Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Possible ReDoS vulnerability in block_format in Action Mailer BIT-rails-2024-47889, CVE-2024-47889, GHSA-h47h-mwp9-c6q6 | Medium | 0.9% | 15 Oct, 2024 | RubyGems actionmailer |
Possible ReDoS vulnerability in plain_text_for_blockquote_node in Action Text BIT-rails-2024-47888, CVE-2024-47888, GHSA-wwhv-wxv9-rpgw | Medium | 1.0% | 15 Oct, 2024 | RubyGems actiontext |
Possible ReDoS vulnerability in HTTP Token authentication in Action Controller BIT-rails-2024-47887, CVE-2024-47887, GHSA-vfg9-r3fq-jvx4 | Medium | 1.0% | 15 Oct, 2024 | RubyGems actionpack |
Possible ReDoS vulnerability in query parameter filtering in Action Dispatch BIT-rails-2024-41128, CVE-2024-41128, GHSA-x76w-6vjr-8xgj | Medium | 1.1% | 15 Oct, 2024 | RubyGems actionpack |
OpenC3 stores passwords in clear text (`GHSL-2024-129`) CVE-2024-47529, GHSA-4xqv-47rm-37mm, PYSEC-2024-121 | Medium | 0.4% | 02 Oct, 2024 | PyPI openc3 RubyGems openc3 npm @openc3/tool-common |
OpenC3 Path Traversal via screen controller (`GHSL-2024-127`) CVE-2024-46977, GHSA-8jxr-mccc-mwg8, PYSEC-2024-101 | High | 0.9% | 02 Oct, 2024 | PyPI openc3 RubyGems openc3 |
OpenC3 Cross-site Scripting in Login functionality (`GHSL-2024-128`) CVE-2024-43795, GHSA-vfj8-5pj7-2f9g, PYSEC-2024-100 | Medium | 0.5% | 02 Oct, 2024 | PyPI openc3 RubyGems openc3 npm @openc3/tool-common |
Decidim has a cross-site scripting vulnerability in the version control page CVE-2024-41673, GHSA-cc4g-m3g7-xmw8 | High | 0.4% | 01 Oct, 2024 | RubyGems decidim |
Camaleon CMS vulnerable to stored XSS through user file upload (GHSL-2024-184) GHSA-75j2-9gmc-m855 | Medium | Not scored | 25 Sep, 2024 | RubyGems camaleon_cms |
Heap-based Buffer Overflow in sqlite-vec CVE-2024-46488, GHSA-vrcx-gx3g-j3h8, PYSEC-2026-1938 | High | 0.4% | 25 Sep, 2024 | PyPI sqlite-vec RubyGems sqlite-vec crates.io sqlite-vec npm sqlite-vec |
Camaleon CMS vulnerable to stored XSS through user file upload (GHSL-2024-184) GHSA-8fx8-3rg2-79xw | Medium | Not scored | 23 Sep, 2024 | RubyGems camaleon_cms |
HTTP Request Smuggling in ruby webrick CVE-2024-47220, GHSA-6f62-3596-g6w7 | High | Not scored | 22 Sep, 2024 | RubyGems webrick |
Puma's header normalization allows for client to clobber proxy set headers CVE-2024-45614, GHSA-9hf4-67fc-4vf4 | Medium | 0.6% | 20 Sep, 2024 | RubyGems puma |
protobuf-java has potential Denial of Service issue CVE-2024-7254, GHSA-735f-pc8j-v9w8 | High | 2.8% | 19 Sep, 2024 | Maven com.google.protobuf:protobuf-java Maven com.google.protobuf:protobuf-javalite Maven com.google.protobuf:protobuf-kotlin Maven com.google.protobuf:protobuf-kotlin-lite +1 more |
Camaleon CMS vulnerable to remote code execution through code injection (GHSL-2024-185) GHSA-7x4w-cj9r-h4v9 | High | Not scored | 18 Sep, 2024 | RubyGems camaleon_cms |
