Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Nokogiri: XML::Schema on JRuby allows network requests when NONET is set, bypassing CVE-2020-26247 CVE-2026-57234, GHSA-8678-w3jw-xfc2 | Low | 0.2% | 19 Jun, 2026 | RubyGems nokogiri |
Nokogiri: Possible Use-After-Free when `Nokogiri::XML::Document#encoding=` raises an exception CVE-2026-57236, GHSA-5v8h-3h3q-446p | Low | 0.4% | 19 Jun, 2026 | RubyGems nokogiri |
Malicious release: Malicious code in final-poc-usa (RubyGems) GHSA-c28g-mxf8-h57f, MAL-2026-6118 | Malicious | Not scored | 18 Jun, 2026 | RubyGems final-poc-usa |
Malicious release: Malicious code in final-shoaib (RubyGems) GHSA-wf6x-pwc6-hx2g, MAL-2026-6117 | Malicious | Not scored | 18 Jun, 2026 | RubyGems final-shoaib |
Avo: Missing Authorization in Avo Association Attach Endpoint Allows Unauthorized Relationship Manipulation and Privilege Escalation CVE-2026-55518, GHSA-8fq9-273g-6mrg | Critical | 0.4% | 17 Jun, 2026 | RubyGems avo |
katello: missing repository authorization in content_uploads exposes cross-product content existence CVE-2026-12515, GHSA-c43c-rf7g-5xpg | Medium | 0.2% | 17 Jun, 2026 | RubyGems katello |
Net::IMAP: Command Injection via ID command argument CVE-2026-47242, GHSA-46q3-7gv7-qmgg | Medium | 0.2% | 09 Jun, 2026 | RubyGems net-imap |
Net::IMAP: Denial of Service via incomplete raw argument validation CVE-2026-47241, GHSA-c4fp-cxrr-mj66 | Low | 0.4% | 09 Jun, 2026 | RubyGems net-imap |
Net::IMAP: Command Injection via non-synchronizing literal in "raw" argument CVE-2026-47240, GHSA-8p34-64r3-mwg8 | Medium | 0.8% | 09 Jun, 2026 | RubyGems net-imap |
Puma PROXY Protocol v1 Accepts Repeated Protocol Headers on Persistent Connections CVE-2026-47737, GHSA-2vqw-3mp8-cgmx | High | 0.2% | 09 Jun, 2026 | RubyGems puma |
Puma PROXY Protocol v1 Parser Allows Remote Memory Exhaustion CVE-2026-47736, GHSA-qpgp-93vx-g8v8 | High | 0.3% | 08 Jun, 2026 | RubyGems puma |
Spree: CSV Formula Injection in Customer Export GHSA-xf4v-w5x5-pv79 | Medium | Not scored | 04 Jun, 2026 | RubyGems spree |
Doorkeeper Openid Connect: Dynamic Client Registration feature creates public clients with client_secret CVE-2026-44476, GHSA-m6vc-f87m-cc2h | Medium | 0.6% | 04 Jun, 2026 | RubyGems doorkeeper-openid_connect |
Malicious release: Malicious code in align_rest_api (RubyGems) GHSA-9pwh-fhvv-qr5q, MAL-2026-5149 | Malicious | Not scored | 01 Jun, 2026 | RubyGems align_rest_api |
CarrierWave has a denylisted_content_type bypass via Unescaped Regex Metacharacters CVE-2026-44587, GHSA-7g26-2qgj-chfg | Medium | 0.2% | 27 May, 2026 | RubyGems carrierwave |
ruby-jwt: Empty-key HMAC bypass; cross-language sibling of CVE-2026-44351 CVE-2026-45363, GHSA-c32j-vqhx-rx3x | High | 0.4% | 18 May, 2026 | RubyGems jwt |
Faraday has a possible incomplete fix for GHSA-33mh-2634-fwr2: protocol-relative URI objects still bypass host scoping CVE-2026-33637, GHSA-5rv5-xj5j-3484 | Low | 0.3% | 18 May, 2026 | RubyGems faraday |
