Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in a1420ks-bmi (RubyGems) GHSA-6g8r-58xc-mwh6, MAL-2024-6282 | Malicious | Not scored | 25 Jun, 2024 | RubyGems a1420ks-bmi |
Malicious release: Malicious code in a1412tk-bmi (RubyGems) GHSA-86c2-872x-35vf, MAL-2024-6281 | Malicious | Not scored | 25 Jun, 2024 | RubyGems a1412tk-bmi |
Malicious release: Malicious code in a1408nw-Ounennhei (RubyGems) GHSA-c6x2-7j44-j569, MAL-2024-6279 | Malicious | Not scored | 25 Jun, 2024 | RubyGems a1408nw-Ounennhei |
Malicious release: Malicious code in a1409yo-health (RubyGems) GHSA-cx95-92gp-48vq, MAL-2024-6280 | Malicious | Not scored | 25 Jun, 2024 | RubyGems a1409yo-health |
Malicious release: Malicious code in a1330ks-bmi (RubyGems) GHSA-2793-572m-xrq7, MAL-2024-6278 | Malicious | Not scored | 25 Jun, 2024 | RubyGems a1330ks-bmi |
Malicious release: Malicious code in a-stupid_test_gem (RubyGems) GHSA-c8g4-4xh5-cf25, MAL-2024-6277 | Malicious | Not scored | 25 Jun, 2024 | RubyGems a-stupid_test_gem |
Malicious release: Malicious code in a-stupid-test_gem (RubyGems) GHSA-m659-vjf3-crmc, MAL-2024-6276 | Malicious | Not scored | 25 Jun, 2024 | RubyGems a-stupid-test_gem |
Malicious release: Malicious code in a-special-day (RubyGems) GHSA-83r4-3324-qq9j, MAL-2024-6274 | Malicious | Not scored | 25 Jun, 2024 | RubyGems a-special-day |
Malicious release: Malicious code in a-special_day (RubyGems) GHSA-wqvq-6h3x-qj26, MAL-2024-6275 | Malicious | Not scored | 25 Jun, 2024 | RubyGems a-special_day |
Malicious release: Malicious code in Testpranay (RubyGems) GHSA-r7gc-9mr3-6v4v, MAL-2024-7040 | Malicious | Not scored | 25 Jun, 2024 | RubyGems Testpranay |
Malicious release: Malicious code in QubitSDK (RubyGems) GHSA-xpw4-qc9r-vh7c, MAL-2024-7006 | Malicious | Not scored | 25 Jun, 2024 | RubyGems QubitSDK |
Malicious release: Malicious code in ActiveAdmin_Globalize3-inputs (RubyGems) GHSA-mrxm-w793-hwhq, MAL-2024-6453 | Malicious | Not scored | 25 Jun, 2024 | RubyGems ActiveAdmin_Globalize3-inputs |
Malicious release: Malicious code in 99designs_tasks (RubyGems) GHSA-gwhf-v48m-7rxc, MAL-2024-6273 | Malicious | Not scored | 25 Jun, 2024 | RubyGems 99designs_tasks |
Malicious release: Malicious code in 3scale-time_range (RubyGems) GHSA-r5pj-vqch-4fcm, MAL-2024-6272 | Malicious | Not scored | 25 Jun, 2024 | RubyGems 3scale-time_range |
Malicious release: Malicious code in 3scale-time-range (RubyGems) GHSA-2wrg-jjcg-v2f6, MAL-2024-6271 | Malicious | Not scored | 25 Jun, 2024 | RubyGems 3scale-time-range |
Malicious release: Malicious code in 3scale-client (RubyGems) GHSA-gpwq-6g42-g482, MAL-2024-6270 | Malicious | Not scored | 25 Jun, 2024 | RubyGems 3scale-client |
Malicious release: Malicious code in 3months-staff_schedule (RubyGems) GHSA-7mwg-8pqm-6f7j, MAL-2024-6269 | Malicious | Not scored | 25 Jun, 2024 | RubyGems 3months-staff_schedule |
