Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Cross-site Scripting (XSS) possible with maliciously formed HTML attribute names and values in Phlex CVE-2024-28199, GHSA-242p-4v39-2v8g | High | Not scored | 12 Mar, 2024 | RubyGems phlex |
XSS sidekiq-unique-jobs UI server vulnerability CVE-2023-46950, CVE-2023-46951, CVE-2024-25122, GHSA-cmh9-rx85-xj38, GHSA-fhx8-5c23-x7x5 | High | Not scored | 13 Feb, 2024 | RubyGems sidekiq-unique-jobs |
avo vulnerable to stored cross-site scripting (XSS) in key_value field CVE-2024-22191, GHSA-ghjv-mh6x-7q6h | High | Not scored | 16 Jan, 2024 | RubyGems avo |
Omniauth::MicrosoftGraph Account takeover (nOAuth) CVE-2024-21632, GHSA-5g66-628f-7cvj | High | Not scored | 03 Jan, 2024 | RubyGems omniauth-microsoft_graph |
Potential CSV export data leak CVE-2023-50448, GHSA-356j-hg45-x525 | High | Not scored | 15 Dec, 2023 | RubyGems activeadmin |
encoded_id-rails potential DOS vulnerability due to URIs with extremely long encoded IDs CVE-2024-0241, GHSA-3px7-jm2p-6h2c | High | Not scored | 24 Oct, 2023 | RubyGems encoded_id-rails |
Decidim has broken access control in templates CVE-2023-36465, GHSA-639h-86hw-qcjq | High | Not scored | 05 Oct, 2023 | RubyGems decidim RubyGems decidim-templates |
Denial of Service Vulnerability in gRPC TCP Server (Posix-compatible platforms) CVE-2023-4785, GHSA-p25m-jpj4-qcrr, PYSEC-2026-1428 | High | 0.8% | 13 Sep, 2023 | PyPI grpcio RubyGems grpc |
Excessive Iteration in gRPC CVE-2023-33953, GHSA-496j-2rq6-j6cc, PYSEC-2026-1424 | High | 0.5% | 09 Aug, 2023 | PyPI grpcio RubyGems grpc |
rswag vulnerable to arbitrary JSON and YAML file read via directory traversal CVE-2023-38337, GHSA-vc79-65pr-q82v | High | Not scored | 15 Jul, 2023 | RubyGems rswag |
Decidim Cross-site Scripting vulnerability in the processes filter CVE-2023-34089, GHSA-5652-92r9-3fx9 | High | Not scored | 11 Jul, 2023 | RubyGems decidim RubyGems decidim-core |
Decidim vulnerable to sensitive data disclosure CVE-2023-34090, GHSA-jm79-9pm4-vrw9 | High | Not scored | 11 Jul, 2023 | RubyGems decidim RubyGems decidim-meetings |
Sanitize vulnerable to Cross-site Scripting via insufficient neutralization of `style` element content CVE-2023-36823, GHSA-f5ww-cq3m-q3g7 | High | Not scored | 06 Jul, 2023 | RubyGems sanitize |
Connection confusion in gRPC CVE-2023-32731, GHSA-cfgp-2977-2fmm, PYSEC-2026-1427 | High | 0.5% | 09 Jun, 2023 | Maven io.grpc:grpc-protobuf PyPI grpcio RubyGems grpc |
gRPC Reachable Assertion issue CVE-2023-1428, GHSA-6628-q6j9-w8vg, PYSEC-2026-1425 | High | 0.4% | 09 Jun, 2023 | Maven io.grpc:grpc-protobuf PyPI grpcio RubyGems grpc |
RedCloth Regular Expression Denial of Service issue CVE-2023-31606, GHSA-qcm3-vfq5-wfr2 | High | Not scored | 06 Jun, 2023 | RubyGems RedCloth |
avo possible unsafe reflection / partial DoS vulnerability CVE-2023-34102, GHSA-86h2-2g4g-29qx | High | Not scored | 06 Jun, 2023 | RubyGems avo |
avo vulnerable to Stored XSS (Cross Site Scripting) in html content based fields CVE-2023-34103, GHSA-5cr9-5jx3-2g39 | High | Not scored | 06 Jun, 2023 | RubyGems avo |
sidekiq vulnerable to cross-site scripting CVE-2023-1892, GHSA-h3r8-h5qw-4r35 | High | Not scored | 21 Apr, 2023 | RubyGems sidekiq |
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in Pay CVE-2023-30614, GHSA-cqf3-vpx7-rxhw | High | Not scored | 20 Apr, 2023 | RubyGems pay |
Fluent Fluentd and Fluent-ui use default password BIT-fluentd-2020-21514, CVE-2020-21514, GHSA-wrxf-x8rm-6ggg | High | Not scored | 04 Apr, 2023 | RubyGems fluentd-ui |
Ruby URI component ReDoS issue CVE-2023-28755, GHSA-hv5j-3h9f-99c2 | High | Not scored | 31 Mar, 2023 | RubyGems uri |
Ruby Time component ReDoS issue BIT-ruby-2023-28756, BIT-ruby-min-2023-28756, CVE-2023-28756, GHSA-fg7x-g82r-94qc | High | Not scored | 31 Mar, 2023 | RubyGems time |
Rack has possible DoS Vulnerability in Multipart MIME parsing CVE-2023-27530, GHSA-3h57-hmj3-gj3p | High | Not scored | 08 Mar, 2023 | RubyGems rack |
