW
CVE-2025-61921
Sinatra is vulnerable to ReDoS through ETag header value generation
LOW
CVE-2024-39311
Publify Vulnerable To Cross-Site Scripting (XSS) Via Redirects Requiring User Interaction
LOW
CVE-2024-54133
Possible Content Security Policy bypass in Action Dispatch
LOW
CVE-2024-53989
rails-html-sanitizer has XSS vulnerability with certain configurations
LOW
CVE-2024-53987
rails-html-sanitizer has XSS vulnerability with certain configurations
LOW
CVE-2024-53988
rails-html-sanitizer has XSS vulnerability with certain configurations
LOW
CVE-2024-53986
rails-html-sanitizer has XSS vulnerability with certain configurations
LOW
CVE-2024-53985
rails-html-sanitize has XSS vulnerability with certain configurations
LOW
CVE-2024-52796
Password Pusher rate limiter can be bypassed by forging proxy headers
LOW
CVE-2024-27281
RDoc RCE vulnerability with .rdoc_options