Search Vulnerabilities

Decidim's private data exports can lead to data leaks

foreman_kubevirt disables SSL verification if a Certificate Authority (CA) certificate is not explicitly set

fog-kubevirt allows remote attacker to perform MITM attack due to disabled certificate validation

AlchemyCMS: Authenticated Remote Code Execution (RCE) via eval injection in ResourcesHelper

Active Job - Object injection security vulnerability

ActiveRecord-JDBC-Adapter (AR-JDBC) lib/arjdbc/jdbc/adapter.rb sql.gsub() Function SQL Injection

openc3-api Vulnerable to Unauthenticated Remote Code Execution

Spree API has Unauthenticated IDOR - Guest Address

Spree API has Authenticated Insecure Direct Object Reference (IDOR) via Order Modification

Shakapacker has environment variable leak via EnvironmentPlugin that exposes secrets to client-side bundles

Trix has a stored XSS vulnerability through its attachment attribute

URI Credential Leakage Bypass over CVE-2025-27221

httparty Has Potential SSRF Vulnerability That Leads to API Key Leakage

Malicious code in verificator (RubyGems)

Malicious code in u2f_client (RubyGems)

Malicious code in stripe-server (RubyGems)

Malicious code in test_gem_978483406ebb19126a2e8c001649a4eb (RubyGems)

Malicious code in stripe-rubocop (RubyGems)

Malicious code in sq-samsa (RubyGems)

Malicious code in stripe-backup (RubyGems)