Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
net-imap vulnerable to command Injection via unvalidated Symbol inputs CVE-2026-42258, GHSA-75xq-5h9v-w6px | Medium | Not scored | 04 May, 2026 | RubyGems net-imap |
net-imap vulnerable to denial of service via high iteration count for `SCRAM-*` authentication CVE-2026-42256, GHSA-87pf-fpwv-p7m7 | Medium | Not scored | 04 May, 2026 | RubyGems net-imap |
OpenC3 COSMOS is Vulnerable to Self-XSS Through the Command Sender CVE-2026-42086, GHSA-ffq5-qpvf-xq7x, PYSEC-2026-105 | Medium | 0.2% | 22 Apr, 2026 | PyPI openc3 RubyGems openc3 |
OpenC3 COSMOS allows arbitrary writes to plugins directory via path-traversed config filenames CVE-2026-42085, GHSA-4jvx-93h3-f45h, PYSEC-2026-2243 | Medium | 0.3% | 22 Apr, 2026 | PyPI openc3 RubyGems openc3 |
yard: Possible arbitrary path traversal and file access via yard server CVE-2026-41493, GHSA-3jfp-46x4-xgfj | Medium | Not scored | 17 Apr, 2026 | RubyGems yard |
Buffer Overflow in Zlib::GzipReader ungetc via large input leads to memory corruption CVE-2026-27820, GHSA-g857-hhfv-j68w | Medium | Not scored | 16 Apr, 2026 | RubyGems zlib |
rdiscount has an Out-of-bounds Read CVE-2026-35201, GHSA-6r34-94wq-jhrc | Medium | Not scored | 06 Apr, 2026 | RubyGems rdiscount |
Rack::Request accepts invalid Host characters, enabling host allowlist bypass CVE-2026-34835, GHSA-g2pf-xv49-m2h5 | Medium | Not scored | 02 Apr, 2026 | RubyGems rack |
Rack has Content-Length mismatch in Rack::Files error responses CVE-2026-34831, GHSA-q2ww-5357-x388 | Medium | Not scored | 02 Apr, 2026 | RubyGems rack |
Rack::Sendfile header-based X-Accel-Mapping regex injection enables unauthorized X-Accel-Redirect CVE-2026-34830, GHSA-qv7j-4883-hwh7 | Medium | Not scored | 02 Apr, 2026 | RubyGems rack |
Rack has a root directory disclosure via unescaped regex interpolation in Rack::Directory CVE-2026-34763, GHSA-7mqq-6cf9-v2qp | Medium | Not scored | 02 Apr, 2026 | RubyGems rack |
Rack: Forwarded Header semicolon injection enables Host and Scheme spoofing CVE-2026-32762, GHSA-qfgr-crr9-7r49 | Medium | Not scored | 02 Apr, 2026 | RubyGems rack |
Rack's improper unfolding of folded multipart headers preserves CRLF in parsed parameter values CVE-2026-26962, GHSA-rx22-g9mx-qrhv | Medium | Not scored | 02 Apr, 2026 | RubyGems rack |
Rack's greedy multipart boundary parsing can cause parser differentials and WAF bypass. CVE-2026-26961, GHSA-vgpv-f759-9wx3 | Medium | Not scored | 02 Apr, 2026 | RubyGems rack |
Rack's multipart byte range processing allows denial of service via excessive overlapping ranges CVE-2026-34826, GHSA-x8cg-fq8g-mxfx | Medium | Not scored | 02 Apr, 2026 | RubyGems rack |
Rack:: Static header_rules bypass via URL-encoded paths CVE-2026-34786, GHSA-q4qf-9j86-f5mh | Medium | Not scored | 02 Apr, 2026 | RubyGems rack |
iCalendar has ICS injection via unsanitized URI property values CVE-2026-33635, GHSA-pv9c-9mfh-hvxq | Medium | Not scored | 24 Mar, 2026 | RubyGems icalendar |
Rails Active Storage has possible glob injection in its DiskService CVE-2026-33202, GHSA-73f9-jhhh-hr5m | Medium | Not scored | 23 Mar, 2026 | RubyGems activestorage |
Rails Active Support has a possible DoS vulnerability in its number helpers CVE-2026-33176, GHSA-2j26-frm8-cmj9 | Medium | Not scored | 23 Mar, 2026 | RubyGems activesupport |
Rails Active Storage has a possible DoS vulnerability when in proxy mode via Range requests CVE-2026-33174, GHSA-r46p-8f7g-vvvg | Medium | Not scored | 23 Mar, 2026 | RubyGems activestorage |
Rails Active Storage has possible content type bypass via metadata in direct uploads CVE-2026-33173, GHSA-qcfx-2mfw-w4cg | Medium | Not scored | 23 Mar, 2026 | RubyGems activestorage |
Rails Active Support has a possible XSS vulnerability in SafeBuffer#% CVE-2026-33170, GHSA-89vf-4333-qx8v | Medium | Not scored | 23 Mar, 2026 | RubyGems activesupport |
Rails Active Support has a possible ReDoS vulnerability in number_to_delimited CVE-2026-33169, GHSA-cg4j-q9v8-6v38 | Medium | Not scored | 23 Mar, 2026 | RubyGems activesupport |
bcrypt-ruby has an Integer Overflow that Causes Zero Key-Strengthening Iterations at Cost=31 on JRuby CVE-2026-33306, GHSA-f27w-vcwj-c954 | Medium | Not scored | 19 Mar, 2026 | RubyGems bcrypt |
Avo has a XSS vulnerability on `return_to` param CVE-2026-33209, GHSA-762r-27w2-q22j | Medium | Not scored | 18 Mar, 2026 | RubyGems avo |
