Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
YARD's default template vulnerable to Cross-site Scripting in generated frames.html CVE-2024-27285, GHSA-8mq4-9jjh-9xrc | Medium | Not scored | 28 Feb, 2024 | RubyGems yard |
Rails has possible Sensitive Session Information Leak in Active Storage BIT-rails-2024-26144, CVE-2024-26144, GHSA-8h22-8cf7-hq6g | Medium | Not scored | 27 Feb, 2024 | RubyGems activestorage |
Rails has possible XSS Vulnerability in Action Controller BIT-rails-2024-26143, CVE-2024-26143, GHSA-9822-6m93-xqf4 | Medium | Not scored | 27 Feb, 2024 | RubyGems actionpack RubyGems rails |
Rack CORS Middleware has Insecure File Permissions CVE-2024-27456, GHSA-785g-282q-pwvx | Medium | Not scored | 26 Feb, 2024 | RubyGems rack-cors |
Cross-site scripting (XSS) in the dynamic file uploads CVE-2023-51447, GHSA-9w99-78rj-hmxq | Medium | Not scored | 20 Feb, 2024 | RubyGems decidim RubyGems decidim-core |
Possibility to circumvent the invitation token expiry period CVE-2023-48220, GHSA-w3q8-m492-4pwp | Medium | Not scored | 20 Feb, 2024 | RubyGems decidim RubyGems decidim-admin RubyGems decidim-system RubyGems devise_invitable |
Possible CSRF attack at questionnaire templates preview CVE-2023-47635, GHSA-f3qm-vfc3-jg6v | Medium | Not scored | 20 Feb, 2024 | RubyGems decidim-templates |
Nokogiri update packaged libxml2 to v2.12.5 to resolve CVE-2024-25062 CVE-2024-58378, GHSA-xc9x-jj77-9p9j | Medium | Not scored | 05 Feb, 2024 | RubyGems nokogiri |
Cross-site scripting (XSS) in Action messages on Avo CVE-2024-22411, GHSA-g8vp-2v5p-9qfh | Medium | Not scored | 17 Jan, 2024 | RubyGems avo |
Puma HTTP Request/Response Smuggling vulnerability CVE-2024-21647, GHSA-c2f4-cvqm-65w2 | Medium | Not scored | 08 Jan, 2024 | RubyGems puma |
view_component Cross-site Scripting vulnerability CVE-2024-21636, GHSA-wf2x-8w6j-qw37 | Medium | Not scored | 04 Jan, 2024 | RubyGems view_component |
ActiveAdmin CSV Injection leading to sensitive information disclosure CVE-2023-51763, GHSA-xhvv-3jww-c487 | Medium | Not scored | 28 Dec, 2023 | RubyGems activeadmin |
Resque vulnerable to Reflected Cross Site Scripting through pathnames CVE-2023-50724, GHSA-r8xx-8vm8-x6wj | Medium | Not scored | 18 Dec, 2023 | RubyGems resque |
Resque vulnerable to reflected XSS in resque-web failed and queues lists CVE-2023-50725, GHSA-gc3j-vvwf-4rp8 | Medium | Not scored | 18 Dec, 2023 | RubyGems resque |
Resque vulnerable to reflected XSS in Queue Endpoint CVE-2023-50727, GHSA-r9mq-m72x-257g | Medium | Not scored | 18 Dec, 2023 | RubyGems resque |
Resque Scheduler Reflected XSS In Delayed Jobs View CVE-2022-44303, GHSA-9hmq-fm33-x4xx | Medium | Not scored | 18 Dec, 2023 | RubyGems resque-scheduler |
pubnub Insufficient Entropy vulnerability CVE-2023-26154, GHSA-5844-q3fc-56rh, GO-2023-2385, PYSEC-2026-1807 | Medium | 1.0% | 06 Dec, 2023 | Go github.com/pubnub/go Go github.com/pubnub/go/v5 Go github.com/pubnub/go/v6 Go github.com/pubnub/go/v7 +10 more |
CarrierWave Content-Type allowlist bypass vulnerability, possibly leading to XSS CVE-2023-49090, GHSA-gxhx-g4fq-49hj | Medium | Not scored | 29 Nov, 2023 | RubyGems carrierwave |
memory leak flaw was found in ruby-magick CVE-2023-5349, GHSA-frgf-8jr5-j2jv | Medium | Not scored | 30 Oct, 2023 | RubyGems rmagick |
svg_optimizer rubygem external XML entity (XXE) vulnerability CVE-2023-46035, GHSA-6hvg-62q8-95v7 | Medium | Not scored | 20 Oct, 2023 | RubyGems svg_optimizer |
sidekiq Denial of Service vulnerability CVE-2023-26141, GHSA-3qc2-v3hp-6cv8 | Medium | Not scored | 14 Sep, 2023 | RubyGems sidekiq |
Active Support Possibly Discloses Locally Encrypted Files CVE-2023-38037, GHSA-cr5q-6q9f-rq6q | Medium | Not scored | 23 Aug, 2023 | RubyGems activesupport |
Several quadratic complexity bugs may lead to denial of service in Commonmarker GHSA-7vh7-fw88-wj87 | Medium | Not scored | 08 Aug, 2023 | RubyGems commonmarker |
protocol-http1 HTTP Request/Response Smuggling vulnerability CVE-2023-38697, GHSA-6jwc-qr2q-7xwj | Medium | Not scored | 03 Aug, 2023 | RubyGems protocol-http1 |
Decidim Cross-site Scripting vulnerability in the external link redirections CVE-2023-32693, GHSA-469h-mqg8-535r | Medium | Not scored | 11 Jul, 2023 | RubyGems decidim RubyGems decidim-core |