Malicious release: Malicious code in knot-rails-assets-pipeline (RubyGems) GHSA-5548-89gq-w58f, MAL-2026-3634 | Malicious | Not scored | 13 May, 2026 | RubyGems knot-rails-assets-pipeline |
Malicious release: Malicious code in knot-devise-jwt-helper (RubyGems) GHSA-5mm5-vm3m-435p, MAL-2026-3632 | Malicious | Not scored | 13 May, 2026 | RubyGems knot-devise-jwt-helper |
Malicious release: Malicious code in knot-date-utils-rb (RubyGems) GHSA-9967-5rmh-qrxc, MAL-2026-3631 | Malicious | Not scored | 13 May, 2026 | RubyGems knot-date-utils-rb |
Malicious release: Malicious code in knot-simple-formatter (RubyGems) GHSA-hhcv-8cwc-9rm2, MAL-2026-3636 | Malicious | Not scored | 13 May, 2026 | RubyGems knot-simple-formatter |
Malicious release: Malicious code in knot-rspec-formatter-json (RubyGems) GHSA-mf6f-65vp-grjw, MAL-2026-3635 | Malicious | Not scored | 13 May, 2026 | RubyGems knot-rspec-formatter-json |
Malicious release: Malicious code in knot-rack-session-store (RubyGems) GHSA-mmgc-wvxc-qqjm, MAL-2026-3633 | Malicious | Not scored | 13 May, 2026 | RubyGems knot-rack-session-store |
Malicious release: Malicious code in knot-activesupport-logger (RubyGems) GHSA-mwfv-hv2h-2pgf, MAL-2026-3630 | Malicious | Not scored | 13 May, 2026 | RubyGems knot-activesupport-logger |
view_component: System Test Entry Point Path Check Allows Sibling Directory Escape CVE-2026-44837, GHSA-hg3h-g7xc-f7vp | Medium | 0.4% | 08 May, 2026 | RubyGems view_component |
view_component: Preview Route Can Dispatch Inherited Helper Methods CVE-2026-44836, GHSA-7f3r-gwc9-2995 | Medium | 0.3% | 08 May, 2026 | RubyGems view_component |
Devise has an Open Redirect via Unvalidated `request.referrer` in Timeoutable Session Timeout Handler CVE-2026-40295, GHSA-jp94-3292-c3xv | Medium | 0.2% | 08 May, 2026 | RubyGems devise |
Sidekiq-cron is vulnerable to a cross-site scripting (xss) vulnerability via crafted URL CVE-2025-67202, GHSA-xv9c-mjw8-79gf | Medium | 0.2% | 07 May, 2026 | RubyGems sidekiq-cron |
katalyst-koi: Session cookies can be replayed after user logout CVE-2026-44511, GHSA-4cx3-3c38-j9vv | High | 0.2% | 07 May, 2026 | RubyGems katalyst-koi |
CSS Parser: Improper Certificate Validation allows MITM injection of remote CSS content CVE-2026-44312, GHSA-ff6c-w6qf-7xqc | Medium | 0.1% | 07 May, 2026 | RubyGems css_parser |
Nokogiri XSLT transform has a memory leak CVE-2026-79771, GHSA-v2fc-qm4h-8hqv | Medium | 0.4% | 06 May, 2026 | RubyGems nokogiri |
Nokogiri CSS selector tokenizer has regular expression backtracking CVE-2026-79770, GHSA-c4rq-3m3g-8wgx | High | 0.5% | 06 May, 2026 | RubyGems nokogiri |
GraphQL-Ruby's Ruby lexer does not count comment tokens for the purposes of max_query_string_tokens GHSA-3h96-34p3-xm76 | Medium | Not scored | 05 May, 2026 | RubyGems graphql |
net-imap vulnerable to command Injection via "raw" arguments to multiple commands CVE-2026-42257, GHSA-hm49-wcqc-g2xg | Medium | 0.4% | 04 May, 2026 | RubyGems net-imap |
