Browse CVEs by Ecosystem and Severity
5,778 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.
HIGH
CVE-2018-17567
Jekyll allows attackers to access arbitrary files by specifying a symlink
HIGH
CVE-2015-8806
Denial of service or RCE from libxml2 and libxslt
HIGH
CVE-2018-20993
Uncontrolled recursion leads to abort in deserialization
MEDIUM
CVE-2018-14042
Bootstrap Cross-site Scripting vulnerability
MEDIUM
CVE-2018-14041
Bootstrap Cross-site Scripting vulnerability
CRITICAL
CVE-2018-1000544
Rubyzip gem contains a Directory Traversal vulnerability in zip file component
HIGH
CVE-2018-1000201
Ruby-ffi has a DLL loading issue
MEDIUM
CVE-2015-1866
ember-source vulnerable to Cross-site Scripting
HIGH
CVE-2015-4619
Spina gem vulnerable to Cross-site request forgery (CSRF) vulnerability
MEDIUM
CVE-2015-7565
ember-source Cross-site Scripting vulnerability
CRITICAL
CVE-2016-4658
Nokogiri does not forbid namespace nodes in XPointer ranges
HIGH
CVE-2016-5697
Ruby-saml allows attackers to perform XML signature wrapping attacks
HIGH
CVE-2016-10345
Phusion Passenger uses a known /tmp filename
CRITICAL
CVE-2015-8969
Git-fastclone passes user modifiable strings directly to a shell command
HIGH
CVE-2015-8968
git-fastclone permits arbitrary shell command execution from .gitmodules
CRITICAL
CVE-2015-1820
rest-client Gem Vulnerable to Session Fixation
HIGH
CVE-2018-1000211
Doorkeeper subject to Incorrect Permission Assignment
HIGH
CVE-2016-10522
Cross-site request forgery in rails_admin
CRITICAL
CVE-2018-3777
restforce vulnerable to Improper Input Validation
HIGH
CVE-2017-5029
Nokogiri implementation of libxslt lacks integer overflow checks
HIGH
CVE-2017-11173
Missing Regex anchor in Rack-Cors allows malicious third party site to perform CORS request
CRITICAL
CVE-2017-16082
Remote Code Execution in pg
HIGH
CVE-2014-5001
Kcapifony gem for Ruby places database user passwords on the command line
CRITICAL
CVE-2018-7750
Paramiko not properly checking authentication before processing other requests
HIGH
CVE-2018-20990
Links in archives can overwrite any existing file
HIGH
CVE-2018-20989
An integer underflow could lead to panic
HIGH
CVE-2018-3760
Sprockets path traversal leads to information leak
MEDIUM
CVE-2018-11627
Sinatra Cross-site Scripting vulnerability
MEDIUM
CVE-2018-3741
rails-html-sanitizer Cross-site Scripting vulnerability
MEDIUM
CVE-2017-18258
Uncontrolled resource consumption in nokogiri
HIGH
CVE-2018-3740
Sanitize vulnerable to Improper Input Validation and Cross-site Scripting
HIGH
CVE-2014-4992
Cap-Strap gem for Ruby places credentials on the useradd command line
MEDIUM
CVE-2018-1000088
Doorkeeper is vulnerable to stored XSS and code execution
MEDIUM
CVE-2015-1828
http vulnerable to Exposure of Sensitive Information to an Unauthorized Actor
MEDIUM
CVE-2018-1000119
rack-protection gem timing attack vulnerability when validating CSRF token
CRITICAL
CVE-2015-4412
bson is vulnerable to denial of service due to incorrect regex validation
HIGH
CVE-2014-5004
brbackup exposes database password to unauthorized users
MEDIUM
CVE-2017-12097
delayed_job_web Cross-site Scripting vulnerability
HIGH
CVE-2017-18076
Omniauth allows POST parameters to be stored in session
HIGH
CVE-2014-5002
lynx doesn't properly sanitize user input and exposes database password to unauthorized users
HIGH
CVE-2014-5000
lawn-login exposes database password to unauthorized users
HIGH
CVE-2016-10707
Denial of Service in jquery
CRITICAL
CVE-2017-0889
paperclip Server-Side Request Forgery vulnerability
MEDIUM
CVE-2017-17718
net-ldap Improper Certificate Validation vulnerability
HIGH
CVE-2017-17042
Arbitrary file read vulnerability in yard server
HIGH
CVE-2017-9050
Out-of-bounds read in nokogiri
CRITICAL
CVE-2017-0905
Recurly gem Server-Side Request Forgery in Resource#find method
CRITICAL
CVE-2017-1000248
redis-store deserializes untrusted data
MEDIUM
CVE-2017-16833
Gemirro Stored XSS in Gemspec "homepage" value
HIGH
CVE-2017-16516
yajl-ruby gem Denial of Service vulnerability