Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Rack's multipart header parsing allows Denial of Service via escape-heavy quoted parameters CVE-2026-34827, GHSA-v6x5-cg8r-vv6x | High | Not scored | 02 Apr, 2026 | RubyGems rack |
Rack::Static prefix matching can expose unintended files under the static root CVE-2026-34785, GHSA-h2jq-g4cq-5ppq | High | Not scored | 02 Apr, 2026 | RubyGems rack |
Ruby LSP has arbitrary code execution through branch setting CVE-2026-34060, GHSA-c4r5-fxqw-vh93 | High | Not scored | 27 Mar, 2026 | RubyGems ruby-lsp |
MCP Ruby SDK: Insufficient Session Binding Allows SSE Stream Hijacking via Session ID Replay CVE-2026-33946, GHSA-qvqr-5cv7-wh35 | High | Not scored | 27 Mar, 2026 | RubyGems mcp |
Rails Active Storage has possible Path Traversal in DiskService CVE-2026-33195, GHSA-9xrj-h377-fr87 | High | Not scored | 23 Mar, 2026 | RubyGems activestorage |
Ruby JSON has a format string injection vulnerability CVE-2026-33210, GHSA-3m6g-2423-7cp3 | High | Not scored | 19 Mar, 2026 | RubyGems json |
sigstore-ruby verifier returns success for DSSE bundles with mismatched in-toto subject digest CVE-2026-31830, GHSA-mhg6-2q2v-9h2c | High | Not scored | 11 Mar, 2026 | RubyGems sigstore |
rubyipmi is vulnerable to OS Command Injection through malicious usernames CVE-2026-0980, GHSA-hfcp-477w-3wjw | High | Not scored | 27 Feb, 2026 | RubyGems rubyipmi |
Rack has a Directory Traversal via Rack:Directory CVE-2026-22860, GHSA-mxw3-3hh2-x2mh | High | Not scored | 17 Feb, 2026 | RubyGems rack |
Phlex XSS protection bypass via attribute splatting, dynamic tags, and href values GHSA-w67g-2h6v-vjgq | High | Not scored | 06 Feb, 2026 | RubyGems phlex |
Unauthenticated Spree Commerce users can access all guest addresses CVE-2026-25758, GHSA-87fh-rc96-6fr6 | High | Not scored | 05 Feb, 2026 | RubyGems spree_api |
Unauthenticated Spree Commerce users can view completed guest orders by Order ID CVE-2026-25757, GHSA-p6pv-q7rc-g4h9 | High | Not scored | 05 Feb, 2026 | RubyGems spree_storefront |
Decidim's private data exports can lead to data leaks CVE-2025-65017, GHSA-3cx6-j9j4-54mp | High | Not scored | 03 Feb, 2026 | RubyGems decidim RubyGems decidim-core |
fog-kubevirt allows remote attacker to perform MITM attack due to disabled certificate validation CVE-2026-1530, GHSA-m3hq-3qj8-c5fm | High | Not scored | 02 Feb, 2026 | RubyGems fog-kubevirt |
foreman_kubevirt disables SSL verification if a Certificate Authority (CA) certificate is not explicitly set CVE-2026-1531, GHSA-2qxw-7fmx-gqfm | High | Not scored | 02 Feb, 2026 | RubyGems foreman_kubevirt |
Cassandra Web - Remote File Read CVE-2020-36939, GHSA-8mfv-xhp5-48q9 | High | Not scored | 27 Jan, 2026 | RubyGems cassandra-web |
ActiveRecord-JDBC-Adapter (AR-JDBC) lib/arjdbc/jdbc/adapter.rb sql.gsub() Function SQL Injection GHSA-5qw5-wf2q-f538 | High | Not scored | 16 Jan, 2026 | RubyGems activerecord-jdbc-adapter |