Malicious release: Malicious code in 3months-staff-schedule (RubyGems) GHSA-pmpx-vrwx-mhmx, MAL-2024-6268 | Malicious | Not scored | 25 Jun, 2024 | RubyGems 3months-staff-schedule |
Malicious release: Malicious code in 37_pieces-of-flair (RubyGems) GHSA-r6vj-6grj-h5g8, MAL-2024-6267 | Malicious | Not scored | 25 Jun, 2024 | RubyGems 37_pieces-of-flair |
Malicious release: Malicious code in 1-as_identity_function (RubyGems) GHSA-894x-jgwf-6fj4, MAL-2024-6266 | Malicious | Not scored | 25 Jun, 2024 | RubyGems 1-as_identity_function |
Malicious release: Malicious code in 1-as-identity_function (RubyGems) GHSA-48hg-vj26-qcxr, MAL-2024-6265 | Malicious | Not scored | 25 Jun, 2024 | RubyGems 1-as-identity_function |
Missing security headers in Action Pack on non-HTML responses BIT-rails-2024-28103, CVE-2024-28103, GHSA-fwhr-88qx-h9g7 | Medium | 0.7% | 04 Jun, 2024 | RubyGems actionpack |
ActionText ContentAttachment can Contain Unsanitized HTML BIT-rails-2024-32464, CVE-2024-32464, GHSA-prjp-h48f-jgf6 | Medium | 0.4% | 04 Jun, 2024 | RubyGems actiontext |
activeadmin vulnerable to stored persistent cross-site scripting (XSS) in dynamic form legends CVE-2024-37031, GHSA-9mg6-x45v-hcfm | High | 0.4% | 02 Jun, 2024 | RubyGems activeadmin |
rack-contrib vulnerable to Denial of Service due to the unconstrained value of the incoming "profiler_runs" parameter CVE-2024-35231, GHSA-8c8q-2xw3-j869 | High | 0.7% | 28 May, 2024 | RubyGems rack-contrib |
Kaminari Insecure File Permissions Vulnerability CVE-2024-32978, GHSA-7r3j-qmr4-jfpj | Medium | 0.6% | 28 May, 2024 | RubyGems kaminari |
REXML contains a denial of service vulnerability CVE-2024-35176, GHSA-vg3r-rm7w-2xgh | Medium | 2.1% | 16 May, 2024 | RubyGems rexml |
Nokogiri updates packaged libxml2 to v2.12.7 to resolve CVE-2024-34459 CVE-2024-58377, GHSA-r95h-9x8f-r3f7 | Low | Not scored | 13 May, 2024 | RubyGems nokogiri |
Malicious release: Malicious code in dependency_confusion123 (RubyGems) GHSA-c5h6-jp5g-hxpf, MAL-2024-1341 | Malicious | Not scored | 08 May, 2024 | RubyGems dependency_confusion123 |
Trix Editor Arbitrary Code Execution Vulnerability CVE-2024-34341, GHSA-qjqp-xr96-cj99 | Medium | 0.8% | 07 May, 2024 | RubyGems actiontext npm trix |
Phlex vulnerable to Cross-site Scripting (XSS) via maliciously formed HTML attribute names and values CVE-2024-32970, GHSA-9p57-h987-4vgx | High | 0.7% | 01 May, 2024 | RubyGems phlex |
Sidekiq vulnerable to a Reflected XSS in Queues Web Page CVE-2024-32887, GHSA-q655-3pj8-9fxq | Medium | 0.6% | 26 Apr, 2024 | RubyGems sidekiq |
Cross-site Scripting (XSS) possible due to improper sanitisation of `href` attributes on `<a>` tags CVE-2024-32463, GHSA-g7xq-xv8c-h98c | High | 0.6% | 17 Apr, 2024 | RubyGems phlex |
