Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Cross-site scripting (XSS) in the dynamic file uploads CVE-2023-51447, GHSA-9w99-78rj-hmxq | Medium | 0.5% | 20 Feb, 2024 | RubyGems decidim RubyGems decidim-core |
Possibility to circumvent the invitation token expiry period CVE-2023-48220, GHSA-w3q8-m492-4pwp | Medium | 0.8% | 20 Feb, 2024 | RubyGems decidim RubyGems decidim-admin RubyGems decidim-system RubyGems devise_invitable |
Possible CSRF attack at questionnaire templates preview CVE-2023-47635, GHSA-f3qm-vfc3-jg6v | Medium | 0.3% | 20 Feb, 2024 | RubyGems decidim-templates |
Race condition in Endorsements CVE-2023-47634, GHSA-r275-j57c-7mf2 | Low | 0.4% | 20 Feb, 2024 | RubyGems decidim |
XSS sidekiq-unique-jobs UI server vulnerability CVE-2023-46950, CVE-2023-46951, CVE-2024-25122, GHSA-cmh9-rx85-xj38, GHSA-fhx8-5c23-x7x5 | High | 0.6% | 13 Feb, 2024 | RubyGems sidekiq-unique-jobs |
Nokogiri update packaged libxml2 to v2.12.5 to resolve CVE-2024-25062 CVE-2024-58378, GHSA-xc9x-jj77-9p9j | Medium | Not scored | 05 Feb, 2024 | RubyGems nokogiri |
Cross-site scripting (XSS) in Action messages on Avo CVE-2024-22411, GHSA-g8vp-2v5p-9qfh | Medium | 0.7% | 17 Jan, 2024 | RubyGems avo |
avo vulnerable to stored cross-site scripting (XSS) in key_value field CVE-2024-22191, GHSA-ghjv-mh6x-7q6h | High | 0.7% | 16 Jan, 2024 | RubyGems avo |
Puma HTTP Request/Response Smuggling vulnerability CVE-2024-21647, GHSA-c2f4-cvqm-65w2 | Medium | 1.0% | 08 Jan, 2024 | RubyGems puma |
view_component Cross-site Scripting vulnerability CVE-2024-21636, GHSA-wf2x-8w6j-qw37 | Medium | 0.5% | 04 Jan, 2024 | RubyGems view_component |
Omniauth::MicrosoftGraph Account takeover (nOAuth) CVE-2024-21632, GHSA-5g66-628f-7cvj | High | 0.9% | 03 Jan, 2024 | RubyGems omniauth-microsoft_graph |
ActiveAdmin CSV Injection leading to sensitive information disclosure CVE-2023-51763, GHSA-xhvv-3jww-c487 | Medium | 0.9% | 28 Dec, 2023 | RubyGems activeadmin |
Resque vulnerable to Reflected Cross Site Scripting through pathnames CVE-2023-50724, GHSA-r8xx-8vm8-x6wj | Medium | 0.5% | 18 Dec, 2023 | RubyGems resque |
Resque vulnerable to reflected XSS in resque-web failed and queues lists CVE-2023-50725, GHSA-gc3j-vvwf-4rp8 | Medium | 0.5% | 18 Dec, 2023 | RubyGems resque |
Resque vulnerable to reflected XSS in Queue Endpoint CVE-2023-50727, GHSA-r9mq-m72x-257g | Medium | 0.5% | 18 Dec, 2023 | RubyGems resque |
Resque Scheduler Reflected XSS In Delayed Jobs View CVE-2022-44303, GHSA-9hmq-fm33-x4xx | Medium | 0.7% | 18 Dec, 2023 | RubyGems resque-scheduler |
Potential CSV export data leak CVE-2023-50448, GHSA-356j-hg45-x525 | High | 0.5% | 15 Dec, 2023 | RubyGems activeadmin |
pubnub Insufficient Entropy vulnerability CVE-2023-26154, GHSA-5844-q3fc-56rh, GO-2023-2385, PYSEC-2026-1807 | Medium | 1.0% | 06 Dec, 2023 | Go github.com/pubnub/go Go github.com/pubnub/go/v5 Go github.com/pubnub/go/v6 Go github.com/pubnub/go/v7 +10 more |
CarrierWave Content-Type allowlist bypass vulnerability, possibly leading to XSS CVE-2023-49090, GHSA-gxhx-g4fq-49hj | Medium | 0.6% | 29 Nov, 2023 | RubyGems carrierwave |
memory leak flaw was found in ruby-magick CVE-2023-5349, GHSA-frgf-8jr5-j2jv | Medium | 0.7% | 30 Oct, 2023 | RubyGems rmagick |
encoded_id-rails potential DOS vulnerability due to URIs with extremely long encoded IDs CVE-2024-0241, GHSA-3px7-jm2p-6h2c | High | 1.1% | 24 Oct, 2023 | RubyGems encoded_id-rails |
svg_optimizer rubygem external XML entity (XXE) vulnerability CVE-2023-46035, GHSA-6hvg-62q8-95v7 | Medium | 0.4% | 20 Oct, 2023 | RubyGems svg_optimizer |
Malicious release: Malicious code in investing_parameters (RubyGems) GHSA-pqj8-595m-x8f4, MAL-2023-8322 | Malicious | Not scored | 10 Oct, 2023 | RubyGems investing_parameters |
Puppet Bolt privilege escalation vulnerability CVE-2023-5214, GHSA-289m-2964-f8q5 | Critical | 0.4% | 06 Oct, 2023 | RubyGems bolt |
geokit-rails Command Injection vulnerability CVE-2023-26153, GHSA-7xvc-v44j-46fh | Critical | 3.8% | 06 Oct, 2023 | RubyGems geokit-rails |
