Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
net-imap rubygem vulnerable to possible DoS by memory exhaustion CVE-2025-43857, GHSA-j3g3-5qv5-52mj | Medium | 0.5% | 28 Apr, 2025 | RubyGems net-imap |
Malicious release: Malicious code in bvr-api (RubyGems) GHSA-x898-3p28-j8r4, MAL-2025-3295 | Malicious | Not scored | 24 Apr, 2025 | RubyGems bvr-api |
Nokogiri updates packaged libxml2 to v2.13.8 to resolve CVE-2025-32414 and CVE-2025-32415 CVE-2025-71346, GHSA-5w6v-399v-w3cc | Low | Not scored | 21 Apr, 2025 | RubyGems nokogiri |
Publify Vulnerable To Cross-Site Scripting (XSS) Via Redirects Requiring User Interaction CVE-2024-39311, GHSA-8fm5-gg2f-f66q | Low | 0.3% | 28 Mar, 2025 | RubyGems publify_core |
Malicious release: Malicious code in evenote-thrift (RubyGems) GHSA-xh6q-rw2r-gxhv, MAL-2025-3021 | Malicious | Not scored | 28 Mar, 2025 | RubyGems evenote-thrift |
Pitchfork HTTP Request/Response Splitting vulnerability CVE-2025-30221, GHSA-pfqj-w6r6-g86v | Medium | 0.3% | 27 Mar, 2025 | RubyGems pitchfork |
Nokogiri updates packaged libxslt to v1.1.43 to resolve multiple CVEs CVE-2025-71406, GHSA-mrxw-mxhj-p664 | High | Not scored | 14 Mar, 2025 | RubyGems nokogiri |
Camaleon CMS Vulnerable to Privilege Escalation through a Mass Assignment CVE-2025-2304, GHSA-rp28-mvq3-wf8j | Critical | 0.6% | 14 Mar, 2025 | RubyGems camaleon_cms |
Ruby SAML allows a SAML authentication bypass due to namespace handling (parser differential) BIT-gitlab-2025-25292, CVE-2025-25292, GHSA-754f-8gm6-c4r2 | Critical | 65.1% | 12 Mar, 2025 | RubyGems ruby-saml |
Ruby SAML allows a SAML authentication bypass due to DOCTYPE handling (parser differential) BIT-gitlab-2025-25291, CVE-2025-25291, GHSA-4vc4-m8qh-g8jm | Critical | 21.0% | 12 Mar, 2025 | RubyGems ruby-saml |
Ruby SAML allows remote Denial of Service (DoS) with compressed SAML responses BIT-gitlab-2025-25293, CVE-2025-25293, GHSA-92rq-c8cf-prrq | High | 1.5% | 12 Mar, 2025 | RubyGems ruby-saml |
omniauth-saml has dependency on ruby-saml version with Signature Wrapping Attack issue GHSA-hw46-3hmr-x9xv | Critical | Not scored | 12 Mar, 2025 | RubyGems omniauth-saml |
graphql allows remote code execution when loading a crafted GraphQL schema CVE-2025-27407, GHSA-q92j-grw3-h492 | Critical | 3.1% | 12 Mar, 2025 | RubyGems graphql |
Out-of-bounds Read in Ruby JSON Parser CVE-2025-27788, GHSA-9m3q-rhmv-5q44 | High | 0.7% | 12 Mar, 2025 | RubyGems json |
Local File Inclusion in Rack::Static CVE-2025-27610, GHSA-7wqh-767x-r66v | High | 1.2% | 10 Mar, 2025 | RubyGems rack |
Malicious release: Malicious code in poc-by-shahwar (RubyGems) GHSA-9hxq-x27p-fv9c, MAL-2025-2209 | Malicious | Not scored | 06 Mar, 2025 | RubyGems poc-by-shahwar |
