Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Denial of Service (DoS) in Nokogiri on JRuby GHSA-gx8x-g87m-h5q6 | High | Not scored | 11 Apr, 2022 | RubyGems nokogiri |
Out-of-bounds Write in zlib affects Nokogiri GHSA-v6gp-9mmm-c6p5 | High | Not scored | 11 Apr, 2022 | RubyGems nokogiri |
Nokogiri Inefficient Regular Expression Complexity CVE-2022-24836, GHSA-crjr-9rc5-ghw8 | High | Not scored | 11 Apr, 2022 | RubyGems nokogiri |
Command injection in cocoapods-downloader CVE-2022-21223, GHSA-g397-v4w5-4m79, SNYK-RUBY-COCOAPODSDOWNLOADER-2414280 | High | Not scored | 02 Apr, 2022 | RubyGems cocoapods-downloader |
Command injection in cocoapods-downloader CVE-2022-24440, GHSA-7627-mp87-jf6q, SNYK-RUBY-COCOAPODSDOWNLOADER-2414278 | High | Not scored | 02 Apr, 2022 | RubyGems cocoapods-downloader |
Nokogiri affected by zlib's Out-of-bounds Write vulnerability CVE-2018-25032, GHSA-jc36-42cf-vqwj, PSF-2022-3 | High | Not scored | 26 Mar, 2022 | RubyGems nokogiri |
Improper Certificate Validation in kubeclient CVE-2022-0759, GHSA-69p3-xp37-f692 | High | Not scored | 26 Mar, 2022 | RubyGems kubeclient |
Missing Authentication for Critical Function in Foreman Ansible CVE-2021-3589, GHSA-vvff-6wrr-4g7q | High | Not scored | 24 Mar, 2022 | RubyGems foreman_ansible |
Integer overflow in cmark-gfm table parsing extension leads to heap memory corruption CVE-2024-22051, GHSA-fmx4-26r3-wxpf | High | Not scored | 03 Mar, 2022 | RubyGems commonmarker |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in view_component CVE-2022-24722, GHSA-cm9w-c4rj-r2cf | High | Not scored | 02 Mar, 2022 | RubyGems view_component |
Vulnerable dependencies in Nokogiri CVE-2022-51000, GHSA-fq42-c5rg-92c2 | High | Not scored | 25 Feb, 2022 | RubyGems nokogiri |
Puma used with Rails may lead to Information Exposure CVE-2022-23634, GHSA-rmj8-8hhh-gv5h | High | Not scored | 11 Feb, 2022 | RubyGems puma |
Exposure of information in Action Pack CVE-2022-23633, GHSA-wh98-p28r-vrc9 | High | Not scored | 11 Feb, 2022 | RubyGems actionpack |
Publify Business Logic Errors BIT-publify-2022-0524, CVE-2022-0524, GHSA-x3rq-r3cm-5vc4 | High | Not scored | 09 Feb, 2022 | RubyGems publify_core |
Denial of service in sidekiq CVE-2022-23837, GHSA-jrfj-98qg-qjgv | High | Not scored | 27 Jan, 2022 | RubyGems sidekiq |
Cookie Prefix Spoofing in CGI::Cookie.parse BIT-ruby-2021-41819, BIT-ruby-min-2021-41819, CVE-2021-41819, GHSA-4vf4-qmvg-mh7h | High | Not scored | 21 Jan, 2022 | RubyGems cgi |
A potential Denial of Service issue in protobuf-java CVE-2021-22569, GHSA-wrvw-hg22-4m67 | High | Not scored | 07 Jan, 2022 | Maven com.google.protobuf:protobuf-java Maven com.google.protobuf:protobuf-kotlin RubyGems google-protobuf |
Improper Privilege Management in devise_masquerade CVE-2021-28680, GHSA-25f5-gc4h-hc22 | High | Not scored | 08 Dec, 2021 | RubyGems devise_masquerade |
ReDos vulnerability on guest checkout email validation CVE-2021-43805, GHSA-qxmr-qxh6-2cc9 | High | Not scored | 07 Dec, 2021 | RubyGems solidus_core |
Regular expression denial of service vulnerability (ReDoS) in date BIT-ruby-2021-41817, BIT-ruby-min-2021-41817, CVE-2021-41817, GHSA-qg54-694p-wgpp | High | Not scored | 16 Nov, 2021 | RubyGems date |
Improper Restriction of XML External Entity Reference (XXE) in Nokogiri on JRuby CVE-2021-41098, GHSA-2rr5-8q37-2w7h | High | Not scored | 27 Sep, 2021 | RubyGems nokogiri |
Clearance Gem Open Redirect Vulnerability CVE-2021-23435, GHSA-4hpq-rjcx-7vj9, SNYK-RUBY-CLEARANCE-1577284 | High | Not scored | 13 Sep, 2021 | RubyGems clearance |
Arbitrary Code Execution in Rdoc CVE-2021-31799, GHSA-ggxm-pgc9-g7fp | High | Not scored | 01 Sep, 2021 | RubyGems rdoc |
Regular Expression Denial of Service in Addressable templates CVE-2021-32740, GHSA-jxhc-q857-3j6g | High | Not scored | 12 Jul, 2021 | RubyGems addressable |