Spree API has Unauthenticated IDOR - Guest Address CVE-2026-22589, GHSA-3ghg-3787-w2xr | High | Not scored | 08 Jan, 2026 | RubyGems spree_core |
Shakapacker has environment variable leak via EnvironmentPlugin that exposes secrets to client-side bundles GHSA-96qw-h329-v5rg | High | Not scored | 08 Jan, 2026 | RubyGems shakapacker npm shakapacker |
httparty Has Potential SSRF Vulnerability That Leads to API Key Leakage CVE-2025-68696, GHSA-hm5p-x4rq-38w4 | High | Not scored | 23 Dec, 2025 | RubyGems httparty |
MQTT does not validate hostnames CVE-2025-12790, GHSA-9c5q-w6gr-fxcq | High | Not scored | 06 Nov, 2025 | RubyGems mqtt |
Cross-Site Scripting (XSS) vulnerability through unescaped HTML attribute values CVE-2025-64501, GHSA-52c5-vh7f-26fx | High | Not scored | 06 Nov, 2025 | RubyGems prosemirror_to_html |
Rack is vulnerable to a memory-exhaustion DoS through unbounded URL-encoded body parsing CVE-2025-61919, GHSA-6xw4-3v39-52mm | High | Not scored | 10 Oct, 2025 | RubyGems rack |
Rack's multipart parser buffers unbounded per-part headers, enabling DoS (memory exhaustion) CVE-2025-61772, GHSA-wpv5-97wm-hp9c | High | Not scored | 07 Oct, 2025 | RubyGems rack |
Rack: Multipart parser buffers large non‑file fields entirely in memory, enabling DoS (memory exhaustion) CVE-2025-61771, GHSA-w9pc-fmgc-vxvw | High | Not scored | 07 Oct, 2025 | RubyGems rack |
Rack's unbounded multipart preamble buffering enables DoS (memory exhaustion) CVE-2025-61770, GHSA-p543-xpfm-54cp | High | Not scored | 07 Oct, 2025 | RubyGems rack |
Rack has an unsafe default in Rack::QueryParser allows params_limit bypass via semicolon-separated parameters CVE-2025-59830, GHSA-625h-95r8-8xpm | High | Not scored | 25 Sep, 2025 | RubyGems rack |
OpenC3 COSMOS Vulnerable to Directory Traversal via openc3-api/tables endpoint CVE-2025-28382, GHSA-cf8v-5mrc-jv7f, PYSEC-2025-256 | High | 0.9% | 13 Jun, 2025 | PyPI openc3 RubyGems openc3-cosmos-tool-iframe |
Rack has an Unbounded-Parameter DoS in Rack::QueryParser CVE-2025-46727, GHSA-gjh7-p2fx-99vx | High | Not scored | 08 May, 2025 | RubyGems rack |
Nokogiri updates packaged libxslt to v1.1.43 to resolve multiple CVEs CVE-2025-71406, GHSA-mrxw-mxhj-p664 | High | Not scored | 14 Mar, 2025 | RubyGems nokogiri |
Ruby SAML allows remote Denial of Service (DoS) with compressed SAML responses BIT-gitlab-2025-25293, CVE-2025-25293, GHSA-92rq-c8cf-prrq | High | Not scored | 12 Mar, 2025 | RubyGems ruby-saml |
Out-of-bounds Read in Ruby JSON Parser CVE-2025-27788, GHSA-9m3q-rhmv-5q44 | High | Not scored | 12 Mar, 2025 | RubyGems json |
Local File Inclusion in Rack::Static CVE-2025-27610, GHSA-7wqh-767x-r66v | High | Not scored | 10 Mar, 2025 | RubyGems rack |
Decidim-Awesome has SQL injection in AdminAccountability CVE-2024-43415, GHSA-cxwf-qc32-375f | High | Not scored | 12 Nov, 2024 | RubyGems decidim-decidim_awesome |