Devise has a confirmable "change email" race condition permits user to confirm email they have no access to CVE-2026-32700, GHSA-57hq-95w6-v4fc | Medium | Not scored | 17 Mar, 2026 | RubyGems devise |
Katello: Denial of Service and potential information disclosure via SQL injection CVE-2026-4324, GHSA-fwj4-6wgp-mpxm | Medium | Not scored | 17 Mar, 2026 | RubyGems katello |
Trix has a Stored XSS vulnerability through serialized attributes CVE-2026-73426, GHSA-qmpg-8xg6-ph5q | Medium | 0.3% | 12 Mar, 2026 | RubyGems action_text-trix npm trix |
Camaleon CMS vulnerable to Path Traversal through AWS S3 uploader implementation CVE-2026-1776, GHSA-jw5g-f64p-6x78 | Medium | Not scored | 10 Mar, 2026 | RubyGems camaleon_cms |
Nokogiri does not check the return value from xmlC14NExecute CVE-2026-79772, GHSA-wx95-c6cv-8532 | Medium | Not scored | 18 Feb, 2026 | RubyGems nokogiri |
Stored XSS in Rack::Directory via javascript: filenames rendered into anchor href CVE-2026-25500, GHSA-whrj-4476-wvmp | Medium | Not scored | 17 Feb, 2026 | RubyGems rack |
Faraday affected by SSRF via protocol-relative URL host override in build_exclusive_url CVE-2026-25765, GHSA-33mh-2634-fwr2 | Medium | Not scored | 09 Feb, 2026 | RubyGems faraday |
AlchemyCMS: Authenticated Remote Code Execution (RCE) via eval injection in ResourcesHelper CVE-2026-23885, GHSA-2762-657x-v979 | Medium | Not scored | 21 Jan, 2026 | RubyGems alchemy_cms |
Active Job - Object injection security vulnerability GHSA-mpwp-4h2m-765c | Medium | Not scored | 16 Jan, 2026 | RubyGems activejob |
Spree API has Authenticated Insecure Direct Object Reference (IDOR) via Order Modification CVE-2026-22588, GHSA-g268-72p7-9j6j | Medium | Not scored | 08 Jan, 2026 | RubyGems spree_api |
Trix has a stored XSS vulnerability through its attachment attribute GHSA-g9jg-w8vm-g96v | Medium | Not scored | 31 Dec, 2025 | RubyGems action_text-trix npm trix |
AWS SDK for Ruby's S3 Encryption Client has a Key Commitment Issue CVE-2025-14762, GHSA-2xgq-q749-89fq | Medium | Not scored | 18 Dec, 2025 | RubyGems aws-sdk-s3 |
ALTCHA Proof-of-Work Vulnerable to Challenge Splicing and Replay CVE-2025-68113, GHSA-6gvq-jcmp-8959, GO-2025-4239, PYSEC-2026-1115 | Medium | 0.5% | 16 Dec, 2025 | Go github.com/altcha-org/altcha-lib-go Hex altcha Maven org.altcha:altcha Packagist altcha-org/altcha +3 more |
Rack has a Possible Information Disclosure Vulnerability CVE-2025-61780, GHSA-r657-rxjc-j557 | Medium | Not scored | 10 Oct, 2025 | RubyGems rack |
Google Sign-In for Rails allowed redirect to protocol-relative URI CVE-2025-58067, GHSA-5jch-xhw4-r43v | Medium | Not scored | 29 Aug, 2025 | RubyGems google_sign_in |
Google Sign-In for Rails allowed redirects to malformed URLs CVE-2025-57821, GHSA-7pwc-wh6m-44q3 | Medium | Not scored | 27 Aug, 2025 | RubyGems google_sign_in |
Active Record logging vulnerable to ANSI escape injection CVE-2025-55193, GHSA-76r7-hhxj-r776 | Medium | Not scored | 13 Aug, 2025 | RubyGems activerecord |
Ruby SAML DOS vulnerability with large SAML response CVE-2025-54572, GHSA-rrqh-93c8-j966 | Medium | Not scored | 30 Jul, 2025 | RubyGems ruby-saml |
Measured is vulnerable to Path Traversal attacks during class initialization GHSA-29g5-m8v7-v564 | Medium | Not scored | 15 Jul, 2025 | RubyGems measured |
resolv vulnerable to DoS via insufficient DNS domain name length validation CVE-2025-24294, GHSA-xh69-987w-hrp8 | Medium | Not scored | 15 Jul, 2025 | RubyGems resolv |
HashiCorp Vagrant has code injection vulnerability through default synced folders CVE-2025-34075, GHSA-hqp6-mjw3-f586 | Medium | Not scored | 02 Jul, 2025 | RubyGems vagrant |
Ruby WEBrick read_headers method can lead to HTTP Request/Response Smuggling CVE-2025-6442, GHSA-r995-q44h-hr64 | Medium | Not scored | 26 Jun, 2025 | RubyGems webrick |
ReDoS Vulnerability in Rack::Multipart handle_mime_head CVE-2025-49007, GHSA-47m2-26rw-j2jw | Medium | Not scored | 05 Jun, 2025 | RubyGems rack |
Insufficient input sanitization in ejson2env CVE-2025-48069, GHSA-2c47-m757-32g6, GO-2025-3702 | Medium | Not scored | 21 May, 2025 | Go github.com/Shopify/ejson2env Go github.com/Shopify/ejson2env/v2 RubyGems ejson2env |
Rack session gets restored after deletion CVE-2025-46336, GHSA-9j94-67jr-4cqj | Medium | Not scored | 08 May, 2025 | RubyGems rack-session |