Browse CVEs by Ecosystem and Severity
5,778 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.
HIGH
CVE-2020-15240
Regression in JWT Signature Validation
HIGH
CVE-2020-36442
beef::Cow lacks a Sync bound on its Send trait allowing for data races
HIGH
CVE-2020-15269
Ensure that doorkeeper_token is valid when authenticating requests in API v2 calls
MEDIUM
CVE-2020-15237
Possible timing attack in derivation_endpoint
LOW
CVE-2020-15168EPSS 0.1%
The `size` option isn't honored after following a redirect in node-fetch
HIGH
CVE-2020-35889
Misbehaving `HandleLike` implementation can lead to memory safety violation
CRITICAL
CVE-2020-15146
Remote Code Execution in SyliusResourceBundle
HIGH
CVE-2015-4410
Moped Rubygem Data Injection Vulnerability
CRITICAL
CVE-2020-14001
Unintended read access in kramdown gem
HIGH
CVE-2020-16253
PgHero gem allows CSRF
CRITICAL
CVE-2020-5413
Code execution in Spring Integration
MEDIUM
CVE-2020-15109
Ability to change order address without triggering address validations in solidus
HIGH
CVE-2020-15133
Missing TLS certificate verification in faye-websocket
HIGH
CVE-2020-15134
Missing TLS certificate verification
HIGH
CVE-2020-10663
Unsafe object creation in json RubyGem
HIGH
CVE-2020-8203
Prototype Pollution in lodash
HIGH
CVE-2020-8163
Remote code execution via user-provided local names in ActionView
MEDIUM
CVE-2020-8167
CSRF Vulnerability in rails-ujs
HIGH
CVE-2020-8161
Directory traversal in Rack::Directory app bundled with Rack
MEDIUM
CVE-2020-8185
Untrusted users can run pending migrations in production in Rails
HIGH
CVE-2020-8184
Rack allows Percent-encoded cookies to overwrite existing prefixed cookie names
HIGH
CVE-2020-4054
Cross-site Scripting in Sanitize
CRITICAL
CVE-2020-7981
SQL Injection in Geocoder
HIGH
CVE-2020-7663
Regular Expression Denial of Service in websocket-extensions (RubyGem)
HIGH
CVE-2020-8162
Circumvention of file size limits in ActiveStorage
HIGH
CVE-2020-8164
Possible Strong Parameters Bypass in ActionPack
CRITICAL
CVE-2020-8165
ActiveSupport potentially unintended unmarshalling of user-provided objects in MemCacheStore and RedisCacheStore
MEDIUM
CVE-2020-11077
HTTP Smuggling via Transfer-Encoding Header in Puma
HIGH
CVE-2020-11076
HTTP Smuggling via Transfer-Encoding Header in Puma
HIGH
CVE-2020-8151
Information disclosure issue in Active Resource
CRITICAL
CVE-2020-8159
Arbitrary file write in actionpack-page_caching gem
HIGH
CVE-2020-11052
Improper Restriction of Excessive Authentication Attempts in Sorcery
HIGH
CVE-2020-10187
Exposure of Sensitive Information to an Unauthorized Actor in Doorkeeper
MEDIUM
CVE-2020-11023KEV
Potential XSS vulnerability in jQuery
MEDIUM
CVE-2020-11022
Potential XSS vulnerability in jQuery
HIGH
CVE-2020-11020
Authentication and extension bypass in Faye
HIGH
CVE-2015-4411
BSON rubygem contains potential denial of service
MEDIUM
CVE-2020-5268
Subject Confirmation Method not validated in Saml2 Authentication Services for ASP.NET
MEDIUM
CVE-2020-7598EPSS 0.3%
Prototype Pollution in minimist
HIGH
CVE-2020-5261
Missing Token Replay Detection in Saml2 Authentication services for ASP.NET
HIGH
CVE-2020-5257
Sort order SQL injection in Administrate
CRITICAL
CVE-2020-8840
Deserialization of Untrusted Data in jackson-databind
CRITICAL
CVE-2019-20330
Deserialization of Untrusted Data in jackson-databind
MEDIUM
CVE-2020-5249
HTTP Response Splitting (Early Hints) in Puma
MEDIUM
CVE-2020-5247
HTTP Response Splitting in Puma
HIGH
CVE-2020-7595
libxml as used in Nokogiri has an infinite loop in a certain end-of-file situation
MEDIUM
CVE-2020-5243
Denial of Service in uap-core when processing crafted User-Agent strings
CRITICAL
CVE-2019-10780
BibTeX-Ruby vulnerable to OS command injection
HIGH
CVE-2020-5241
XSS/Script injection vulnerability in matestack
CRITICAL
CVE-2019-11325
Improper Input Validation in Symfony