Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in aituhdbvptgs (RubyGems) GHSA-p6h8-3cvx-5585, MAL-2026-7488 | Malicious | Not scored | 07 Jul, 2026 | RubyGems aituhdbvptgs |
Malicious release: Malicious code in aitdodvcpoam (RubyGems) GHSA-22h6-5q95-f432, MAL-2026-7486 | Malicious | Not scored | 07 Jul, 2026 | RubyGems aitdodvcpoam |
Malicious release: Malicious code in aicalunosquaz (RubyGems) GHSA-32cq-577r-9vc6, MAL-2026-7483 | Malicious | Not scored | 07 Jul, 2026 | RubyGems aicalunosquaz |
Malicious release: Malicious code in aidoklxlhvfkeq (RubyGems) GHSA-j4cp-qrrj-925x, MAL-2026-7484 | Malicious | Not scored | 07 Jul, 2026 | RubyGems aidoklxlhvfkeq |
Malicious release: Malicious code in aitdaludfnfq (RubyGems) GHSA-wqhq-r88q-pc35, MAL-2026-7485 | Malicious | Not scored | 07 Jul, 2026 | RubyGems aitdaludfnfq |
Malicious release: Malicious code in aicaltdfdlekz (RubyGems) GHSA-2hw5-p72w-3ch7, MAL-2026-7481 | Malicious | Not scored | 07 Jul, 2026 | RubyGems aicaltdfdlekz |
Malicious release: Malicious code in aicaltroixtqg (RubyGems) GHSA-6fw8-vpf6-mpqx, MAL-2026-7482 | Malicious | Not scored | 07 Jul, 2026 | RubyGems aicaltroixtqg |
Malicious release: Malicious code in aicalojdhdxoa (RubyGems) GHSA-4pf9-pqvc-3jg9, MAL-2026-7480 | Malicious | Not scored | 07 Jul, 2026 | RubyGems aicalojdhdxoa |
Malicious release: Malicious code in aicalllngxwwh (RubyGems) GHSA-f2p2-m3pq-39fr, MAL-2026-7479 | Malicious | Not scored | 07 Jul, 2026 | RubyGems aicalllngxwwh |
Malicious release: Malicious code in agfossstd21 (RubyGems) GHSA-333w-rq7m-3w56, MAL-2026-7478 | Malicious | Not scored | 07 Jul, 2026 | RubyGems agfossstd21 |
Malicious release: Malicious code in agfosslic24 (RubyGems) GHSA-7vr9-2pfp-9w4g, MAL-2026-7476 | Malicious | Not scored | 07 Jul, 2026 | RubyGems agfosslic24 |
Malicious release: Malicious code in agfosssacre22 (RubyGems) GHSA-mwfg-26h4-m935, MAL-2026-7477 | Malicious | Not scored | 07 Jul, 2026 | RubyGems agfosssacre22 |
Malicious release: Malicious code in agfossgrant23 (RubyGems) GHSA-jp6x-j4wj-pmvq, MAL-2026-7475 | Malicious | Not scored | 07 Jul, 2026 | RubyGems agfossgrant23 |
Malicious release: Malicious code in agfosscab20 (RubyGems) GHSA-mqx5-7r68-m823, MAL-2026-7474 | Malicious | Not scored | 07 Jul, 2026 | RubyGems agfosscab20 |
Malicious release: Malicious code in agentoaitestabc123 (RubyGems) GHSA-p8p4-8qq5-h277, MAL-2026-7473 | Malicious | Not scored | 07 Jul, 2026 | RubyGems agentoaitestabc123 |
Malicious release: Malicious code in abcfoobar1778550629075869 (RubyGems) GHSA-6v8w-647p-45g4, MAL-2026-7471 | Malicious | Not scored | 07 Jul, 2026 | RubyGems abcfoobar1778550629075869 |
Malicious release: Malicious code in abcfoobar1778550632348198 (RubyGems) GHSA-gmpq-h2m9-r735, MAL-2026-7472 | Malicious | Not scored | 07 Jul, 2026 | RubyGems abcfoobar1778550632348198 |
