Feed live

The CMS vulnerability ledger.

Every published CVE that touches a CMS, plugin, theme, or page builder — indexed, scored, and cross-referenced against the components running on your sites.

Total CVEs tracked

335,499

All time

Critical · Active

10,538

CVSS ≥ 9.0

New · 14 days

707

Newly disclosed

Feed last synced

4 hrs ago

Data freshness

Showing 1–30 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-45758	critical	9.6/10	Malicious code in guardrails-ai 0.10.1 (supply chain compromise)	Jun 5, 2026 21d ago
CVE-2026-33658	low	2.3/10	Rails Active Storage has a possible DoS vulnerability in proxy mode via multi-range requests	Mar 26, 2026 3mo ago
CVE-2026-33202	medium	6.6/10	Rails Active Storage has possible glob injection in its DiskService	Mar 23, 2026 3mo ago
CVE-2026-33195	high	8.0/10	Rails Active Storage has possible Path Traversal in DiskService	Mar 23, 2026 3mo ago
CVE-2026-33176	medium	6.6/10	Rails Active Support has a possible DoS vulnerability in its number helpers	Mar 23, 2026 3mo ago
CVE-2026-33174	medium	6.6/10	Rails Active Storage has a possible DoS vulnerability when in proxy mode via Range requests	Mar 23, 2026 3mo ago
CVE-2026-33173	medium	5.3/10	Rails Active Storage has possible content type bypass via metadata in direct uploads	Mar 23, 2026 3mo ago
CVE-2026-33170	medium	5.3/10	Rails Active Support has a possible XSS vulnerability in SafeBuffer#%	Mar 23, 2026 3mo ago
CVE-2026-33169	medium	6.9/10	Rails Active Support has a possible ReDoS vulnerability in number_to_delimited	Mar 23, 2026 3mo ago
CVE-2026-33168	low	2.3/10	Rails has a possible XSS vulnerability in its Action View tag helpers	Mar 23, 2026 3mo ago
CVE-2026-33167	low	1.3/10	Rails has a possible XSS vulnerability in its Action Pack debug exceptions	Mar 23, 2026 3mo ago
CVE-2026-25540	medium	6.5/10	Mastodon's signature-dependent ActivityPub collection responses cached under signature-independent keys (Web Cache Poisoning via `Rails.cache`)	Feb 4, 2026 4mo ago
CVE-2025-58067	medium	4.2/10	Basecamp's Google Sign-In for Rails allowed redirects to protocol-relative URI	Aug 29, 2025 10mo ago
CVE-2025-57821	medium	4.2/10	Basecamp's Google Sign-In for Rails allowed redirects to a malformed URL	Aug 27, 2025 10mo ago
CVE-2024-53985	low	2.3/10	Possible XSS vulnerability with certain configurations of rails-html-sanitizer 1.6.0	Dec 2, 2024 1y ago
CVE-2024-53987	low	2.3/10	Possible XSS vulnerability with certain configurations of rails-html-sanitizer 1.6.0	Dec 2, 2024 1y ago
CVE-2024-53986	low	2.3/10	Possible XSS vulnerability with certain configurations of rails-html-sanitizer 1.6.0	Dec 2, 2024 1y ago
CVE-2024-53988	low	2.3/10	Possible XSS vulnerability with certain configurations of rails-html-sanitizer 1.6.0	Dec 2, 2024 1y ago
CVE-2024-53989	low	2.3/10	Possible XSS vulnerability with certain configurations of rails-html-sanitizer 1.6.0	Dec 2, 2024 1y ago
CVE-2024-6961	medium	5.9/10	XXE in Guardrails AI when consuming RAIL documents	Jul 21, 2024 1y ago
CVE-2024-39308	medium	6.8/10	RailsAdmin Cross-site Scripting vulnerability in the list view	Jul 8, 2024 1y ago
CVE-2024-26143	medium	6.1/10	Rails Possible XSS Vulnerability in Action Controller	Feb 27, 2024 2y ago
CVE-2024-26142	high	7.5/10	Rails possible ReDoS vulnerability in Accept header parsing in Action Dispatch	Feb 27, 2024 2y ago
CVE-2024-0241	—	—	encoded_id-rails Denial of Service Vulnerability	Jan 4, 2024 2y ago
CVE-2023-46131	medium	6.5/10	Grails® data binding causes JVM crash and/or DoS	Dec 20, 2023 2y ago
CVE-2023-28846	medium	5.9/10	Denial of Service in unpoly-rails	Mar 30, 2023 3y ago
CVE-2015-10083	medium	6.3/10	harrystech Dynosaur-Rails application_controller.rb basic_auth improper authentication	Feb 21, 2023 3y ago
CVE-2014-125054	medium	4.3/10	koroket RedditOnRails Vote access control	Jan 7, 2023 3y ago
CVE-2014-125033	low	3.5/10	rails-cv-app uploaded_files_controller.rb path traversal	Jan 2, 2023 3y ago
CVE-2022-23520	medium	6.1/10	rails-html-sanitizer contains an incomplete fix for an XSS vulnerability	Dec 14, 2022 3y ago