net-imap vulnerable to command Injection via unvalidated Symbol inputs CVE-2026-42258, GHSA-75xq-5h9v-w6px | Medium | 0.8% | 04 May, 2026 | RubyGems net-imap |
net-imap vulnerable to denial of service via high iteration count for `SCRAM-*` authentication CVE-2026-42256, GHSA-87pf-fpwv-p7m7 | Medium | 0.3% | 04 May, 2026 | RubyGems net-imap |
net-imap has quadratic complexity when reading response literals CVE-2026-42245, GHSA-q2mw-fvj9-vvcw | Low | 0.4% | 04 May, 2026 | RubyGems net-imap |
net-imap vulnerable to STARTTLS stripping via invalid response timing CVE-2026-42246, GHSA-vcgp-9326-pqcp | High | 0.3% | 04 May, 2026 | RubyGems net-imap |
Avo: Broken Access Control Through Unauthorized Execution of Arbitrary Action Classes Across Resources CVE-2026-42205, GHSA-qc5p-3mg5-9fh8 | High | 0.3% | 24 Apr, 2026 | RubyGems avo |
ERB has an @_init deserialization guard bypass via def_module / def_method / def_class CVE-2026-41316, GHSA-q339-8rmv-2mhv | High | 1.1% | 24 Apr, 2026 | RubyGems erb |
OpenC3 COSMOS: Permissions Bypass Provides User Access to Unassigned Administrative Actions via Script Runner Tool CVE-2026-42088, GHSA-2wvh-87g2-89hr, PYSEC-2026-2245 | Critical | 0.3% | 23 Apr, 2026 | PyPI openc3 RubyGems openc3 |
OpenC3 COSMOS has SQL Injection in QuestDB Time-Series Database CVE-2026-42087, GHSA-v529-vhwc-wfc5, PYSEC-2026-2244 | Critical | 0.3% | 23 Apr, 2026 | PyPI openc3 RubyGems openc3 |
OpenC3 COSMOS is Vulnerable to Self-XSS Through the Command Sender CVE-2026-42086, GHSA-ffq5-qpvf-xq7x, PYSEC-2026-105 | Medium | 0.2% | 22 Apr, 2026 | PyPI openc3 RubyGems openc3 |
OpenC3 COSMOS allows arbitrary writes to plugins directory via path-traversed config filenames CVE-2026-42085, GHSA-4jvx-93h3-f45h, PYSEC-2026-2243 | Medium | 0.3% | 22 Apr, 2026 | PyPI openc3 RubyGems openc3 |
OpenC3 COSMOS: Hijacked session token can be used to reset password for persistence CVE-2026-42084, GHSA-wgx6-g857-jjf7, PYSEC-2026-2242 | High | 0.3% | 22 Apr, 2026 | PyPI openc3 RubyGems openc3 |
yard: Possible arbitrary path traversal and file access via yard server CVE-2026-41493, GHSA-3jfp-46x4-xgfj | Medium | 0.4% | 17 Apr, 2026 | RubyGems yard |
Buffer Overflow in Zlib::GzipReader ungetc via large input leads to memory corruption CVE-2026-27820, GHSA-g857-hhfv-j68w | Medium | 0.6% | 16 Apr, 2026 | RubyGems zlib |
Malicious release: Malicious code in monolith-twirp-pullsd-users (RubyGems) GHSA-4hrq-2ffw-r43p, MAL-2026-2816 | Malicious | Not scored | 16 Apr, 2026 | RubyGems monolith-twirp-pullsd-users |
Malicious release: Malicious code in monolith-twirp-pullsd-authorization (RubyGems) GHSA-q95q-37r8-9cmp, MAL-2026-2815 | Malicious | Not scored | 16 Apr, 2026 | RubyGems monolith-twirp-pullsd-authorization |
Malicious release: Malicious code in gitlab-orchestrator (RubyGems) GHSA-fpg3-pj6c-r8g2, MAL-2026-2814 | Malicious | Not scored | 16 Apr, 2026 | RubyGems gitlab-orchestrator |