Autolab Misconfigured Reset Password Permissions CVE-2024-49376, GHSA-v46j-h43h-rwrm | High | Not scored | 25 Oct, 2024 | RubyGems Autolab |
OpenC3 Path Traversal via screen controller (`GHSL-2024-127`) CVE-2024-46977, GHSA-8jxr-mccc-mwg8, PYSEC-2024-101 | High | 0.9% | 02 Oct, 2024 | PyPI openc3 RubyGems openc3 |
Decidim has a cross-site scripting vulnerability in the version control page CVE-2024-41673, GHSA-cc4g-m3g7-xmw8 | High | Not scored | 01 Oct, 2024 | RubyGems decidim |
Heap-based Buffer Overflow in sqlite-vec CVE-2024-46488, GHSA-vrcx-gx3g-j3h8, PYSEC-2026-1938 | High | 0.4% | 25 Sep, 2024 | PyPI sqlite-vec RubyGems sqlite-vec crates.io sqlite-vec npm sqlite-vec |
HTTP Request Smuggling in ruby webrick CVE-2024-47220, GHSA-6f62-3596-g6w7 | High | Not scored | 22 Sep, 2024 | RubyGems webrick |
protobuf-java has potential Denial of Service issue CVE-2024-7254, GHSA-735f-pc8j-v9w8 | High | Not scored | 19 Sep, 2024 | Maven com.google.protobuf:protobuf-java Maven com.google.protobuf:protobuf-javalite Maven com.google.protobuf:protobuf-kotlin Maven com.google.protobuf:protobuf-kotlin-lite +1 more |
Camaleon CMS vulnerable to remote code execution through code injection (GHSL-2024-185) GHSA-7x4w-cj9r-h4v9 | High | Not scored | 18 Sep, 2024 | RubyGems camaleon_cms |
Camaleon CMS vulnerable to arbitrary path traversal (GHSL-2024-183) CVE-2024-46987, GHSA-cp65-5m9r-vc2c | High | Not scored | 18 Sep, 2024 | RubyGems camaleon_cms |
Camaleon CMS affected by arbitrary file write to RCE (GHSL-2024-182) CVE-2024-46986, GHSA-wmjg-vqhv-q5p5 | High | Not scored | 18 Sep, 2024 | RubyGems camaleon_cms |
REXML denial of service vulnerability CVE-2024-43398, GHSA-vmwr-mc7x-5vc3 | High | Not scored | 22 Aug, 2024 | RubyGems rexml |
activeadmin vulnerable to stored persistent cross-site scripting (XSS) in dynamic form legends CVE-2024-37031, GHSA-9mg6-x45v-hcfm | High | Not scored | 02 Jun, 2024 | RubyGems activeadmin |
rack-contrib vulnerable to Denial of Service due to the unconstrained value of the incoming "profiler_runs" parameter CVE-2024-35231, GHSA-8c8q-2xw3-j869 | High | Not scored | 28 May, 2024 | RubyGems rack-contrib |
Phlex vulnerable to Cross-site Scripting (XSS) via maliciously formed HTML attribute names and values CVE-2024-32970, GHSA-9p57-h987-4vgx | High | Not scored | 01 May, 2024 | RubyGems phlex |
Cross-site Scripting (XSS) possible due to improper sanitisation of `href` attributes on `<a>` tags CVE-2024-32463, GHSA-g7xq-xv8c-h98c | High | Not scored | 17 Apr, 2024 | RubyGems phlex |
TurboBoost Commands vulnerable to arbitrary method invocation CVE-2024-28181, GHSA-mp76-7w5v-pr75 | High | 0.8% | 14 Mar, 2024 | RubyGems turbo_boost-commands npm @turbo-boost/commands |
StimulusReflex arbitrary method call CVE-2024-28121, GHSA-f78j-4w3g-4q65 | High | 1.6% | 12 Mar, 2024 | RubyGems stimulus_reflex npm stimulus_reflex |