Code injection in Narou CVE-2021-35514, GHSA-gwrj-88fp-5m36 | High | Not scored | 02 Jul, 2021 | RubyGems narou |
Exposure of Sensitive Information to an Unauthorized Actor in foreman_fog_proxmox CVE-2021-20259, GHSA-f2rp-4rv7-fc95 | High | Not scored | 10 Jun, 2021 | RubyGems foreman_fog_proxmox |
HTTP Request Smuggling in goliath CVE-2020-7671, GHSA-3892-2r52-p65m, SNYK-RUBY-GOLIATH-569136 | High | Not scored | 24 May, 2021 | RubyGems goliath |
HTTP Request Smuggling in reel CVE-2020-7659, GHSA-x3v4-pxvm-63j8, SNYK-RUBY-REEL-569135 | High | Not scored | 24 May, 2021 | RubyGems reel |
Improper Certificate Validation in EM-HTTP-Request CVE-2020-13482, GHSA-q27f-v3r6-9v77 | High | Not scored | 24 May, 2021 | RubyGems em-http-request |
Dependency Confusion in Bundler CVE-2020-36327, GHSA-fp4w-jxhp-m23p | High | Not scored | 24 May, 2021 | RubyGems bundler |
Improper certificate validation in em-imap CVE-2020-13163, GHSA-4f68-49qq-h392 | High | Not scored | 24 May, 2021 | RubyGems em-imap |
Puma's Keepalive Connections Causing Denial Of Service CVE-2021-29509, GHSA-q28m-8xjw-8vr5 | High | Not scored | 18 May, 2021 | RubyGems puma |
Insecure path handling in Bundler CVE-2019-3881, GHSA-g98m-96g9-wfjq | High | Not scored | 10 May, 2021 | RubyGems bundler |
Tempfile on Windows path traversal vulnerability BIT-ruby-2021-28966, BIT-ruby-min-2021-28966, CVE-2021-28966, GHSA-46f2-3v63-3xrp | High | Not scored | 06 May, 2021 | RubyGems tmpdir |
Possible DoS Vulnerability in Action Controller Token Authentication CVE-2021-22904, GHSA-7wjx-3g7j-8584 | High | Not scored | 05 May, 2021 | RubyGems actionpack |
Action Pack contains Information Disclosure / Unintended Method Execution vulnerability CVE-2021-22885, GHSA-hjg4-8q5f-x6fm | High | Not scored | 05 May, 2021 | RubyGems actionpack |
Denial of Service in Action Dispatch CVE-2021-22902, GHSA-g8ww-46x2-2p65 | High | Not scored | 05 May, 2021 | RubyGems actionpack |
REXML round-trip instability BIT-ruby-2021-28965, BIT-ruby-min-2021-28965, CVE-2021-28965, GHSA-8cr8-4vfw-mr7h | High | Not scored | 30 Apr, 2021 | RubyGems rexml |
Pgsync Contains Cleartext Transmission of Sensitive Information CVE-2021-31671, GHSA-72rj-36qc-47g7 | High | Not scored | 27 Apr, 2021 | RubyGems pgsync |
Improper Certificate Validation in oauth ruby gem CVE-2016-11086, GHSA-7359-3c6r-hfc2 | High | Not scored | 22 Apr, 2021 | RubyGems oauth |
Cross-Site Request Forgery (CSRF) in trestle-auth CVE-2021-29435, GHSA-h8hx-2c5r-32cf | High | Not scored | 13 Apr, 2021 | RubyGems trestle-auth |
Remote code execution in Kramdown CVE-2021-28834, GHSA-52p9-v744-mwjj | High | Not scored | 29 Mar, 2021 | RubyGems kramdown |
Active Record subject to Regular Expression Denial-of-Service (ReDoS) CVE-2021-22880, GHSA-8hc4-xxm3-5ppp | High | Not scored | 02 Mar, 2021 | RubyGems activerecord |
Command Injection in lodash CVE-2021-23337, GHSA-35jh-r3h4-6jhm | High | 21.3% | 15 Feb, 2021 | RubyGems lodash-rails npm lodash npm lodash-es npm lodash-template +1 more |
Code Injection vulnerability in CarrierWave::RMagick CVE-2021-21305, GHSA-cf3w-g86h-35x4 | High | Not scored | 08 Feb, 2021 | RubyGems carrierwave |
Command Injection Vulnerability in Mechanize CVE-2021-21289, GHSA-qrqm-fpv6-6r8g | High | Not scored | 02 Feb, 2021 | RubyGems mechanize |
omniauth-apple allows attacker to fake their email address during authentication CVE-2020-26254, GHSA-49r3-2549-3633 | High | Not scored | 08 Dec, 2020 | RubyGems omniauth-apple |
Authorization bypass in Spree CVE-2020-26223, GHSA-m2jr-hmc3-qmpr | High | Not scored | 13 Nov, 2020 | RubyGems spree_api |
Remote code execution in dependabot-core branch names when cloning CVE-2020-26222, GHSA-23f7-99jx-m54r | High | Not scored | 13 Nov, 2020 | RubyGems dependabot-common RubyGems dependabot-omnibus |
Regression in JWT Signature Validation CVE-2020-15240, GHSA-58r4-h6v8-jcvm | High | Not scored | 03 Nov, 2020 | RubyGems omniauth-auth0 |