Browse CVEs by Ecosystem and Severity
2,578 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.
CRITICAL
CVE-2018-19362
com.fasterxml.jackson.core:jackson-databind vulnerable to Deserialization of Untrusted Data
CRITICAL
CVE-2018-14718
Arbitrary Code Execution in jackson-databind
CRITICAL
CVE-2018-18476
mysql-bunuuid-rails vulnerable to SQL injection
CRITICAL
CVE-2018-1260
Spring Security OAuth vulnerable to remote code execution (RCE)
CRITICAL
CVE-2017-15095
jackson-databind vulnerable to deserialization flaw leading to unauthenticated remote code execution
CRITICAL
CVE-2018-8014
The defaults settings for the CORS filter provided in Apache Tomcat are insecure and enable 'supportsCredentials' for all origins
CRITICAL
CVE-2015-2794
The installation wizard in DotNetNuke (DNN) allows privilege escalation
CRITICAL
CVE-2018-7489
FasterXML jackson-databind allows unauthenticated remote code execution
CRITICAL
CVE-2018-14643
smart_proxy_dynflow gem authentication bypass in Foreman remote execution feature
CRITICAL
CVE-2018-1000544
Rubyzip gem contains a Directory Traversal vulnerability in zip file component
CRITICAL
CVE-2016-4658
Nokogiri does not forbid namespace nodes in XPointer ranges
CRITICAL
CVE-2015-8969
Git-fastclone passes user modifiable strings directly to a shell command
CRITICAL
CVE-2015-1820
rest-client Gem Vulnerable to Session Fixation
CRITICAL
CVE-2018-3777
restforce vulnerable to Improper Input Validation
CRITICAL
CVE-2017-16082
Remote Code Execution in pg
CRITICAL
CVE-2018-7750
Paramiko not properly checking authentication before processing other requests
CRITICAL
CVE-2015-4412
bson is vulnerable to denial of service due to incorrect regex validation
CRITICAL
CVE-2017-0889
paperclip Server-Side Request Forgery vulnerability
CRITICAL
CVE-2017-0905
Recurly gem Server-Side Request Forgery in Resource#find method
CRITICAL
CVE-2017-1000248
redis-store deserializes untrusted data
CRITICAL
CVE-2009-2422
rails vulnerable to improper authentication
CRITICAL
CVE-2015-8857
Incorrect Handling of Non-Boolean Comparisons During Minification in uglify-js
CRITICAL
CVE-2015-7541
colorscore Command Injection vulnerability
CRITICAL
CVE-2016-6582
Doorkeeper is vulnerable to replay attacks
CRITICAL
CVE-2016-10193
espeak-ruby allows arbitrary command execution
CRITICAL
CVE-2017-7540
Safemode Gem Has Incomplete List of Disallowed Inputs
CRITICAL
CVE-2016-10194
festivaltts4r allows arbitrary command execution
CRITICAL
CVE-2017-5946
Directory traversal vulnerability in RubyZip