Browse CVEs by Ecosystem and Severity
797 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.
MEDIUM
CVE-2018-1000078
RubyGems Cross-site Scripting vulnerability
MEDIUM
CVE-2017-10689
Tarball permission preservation in puppet
MEDIUM
CVE-2016-10362
Logstash Logs Sensitive Information
MEDIUM
CVE-2017-14506
Gem in a Box vulnerable to Cross-site Scripting
MEDIUM
CVE-2018-14040
Bootstrap vulnerable to Cross-Site Scripting (XSS)
MEDIUM
CVE-2018-18260
Camaleon CMS vulnerable to Stored Cross-site Scripting
MEDIUM
CVE-2013-6460
Nokogiri vulnerable to DoS while parsing XML documents
MEDIUM
CVE-2013-6461
Nokogiri vulnerable to DoS while parsing XML entities
MEDIUM
CVE-2022-27777
XSS Vulnerability in Action View tag helpers
MEDIUM
CVE-2022-22577
Cross-site Scripting Vulnerability in Action Pack
MEDIUM
CVE-2022-24849
Exposure of Sensitive Information to an Unauthorized Actor in DisCatSharp
MEDIUM
CVE-2011-1497
Cross site scripting in actionpack Rubygem
MEDIUM
CVE-2020-2023
Improper Privilege Management and Execution with Unnecessary Privileges in Kata Containers
MEDIUM
CVE-2022-22818EPSS 0.6%
Cross-site Scripting in Django
MEDIUM
CVE-2022-0274
Cross-site Scripting OrchardCore.Application.Cms.Targets
MEDIUM
CVE-2021-45452EPSS 0.3%
Directory-traversal in Django
MEDIUM
CVE-2020-28500EPSS 0.2%
Regular Expression Denial of Service (ReDoS) in lodash
MEDIUM
CVE-2021-43846
CSRF forgery protection bypass in solidus_frontend
MEDIUM
CVE-2021-44832EPSS 53.6%
Improper Input Validation and Injection in Apache Log4j2
MEDIUM
CVE-2021-44528
actionpack Open Redirect in Host Authorization Middleware
MEDIUM
CVE-2021-44420EPSS 0.1%
Potential bypass of an upstream access control based on URL paths in Django
MEDIUM
CVE-2021-43809
Local Code Execution through Argument Injection via dash leading git url parameter in Gemfile.
MEDIUM
CVE-2021-27025
Silent Configuration Failure in Puppet Agent
MEDIUM
CVE-2021-27023
Unsafe HTTP Redirect in Puppet Agent and Puppet Server
MEDIUM
CVE-2021-41263
Rails Multisite secure/signed cookies share secrets between sites in a multi-site application
MEDIUM
CVE-2021-25973
Publify `guest` role users can self-register even when the admin does not allow it
MEDIUM
CVE-2024-21910
Cross-site scripting vulnerability in TinyMCE plugins
MEDIUM
CVE-2021-41183
XSS in `*Text` options of the Datepicker widget in jquery-ui
MEDIUM
CVE-2021-41184
XSS in the `of` option of the `.position()` util in jquery-ui
MEDIUM
CVE-2021-41182
XSS in the `altField` option of the Datepicker widget in jquery-ui
MEDIUM
CVE-2024-21908
Cross-site scripting vulnerability in TinyMCE
MEDIUM
CVE-2021-39197
Older releases of better_errors open to Cross-Site Request Forgery attack
MEDIUM
CVE-2021-23343EPSS 0.3%
Regular Expression Denial of Service in path-parse
MEDIUM
CVE-2020-9472
Unrestricted Upload of File with Dangerous Type in Umbraco CMS
MEDIUM
CVE-2020-8867
Insufficient Session Expiration and TOCTOU Race Condition in OPC FOundation UA .Net Standard
MEDIUM
CVE-2021-28833
qiita-markdown Cross-site Scripting vulnerability
MEDIUM
CVE-2021-33203EPSS 0.3%
Path Traversal in Django
MEDIUM
CVE-2021-32052EPSS 2.6%
Header injection possible in Django
MEDIUM
CVE-2021-22903
Possible Open Redirect Vulnerability in Action Pack
MEDIUM
CVE-2020-25739
Gon gem lack of escaping certain input when outputting as JSON
MEDIUM
CVE-2020-5811
Authenticated path traversal in Umbraco CMS
MEDIUM
CVE-2020-24393
Improper Certificate Validation in TweetStream
MEDIUM
CVE-2020-7942
Improper Certificate Validation in Puppet
MEDIUM
CVE-2021-28658EPSS 1.5%
Directory Traversal in Django
MEDIUM
CVE-2020-24392
Improper Certificate Validation in twitter-stream
MEDIUM
CVE-2020-24584EPSS 3.3%
Django Incorrect Default Permissions
MEDIUM
CVE-2021-3281EPSS 36.2%
Django Directory Traversal via archive.extract
MEDIUM
CVE-2020-26298
Injection/XSS in Redcarpet
MEDIUM
CVE-2020-15237
Possible timing attack in derivation_endpoint
MEDIUM
CVE-2020-15109
Ability to change order address without triggering address validations in solidus