Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in space-commander (RubyGems) GHSA-c64m-6q6c-x7m5, MAL-2025-192917 | Malicious | Not scored | 23 Dec, 2025 | RubyGems space-commander |
Malicious release: Malicious code in sq-mdc (RubyGems) GHSA-h6jf-262m-h7cg, MAL-2025-192918 | Malicious | Not scored | 23 Dec, 2025 | RubyGems sq-mdc |
Malicious release: Malicious code in redis_connectable (RubyGems) GHSA-jcpm-3wq9-c6g9, MAL-2025-192916 | Malicious | Not scored | 23 Dec, 2025 | RubyGems redis_connectable |
Malicious release: Malicious code in rails-structured-logging (RubyGems) GHSA-4j8p-mfc7-qrrj, MAL-2025-192915 | Malicious | Not scored | 23 Dec, 2025 | RubyGems rails-structured-logging |
Malicious release: Malicious code in queenbee-plugin (RubyGems) GHSA-v7j5-ccf7-5prj, MAL-2025-192914 | Malicious | Not scored | 23 Dec, 2025 | RubyGems queenbee-plugin |
Malicious release: Malicious code in prometheus_gcstat (RubyGems) GHSA-72qc-7wh3-cmf2, MAL-2025-192913 | Malicious | Not scored | 23 Dec, 2025 | RubyGems prometheus_gcstat |
Malicious release: Malicious code in prometheus_client_ruby (RubyGems) GHSA-4p5q-r9hj-2qwq, MAL-2025-192912 | Malicious | Not scored | 23 Dec, 2025 | RubyGems prometheus_client_ruby |
Malicious release: Malicious code in md_confluence (RubyGems) GHSA-p7p5-wq77-5m4p, MAL-2025-192911 | Malicious | Not scored | 23 Dec, 2025 | RubyGems md_confluence |
Malicious release: Malicious code in macklemore (RubyGems) GHSA-v2fc-fvqh-vg8c, MAL-2025-192910 | Malicious | Not scored | 23 Dec, 2025 | RubyGems macklemore |
Malicious release: Malicious code in html_scrubber (RubyGems) GHSA-5j53-gxh6-wvx8, MAL-2025-192909 | Malicious | Not scored | 23 Dec, 2025 | RubyGems html_scrubber |
Malicious release: Malicious code in hola_rreichel3github (RubyGems) GHSA-pwhf-jhrv-rp5h, MAL-2025-192908 | Malicious | Not scored | 23 Dec, 2025 | RubyGems hola_rreichel3github |
Malicious release: Malicious code in haybales (RubyGems) GHSA-r2cm-m2p4-r229, MAL-2025-192906 | Malicious | Not scored | 23 Dec, 2025 | RubyGems haybales |
Malicious release: Malicious code in hockeystick (RubyGems) GHSA-vr9g-rx8r-fv3f, MAL-2025-192907 | Malicious | Not scored | 23 Dec, 2025 | RubyGems hockeystick |
Malicious release: Malicious code in critter (RubyGems) GHSA-f93c-chq5-5xvv, MAL-2025-192905 | Malicious | Not scored | 23 Dec, 2025 | RubyGems critter |
Malicious release: Malicious code in cocoapod (RubyGems) GHSA-8w8q-j2qm-8gfp, MAL-2025-192904 | Malicious | Not scored | 23 Dec, 2025 | RubyGems cocoapod |
Malicious release: Malicious code in chalk-thrift (RubyGems) GHSA-wpx5-rqqc-wwpq, MAL-2025-192903 | Malicious | Not scored | 23 Dec, 2025 | RubyGems chalk-thrift |
Malicious release: Malicious code in chalk-service (RubyGems) GHSA-mmrp-j38f-6pvw, MAL-2025-192902 | Malicious | Not scored | 23 Dec, 2025 | RubyGems chalk-service |
