Browse CVEs by Ecosystem and Severity
797 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.
MEDIUM
CVE-2020-8167
CSRF Vulnerability in rails-ujs
MEDIUM
CVE-2020-8185
Untrusted users can run pending migrations in production in Rails
MEDIUM
CVE-2020-11077
HTTP Smuggling via Transfer-Encoding Header in Puma
MEDIUM
CVE-2020-11023KEV
Potential XSS vulnerability in jQuery
MEDIUM
CVE-2020-11022
Potential XSS vulnerability in jQuery
MEDIUM
CVE-2020-5268
Subject Confirmation Method not validated in Saml2 Authentication Services for ASP.NET
MEDIUM
CVE-2020-7598EPSS 0.3%
Prototype Pollution in minimist
MEDIUM
CVE-2020-5249
HTTP Response Splitting (Early Hints) in Puma
MEDIUM
CVE-2020-5247
HTTP Response Splitting in Puma
MEDIUM
CVE-2020-5243
Denial of Service in uap-core when processing crafted User-Agent strings
MEDIUM
CVE-2020-5234
Untrusted data can lead to DoS attack due to hash collisions and stack overflow in MessagePack
MEDIUM
CVE-2019-16782
Possible Information Leak / Session Hijack Vulnerability in Rack
MEDIUM
CVE-2019-16779
In RubyGem excon, interrupted Persistent Connections May Leak Response Data
MEDIUM
CVE-2019-1010266
Regular Expression Denial of Service (ReDoS) in lodash
MEDIUM
CVE-2019-11358
XSS in jQuery as used in Drupal, Backdrop CMS, and other products
MEDIUM
CVE-2019-0746
Microsoft.ChakraCore vulnerable to Exposure of Sensitive Information to an Unauthorized Actor
MEDIUM
CVE-2019-9837
Doorkeeper-openid_connect contains Open Redirect
MEDIUM
CVE-2019-8331
Bootstrap Vulnerable to Cross-Site Scripting
MEDIUM
CVE-2018-20677
bootstrap Cross-site Scripting vulnerability
MEDIUM
CVE-2018-20676
XSS vulnerability that affects bootstrap
MEDIUM
CVE-2016-10735
Bootstrap Cross-site Scripting vulnerability
MEDIUM
CVE-2018-1000855
Cross Site Scripting (XSS) vulnerability in easymon
MEDIUM
CVE-2018-1000842
Fat Free CRM vulnerable to Cross-site Scripting
MEDIUM
CVE-2018-16477
Exposure of Sensitive Information to an Unauthorized Actor in activestorage
MEDIUM
CVE-2017-1000043
Content Injection via TileJSON Name in mapbox.js
MEDIUM
CVE-2017-1000042
Content Injection via TileJSON attribute in mapbox.js
MEDIUM
CVE-2017-0256
Moderate severity vulnerability that affects Microsoft.AspNetCore.Mvc
MEDIUM
CVE-2018-14042
Bootstrap Cross-site Scripting vulnerability
MEDIUM
CVE-2018-14041
Bootstrap Cross-site Scripting vulnerability
MEDIUM
CVE-2015-1866
ember-source vulnerable to Cross-site Scripting
MEDIUM
CVE-2015-7565
ember-source Cross-site Scripting vulnerability
MEDIUM
CVE-2018-11627
Sinatra Cross-site Scripting vulnerability
MEDIUM
CVE-2018-3741
rails-html-sanitizer Cross-site Scripting vulnerability
MEDIUM
CVE-2017-18258
Uncontrolled resource consumption in nokogiri
MEDIUM
CVE-2018-1000088
Doorkeeper is vulnerable to stored XSS and code execution
MEDIUM
CVE-2015-1828
http vulnerable to Exposure of Sensitive Information to an Unauthorized Actor
MEDIUM
CVE-2018-1000119
rack-protection gem timing attack vulnerability when validating CSRF token
MEDIUM
CVE-2017-12097
delayed_job_web Cross-site Scripting vulnerability
MEDIUM
CVE-2017-17718
net-ldap Improper Certificate Validation vulnerability
MEDIUM
CVE-2017-16833
Gemirro Stored XSS in Gemspec "homepage" value
MEDIUM
CVE-2015-7578
rails-html-sanitizer Cross-site Scripting vulnerability
MEDIUM
CVE-2015-7580
rails-html-sanitizer Cross-site Scripting vulnerability
MEDIUM
CVE-2015-7579
rails-html-sanitizer Cross-site Scripting vulnerability
MEDIUM
CVE-2014-2538
rack-ssl Cross-site Scripting vulnerability
MEDIUM
CVE-2016-7103
jQuery-UI vulnerable to Cross-site Scripting in dialog closeText
MEDIUM
CVE-2016-6316
actionview Cross-site Scripting vulnerability
MEDIUM
CVE-2016-2097
actionview contains Path Traversal vulnerability