Decidim has broken access control in templates CVE-2023-36465, GHSA-639h-86hw-qcjq | High | 0.7% | 05 Oct, 2023 | RubyGems decidim RubyGems decidim-templates |
sidekiq Denial of Service vulnerability CVE-2023-26141, GHSA-3qc2-v3hp-6cv8 | Medium | 0.9% | 14 Sep, 2023 | RubyGems sidekiq |
Denial of Service Vulnerability in gRPC TCP Server (Posix-compatible platforms) CVE-2023-4785, GHSA-p25m-jpj4-qcrr, PYSEC-2026-1428 | High | 0.8% | 13 Sep, 2023 | PyPI grpcio RubyGems grpc |
Active Support Possibly Discloses Locally Encrypted Files CVE-2023-38037, GHSA-cr5q-6q9f-rq6q | Medium | 0.3% | 23 Aug, 2023 | RubyGems activesupport |
Puma HTTP Request/Response Smuggling vulnerability CVE-2023-40175, GHSA-68xg-gqqm-vgj8 | Critical | 0.8% | 18 Aug, 2023 | RubyGems puma |
Malicious release: Malicious code in puppet-module-posix-system-r3.2 (RubyGems) GHSA-mjw8-6c5m-7q74, MAL-2023-1436 | Malicious | Not scored | 10 Aug, 2023 | RubyGems puppet-module-posix-system-r3.2 |
Malicious release: Malicious code in puppet-module-posix-system-r (RubyGems) GHSA-83gv-cxp8-4pmj, MAL-2023-1433 | Malicious | Not scored | 09 Aug, 2023 | RubyGems puppet-module-posix-system-r |
Excessive Iteration in gRPC CVE-2023-33953, GHSA-496j-2rq6-j6cc, PYSEC-2026-1424 | High | 0.5% | 09 Aug, 2023 | PyPI grpcio RubyGems grpc |
Several quadratic complexity bugs may lead to denial of service in Commonmarker GHSA-7vh7-fw88-wj87 | Medium | Not scored | 08 Aug, 2023 | RubyGems commonmarker |
protocol-http1 HTTP Request/Response Smuggling vulnerability CVE-2023-38697, GHSA-6jwc-qr2q-7xwj | Medium | 0.8% | 03 Aug, 2023 | RubyGems protocol-http1 |
Malicious release: Malicious code in google-apis-androidpublisher_v2 (RubyGems) GHSA-hmfq-mrg8-79hh, MAL-2023-1426 | Malicious | Not scored | 19 Jul, 2023 | RubyGems google-apis-androidpublisher_v2 |
Malicious release: Malicious code in systemd-daemon (RubyGems) GHSA-84px-hgwq-vg95, MAL-2023-1434 | Malicious | Not scored | 17 Jul, 2023 | RubyGems systemd-daemon |
Malicious release: Malicious code in naveen4gem (RubyGems) GHSA-96c3-h93w-3cmm, MAL-2023-1430 | Malicious | Not scored | 16 Jul, 2023 | RubyGems naveen4gem |
Malicious release: Malicious code in naveengem (RubyGems) GHSA-mf75-g4wq-2p97, MAL-2023-1431 | Malicious | Not scored | 15 Jul, 2023 | RubyGems naveengem |
rswag vulnerable to arbitrary JSON and YAML file read via directory traversal CVE-2023-38337, GHSA-vc79-65pr-q82v | High | 1.3% | 15 Jul, 2023 | RubyGems rswag |
Decidim Cross-site Scripting vulnerability in the external link redirections CVE-2023-32693, GHSA-469h-mqg8-535r | Medium | 0.8% | 11 Jul, 2023 | RubyGems decidim RubyGems decidim-core |
Decidim Cross-site Scripting vulnerability in the processes filter CVE-2023-34089, GHSA-5652-92r9-3fx9 | High | 0.7% | 11 Jul, 2023 | RubyGems decidim RubyGems decidim-core |
Decidim vulnerable to sensitive data disclosure CVE-2023-34090, GHSA-jm79-9pm4-vrw9 | High | 1.3% | 11 Jul, 2023 | RubyGems decidim RubyGems decidim-meetings |
Sanitize vulnerable to Cross-site Scripting via insufficient neutralization of `style` element content CVE-2023-36823, GHSA-f5ww-cq3m-q3g7 | High | 0.7% | 06 Jul, 2023 | RubyGems sanitize |
Malicious release: Malicious code in gitlab-glfm-markdown (RubyGems) GHSA-9953-358v-57cx, MAL-2023-1425 | Malicious | Not scored | 02 Jul, 2023 | RubyGems gitlab-glfm-markdown |
URI gem has ReDoS vulnerability CVE-2023-36617, GHSA-hww2-5g85-429m | Medium | 1.7% | 29 Jun, 2023 | RubyGems uri |
Actionpack has possible cross-site scripting vulnerability via User Supplied Values to redirect_to CVE-2023-28362, GHSA-4g8v-vg43-wpgf | Medium | 0.3% | 29 Jun, 2023 | RubyGems actionpack |
Spina Cross-site Scripting vulnerability CVE-2023-3445, GHSA-97wh-6hmj-g8j9 | Low | 0.6% | 28 Jun, 2023 | RubyGems spina |
Malicious release: Malicious code in att-codekit (RubyGems) GHSA-6cf9-g99j-v64f, MAL-2023-1423 | Malicious | Not scored | 19 Jun, 2023 | RubyGems att-codekit |
Malicious release: Malicious code in ptrsec_rce (RubyGems) GHSA-rp95-74h9-vp82, MAL-2023-1432 | Malicious | Not scored | 17 Jun, 2023 | RubyGems ptrsec_rce |