Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in hyper-sharp-box (RubyGems) MAL-2026-15709 | Malicious | Not scored | 24 Aug, 2026 | RubyGems hyper-sharp-box |
Malicious release: Malicious code in hyper-safe-kit (RubyGems) MAL-2026-15708 | Malicious | Not scored | 24 Aug, 2026 | RubyGems hyper-safe-kit |
Malicious release: Malicious code in hyper-safe-hub (RubyGems) MAL-2026-15707 | Malicious | Not scored | 24 Aug, 2026 | RubyGems hyper-safe-hub |
Malicious release: Malicious code in hyper-pro-kit (RubyGems) MAL-2026-15705 | Malicious | Not scored | 24 Aug, 2026 | RubyGems hyper-pro-kit |
Malicious release: Malicious code in hyper-quick-kit (RubyGems) MAL-2026-15706 | Malicious | Not scored | 24 Aug, 2026 | RubyGems hyper-quick-kit |
Malicious release: Malicious code in hyper-lite-tool (RubyGems) MAL-2026-15704 | Malicious | Not scored | 24 Aug, 2026 | RubyGems hyper-lite-tool |
Malicious release: Malicious code in giga-sharp-tool (RubyGems) MAL-2026-15703 | Malicious | Not scored | 24 Aug, 2026 | RubyGems giga-sharp-tool |
Malicious release: Malicious code in giga-safe-hub (RubyGems) MAL-2026-15702 | Malicious | Not scored | 24 Aug, 2026 | RubyGems giga-safe-hub |
Malicious release: Malicious code in giga-quick-rb (RubyGems) MAL-2026-15701 | Malicious | Not scored | 24 Aug, 2026 | RubyGems giga-quick-rb |
Malicious release: Malicious code in giga-pure-kit (RubyGems) MAL-2026-15700 | Malicious | Not scored | 24 Aug, 2026 | RubyGems giga-pure-kit |
Malicious release: Malicious code in giga-max-kit (RubyGems) MAL-2026-15698 | Malicious | Not scored | 24 Aug, 2026 | RubyGems giga-max-kit |
Malicious release: Malicious code in giga-max-mod (RubyGems) MAL-2026-15699 | Malicious | Not scored | 24 Aug, 2026 | RubyGems giga-max-mod |
Malicious release: Malicious code in giga-clean-kit (RubyGems) MAL-2026-15696 | Malicious | Not scored | 24 Aug, 2026 | RubyGems giga-clean-kit |
Malicious release: Malicious code in giga-clean-pkg (RubyGems) MAL-2026-15697 | Malicious | Not scored | 24 Aug, 2026 | RubyGems giga-clean-pkg |
Malicious release: Malicious code in giga-clean-box (RubyGems) MAL-2026-15695 | Malicious | Not scored | 24 Aug, 2026 | RubyGems giga-clean-box |
Malicious release: Malicious code in circle-w3s (RubyGems) MAL-2026-15694 | Malicious | Not scored | 24 Aug, 2026 | RubyGems circle-w3s |
kobako Sandbox Escape: guest eval reaches host RCE via method_missing → public_send (any bound Service) CVE-2026-55107, GHSA-7pwq-q9jf-539h | Critical | 0.8% | 18 Aug, 2026 | RubyGems kobako |
Ruby JSON: JSON::ResumableParser#partial_value dereferences a freed input buffer and crashes on truncated duplicate-key streams CVE-2026-71847, GHSA-9hj4-r449-hfvc | Low | 0.4% | 07 Aug, 2026 | RubyGems json |
guard-livereload has a directory traversal vulnerability CVE-2016-1000305, GHSA-g65v-27r3-5p6m | Medium | Not scored | 31 Jul, 2026 | RubyGems guard-livereload |
Savon::Model evaluates WSDL operation names as Ruby source CVE-2026-53510, GHSA-mx5j-mp4f-g8jg | High | 0.7% | 31 Jul, 2026 | RubyGems savon |
Active Storage has possible arbitrary file read and remote code execution in Active Storage variant processing CVE-2026-66066, GHSA-xr9x-r78c-5hrm | Critical | 30.1% | 30 Jul, 2026 | RubyGems activestorage |
MessagePack::Buffer#clear Use-After-Free that Enables Cross-Buffer Disclosure CVE-2026-54522, GHSA-4mrv-5p47-p938 | Low | 0.2% | 30 Jul, 2026 | RubyGems msgpack |
MCP Ruby SDK: Ruby SSE Session Poisoning CVE-2026-67431, GHSA-5p9g-j988-pcwv | High | 0.4% | 30 Jul, 2026 | RubyGems mcp |
MCP Ruby SDK: Unbounded JSON-RPC request body causes uncontrolled memory allocation in StreamableHTTPTransport CVE-2026-67432, GHSA-h669-8m4g-r2hc | High | 0.8% | 30 Jul, 2026 | RubyGems mcp |
MCP Ruby SDK: Unbounded session retention in StreamableHTTPTransport allows memory exhaustion via initialize flood CVE-2026-67430, GHSA-52jp-gj8w-j6xh | Medium | 0.4% | 30 Jul, 2026 | RubyGems mcp |
MCP Ruby SDK: Unbounded line buffer in stdio transports leads to memory exhaustion (DoS) CVE-2026-63119, GHSA-7683-3w9x-ch42 | Medium | 0.2% | 30 Jul, 2026 | RubyGems mcp |