Malicious release: Malicious code in chalk-hostname (RubyGems) GHSA-cfqc-qhv4-7w9q, MAL-2025-192899 | Malicious | Not scored | 23 Dec, 2025 | RubyGems chalk-hostname |
Malicious release: Malicious code in chalk-interface (RubyGems) GHSA-g98x-9jhj-3j9h, MAL-2025-192900 | Malicious | Not scored | 23 Dec, 2025 | RubyGems chalk-interface |
Malicious release: Malicious code in chalk-sentry (RubyGems) GHSA-hj29-rphg-wm74, MAL-2025-192901 | Malicious | Not scored | 23 Dec, 2025 | RubyGems chalk-sentry |
Malicious release: Malicious code in chalk-henson (RubyGems) GHSA-v867-6gqg-f76m, MAL-2025-192898 | Malicious | Not scored | 23 Dec, 2025 | RubyGems chalk-henson |
Malicious release: Malicious code in chalk-consul (RubyGems) GHSA-xm5g-gqcf-3fh8, MAL-2025-192897 | Malicious | Not scored | 23 Dec, 2025 | RubyGems chalk-consul |
Malicious release: Malicious code in chalk-cli (RubyGems) GHSA-4p78-xfgj-hmqm, MAL-2025-192896 | Malicious | Not scored | 23 Dec, 2025 | RubyGems chalk-cli |
Malicious release: Malicious code in chalk-aws (RubyGems) GHSA-3c36-fj22-cjxw, MAL-2025-192895 | Malicious | Not scored | 23 Dec, 2025 | RubyGems chalk-aws |
Malicious release: Malicious code in activestorage-redundancy (RubyGems) GHSA-hhwf-9gc7-jxcj, MAL-2025-192894 | Malicious | Not scored | 23 Dec, 2025 | RubyGems activestorage-redundancy |
AWS SDK for Ruby's S3 Encryption Client has a Key Commitment Issue CVE-2025-14762, GHSA-2xgq-q749-89fq | Medium | 0.2% | 18 Dec, 2025 | RubyGems aws-sdk-s3 |
ALTCHA Proof-of-Work Vulnerable to Challenge Splicing and Replay CVE-2025-68113, GHSA-6gvq-jcmp-8959, GO-2025-4239, PYSEC-2026-1115 | Medium | 0.5% | 16 Dec, 2025 | Go github.com/altcha-org/altcha-lib-go Hex altcha Maven org.altcha:altcha Packagist altcha-org/altcha +3 more |
Ruby-saml allows a Libxml2 Canonicalization error to bypass Digest/Signature validation CVE-2025-66568, GHSA-x4h9-gwv3-r4m4 | Critical | 0.3% | 08 Dec, 2025 | RubyGems ruby-saml |
Ruby-saml has a SAML authentication bypass due to namespace handling (parser differential) CVE-2025-66567, GHSA-9v8j-x534-2fx3 | Critical | 0.4% | 08 Dec, 2025 | RubyGems ruby-saml |
Malicious release: Malicious code in pg_result_init (RubyGems) GHSA-wq5q-x686-23m4, MAL-2025-191667 | Malicious | Not scored | 02 Dec, 2025 | RubyGems pg_result_init |
MQTT does not validate hostnames CVE-2025-12790, GHSA-9c5q-w6gr-fxcq | High | 0.4% | 06 Nov, 2025 | RubyGems mqtt |
Cross-Site Scripting (XSS) vulnerability through unescaped HTML attribute values CVE-2025-64501, GHSA-52c5-vh7f-26fx | High | 0.2% | 06 Nov, 2025 | RubyGems prosemirror_to_html |
Sinatra is vulnerable to ReDoS through ETag header value generation CVE-2025-61921, GHSA-mr3q-g2mv-mr4q | Low | 0.5% | 10 Oct, 2025 | RubyGems sinatra |
Rack is vulnerable to a memory-exhaustion DoS through unbounded URL-encoded body parsing CVE-2025-61919, GHSA-6xw4-3v39-52mm | High | 0.6% | 10 Oct, 2025 | RubyGems rack |
