Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Rack session gets restored after deletion CVE-2025-32441, GHSA-vpfw-47h7-xj4g | Medium | Not scored | 08 May, 2025 | RubyGems rack |
JRuby-OpenSSL has hostname verification disabled by default CVE-2025-46551, GHSA-72qj-48g4-5xgx | Medium | Not scored | 07 May, 2025 | Maven org.jruby:jruby Maven rubygems:jruby-openssl RubyGems jruby-openssl |
net-imap rubygem vulnerable to possible DoS by memory exhaustion CVE-2025-43857, GHSA-j3g3-5qv5-52mj | Medium | Not scored | 28 Apr, 2025 | RubyGems net-imap |
Pitchfork HTTP Request/Response Splitting vulnerability CVE-2025-30221, GHSA-pfqj-w6r6-g86v | Medium | Not scored | 27 Mar, 2025 | RubyGems pitchfork |
Escape Sequence Injection vulnerability in Rack lead to Possible Log Injection CVE-2025-27111, GHSA-8cgq-6mh2-7j6v | Medium | Not scored | 04 Mar, 2025 | RubyGems rack |
CGI has Regular Expression Denial of Service (ReDoS) potential in Util#escapeElement CVE-2025-27220, GHSA-mhwm-jh88-3gjf | Medium | Not scored | 03 Mar, 2025 | RubyGems cgi |
CGI has Denial of Service (DoS) potential in Cookie.parse CVE-2025-27219, GHSA-gh9q-2xrm-x6qv | Medium | Not scored | 03 Mar, 2025 | RubyGems cgi |
Phusion Passenger denial of service BIT-passenger-2025-26803, BIT-passenger-apache-module-2025-26803, BIT-passenger-nginx-module-2025-26803, CVE-2025-26803, GHSA-2cj2-qqxj-5m3r | Medium | Not scored | 24 Feb, 2025 | RubyGems passenger |
Possible Log Injection in Rack::CommonLogger CVE-2025-25184, GHSA-7g2v-jj9q-g3rg | Medium | Not scored | 12 Feb, 2025 | RubyGems rack |
Possible DoS by memory exhaustion in net-imap CVE-2025-25186, GHSA-7fc5-f82f-cx69 | Medium | Not scored | 10 Feb, 2025 | RubyGems net-imap |
Password Pusher Allows Session Token Interception Leading to Potential Hijacking CVE-2024-56733, GHSA-4fwj-m62q-pp47 | Medium | Not scored | 30 Dec, 2024 | RubyGems pwpush |
decidim-meetings Cross-site scripting vulnerability in the online or hybrid meeting embeds CVE-2024-45594, GHSA-j4h6-gcj7-7v9v | Medium | Not scored | 13 Nov, 2024 | RubyGems decidim-meetings |
Sinatra vulnerable to Reliance on Untrusted Inputs in a Security Decision CVE-2024-21510, GHSA-hxx2-7vcw-mqr3 | Medium | Not scored | 01 Nov, 2024 | RubyGems sinatra |
MPXJ has a Potential Path Traversal Vulnerability CVE-2024-49771, GHSA-j945-c44v-97g6, PYSEC-2026-1681 | Medium | 0.5% | 28 Oct, 2024 | Maven net.sf.mpxj:mpxj NuGet MPXJ.Net NuGet net.sf.mpxj NuGet net.sf.mpxj-for-csharp +3 more |
REXML ReDoS vulnerability CVE-2024-49761, CVE-2025-10990, GHSA-2rxp-v6pw-ch6m | Medium | Not scored | 28 Oct, 2024 | RubyGems rexml |
camaleon_cms affected by cross site scripting CVE-2024-48652, GHSA-hhxg-rvc9-8726 | Medium | Not scored | 23 Oct, 2024 | RubyGems camaleon_cms |
Possible ReDoS vulnerability in block_format in Action Mailer BIT-rails-2024-47889, CVE-2024-47889, GHSA-h47h-mwp9-c6q6 | Medium | Not scored | 15 Oct, 2024 | RubyGems actionmailer |
Possible ReDoS vulnerability in plain_text_for_blockquote_node in Action Text BIT-rails-2024-47888, CVE-2024-47888, GHSA-wwhv-wxv9-rpgw | Medium | Not scored | 15 Oct, 2024 | RubyGems actiontext |
Possible ReDoS vulnerability in HTTP Token authentication in Action Controller BIT-rails-2024-47887, CVE-2024-47887, GHSA-vfg9-r3fq-jvx4 | Medium | Not scored | 15 Oct, 2024 | RubyGems actionpack |
Possible ReDoS vulnerability in query parameter filtering in Action Dispatch BIT-rails-2024-41128, CVE-2024-41128, GHSA-x76w-6vjr-8xgj | Medium | Not scored | 15 Oct, 2024 | RubyGems actionpack |
OpenC3 stores passwords in clear text (`GHSL-2024-129`) CVE-2024-47529, GHSA-4xqv-47rm-37mm, PYSEC-2024-121 | Medium | 0.4% | 02 Oct, 2024 | PyPI openc3 RubyGems openc3 npm @openc3/tool-common |
OpenC3 Cross-site Scripting in Login functionality (`GHSL-2024-128`) CVE-2024-43795, GHSA-vfj8-5pj7-2f9g, PYSEC-2024-100 | Medium | 0.5% | 02 Oct, 2024 | PyPI openc3 RubyGems openc3 npm @openc3/tool-common |
Camaleon CMS vulnerable to stored XSS through user file upload (GHSL-2024-184) GHSA-75j2-9gmc-m855 | Medium | Not scored | 25 Sep, 2024 | RubyGems camaleon_cms |