Camaleon CMS vulnerable to stored XSS through user file upload (GHSL-2024-184) GHSA-r9cr-qmfw-pmrc | Medium | Not scored | 18 Sep, 2024 | RubyGems camaleon_cms |
Camaleon CMS vulnerable to arbitrary path traversal (GHSL-2024-183) CVE-2024-46987, GHSA-cp65-5m9r-vc2c | High | 14.6% | 18 Sep, 2024 | RubyGems camaleon_cms |
Camaleon CMS affected by arbitrary file write to RCE (GHSL-2024-182) CVE-2024-46986, GHSA-wmjg-vqhv-q5p5 | High | 37.1% | 18 Sep, 2024 | RubyGems camaleon_cms |
Devise-Two-Factor Authentication Uses Insufficient Default OTP Shared Secret Length CVE-2024-8796, GHSA-qjxf-mc72-wjr2 | Medium | 0.6% | 17 Sep, 2024 | RubyGems devise-two-factor |
Decidim::Admin vulnerable to cross-site scripting (XSS) in the admin panel with QuillJS WYSWYG editor CVE-2024-39910, GHSA-vvqw-fqwx-mqmm | Medium | 0.3% | 16 Sep, 2024 | RubyGems decidim |
Decidim::Admin vulnerable to cross-site scripting (XSS) in the admin activity log CVE-2024-32034, GHSA-rx9f-5ggv-5rh6 | Medium | 0.4% | 16 Sep, 2024 | RubyGems decidim-admin |
omniauth-saml vulnerable to Improper Verification of Cryptographic Signature GHSA-cvp8-5r8g-fhvq | Critical | Not scored | 11 Sep, 2024 | RubyGems omniauth-saml |
SAML authentication bypass via Incorrect XPath selector BIT-gitlab-2024-45409, CVE-2024-45409, GHSA-jw9c-mfg7-9rx2 | Critical | 10.7% | 10 Sep, 2024 | RubyGems ruby-saml |
request_store has Incorrect Default Permissions CVE-2024-43791, GHSA-frp2-5qfc-7r8m | Medium | 0.2% | 23 Aug, 2024 | RubyGems request_store |
REXML denial of service vulnerability CVE-2024-43398, GHSA-vmwr-mc7x-5vc3 | High | 1.2% | 22 Aug, 2024 | RubyGems rexml |
fugit parse and parse_nat stall on lengthy input CVE-2024-43380, GHSA-2m96-52r3-2f3g | Medium | 0.8% | 19 Aug, 2024 | RubyGems fugit |
Command Injection in sequenceserver CVE-2024-42360, GHSA-qv32-5wm2-p32h | Critical | 0.6% | 13 Aug, 2024 | RubyGems sequenceserver |
REXML DoS vulnerability CVE-2024-41946, GHSA-5866-49gr-22v4 | Medium | 1.2% | 02 Aug, 2024 | RubyGems rexml |
REXML DoS vulnerability CVE-2024-41123, GHSA-r55c-59qm-vjw6 | Medium | 1.3% | 01 Aug, 2024 | RubyGems rexml |
Malicious release: Malicious code in melio-platform-api-client (RubyGems) GHSA-6m65-49xq-pfxj, MAL-2024-7834 | Malicious | Not scored | 28 Jul, 2024 | RubyGems melio-platform-api-client |
Malicious release: Malicious code in prnigtest (RubyGems) GHSA-6mwc-4vwq-6g6q, MAL-2024-7824 | Malicious | Not scored | 27 Jul, 2024 | RubyGems prnigtest |
Cross-Site Request Forgery in Spina CVE-2024-7106, GHSA-wqw3-p83g-r24v | Medium | 0.4% | 25 Jul, 2024 | RubyGems spina |
REXML denial of service vulnerability CVE-2024-39908, GHSA-4xqq-m2hx-25v8 | Medium | 1.5% | 16 Jul, 2024 | RubyGems rexml |
