Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in diet_earthsmoke (RubyGems) GHSA-v75v-mx8w-8mwg, MAL-2025-46903 | Malicious | Not scored | 01 Sep, 2025 | RubyGems diet_earthsmoke |
Malicious release: Malicious code in github-kv (RubyGems) GHSA-cmj4-pxm4-cgx2, MAL-2025-46909 | Malicious | Not scored | 01 Sep, 2025 | RubyGems github-kv |
Malicious release: Malicious code in github-orca (RubyGems) GHSA-9xf7-gg3r-x42v, MAL-2025-46910 | Malicious | Not scored | 01 Sep, 2025 | RubyGems github-orca |
Malicious release: Malicious code in blackbird-client (RubyGems) GHSA-q8px-h8q7-x4hg, MAL-2025-46897 | Malicious | Not scored | 01 Sep, 2025 | RubyGems blackbird-client |
Malicious release: Malicious code in authnd-client (RubyGems) GHSA-fghg-57x6-cp72, MAL-2025-46894 | Malicious | Not scored | 01 Sep, 2025 | RubyGems authnd-client |
Malicious release: Malicious code in driftwood-client (RubyGems) GHSA-j923-h46v-qqhw, MAL-2025-46905 | Malicious | Not scored | 01 Sep, 2025 | RubyGems driftwood-client |
Malicious release: Malicious code in aqueduct-client (RubyGems) GHSA-rq8h-cqf4-8mvv, MAL-2025-46893 | Malicious | Not scored | 01 Sep, 2025 | RubyGems aqueduct-client |
Malicious release: Malicious code in badge-ruler (RubyGems) GHSA-hgj3-mgg7-x2q4, MAL-2025-46895 | Malicious | Not scored | 01 Sep, 2025 | RubyGems badge-ruler |
Malicious release: Malicious code in feature-flags-client (RubyGems) GHSA-jcww-5gc4-wq35, MAL-2025-46907 | Malicious | Not scored | 01 Sep, 2025 | RubyGems feature-flags-client |
Malicious release: Malicious code in diff-analysis (RubyGems) GHSA-j8g3-764g-vg2h, MAL-2025-46904 | Malicious | Not scored | 01 Sep, 2025 | RubyGems diff-analysis |
Malicious release: Malicious code in dependency-graph-platform-proto (RubyGems) GHSA-mm8m-5886-mv74, MAL-2025-46901 | Malicious | Not scored | 01 Sep, 2025 | RubyGems dependency-graph-platform-proto |
Malicious release: Malicious code in actions-broker (RubyGems) GHSA-58mr-fw5f-cf2c, MAL-2025-46890 | Malicious | Not scored | 01 Sep, 2025 | RubyGems actions-broker |
Malicious release: Malicious code in delorean_client (RubyGems) GHSA-9q8p-w45w-jhq8, MAL-2025-46900 | Malicious | Not scored | 01 Sep, 2025 | RubyGems delorean_client |
Malicious release: Malicious code in console_auth (RubyGems) GHSA-gx8p-ffph-8949, MAL-2025-46899 | Malicious | Not scored | 01 Sep, 2025 | RubyGems console_auth |
Malicious release: Malicious code in egress (RubyGems) GHSA-988r-695r-xw67, MAL-2025-46906 | Malicious | Not scored | 01 Sep, 2025 | RubyGems egress |
Malicious release: Malicious code in dependency-snapshots-api-proto (RubyGems) GHSA-39pf-ccvj-97jm, MAL-2025-46902 | Malicious | Not scored | 01 Sep, 2025 | RubyGems dependency-snapshots-api-proto |
Malicious release: Malicious code in github-kredz (RubyGems) GHSA-g5gq-6cgh-7mmq, MAL-2025-46908 | Malicious | Not scored | 01 Sep, 2025 | RubyGems github-kredz |
Google Sign-In for Rails allowed redirect to protocol-relative URI CVE-2025-58067, GHSA-5jch-xhw4-r43v | Medium | 0.2% | 29 Aug, 2025 | RubyGems google_sign_in |
Malicious release: Malicious code in omniauth-pro-sante-connect (RubyGems) GHSA-c74g-2qc7-vwrx, MAL-2025-41805 | Malicious | Not scored | 28 Aug, 2025 | RubyGems omniauth-pro-sante-connect |
Google Sign-In for Rails allowed redirects to malformed URLs CVE-2025-57821, GHSA-7pwc-wh6m-44q3 | Medium | 0.3% | 27 Aug, 2025 | RubyGems google_sign_in |
Spree Commerce is vulnerable to RCE through Search API CVE-2011-10026, GHSA-x485-rhg3-cqr4 | Critical | 3.8% | 20 Aug, 2025 | RubyGems rd_searchlogic RubyGems spree |
Active Storage allowed transformation methods that were potentially unsafe CVE-2025-24293, GHSA-r4mg-4433-c7g3 | Critical | 5.6% | 14 Aug, 2025 | RubyGems activestorage |
Active Record logging vulnerable to ANSI escape injection CVE-2025-55193, GHSA-76r7-hhxj-r776 | Medium | 0.6% | 13 Aug, 2025 | RubyGems activerecord |
Spree has Remote Command Execution vulnerability in search functionality CVE-2011-10019, GHSA-97vm-c39p-jr86 | Critical | 6.3% | 13 Aug, 2025 | RubyGems spree |
JWE is missing AES-GCM authentication tag validation in encrypted JWE CVE-2025-54887, GHSA-c7p4-hx26-pr73 | Critical | 0.3% | 07 Aug, 2025 | RubyGems jwe |