MCP Ruby SDK: Streamable HTTP transport lacks DNS-rebinding (Host/Origin) protection CVE-2026-63118, GHSA-rjr6-rcgv-9m7m | Medium | 0.2% | 30 Jul, 2026 | RubyGems mcp |
ActiveRecord::Tenanted::Storage::DiskService#path_for has a possible path traversal GHSA-pmwx-rm49-xv39 | Low | Not scored | 29 Jul, 2026 | RubyGems activerecord-tenanted |
Pagy I18n locale option is not validated before being used in a file path CVE-2026-54659, GHSA-2xmw-f8j8-wfxc | Medium | 0.4% | 28 Jul, 2026 | RubyGems pagy |
OAuth2::Client#request: Protocol-relative redirect Location overrides authority, leaking bearer Authorization to attacker host CVE-2026-54603, GHSA-pp92-crg2-gfv9 | High | 0.4% | 28 Jul, 2026 | RubyGems oauth2 |
OAuth: Cross-origin token-request redirects can expose signed request metadata CVE-2026-54605, GHSA-prq8-7wvh-44qh | High | 0.2% | 28 Jul, 2026 | RubyGems oauth |
sqlite3-ruby has Use-After-Free in SQLite Aggregate Function Callbacks CVE-2026-54620, GHSA-j7fr-3v8c-3qc3 | Low | 0.1% | 28 Jul, 2026 | RubyGems sqlite3 RubyGems sqlite3-ruby |
sqlite3-ruby has Use-After-Free When Redefining SQLite Functions with Different Arity CVE-2026-54619, GHSA-28hh-pr2h-2w89 | Low | 0.1% | 28 Jul, 2026 | RubyGems sqlite3 RubyGems sqlite3-ruby |
Trix: Stored XSS via HTMLParser attribute injection on paste CVE-2026-73428, GHSA-53g2-mvcc-q9x3 | Medium | 0.4% | 24 Jul, 2026 | RubyGems action_text-trix npm trix |
Ruby json: JSON generator heap buffer overflow when streaming to an IO CVE-2026-54696, GHSA-x2f5-4prf-w687 | Low | 0.4% | 23 Jul, 2026 | RubyGems json |
Rails HTML Sanitizers: Possible XSS vulnerability with certain configurations CVE-2026-73648, GHSA-cj75-f6xr-r4g7 | Medium | 0.5% | 21 Jul, 2026 | RubyGems rails-html-sanitizer |
Loofah `allowed_uri?` does not detect `javascript:` URIs split by numeric character references without semicolons CVE-2026-73492, GHSA-5qhf-9phg-95m2 | Low | 0.4% | 21 Jul, 2026 | RubyGems loofah |
Loofah: SVG `href` attribute bypasses local-reference restriction CVE-2026-73490, GHSA-9wjq-cp2p-hrgf | Medium | 0.3% | 21 Jul, 2026 | RubyGems loofah |
websocket-driver-ruby: Denial of service via malformed Host header CVE-2026-61666, GHSA-2x63-gw47-w4mm | High | 0.4% | 21 Jul, 2026 | RubyGems websocket-driver |
Loofah `allowed_uri?` does not detect `javascript:` URIs split by named whitespace character references CVE-2026-73491, GHSA-8whx-365g-h9vv | Low | 0.4% | 21 Jul, 2026 | RubyGems loofah |
Malicious release: Malicious code in my_shoaib_gem (RubyGems) MAL-2026-10914 | Malicious | Not scored | 20 Jul, 2026 | RubyGems my_shoaib_gem |
Malicious release: Malicious code in ike-artifactory-ruby (RubyGems) MAL-2026-10913 | Malicious | Not scored | 20 Jul, 2026 | RubyGems ike-artifactory-ruby |
dd-trace-rb: Improper parsing of W3C baggage headers may lead to DoS CVE-2026-50276, GHSA-p5f6-rccc-jv98 | High | 0.8% | 15 Jul, 2026 | RubyGems datadog |
ViewComponent: Reused Component Instances Retain Stale Render Context CVE-2026-54497, GHSA-9h85-g7w3-rh49 | Medium | 0.3% | 15 Jul, 2026 | RubyGems view_component |
ViewComponent: around_render HTML-Safety Bypass CVE-2026-54498, GHSA-97jw-64cj-jc58 | High | 0.5% | 15 Jul, 2026 | RubyGems view_component |
websocket-driver: Memory exhaustion in HTTP header parser CVE-2026-54465, GHSA-8j3g-f24p-4mpw | Medium | 0.5% | 15 Jul, 2026 | RubyGems websocket-driver |
websocket-driver: Resource limit bypass via message compression CVE-2026-54464, GHSA-33ph-fccm-39pj | Medium | 0.4% | 15 Jul, 2026 | RubyGems websocket-driver |
websocket-driver: Memory exhaustion via abuse of protocol length headers CVE-2026-54463, GHSA-ghhp-3qvg-889p | Medium | 0.5% | 15 Jul, 2026 | RubyGems websocket-driver |
Decidim: Push subscriptions can be abused for server-side requests CVE-2026-45573, GHSA-2g9c-vf8h-prxx | Medium | 0.3% | 13 Jul, 2026 | RubyGems decidim-core |
Decidim: HTML content blocks allow stored script execution CVE-2026-45572, GHSA-533c-2vh9-4r86 | Medium | 0.3% | 13 Jul, 2026 | RubyGems decidim-core |