Malicious release: Malicious code in abcfoobar1778550625683711 (RubyGems) GHSA-2q77-mj2w-wwm8, MAL-2026-7470 | Malicious | Not scored | 07 Jul, 2026 | RubyGems abcfoobar1778550625683711 |
Malicious release: Malicious code in a0a_arcgraph (RubyGems) GHSA-j8v7-3h33-7p49, MAL-2026-7469 | Malicious | Not scored | 07 Jul, 2026 | RubyGems a0a_arcgraph |
Malicious release: Malicious code in a00_arcguide (RubyGems) GHSA-q64v-8pxj-6w86, MAL-2026-7468 | Malicious | Not scored | 07 Jul, 2026 | RubyGems a00_arcguide |
pay-rails/pay: non-constant-time HMAC comparison in Paddle Billing webhook signature verifier CVE-2026-70658, GHSA-mjgf-xj26-9qf9 | High | 0.6% | 01 Jul, 2026 | RubyGems pay |
YARD static cache reads raw traversal paths before router sanitization CVE-2026-49342, GHSA-pxcc-8665-phx8 | Medium | 0.3% | 26 Jun, 2026 | RubyGems yard |
fluent-plugin-opentelemetry Has Denial of Service (DoS) via Large Payloads and Decompression Bombs in `in_opentelemetry` CVE-2026-44163, GHSA-2jc5-xhx8-qj6h | Medium | 0.4% | 26 Jun, 2026 | RubyGems fluent-plugin-opentelemetry |
fluent-plugin-s3 Vulnerable to Denial of Service (DoS) via Decompression Bomb in `in_s3` CVE-2026-44162, GHSA-xv9w-7v6q-hpjh | Low | 0.5% | 26 Jun, 2026 | RubyGems fluent-plugin-s3 |
Fluentd is Vulnerable to Server-Side Request Forgery (SSRF) via Placeholder Expansion in `out_http` BIT-fluentd-2026-44161, CVE-2026-44161, GHSA-72f5-rr8c-r6gr | High | 0.4% | 26 Jun, 2026 | RubyGems fluentd |
Fluentd is Vulnerable to Denial of Service (DoS) via Gzip Decompression Bomb in `in_http` and `in_forward` BIT-fluentd-2026-44160, CVE-2026-44160, GHSA-j9cw-hwqf-85w7 | High | 0.6% | 26 Jun, 2026 | RubyGems fluentd |
Fluentd is Vulnerable to Exposure of Sensitive Information via Monitor Agent API BIT-fluentd-2026-44025, CVE-2026-44025, GHSA-pr7j-96cj-549h | High | 0.5% | 26 Jun, 2026 | RubyGems fluentd |
Fluentd is Vulnerable to Remote Code Execution (RCE) via Arbitrary File Write in `${tag}` Placeholder BIT-fluentd-2026-44024, CVE-2026-44024, GHSA-44hj-4m45-frj3 | Critical | 1.1% | 26 Jun, 2026 | RubyGems fluentd |
Concurrent Ruby: ReadWriteLock allows wrong-thread write release and stray read-release counter corruption CVE-2026-54906, GHSA-6wx8-w4f5-wwcr | Low | 0.2% | 19 Jun, 2026 | RubyGems concurrent-ruby |
Concurrent Ruby: `ReentrantReadWriteLock` read-count overflow grants a write lock without exclusivity CVE-2026-54905, GHSA-wv3x-4vxv-whpp | Low | 0.2% | 19 Jun, 2026 | RubyGems concurrent-ruby |
Concurrent Ruby : `AtomicReference#update` livelocks when the stored value is `Float::NAN` CVE-2026-54904, GHSA-h8w8-99g7-qmvj | High | 0.7% | 19 Jun, 2026 | RubyGems concurrent-ruby |
Oj: Integer Overflow in Oj.load 2GB String Handling CVE-2026-54903, GHSA-475m-ph3x-64gp | High | 0.4% | 19 Jun, 2026 | RubyGems oj |