Withdrawn: Fortra GoAnywhere MFT Deserialization of Untrusted Data vulnerability affects metasploit-framework CVE-2023-0669, GHSA-6pm2-j2v8-h3cj | HighExploited | 100.0% | 06 Feb, 2023 | RubyGems metasploit-framework |
Devise Gem for Ruby Unauthorized Access Using "Remember Me" Cookie CVE-2015-8314, GHSA-746g-3gfp-hfhw | High | Not scored | 26 Jan, 2023 | RubyGems devise |
ExifTool vulnerable to arbitrary code execution GHSA-q95h-cqrv-8jv5 | High | Not scored | 20 Jan, 2023 | RubyGems exiftool_vendored |
jruby-openssl gem for JRuby fails to do proper certificate validation CVE-2009-4123, GHSA-xgv7-pqqh-h2w9 | High | Not scored | 19 Jan, 2023 | RubyGems jruby-openssl |
Denial of Service Vulnerability in ActiveRecord's PostgreSQL adapter CVE-2022-44566, GHSA-579w-22j4-4749 | High | Not scored | 18 Jan, 2023 | RubyGems activerecord |
SQL Injection Vulnerability via ActiveRecord comments CVE-2023-22794, GHSA-hq7p-j377-6v63 | High | Not scored | 18 Jan, 2023 | RubyGems activerecord |
Denial of service via header parsing in Rack CVE-2022-44570, GHSA-65f5-mfpf-vfhj | High | Not scored | 18 Jan, 2023 | RubyGems rack |
Code injection in ruby git CVE-2022-47318, GHSA-pphf-gfrm-v32r | High | Not scored | 17 Jan, 2023 | RubyGems git |
ruby-git has potential remote code execution vulnerability CVE-2022-46648, GHSA-pfpr-3463-c6jh | High | Not scored | 09 Jan, 2023 | RubyGems git |
PgHero Allows Information Disclosure Through EXPLAIN Feature CVE-2023-22626, GHSA-vf99-xw26-86g5 | High | Not scored | 05 Jan, 2023 | RubyGems pghero |
active_attr Improper Resource Shutdown or Release vulnerability CVE-2021-4250, GHSA-4whf-rmx5-8frv | High | Not scored | 19 Dec, 2022 | RubyGems active_attr |
Inefficient Regular Expression Complexity in rails-html-sanitizer CVE-2022-23517, GHSA-5x79-w82f-gw8w | High | Not scored | 13 Dec, 2022 | RubyGems rails-html-sanitizer |
Uncontrolled Recursion in Loofah CVE-2022-23516, GHSA-3x8r-x6xp-q4vm | High | Not scored | 13 Dec, 2022 | RubyGems loofah |
Inefficient Regular Expression Complexity in Loofah CVE-2022-23514, GHSA-486f-hjj9-9vhh | High | Not scored | 13 Dec, 2022 | RubyGems loofah |
Unchecked return value from xmlTextReaderExpand CVE-2022-23476, GHSA-qv4q-mr5r-qprj | High | Not scored | 08 Dec, 2022 | RubyGems nokogiri |
Sinatra vulnerable to Reflected File Download attack CVE-2022-45442, GHSA-2x8x-jmrp-phxw | High | Not scored | 30 Nov, 2022 | RubyGems sinatra |
HTTP response splitting in CGI BIT-ruby-2021-33621, BIT-ruby-min-2021-33621, CVE-2021-33621, GHSA-vc47-6rqg-c7f5 | High | Not scored | 19 Nov, 2022 | RubyGems cgi |
arr-pm vulnerable to arbitrary shell execution when extracting or listing files contained in a malicious rpm. CVE-2022-39224, GHSA-88cv-mj24-8w3q | High | Not scored | 21 Sep, 2022 | RubyGems arr-pm |
Pageflow vulnerable to insecure direct object reference in membership update endpoint GHSA-qcqv-38jg-2r43 | High | Not scored | 15 Sep, 2022 | RubyGems pageflow |
Pageflow vulnerable to sensitive user data extraction via Ransack query injection GHSA-wrrw-crp8-979q | High | Not scored | 15 Sep, 2022 | RubyGems pageflow |
TZInfo relative path traversal vulnerability allows loading of arbitrary files CVE-2022-31163, GHSA-5cm2-9h8c-rvfx | High | Not scored | 21 Jul, 2022 | RubyGems tzinfo |
opensearch-ruby 2.x before 2.0.2 vulnerable to unsafe YAML deserialization CVE-2022-31115, GHSA-977c-63xq-cgw3 | High | Not scored | 05 Jul, 2022 | RubyGems opensearch-ruby |
Denial of Service Vulnerability in Rack Multipart Parsing CVE-2022-30122, GHSA-hxqx-xwvh-44m2 | High | Not scored | 27 May, 2022 | RubyGems rack |
Camaleon CMS Insufficient Session Expiration vulnerability CVE-2021-25970, GHSA-438x-2p9v-g8h9 | High | Not scored | 24 May, 2022 | RubyGems camaleon_cms |
Nokogiri has vulnerable dependencies on libxml2 and libxslt CVE-2021-30560, GHSA-59gp-qqm7-cw4j | High | Not scored | 24 May, 2022 | RubyGems nokogiri |
Nokogiri contains libxml Out-of-bounds Write vulnerability CVE-2021-3517, GHSA-jw9f-hh49-cvp9 | High | Not scored | 24 May, 2022 | RubyGems nokogiri |