URI gem has ReDoS vulnerability CVE-2023-36617, GHSA-hww2-5g85-429m | Medium | Not scored | 29 Jun, 2023 | RubyGems uri |
Actionpack has possible cross-site scripting vulnerability via User Supplied Values to redirect_to CVE-2023-28362, GHSA-4g8v-vg43-wpgf | Medium | Not scored | 29 Jun, 2023 | RubyGems actionpack |
Doorkeeper Improper Authentication vulnerability CVE-2023-34246, GHSA-7w2c-w47h-789w | Medium | Not scored | 12 Jun, 2023 | RubyGems doorkeeper |
rails-ujs vulnerable to DOM Based Cross-site Scripting contenteditable HTML Elements CVE-2023-23913, GHSA-xp5h-f8jf-rc8q | Medium | Not scored | 09 Jun, 2023 | RubyGems actionview |
Kredis JSON Possible Deserialization of Untrusted Data Vulnerability CVE-2023-27531, GHSA-h2wm-p2vg-6pw4 | Medium | Not scored | 09 Jun, 2023 | RubyGems kredis |
gRPC connection termination issue CVE-2023-32732, GHSA-9hxf-ppjv-w6rq, PYSEC-2026-1426 | Medium | 0.5% | 09 Jun, 2023 | Maven io.grpc:grpc-protobuf PyPI grpcio RubyGems grpc |
Cross Site Scripting (XSS) Vulnerability in Fetlife rollout-ui gem CVE-2023-25309, GHSA-5xq9-h3j2-jxvc | Medium | Not scored | 11 May, 2023 | RubyGems rollout-ui |
Commonmarker vulnerable to to several quadratic complexity bugs that may lead to denial of service GHSA-48wp-p9qv-4j64 | Medium | Not scored | 11 Apr, 2023 | RubyGems commonmarker |
Nokogiri updates packaged libxml2 to v2.10.4 to resolve multiple CVEs CVE-2023-54354, GHSA-pxvg-2qj5-37jq | Medium | Not scored | 11 Apr, 2023 | RubyGems nokogiri |
unpoly-rails Denial of Service vulnerability CVE-2023-28846, GHSA-m875-3xf6-mf78 | Medium | Not scored | 30 Mar, 2023 | RubyGems unpoly-rails |
Reflective Cross-site Scripting Vulnerability in twitter-bootstrap-rails CVE-2014-4920, GHSA-vpqv-mqvc-pcx2 | Medium | Not scored | 16 Mar, 2023 | RubyGems twitter-bootstrap-rails |
Possible XSS Security Vulnerability in SafeBuffer#bytesplice CVE-2023-28120, GHSA-pj73-v5mw-pm9j | Medium | Not scored | 15 Mar, 2023 | RubyGems activesupport |
Clockwork Web contains a Cross-Site Request Forgery Vulnerability with Rails < 5.2 CVE-2023-25015, GHSA-p4xx-w6fr-c4w9 | Medium | Not scored | 02 Feb, 2023 | RubyGems clockwork_web |
Publify contains Weak Password Requirements BIT-publify-2023-0569, CVE-2023-0569, GHSA-g7gf-2rqw-5rwx | Medium | Not scored | 29 Jan, 2023 | RubyGems publify_core |
Improper neutralization of `noscript` element content may allow XSS in Sanitize CVE-2023-23627, GHSA-fw3g-2h3j-qmm7 | Medium | Not scored | 28 Jan, 2023 | RubyGems sanitize |
xaviershay-dm-rails Gem for Ruby exposes sensitive information via the process table CVE-2015-2179, GHSA-88p8-4vv5-82j7 | Medium | Not scored | 26 Jan, 2023 | RubyGems xaviershay-dm-rails |
Several quadratic complexity bugs may lead to denial of service in Commonmarker GHSA-636f-xm5j-pj9m | Medium | Not scored | 24 Jan, 2023 | RubyGems commonmarker |
Open Redirect Vulnerability in Action Pack CVE-2023-22797, GHSA-9445-4cr6-336r | Medium | Not scored | 18 Jan, 2023 | RubyGems actionpack |
Sisimai Inefficient Regular Expression Complexity vulnerability CVE-2022-4891, GHSA-vm74-j4wq-82xj | Medium | Not scored | 17 Jan, 2023 | RubyGems sisimai |
Publify Core does not strip metadata from images BIT-publify-2022-2815, CVE-2022-2815, GHSA-79wq-g4v9-gfj4 | Medium | Not scored | 14 Jan, 2023 | RubyGems publify_core |
Inline SVG vulnerable to Cross-site Scripting CVE-2020-36644, GHSA-p33q-4h4m-j994 | Medium | Not scored | 07 Jan, 2023 | RubyGems inline_svg |
httparty has multipart/form-data request tampering vulnerability CVE-2024-22049, GHSA-5pq7-52mg-hr42 | Medium | Not scored | 03 Jan, 2023 | RubyGems httparty |
keynote Cross-site Scripting vulnerability CVE-2017-20159, GHSA-399p-vq28-5hg8 | Medium | Not scored | 31 Dec, 2022 | RubyGems keynote |
Oxidized Web vulnerable to Cross-site Scripting CVE-2019-25088, GHSA-8qwh-rm6c-jv96 | Medium | Not scored | 27 Dec, 2022 | RubyGems oxidized-web |
text_helpers uses web link to untrusted target with window.opener access CVE-2020-36624, GHSA-74hc-57m5-83ch | Medium | Not scored | 22 Dec, 2022 | RubyGems text_helpers |