Malicious release: Malicious code in poc-genrateed-by-noob (RubyGems) GHSA-r5fj-3hmq-cp24, MAL-2025-2210 | Malicious | Not scored | 06 Mar, 2025 | RubyGems poc-genrateed-by-noob |
Malicious release: Malicious code in evil_gem (RubyGems) GHSA-vw39-jx4v-f5cj, MAL-2025-2208 | Malicious | Not scored | 06 Mar, 2025 | RubyGems evil_gem |
Escape Sequence Injection vulnerability in Rack lead to Possible Log Injection CVE-2025-27111, GHSA-8cgq-6mh2-7j6v | Medium | 0.8% | 04 Mar, 2025 | RubyGems rack |
URI allows for userinfo Leakage in URI#join, URI#merge, and URI#+ CVE-2025-27221, GHSA-22h5-pq3x-2gf2 | Low | 0.5% | 03 Mar, 2025 | RubyGems uri |
CGI has Regular Expression Denial of Service (ReDoS) potential in Util#escapeElement CVE-2025-27220, GHSA-mhwm-jh88-3gjf | Medium | 0.8% | 03 Mar, 2025 | RubyGems cgi |
CGI has Denial of Service (DoS) potential in Cookie.parse CVE-2025-27219, GHSA-gh9q-2xrm-x6qv | Medium | 0.8% | 03 Mar, 2025 | RubyGems cgi |
Oxidized Web RANCID migration page allows unauthenticated user to gain control over Linux user account CVE-2025-27590, GHSA-jx6p-9c26-g373 | Critical | 27.6% | 03 Mar, 2025 | RubyGems oxidized-web |
Malicious release: Malicious code in luno-cocoapods (RubyGems) GHSA-39r9-8gm3-5h7x, MAL-2025-1555 | Malicious | Not scored | 25 Feb, 2025 | RubyGems luno-cocoapods |
Phusion Passenger denial of service BIT-passenger-2025-26803, BIT-passenger-apache-module-2025-26803, BIT-passenger-nginx-module-2025-26803, CVE-2025-26803, GHSA-2cj2-qqxj-5m3r | Medium | 0.6% | 24 Feb, 2025 | RubyGems passenger |
Malicious release: Malicious code in komojuu (RubyGems) GHSA-r7hh-wpmq-vv9c, MAL-2025-1508 | Malicious | Not scored | 21 Feb, 2025 | RubyGems komojuu |
Nokogiri updates packaged libxml2 to 2.13.6 to resolve CVE-2025-24928 and CVE-2024-56171 CVE-2025-71407, GHSA-vvfq-8hwr-qm4m | Low | Not scored | 18 Feb, 2025 | RubyGems nokogiri |
Possible Log Injection in Rack::CommonLogger CVE-2025-25184, GHSA-7g2v-jj9q-g3rg | Medium | 1.2% | 12 Feb, 2025 | RubyGems rack |
Possible DoS by memory exhaustion in net-imap CVE-2025-25186, GHSA-7fc5-f82f-cx69 | Medium | 0.6% | 10 Feb, 2025 | RubyGems net-imap |
Malicious release: Malicious code in dextester (RubyGems) GHSA-4qgm-58v4-v4v2, MAL-2025-1010 | Malicious | Not scored | 03 Feb, 2025 | RubyGems dextester |
Password Pusher Allows Session Token Interception Leading to Potential Hijacking CVE-2024-56733, GHSA-4fwj-m62q-pp47 | Medium | 0.2% | 30 Dec, 2024 | RubyGems pwpush |
Malicious release: Malicious code in haefgerasgrae (RubyGems) GHSA-4p72-v4v8-9ph6, MAL-2024-11896 | Malicious | Not scored | 17 Dec, 2024 | RubyGems haefgerasgrae |
Possible Content Security Policy bypass in Action Dispatch BIT-rails-2024-54133, CVE-2024-54133, GHSA-vfm5-rmrh-j26v | Low | 1.0% | 10 Dec, 2024 | RubyGems actionpack |