Camaleon CMS vulnerable to stored XSS through user file upload (GHSL-2024-184) GHSA-8fx8-3rg2-79xw | Medium | Not scored | 23 Sep, 2024 | RubyGems camaleon_cms |
Puma's header normalization allows for client to clobber proxy set headers CVE-2024-45614, GHSA-9hf4-67fc-4vf4 | Medium | Not scored | 20 Sep, 2024 | RubyGems puma |
Camaleon CMS vulnerable to stored XSS through user file upload (GHSL-2024-184) GHSA-r9cr-qmfw-pmrc | Medium | Not scored | 18 Sep, 2024 | RubyGems camaleon_cms |
Devise-Two-Factor Authentication Uses Insufficient Default OTP Shared Secret Length CVE-2024-8796, GHSA-qjxf-mc72-wjr2 | Medium | Not scored | 17 Sep, 2024 | RubyGems devise-two-factor |
Decidim::Admin vulnerable to cross-site scripting (XSS) in the admin panel with QuillJS WYSWYG editor CVE-2024-39910, GHSA-vvqw-fqwx-mqmm | Medium | Not scored | 16 Sep, 2024 | RubyGems decidim |
Decidim::Admin vulnerable to cross-site scripting (XSS) in the admin activity log CVE-2024-32034, GHSA-rx9f-5ggv-5rh6 | Medium | Not scored | 16 Sep, 2024 | RubyGems decidim-admin |
request_store has Incorrect Default Permissions CVE-2024-43791, GHSA-frp2-5qfc-7r8m | Medium | Not scored | 23 Aug, 2024 | RubyGems request_store |
fugit parse and parse_nat stall on lengthy input CVE-2024-43380, GHSA-2m96-52r3-2f3g | Medium | Not scored | 19 Aug, 2024 | RubyGems fugit |
REXML DoS vulnerability CVE-2024-41946, GHSA-5866-49gr-22v4 | Medium | Not scored | 02 Aug, 2024 | RubyGems rexml |
REXML DoS vulnerability CVE-2024-41123, GHSA-r55c-59qm-vjw6 | Medium | Not scored | 01 Aug, 2024 | RubyGems rexml |
Cross-Site Request Forgery in Spina CVE-2024-7106, GHSA-wqw3-p83g-r24v | Medium | Not scored | 25 Jul, 2024 | RubyGems spina |
REXML denial of service vulnerability CVE-2024-39908, GHSA-4xqq-m2hx-25v8 | Medium | Not scored | 16 Jul, 2024 | RubyGems rexml |
Decidim cross-site scripting (XSS) in the admin panel CVE-2024-27095, GHSA-529p-jj47-w3m3 | Medium | Not scored | 10 Jul, 2024 | RubyGems decidim-admin |
Decidim cross-site scripting (XSS) in the pagination CVE-2024-32469, GHSA-7cx8-44pc-xv3q | Medium | Not scored | 10 Jul, 2024 | RubyGems decidim |
Decidim vulnerable to data disclosure through the embed feature CVE-2024-27090, GHSA-qcj6-vxwx-4rqv | Medium | Not scored | 10 Jul, 2024 | RubyGems decidim |
RailsAdmin Cross-site Scripting vulnerability in the list view CVE-2024-39308, GHSA-8qgm-g2vv-vwvc | Medium | Not scored | 08 Jul, 2024 | RubyGems rails_admin |
Rack ReDoS Vulnerability in HTTP Accept Headers Parsing CVE-2024-39316, GHSA-cj83-2ww7-mvq7 | Medium | Not scored | 03 Jul, 2024 | RubyGems rack |
Missing security headers in Action Pack on non-HTML responses BIT-rails-2024-28103, CVE-2024-28103, GHSA-fwhr-88qx-h9g7 | Medium | Not scored | 04 Jun, 2024 | RubyGems actionpack |
ActionText ContentAttachment can Contain Unsanitized HTML BIT-rails-2024-32464, CVE-2024-32464, GHSA-prjp-h48f-jgf6 | Medium | Not scored | 04 Jun, 2024 | RubyGems actiontext |
Kaminari Insecure File Permissions Vulnerability CVE-2024-32978, GHSA-7r3j-qmr4-jfpj | Medium | Not scored | 28 May, 2024 | RubyGems kaminari |
REXML contains a denial of service vulnerability CVE-2024-35176, GHSA-vg3r-rm7w-2xgh | Medium | Not scored | 16 May, 2024 | RubyGems rexml |
Trix Editor Arbitrary Code Execution Vulnerability CVE-2024-34341, GHSA-qjqp-xr96-cj99 | Medium | 0.8% | 07 May, 2024 | RubyGems actiontext npm trix |
Sidekiq vulnerable to a Reflected XSS in Queues Web Page CVE-2024-32887, GHSA-q655-3pj8-9fxq | Medium | Not scored | 26 Apr, 2024 | RubyGems sidekiq |
CarrierWave content-Type allowlist bypass vulnerability which possibly leads to XSS remained CVE-2024-29034, GHSA-vfmv-jfc5-pjjw | Medium | Not scored | 25 Mar, 2024 | RubyGems carrierwave |
ROTP 6.2.2 and 6.2.1 has 0666 permissions for the .rb files. CVE-2024-28862, GHSA-x2h8-qmj4-g62f | Medium | Not scored | 18 Mar, 2024 | RubyGems rotp |
json-jwt allows bypass of identity checks via a sign/encryption confusion attack CVE-2023-51774, GHSA-c8v6-786g-vjx6 | Medium | Not scored | 29 Feb, 2024 | RubyGems json-jwt |
Rack vulnerable to ReDoS in content type parsing (2nd degree polynomial) CVE-2024-25126, GHSA-22f2-v57c-j9cx | Medium | Not scored | 28 Feb, 2024 | RubyGems rack |