Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Avo has a XSS vulnerability on `return_to` param CVE-2026-33209, GHSA-762r-27w2-q22j | Medium | 0.3% | 18 Mar, 2026 | RubyGems avo |
Improper detection of disallowed URIs by Loofah `allowed_uri?` GHSA-46fp-8f5p-pf2m | Low | Not scored | 18 Mar, 2026 | RubyGems loofah |
Malicious release: Malicious code in testcatplzignore (RubyGems) GHSA-gfv2-9r3q-xv4f, MAL-2026-1924 | Malicious | Not scored | 18 Mar, 2026 | RubyGems testcatplzignore |
Malicious release: Malicious code in sq-minimal-feature-flags (RubyGems) GHSA-c4ww-pjrh-jvhp, MAL-2026-1923 | Malicious | Not scored | 18 Mar, 2026 | RubyGems sq-minimal-feature-flags |
Malicious release: Malicious code in rubylogger (RubyGems) GHSA-5v73-6j22-qx2m, MAL-2026-1922 | Malicious | Not scored | 18 Mar, 2026 | RubyGems rubylogger |
Malicious release: Malicious code in resolvrtest (RubyGems) GHSA-p63r-38xr-4vqm, MAL-2026-1921 | Malicious | Not scored | 18 Mar, 2026 | RubyGems resolvrtest |
Malicious release: Malicious code in rails_structured_logging (RubyGems) GHSA-8279-74vj-vmc5, MAL-2026-1920 | Malicious | Not scored | 18 Mar, 2026 | RubyGems rails_structured_logging |
Malicious release: Malicious code in rafka-rb (RubyGems) GHSA-59hf-3rrf-fh9v, MAL-2026-1919 | Malicious | Not scored | 18 Mar, 2026 | RubyGems rafka-rb |
Malicious release: Malicious code in newlogger (RubyGems) GHSA-pc7p-8gqv-g3r4, MAL-2026-1918 | Malicious | Not scored | 18 Mar, 2026 | RubyGems newlogger |
Malicious release: Malicious code in kaleido (RubyGems) GHSA-xv4c-3p6c-xfhm, MAL-2026-1917 | Malicious | Not scored | 18 Mar, 2026 | RubyGems kaleido |
Malicious release: Malicious code in freshworks-ruby (RubyGems) GHSA-h7mp-mx24-m63j, MAL-2026-1916 | Malicious | Not scored | 18 Mar, 2026 | RubyGems freshworks-ruby |
Malicious release: Malicious code in doctolib (RubyGems) GHSA-p6wh-8gcc-mqrc, MAL-2026-1915 | Malicious | Not scored | 18 Mar, 2026 | RubyGems doctolib |
Devise has a confirmable "change email" race condition permits user to confirm email they have no access to CVE-2026-32700, GHSA-57hq-95w6-v4fc | Medium | 0.3% | 17 Mar, 2026 | RubyGems devise |
Katello: Denial of Service and potential information disclosure via SQL injection CVE-2026-4324, GHSA-fwj4-6wgp-mpxm | Medium | 0.3% | 17 Mar, 2026 | RubyGems katello |
Trix has a Stored XSS vulnerability through serialized attributes CVE-2026-73426, GHSA-qmpg-8xg6-ph5q | Medium | 0.3% | 12 Mar, 2026 | RubyGems action_text-trix npm trix |
sigstore-ruby verifier returns success for DSSE bundles with mismatched in-toto subject digest CVE-2026-31830, GHSA-mhg6-2q2v-9h2c | High | 0.3% | 11 Mar, 2026 | RubyGems sigstore |
Camaleon CMS vulnerable to Path Traversal through AWS S3 uploader implementation CVE-2026-1776, GHSA-jw5g-f64p-6x78 | Medium | 0.8% | 10 Mar, 2026 | RubyGems camaleon_cms |
rubyipmi is vulnerable to OS Command Injection through malicious usernames CVE-2026-0980, GHSA-hfcp-477w-3wjw | High | 0.9% | 27 Feb, 2026 | RubyGems rubyipmi |
Malicious release: Malicious code in newrubylogger (RubyGems) GHSA-ppf2-mgq7-9q2c, MAL-2026-1002 | Malicious | Not scored | 23 Feb, 2026 | RubyGems newrubylogger |
Malicious release: Malicious code in rubocop-vintedmetrics (RubyGems) GHSA-74p9-vf24-gx2h, MAL-2026-996 | Malicious | Not scored | 20 Feb, 2026 | RubyGems rubocop-vintedmetrics |
Nokogiri does not check the return value from xmlC14NExecute CVE-2026-79772, GHSA-wx95-c6cv-8532 | Medium | 0.3% | 18 Feb, 2026 | RubyGems nokogiri |
Stored XSS in Rack::Directory via javascript: filenames rendered into anchor href CVE-2026-25500, GHSA-whrj-4476-wvmp | Medium | 0.3% | 17 Feb, 2026 | RubyGems rack |
Rack has a Directory Traversal via Rack:Directory CVE-2026-22860, GHSA-mxw3-3hh2-x2mh | High | 0.8% | 17 Feb, 2026 | RubyGems rack |
Malicious release: Malicious code in cucumber_json_schema (RubyGems) GHSA-mg5m-qmr9-mphv, MAL-2026-906 | Malicious | Not scored | 15 Feb, 2026 | RubyGems cucumber_json_schema |
Bitcoinrb Vulnerable to Command injection via RPC GHSA-q66h-m87m-j2q6 | Low | Not scored | 10 Feb, 2026 | RubyGems bitcoinrb |