rails-html-sanitizer has XSS vulnerability with certain configurations CVE-2024-53989, GHSA-rxv5-gxqc-xx8g | Low | 0.5% | 02 Dec, 2024 | RubyGems rails-html-sanitizer |
rails-html-sanitizer has XSS vulnerability with certain configurations CVE-2024-53987, GHSA-2x5m-9ch4-qgrr | Low | 0.4% | 02 Dec, 2024 | RubyGems rails-html-sanitizer |
rails-html-sanitizer has XSS vulnerability with certain configurations CVE-2024-53988, GHSA-cfjx-w229-hgx5 | Low | 0.4% | 02 Dec, 2024 | RubyGems rails-html-sanitizer |
rails-html-sanitizer has XSS vulnerability with certain configurations CVE-2024-53986, GHSA-638j-pmjw-jq48 | Low | 0.5% | 02 Dec, 2024 | RubyGems rails-html-sanitizer |
rails-html-sanitize has XSS vulnerability with certain configurations CVE-2024-53985, GHSA-w8gc-x259-rc7x | Low | 0.6% | 02 Dec, 2024 | RubyGems rails-html-sanitizer |
Password Pusher rate limiter can be bypassed by forging proxy headers CVE-2024-52796, GHSA-ffp2-8p2h-4m5j | Low | 0.5% | 20 Nov, 2024 | RubyGems pwpush |
decidim-meetings Cross-site scripting vulnerability in the online or hybrid meeting embeds CVE-2024-45594, GHSA-j4h6-gcj7-7v9v | Medium | 0.3% | 13 Nov, 2024 | RubyGems decidim-meetings |
Decidim-Awesome has SQL injection in AdminAccountability CVE-2024-43415, GHSA-cxwf-qc32-375f | High | 0.7% | 12 Nov, 2024 | RubyGems decidim-decidim_awesome |
Sinatra vulnerable to Reliance on Untrusted Inputs in a Security Decision CVE-2024-21510, GHSA-hxx2-7vcw-mqr3 | Medium | 0.5% | 01 Nov, 2024 | RubyGems sinatra |
MPXJ has a Potential Path Traversal Vulnerability CVE-2024-49771, GHSA-j945-c44v-97g6, PYSEC-2026-1681 | Medium | 0.5% | 28 Oct, 2024 | Maven net.sf.mpxj:mpxj NuGet MPXJ.Net NuGet net.sf.mpxj NuGet net.sf.mpxj-for-csharp +3 more |
REXML ReDoS vulnerability CVE-2024-49761, CVE-2025-10990, GHSA-2rxp-v6pw-ch6m | Medium | 1.4% | 28 Oct, 2024 | RubyGems rexml |
Autolab Misconfigured Reset Password Permissions CVE-2024-49376, GHSA-v46j-h43h-rwrm | High | 0.5% | 25 Oct, 2024 | RubyGems Autolab |
camaleon_cms affected by cross site scripting CVE-2024-48652, GHSA-hhxg-rvc9-8726 | Medium | 1.1% | 23 Oct, 2024 | RubyGems camaleon_cms |
Malicious release: Malicious code in znowflake_client (RubyGems) GHSA-9x3w-g2mq-8282, MAL-2024-10224 | Malicious | Not scored | 16 Oct, 2024 | RubyGems znowflake_client |
Malicious release: Malicious code in zen-ruby-linter (RubyGems) GHSA-944j-2633-r3q4, MAL-2024-10223 | Malicious | Not scored | 16 Oct, 2024 | RubyGems zen-ruby-linter |
Malicious release: Malicious code in zbt_element_definer (RubyGems) GHSA-rfqq-7wpp-wwwc, MAL-2024-10222 | Malicious | Not scored | 16 Oct, 2024 | RubyGems zbt_element_definer |
Malicious release: Malicious code in johnny_five (RubyGems) GHSA-833j-vqwv-ch5m, MAL-2024-10221 | Malicious | Not scored | 16 Oct, 2024 | RubyGems johnny_five |