Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Uncontrolled resource consumption and loop with unreachable exit condition in facil.io and downstream iodine ruby gem CVE-2026-41146, GHSA-2x79-gwq3-vxxm | High | 0.4% | 14 Apr, 2026 | RubyGems iodine |
Decidim amendments can be accepted or rejected by anyone CVE-2026-40869, GHSA-w5xj-99cg-rccm | High | 0.2% | 14 Apr, 2026 | RubyGems decidim-core |
Fat Free CRM has BOLA in DELETE /emails/:id - Any authenticated user can hit this endpoint and delete emails by ID GHSA-9pm8-vwc5-w2hm | Low | Not scored | 14 Apr, 2026 | RubyGems fat_free_crm |
Decidim has a cross-site scripting (XSS) in user name CVE-2026-23891, GHSA-fc46-r95f-hq7g | Critical | 0.4% | 13 Apr, 2026 | RubyGems decidim-core |
bsv-sdk ARC broadcaster treats INVALID/MALFORMED/ORPHAN responses as successful broadcasts CVE-2026-40069, GHSA-9hfr-gw99-8rhx | High | 0.3% | 09 Apr, 2026 | RubyGems bsv-sdk |
bsv-sdk and bsv-wallet persist unverified certifier signatures in acquire_certificate (direct and issuance paths) CVE-2026-40070, GHSA-hc36-c89j-5f4j | High | 0.1% | 09 Apr, 2026 | RubyGems bsv-sdk RubyGems bsv-wallet |
Rack::Session::Cookie secrets: decrypt failure fallback enables secretless session forgery and Marshal deserialization CVE-2026-39324, GHSA-33qg-7wpp-89cq | Critical | 0.3% | 08 Apr, 2026 | RubyGems rack-session |
Addressable has a Regular Expression Denial of Service in Addressable templates CVE-2026-35611, GHSA-h27x-rffw-24p4 | High | 0.4% | 08 Apr, 2026 | RubyGems addressable |
rdiscount has an Out-of-bounds Read CVE-2026-35201, GHSA-6r34-94wq-jhrc | Medium | 0.3% | 06 Apr, 2026 | RubyGems rdiscount |
Rack::Request accepts invalid Host characters, enabling host allowlist bypass CVE-2026-34835, GHSA-g2pf-xv49-m2h5 | Medium | 0.2% | 02 Apr, 2026 | RubyGems rack |
Rack has Content-Length mismatch in Rack::Files error responses CVE-2026-34831, GHSA-q2ww-5357-x388 | Medium | 0.2% | 02 Apr, 2026 | RubyGems rack |
Rack::Sendfile header-based X-Accel-Mapping regex injection enables unauthorized X-Accel-Redirect CVE-2026-34830, GHSA-qv7j-4883-hwh7 | Medium | 0.2% | 02 Apr, 2026 | RubyGems rack |
Rack's multipart parsing without Content-Length header allows unbounded chunked file uploads CVE-2026-34829, GHSA-8vqr-qjwx-82mw | High | 0.4% | 02 Apr, 2026 | RubyGems rack |
Rack has a root directory disclosure via unescaped regex interpolation in Rack::Directory CVE-2026-34763, GHSA-7mqq-6cf9-v2qp | Medium | 0.3% | 02 Apr, 2026 | RubyGems rack |
Rack has quadratic complexity in Rack::Utils.select_best_encoding via wildcard Accept-Encoding header CVE-2026-34230, GHSA-v569-hp3g-36wr | High | 0.4% | 02 Apr, 2026 | RubyGems rack |
Rack: Forwarded Header semicolon injection enables Host and Scheme spoofing CVE-2026-32762, GHSA-qfgr-crr9-7r49 | Medium | 0.2% | 02 Apr, 2026 | RubyGems rack |
Rack's improper unfolding of folded multipart headers preserves CRLF in parsed parameter values CVE-2026-26962, GHSA-rx22-g9mx-qrhv | Medium | 0.2% | 02 Apr, 2026 | RubyGems rack |