Malicious release: Malicious code in webpack-dev-server (RubyGems) GHSA-3r7c-pwq8-c9j6, MAL-2025-6629 | Malicious | Not scored | 31 Jul, 2025 | RubyGems webpack-dev-server |
Malicious release: Malicious code in maventa_utils (RubyGems) GHSA-hgfc-v9cg-p6p6, MAL-2025-6628 | Malicious | Not scored | 31 Jul, 2025 | RubyGems maventa_utils |
Malicious release: Malicious code in maventa_common (RubyGems) GHSA-v8mq-wfph-m6wx, MAL-2025-6627 | Malicious | Not scored | 31 Jul, 2025 | RubyGems maventa_common |
Malicious release: Malicious code in icare (RubyGems) GHSA-8cc3-85hm-3229, MAL-2025-6385 | Malicious | Not scored | 31 Jul, 2025 | RubyGems icare |
Malicious release: Malicious code in icaret (RubyGems) GHSA-43r2-pr5x-jf67, MAL-2025-6386 | Malicious | Not scored | 31 Jul, 2025 | RubyGems icaret |
Ruby SAML DOS vulnerability with large SAML response CVE-2025-54572, GHSA-rrqh-93c8-j966 | Medium | 0.5% | 30 Jul, 2025 | RubyGems ruby-saml |
Malicious release: Malicious code in resource_registry (RubyGems) GHSA-pmfx-6mmf-ph4x, MAL-2025-6348 | Malicious | Not scored | 30 Jul, 2025 | RubyGems resource_registry |
Malicious release: Malicious code in message_gateway (RubyGems) GHSA-mc65-hh92-wc9m, MAL-2025-6265 | Malicious | Not scored | 27 Jul, 2025 | RubyGems message_gateway |
Nokogiri patches vendored libxml2 to resolve multiple CVEs GHSA-353f-x4gh-cqq8 | Critical | Not scored | 21 Jul, 2025 | RubyGems nokogiri |
Measured is vulnerable to Path Traversal attacks during class initialization GHSA-29g5-m8v7-v564 | Medium | Not scored | 15 Jul, 2025 | RubyGems measured |
resolv vulnerable to DoS via insufficient DNS domain name length validation CVE-2025-24294, GHSA-xh69-987w-hrp8 | Medium | 0.7% | 15 Jul, 2025 | RubyGems resolv |
Job Iteration API is vulnerable to OS Command Injection attack through its CsvEnumerator class CVE-2025-53623, GHSA-6qjf-g333-pv38 | Critical | 0.8% | 14 Jul, 2025 | RubyGems job-iteration |
HashiCorp Vagrant has code injection vulnerability through default synced folders CVE-2025-34075, GHSA-hqp6-mjw3-f586 | Medium | Not scored | 02 Jul, 2025 | RubyGems vagrant |
Ruby WEBrick read_headers method can lead to HTTP Request/Response Smuggling CVE-2025-6442, GHSA-r995-q44h-hr64 | Medium | 0.5% | 26 Jun, 2025 | RubyGems webrick |
Malicious release: Malicious code in xxxxxxxx (RubyGems) GHSA-whmm-4mjc-75rj, MAL-2025-5147 | Malicious | Not scored | 18 Jun, 2025 | RubyGems xxxxxxxx |
Malicious release: Malicious code in teaspoon-devkit (RubyGems) GHSA-g5r5-2qxx-4222, MAL-2025-5146 | Malicious | Not scored | 18 Jun, 2025 | RubyGems teaspoon-devkit |
Malicious release: Malicious code in jdbc-zzz (RubyGems) GHSA-vc7p-hj9r-3hr8, MAL-2025-5145 | Malicious | Not scored | 18 Jun, 2025 | RubyGems jdbc-zzz |
OpenC3 COSMOS Vulnerable to Directory Traversal via /script-api/scripts/ endpoint CVE-2025-28384, GHSA-p67j-387g-75wc, PYSEC-2025-257 | Critical | 0.9% | 13 Jun, 2025 | PyPI openc3 RubyGems openc3-cosmos-tool-iframe |
OpenC3 COSMOS Vulnerable to Directory Traversal via openc3-api/tables endpoint CVE-2025-28382, GHSA-cf8v-5mrc-jv7f, PYSEC-2025-256 | High | 0.9% | 13 Jun, 2025 | PyPI openc3 RubyGems openc3-cosmos-tool-iframe |
ReDoS Vulnerability in Rack::Multipart handle_mime_head CVE-2025-49007, GHSA-47m2-26rw-j2jw | Medium | 0.6% | 05 Jun, 2025 | RubyGems rack |
Insufficient input sanitization in ejson2env CVE-2025-48069, GHSA-2c47-m757-32g6, GO-2025-3702 | Medium | 1.4% | 21 May, 2025 | Go github.com/Shopify/ejson2env Go github.com/Shopify/ejson2env/v2 RubyGems ejson2env |
Rack has an Unbounded-Parameter DoS in Rack::QueryParser CVE-2025-46727, GHSA-gjh7-p2fx-99vx | High | 1.2% | 08 May, 2025 | RubyGems rack |
Rack session gets restored after deletion CVE-2025-46336, GHSA-9j94-67jr-4cqj | Medium | 0.4% | 08 May, 2025 | RubyGems rack-session |
Rack session gets restored after deletion CVE-2025-32441, GHSA-vpfw-47h7-xj4g | Medium | 0.3% | 08 May, 2025 | RubyGems rack |
JRuby-OpenSSL has hostname verification disabled by default CVE-2025-46551, GHSA-72qj-48g4-5xgx | Medium | 0.2% | 07 May, 2025 | Maven org.jruby:jruby Maven rubygems:jruby-openssl RubyGems jruby-openssl |