Decidim cross-site scripting (XSS) in the admin panel CVE-2024-27095, GHSA-529p-jj47-w3m3 | Medium | 0.3% | 10 Jul, 2024 | RubyGems decidim-admin |
Decidim cross-site scripting (XSS) in the pagination CVE-2024-32469, GHSA-7cx8-44pc-xv3q | Medium | 0.4% | 10 Jul, 2024 | RubyGems decidim |
Decidim vulnerable to data disclosure through the embed feature CVE-2024-27090, GHSA-qcj6-vxwx-4rqv | Medium | 0.5% | 10 Jul, 2024 | RubyGems decidim |
RailsAdmin Cross-site Scripting vulnerability in the list view CVE-2024-39308, GHSA-8qgm-g2vv-vwvc | Medium | 0.6% | 08 Jul, 2024 | RubyGems rails_admin |
Rack ReDoS Vulnerability in HTTP Accept Headers Parsing CVE-2024-39316, GHSA-cj83-2ww7-mvq7 | Medium | 0.9% | 03 Jul, 2024 | RubyGems rack |
Malicious release: Malicious code in wurl-aws-s3 (RubyGems) GHSA-9v6v-hxc6-j9x2, MAL-2024-7047 | Malicious | Not scored | 25 Jun, 2024 | RubyGems wurl-aws-s3 |
Malicious release: Malicious code in workarea-gift-cards (RubyGems) GHSA-hpqv-9x5w-2v9f, MAL-2024-7046 | Malicious | Not scored | 25 Jun, 2024 | RubyGems workarea-gift-cards |
Malicious release: Malicious code in wordify-stuckiest (RubyGems) GHSA-c3g5-42r2-7qhx, MAL-2024-7045 | Malicious | Not scored | 25 Jun, 2024 | RubyGems wordify-stuckiest |
Malicious release: Malicious code in vagrant_hvinfo (RubyGems) GHSA-g6f8-8h77-8fx8, MAL-2024-7044 | Malicious | Not scored | 25 Jun, 2024 | RubyGems vagrant_hvinfo |
Malicious release: Malicious code in vacuole (RubyGems) GHSA-5pxq-j7qx-vhpr, MAL-2024-7043 | Malicious | Not scored | 25 Jun, 2024 | RubyGems vacuole |
Malicious release: Malicious code in twitter_vine (RubyGems) GHSA-jqmx-72ch-rvhc, MAL-2024-7042 | Malicious | Not scored | 25 Jun, 2024 | RubyGems twitter_vine |
Malicious release: Malicious code in twitter-cards (RubyGems) GHSA-v8f2-xq54-5hg3, MAL-2024-7041 | Malicious | Not scored | 25 Jun, 2024 | RubyGems twitter-cards |
Malicious release: Malicious code in telegram_bot-types (RubyGems) GHSA-948f-p3pj-wf99, MAL-2024-7039 | Malicious | Not scored | 25 Jun, 2024 | RubyGems telegram_bot-types |
Malicious release: Malicious code in telegram_bot-ruby (RubyGems) GHSA-qj87-53m9-rvjp, MAL-2024-7038 | Malicious | Not scored | 25 Jun, 2024 | RubyGems telegram_bot-ruby |
Malicious release: Malicious code in telegram-notifications (RubyGems) GHSA-2897-6wq7-h46j, MAL-2024-7037 | Malicious | Not scored | 25 Jun, 2024 | RubyGems telegram-notifications |
Malicious release: Malicious code in telegram-bot_ruby (RubyGems) GHSA-3vqc-v65q-45c5, MAL-2024-7035 | Malicious | Not scored | 25 Jun, 2024 | RubyGems telegram-bot_ruby |
Malicious release: Malicious code in telegram-meetup_bot (RubyGems) GHSA-6fr9-9v8f-vgw6, MAL-2024-7036 | Malicious | Not scored | 25 Jun, 2024 | RubyGems telegram-meetup_bot |