Oj: Use-After-Free in Oj::Parser SAJ Long Key Callback CVE-2026-54902, GHSA-m578-w5vf-rfcm | High | 0.5% | 19 Jun, 2026 | RubyGems oj |
Oj: Use-After-Free in Oj::Parser array_class/hash_class GC Marking CVE-2026-54901, GHSA-vwm4-62gf-x745 | High | 0.4% | 19 Jun, 2026 | RubyGems oj |
Oj: Negative-Size memcpy in Oj::Parser create_id Attribute Handling CVE-2026-54900, GHSA-9cv6-qcjw-4grx | High | 0.5% | 19 Jun, 2026 | RubyGems oj |
Oj: Use-After-Free in Oj::Parser SAJ Callback via Input Mutation CVE-2026-54898, GHSA-q2gm-54r6-8fwm | High | 0.2% | 19 Jun, 2026 | RubyGems oj |
Oj: Use-After-Free in Oj::Doc Iterators via Reentrant Close CVE-2026-54897, GHSA-9ppp-w3g4-fh4q | High | 0.2% | 19 Jun, 2026 | RubyGems oj |
Oj: Heap Buffer Overflow in Oj.dump Exception Serialization via Large Indent CVE-2026-54896, GHSA-35w3-pjm6-wj95 | High | 0.2% | 19 Jun, 2026 | RubyGems oj |
Oj: Stack Buffer Overflow in Oj::Doc#each_child via Deeply Nested Input CVE-2026-54592, GHSA-3m6q-jj5j-38c9 | High | 0.3% | 19 Jun, 2026 | RubyGems oj |
Oj: intern.c form_attr (uninitialized stack read) CVE-2026-54500, GHSA-fm7p-mprw-wjm9 | Medium | 0.2% | 19 Jun, 2026 | RubyGems oj |
Faraday: Uncontrolled recursion in NestedParamsEncoder allows stack exhaustion DoS via deeply nested query parameters CVE-2026-54297, GHSA-98m9-hrrm-r99r | High | 0.8% | 19 Jun, 2026 | RubyGems faraday |
Oj: Stack Buffer Overflow in Oj.dump via Large Indent CVE-2026-54502, GHSA-3v45-f3vh-wg7m | High | 0.4% | 19 Jun, 2026 | RubyGems oj |
Oj: Use-After-Free in Oj::Parser Symbol Key Cache Toggle CVE-2026-54899, GHSA-2cw7-v8ff-p88r | High | 0.4% | 19 Jun, 2026 | RubyGems oj |
AlchemyCMS: Unauthenticated nested page API leaks restricted & unpublished content CVE-2026-57579, GHSA-mqq5-j7w8-2hgh | High | 0.6% | 19 Jun, 2026 | RubyGems alchemy_cms |
Nokogiri: Possible Use-After-Free when setting an attribute value via `Nokogiri::XML::Attr#value=` or `#content=` CVE-2026-57435, GHSA-phwj-rprq-35pp | Low | 0.5% | 19 Jun, 2026 | RubyGems nokogiri |
Nokogiri: Possible Use-After-Free in XInclude Processing CVE-2026-57438, GHSA-wfpw-mmfh-qq69 | Low | 0.1% | 19 Jun, 2026 | RubyGems nokogiri |
Nokogiri: Possible Use-After-Free when directly using `NokogirI::XML::XPathContext` beyond document lifetime CVE-2026-57437, GHSA-p67v-3w7g-wjg7 | Low | 0.4% | 19 Jun, 2026 | RubyGems nokogiri |
Nokogiri: Possible Use-After-Free when setting `Document#root=` to an invalid node type CVE-2026-57436, GHSA-wjv4-x9w8-wm3h | Low | 0.4% | 19 Jun, 2026 | RubyGems nokogiri |
Nokogiri: Possible Out-of-Bounds Read in `Nokogiri::XML::NodeSet#[]` CVE-2026-57235, GHSA-5prr-v3j2-97mh | Medium | 0.4% | 19 Jun, 2026 | RubyGems nokogiri |
Nokogiri: Null Pointer Dereference calling methods on uninitialized wrapper classes CVE-2026-57434, GHSA-9cv2-cfxc-v4v2 | Low | 0.5% | 19 Jun, 2026 | RubyGems nokogiri |