Rack's greedy multipart boundary parsing can cause parser differentials and WAF bypass. CVE-2026-26961, GHSA-vgpv-f759-9wx3 | Medium | 0.3% | 02 Apr, 2026 | RubyGems rack |
Rack's multipart header parsing allows Denial of Service via escape-heavy quoted parameters CVE-2026-34827, GHSA-v6x5-cg8r-vv6x | High | 0.5% | 02 Apr, 2026 | RubyGems rack |
Rack's multipart byte range processing allows denial of service via excessive overlapping ranges CVE-2026-34826, GHSA-x8cg-fq8g-mxfx | Medium | 0.4% | 02 Apr, 2026 | RubyGems rack |
Rack:: Static header_rules bypass via URL-encoded paths CVE-2026-34786, GHSA-q4qf-9j86-f5mh | Medium | 0.2% | 02 Apr, 2026 | RubyGems rack |
Rack::Static prefix matching can expose unintended files under the static root CVE-2026-34785, GHSA-h2jq-g4cq-5ppq | High | 0.4% | 02 Apr, 2026 | RubyGems rack |
Trix is vulnerable to XSS through JSON deserialization bypass in drag-and-drop (Level0InputController) CVE-2026-73427, GHSA-53p3-c7vp-4mcc | Low | 0.6% | 29 Mar, 2026 | RubyGems action_text-trix npm trix |
Ruby LSP has arbitrary code execution through branch setting CVE-2026-34060, GHSA-c4r5-fxqw-vh93 | High | 0.5% | 27 Mar, 2026 | RubyGems ruby-lsp |
MCP Ruby SDK: Insufficient Session Binding Allows SSE Stream Hijacking via Session ID Replay CVE-2026-33946, GHSA-qvqr-5cv7-wh35 | High | 0.5% | 27 Mar, 2026 | RubyGems mcp |
Malicious release: Malicious code in monolith-twirp-codingagentintegrations-codingagentintegrations (RubyGems) GHSA-m7wg-pxqp-335v, MAL-2026-2265 | Malicious | Not scored | 27 Mar, 2026 | RubyGems monolith-twirp-codingagentintegrations-codingagentintegrations |
Malicious release: Malicious code in monolith-twirp-copilot-registry (RubyGems) GHSA-7gx2-vrc5-8h3j, MAL-2026-2266 | Malicious | Not scored | 27 Mar, 2026 | RubyGems monolith-twirp-copilot-registry |
Malicious release: Malicious code in monolith-twirp-partitioning-pull_requests (RubyGems) GHSA-8gr7-86m4-34p7, MAL-2026-2267 | Malicious | Not scored | 27 Mar, 2026 | RubyGems monolith-twirp-partitioning-pull_requests |
Malicious release: Malicious code in monolith-twirp-reposinsights-reposinsights (RubyGems) GHSA-jv2c-ggw4-8cx7, MAL-2026-2263 | Malicious | Not scored | 27 Mar, 2026 | RubyGems monolith-twirp-reposinsights-reposinsights |
Malicious release: Malicious code in monolith-twirp-pullsd-teams (RubyGems) GHSA-rgc6-cw8v-59mw, MAL-2026-2262 | Malicious | Not scored | 27 Mar, 2026 | RubyGems monolith-twirp-pullsd-teams |
Malicious release: Malicious code in monolith-twirp-loops-core (RubyGems) GHSA-92p7-h3wm-fr96, MAL-2026-2259 | Malicious | Not scored | 27 Mar, 2026 | RubyGems monolith-twirp-loops-core |
Malicious release: Malicious code in monolith-twirp-pullsd-repositories (RubyGems) GHSA-cmp7-3c7r-c22j, MAL-2026-2261 | Malicious | Not scored | 27 Mar, 2026 | RubyGems monolith-twirp-pullsd-repositories |