Rack has a Possible Information Disclosure Vulnerability CVE-2025-61780, GHSA-r657-rxjc-j557 | Medium | 0.6% | 10 Oct, 2025 | RubyGems rack |
Rack's multipart parser buffers unbounded per-part headers, enabling DoS (memory exhaustion) CVE-2025-61772, GHSA-wpv5-97wm-hp9c | High | 0.9% | 07 Oct, 2025 | RubyGems rack |
Rack: Multipart parser buffers large non‑file fields entirely in memory, enabling DoS (memory exhaustion) CVE-2025-61771, GHSA-w9pc-fmgc-vxvw | High | 0.6% | 07 Oct, 2025 | RubyGems rack |
Rack's unbounded multipart preamble buffering enables DoS (memory exhaustion) CVE-2025-61770, GHSA-p543-xpfm-54cp | High | 0.9% | 07 Oct, 2025 | RubyGems rack |
Malicious release: Malicious code in sqlcommenter_rails (RubyGems) GHSA-4h87-w5j9-qcw6, MAL-2025-47815 | Malicious | Not scored | 26 Sep, 2025 | RubyGems sqlcommenter_rails |
Malicious release: Malicious code in your-gem-name12 (RubyGems) GHSA-528g-376v-hwq4, MAL-2025-47816 | Malicious | Not scored | 26 Sep, 2025 | RubyGems your-gem-name12 |
Rack has an unsafe default in Rack::QueryParser allows params_limit bypass via semicolon-separated parameters CVE-2025-59830, GHSA-625h-95r8-8xpm | High | 0.6% | 25 Sep, 2025 | RubyGems rack |
REXML has DoS condition when parsing malformed XML file CVE-2025-58767, GHSA-c2f4-jgmc-q2r5 | Low | 0.3% | 17 Sep, 2025 | RubyGems rexml |
Malicious release: Malicious code in authzd-client (RubyGems) GHSA-rj4p-jv9w-r7wq, MAL-2025-46925 | Malicious | Not scored | 01 Sep, 2025 | RubyGems authzd-client |
Malicious release: Malicious code in advisory_db_toolkit (RubyGems) GHSA-vwjj-4pjc-jxh6, MAL-2025-46924 | Malicious | Not scored | 01 Sep, 2025 | RubyGems advisory_db_toolkit |
Malicious release: Malicious code in github_chatops_extensions (RubyGems) GHSA-qpmj-hg95-gc3q, MAL-2025-46926 | Malicious | Not scored | 01 Sep, 2025 | RubyGems github_chatops_extensions |
Malicious release: Malicious code in monolith-twirp-mailreplies-replies (RubyGems) GHSA-f44c-6cr3-5wj9, MAL-2025-46930 | Malicious | Not scored | 01 Sep, 2025 | RubyGems monolith-twirp-mailreplies-replies |
Malicious release: Malicious code in monolith-twirp-merge-queue-go-mergequeuemonolith (RubyGems) GHSA-v3c3-mr4w-2cf4, MAL-2025-46931 | Malicious | Not scored | 01 Sep, 2025 | RubyGems monolith-twirp-merge-queue-go-mergequeuemonolith |
Malicious release: Malicious code in monolith-twirp-github-repositories (RubyGems) GHSA-v659-389f-xg6w, MAL-2025-46929 | Malicious | Not scored | 01 Sep, 2025 | RubyGems monolith-twirp-github-repositories |
Malicious release: Malicious code in service-catalog-client (RubyGems) GHSA-9hf4-f77m-fvfc, MAL-2025-46943 | Malicious | Not scored | 01 Sep, 2025 | RubyGems service-catalog-client |
Malicious release: Malicious code in secret-scanning-proto (RubyGems) GHSA-97w5-qfpm-q3xg, MAL-2025-46942 | Malicious | Not scored | 01 Sep, 2025 | RubyGems secret-scanning-proto |