CarrierWave content-Type allowlist bypass vulnerability which possibly leads to XSS remained CVE-2024-29034, GHSA-vfmv-jfc5-pjjw | Medium | 0.4% | 25 Mar, 2024 | RubyGems carrierwave |
RDoc RCE vulnerability with .rdoc_options CVE-2024-27281, GHSA-592j-995h-p23j | Low | 1.6% | 25 Mar, 2024 | RubyGems rdoc |
StringIO buffer overread vulnerability CVE-2024-27280, GHSA-v5h6-c2hv-hv3r | Critical | 2.4% | 25 Mar, 2024 | RubyGems stringio |
ROTP 6.2.2 and 6.2.1 has 0666 permissions for the .rb files. CVE-2024-28862, GHSA-x2h8-qmj4-g62f | Medium | 0.2% | 18 Mar, 2024 | RubyGems rotp |
discordrb OS Command Injection vulnerability CVE-2023-28102, GHSA-8832-4mm5-x2r6 | Critical | 2.6% | 14 Mar, 2024 | RubyGems discordrb |
TurboBoost Commands vulnerable to arbitrary method invocation CVE-2024-28181, GHSA-mp76-7w5v-pr75 | High | 0.8% | 14 Mar, 2024 | RubyGems turbo_boost-commands npm @turbo-boost/commands |
StimulusReflex arbitrary method call CVE-2024-28121, GHSA-f78j-4w3g-4q65 | High | 1.6% | 12 Mar, 2024 | RubyGems stimulus_reflex npm stimulus_reflex |
Cross-site Scripting (XSS) possible with maliciously formed HTML attribute names and values in Phlex CVE-2024-28199, GHSA-242p-4v39-2v8g | High | 0.6% | 12 Mar, 2024 | RubyGems phlex |
json-jwt allows bypass of identity checks via a sign/encryption confusion attack CVE-2023-51774, GHSA-c8v6-786g-vjx6 | Medium | 0.2% | 29 Feb, 2024 | RubyGems json-jwt |
Rack vulnerable to ReDoS in content type parsing (2nd degree polynomial) CVE-2024-25126, GHSA-22f2-v57c-j9cx | Medium | 35.4% | 28 Feb, 2024 | RubyGems rack |
Rack has possible DoS Vulnerability with Range Header CVE-2024-26141, GHSA-xj5v-6v4g-jfw6 | Low | 1.6% | 28 Feb, 2024 | RubyGems rack |
Rack Header Parsing leads to Possible Denial of Service Vulnerability CVE-2024-26146, GHSA-54rr-7fvw-6x8f | Low | 2.0% | 28 Feb, 2024 | RubyGems rack |
YARD's default template vulnerable to Cross-site Scripting in generated frames.html CVE-2024-27285, GHSA-8mq4-9jjh-9xrc | Medium | 1.1% | 28 Feb, 2024 | RubyGems yard |
Rails has possible Sensitive Session Information Leak in Active Storage BIT-rails-2024-26144, CVE-2024-26144, GHSA-8h22-8cf7-hq6g | Medium | 1.3% | 27 Feb, 2024 | RubyGems activestorage |
Rails has possible XSS Vulnerability in Action Controller BIT-rails-2024-26143, CVE-2024-26143, GHSA-9822-6m93-xqf4 | Medium | 1.0% | 27 Feb, 2024 | RubyGems actionpack RubyGems rails |
Rails has possible ReDoS vulnerability in Accept header parsing in Action Dispatch BIT-rails-2024-26142, CVE-2024-26142, GHSA-jjhx-jhvp-74wq | Low | 1.5% | 27 Feb, 2024 | RubyGems actionpack |
Rack CORS Middleware has Insecure File Permissions CVE-2024-27456, GHSA-785g-282q-pwvx | Medium | 0.8% | 26 Feb, 2024 | RubyGems rack-cors |