Malicious release: Malicious code in monolith-twirp-pullsd-pullrequestinfo (RubyGems) GHSA-88pj-869j-j8c7, MAL-2026-2260 | Malicious | Not scored | 27 Mar, 2026 | RubyGems monolith-twirp-pullsd-pullrequestinfo |
Malicious release: Malicious code in monolith-twirp-scribe-scribe (RubyGems) GHSA-qmwp-cjhr-hwf2, MAL-2026-2264 | Malicious | Not scored | 27 Mar, 2026 | RubyGems monolith-twirp-scribe-scribe |
Loofah has improper detection of disallowed URIs via `allowed_uri?` GHSA-2j22-pr5w-6gq8 | Low | Not scored | 26 Mar, 2026 | RubyGems loofah |
Rails Active Storage has a possible DoS vulnerability in proxy mode via multi-range requests CVE-2026-33658, GHSA-p9fm-f462-ggrg | Low | 0.5% | 25 Mar, 2026 | RubyGems activestorage |
iCalendar has ICS injection via unsanitized URI property values CVE-2026-33635, GHSA-pv9c-9mfh-hvxq | Medium | 0.3% | 24 Mar, 2026 | RubyGems icalendar |
Malicious release: Malicious code in plugin-gem-example (RubyGems) GHSA-xx9m-8846-6fh9, MAL-2026-2402 | Malicious | Not scored | 24 Mar, 2026 | RubyGems plugin-gem-example |
Rails Active Storage has possible glob injection in its DiskService CVE-2026-33202, GHSA-73f9-jhhh-hr5m | Medium | 0.7% | 23 Mar, 2026 | RubyGems activestorage |
Rails Active Storage has possible Path Traversal in DiskService CVE-2026-33195, GHSA-9xrj-h377-fr87 | High | 0.6% | 23 Mar, 2026 | RubyGems activestorage |
Rails Active Support has a possible DoS vulnerability in its number helpers CVE-2026-33176, GHSA-2j26-frm8-cmj9 | Medium | 0.9% | 23 Mar, 2026 | RubyGems activesupport |
Rails Active Storage has a possible DoS vulnerability when in proxy mode via Range requests CVE-2026-33174, GHSA-r46p-8f7g-vvvg | Medium | 0.6% | 23 Mar, 2026 | RubyGems activestorage |
Rails Active Storage has possible content type bypass via metadata in direct uploads CVE-2026-33173, GHSA-qcfx-2mfw-w4cg | Medium | 0.4% | 23 Mar, 2026 | RubyGems activestorage |
Rails Active Support has a possible XSS vulnerability in SafeBuffer#% CVE-2026-33170, GHSA-89vf-4333-qx8v | Medium | 0.3% | 23 Mar, 2026 | RubyGems activesupport |
Rails Active Support has a possible ReDoS vulnerability in number_to_delimited CVE-2026-33169, GHSA-cg4j-q9v8-6v38 | Medium | 0.7% | 23 Mar, 2026 | RubyGems activesupport |
Rails has a possible XSS vulnerability in its Action View tag helpers CVE-2026-33168, GHSA-v55j-83pf-r9cq | Low | 0.7% | 23 Mar, 2026 | RubyGems actionview |
Rails has a possible XSS vulnerability in its Action Pack debug exceptions CVE-2026-33167, GHSA-pgm4-439c-5jp6 | Low | 0.3% | 23 Mar, 2026 | RubyGems actionpack |
Graphiti Affected by Arbitrary Method Execution via Unvalidated Relationship Names CVE-2026-33286, GHSA-3m5v-4xp5-gjg2 | Critical | 0.6% | 20 Mar, 2026 | RubyGems graphiti |
bcrypt-ruby has an Integer Overflow that Causes Zero Key-Strengthening Iterations at Cost=31 on JRuby CVE-2026-33306, GHSA-f27w-vcwj-c954 | Medium | 0.2% | 19 Mar, 2026 | RubyGems bcrypt |
Ruby JSON has a format string injection vulnerability CVE-2026-33210, GHSA-3m6g-2423-7cp3 | High | 0.9% | 19 Mar, 2026 | RubyGems json |