Faraday affected by SSRF via protocol-relative URL host override in build_exclusive_url CVE-2026-25765, GHSA-33mh-2634-fwr2 | Medium | 0.4% | 09 Feb, 2026 | RubyGems faraday |
Phlex XSS protection bypass via attribute splatting, dynamic tags, and href values GHSA-w67g-2h6v-vjgq | High | Not scored | 06 Feb, 2026 | RubyGems phlex |
Unauthenticated Spree Commerce users can access all guest addresses CVE-2026-25758, GHSA-87fh-rc96-6fr6 | High | 0.7% | 05 Feb, 2026 | RubyGems spree_api |
Unauthenticated Spree Commerce users can view completed guest orders by Order ID CVE-2026-25757, GHSA-p6pv-q7rc-g4h9 | High | 0.5% | 05 Feb, 2026 | RubyGems spree_storefront |
Decidim's private data exports can lead to data leaks CVE-2025-65017, GHSA-3cx6-j9j4-54mp | High | 0.3% | 03 Feb, 2026 | RubyGems decidim RubyGems decidim-core |
fog-kubevirt allows remote attacker to perform MITM attack due to disabled certificate validation CVE-2026-1530, GHSA-m3hq-3qj8-c5fm | High | 0.3% | 02 Feb, 2026 | RubyGems fog-kubevirt |
foreman_kubevirt disables SSL verification if a Certificate Authority (CA) certificate is not explicitly set CVE-2026-1531, GHSA-2qxw-7fmx-gqfm | High | 0.3% | 02 Feb, 2026 | RubyGems foreman_kubevirt |
Cassandra Web - Remote File Read CVE-2020-36939, GHSA-8mfv-xhp5-48q9 | High | 3.0% | 27 Jan, 2026 | RubyGems cassandra-web |
AlchemyCMS: Authenticated Remote Code Execution (RCE) via eval injection in ResourcesHelper CVE-2026-23885, GHSA-2762-657x-v979 | Medium | 0.5% | 21 Jan, 2026 | RubyGems alchemy_cms |
Active Job - Object injection security vulnerability GHSA-mpwp-4h2m-765c | Medium | Not scored | 16 Jan, 2026 | RubyGems activejob |
ActiveRecord-JDBC-Adapter (AR-JDBC) lib/arjdbc/jdbc/adapter.rb sql.gsub() Function SQL Injection GHSA-5qw5-wf2q-f538 | High | Not scored | 16 Jan, 2026 | RubyGems activerecord-jdbc-adapter |
openc3-api Vulnerable to Unauthenticated Remote Code Execution CVE-2025-68271, GHSA-w757-4qv9-mghp | Critical | 0.6% | 13 Jan, 2026 | RubyGems openc3 |
Spree API has Unauthenticated IDOR - Guest Address CVE-2026-22589, GHSA-3ghg-3787-w2xr | High | 0.4% | 08 Jan, 2026 | RubyGems spree_core |
Spree API has Authenticated Insecure Direct Object Reference (IDOR) via Order Modification CVE-2026-22588, GHSA-g268-72p7-9j6j | Medium | 0.4% | 08 Jan, 2026 | RubyGems spree_api |
Shakapacker has environment variable leak via EnvironmentPlugin that exposes secrets to client-side bundles GHSA-96qw-h329-v5rg | High | Not scored | 08 Jan, 2026 | RubyGems shakapacker npm shakapacker |
Trix has a stored XSS vulnerability through its attachment attribute GHSA-g9jg-w8vm-g96v | Medium | Not scored | 31 Dec, 2025 | RubyGems action_text-trix npm trix |
URI Credential Leakage Bypass over CVE-2025-27221 CVE-2025-61594, GHSA-j4pr-3wm6-xx2r | Low | 0.6% | 30 Dec, 2025 | RubyGems uri |
httparty Has Potential SSRF Vulnerability That Leads to API Key Leakage CVE-2025-68696, GHSA-hm5p-x4rq-38w4 | High | 0.3% | 23 Dec, 2025 | RubyGems httparty |
Malicious release: Malicious code in verificator (RubyGems) GHSA-7rh7-qcx5-r482, MAL-2025-192925 | Malicious | Not scored | 23 Dec, 2025 | RubyGems verificator |
Malicious release: Malicious code in u2f_client (RubyGems) GHSA-2xmq-87m8-w8jv, MAL-2025-192924 | Malicious | Not scored | 23 Dec, 2025 | RubyGems u2f_client |
Malicious release: Malicious code in test_gem_978483406ebb19126a2e8c001649a4eb (RubyGems) GHSA-39r9-2gm5-5wx7, MAL-2025-192923 | Malicious | Not scored | 23 Dec, 2025 | RubyGems test_gem_978483406ebb19126a2e8c001649a4eb |
Malicious release: Malicious code in stripe-server (RubyGems) GHSA-whq7-q96m-x8jh, MAL-2025-192922 | Malicious | Not scored | 23 Dec, 2025 | RubyGems stripe-server |
Malicious release: Malicious code in stripe-rubocop (RubyGems) GHSA-f97f-9jmh-gcv2, MAL-2025-192921 | Malicious | Not scored | 23 Dec, 2025 | RubyGems stripe-rubocop |
Malicious release: Malicious code in sq-samsa (RubyGems) GHSA-69j9-f8qf-87xw, MAL-2025-192919 | Malicious | Not scored | 23 Dec, 2025 | RubyGems sq-samsa |
Malicious release: Malicious code in stripe-backup (RubyGems) GHSA-f6vm-pcj3-pp9g, MAL-2025-192920 | Malicious | Not scored | 23 Dec, 2025 | RubyGems stripe-backup |