Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Doorkeeper Improper Authentication vulnerability CVE-2023-34246, GHSA-7w2c-w47h-789w | Medium | 0.7% | 12 Jun, 2023 | RubyGems doorkeeper |
rails-ujs vulnerable to DOM Based Cross-site Scripting contenteditable HTML Elements CVE-2023-23913, GHSA-xp5h-f8jf-rc8q | Medium | 0.6% | 09 Jun, 2023 | RubyGems actionview |
Kredis JSON Possible Deserialization of Untrusted Data Vulnerability CVE-2023-27531, GHSA-h2wm-p2vg-6pw4 | Medium | 0.5% | 09 Jun, 2023 | RubyGems kredis |
gRPC connection termination issue CVE-2023-32732, GHSA-9hxf-ppjv-w6rq, PYSEC-2026-1426 | Medium | 0.5% | 09 Jun, 2023 | Maven io.grpc:grpc-protobuf PyPI grpcio RubyGems grpc |
Connection confusion in gRPC CVE-2023-32731, GHSA-cfgp-2977-2fmm, PYSEC-2026-1427 | High | 0.5% | 09 Jun, 2023 | Maven io.grpc:grpc-protobuf PyPI grpcio RubyGems grpc |
gRPC Reachable Assertion issue CVE-2023-1428, GHSA-6628-q6j9-w8vg, PYSEC-2026-1425 | High | 0.4% | 09 Jun, 2023 | Maven io.grpc:grpc-protobuf PyPI grpcio RubyGems grpc |
RedCloth Regular Expression Denial of Service issue CVE-2023-31606, GHSA-qcm3-vfq5-wfr2 | High | 1.5% | 06 Jun, 2023 | RubyGems RedCloth |
avo possible unsafe reflection / partial DoS vulnerability CVE-2023-34102, GHSA-86h2-2g4g-29qx | High | 1.6% | 06 Jun, 2023 | RubyGems avo |
avo vulnerable to Stored XSS (Cross Site Scripting) in html content based fields CVE-2023-34103, GHSA-5cr9-5jx3-2g39 | High | 0.6% | 06 Jun, 2023 | RubyGems avo |
ruby-saml vulnerable to XPath injection CVE-2015-20108, GHSA-r364-2pj4-pf7f | Critical | 1.3% | 27 May, 2023 | RubyGems ruby-saml |
Server-Side Template Injection in Camaleon CMS CVE-2023-30145, GHSA-x487-866m-p8hr | Critical | 45.9% | 26 May, 2023 | RubyGems camaleon_cms |
Malicious release: Malicious code in i18n_sonder (RubyGems) GHSA-g9vr-pxj3-mf95, MAL-2023-1427 | Malicious | Not scored | 15 May, 2023 | RubyGems i18n_sonder |
Cross Site Scripting (XSS) Vulnerability in Fetlife rollout-ui gem CVE-2023-25309, GHSA-5xq9-h3j2-jxvc | Medium | 0.5% | 11 May, 2023 | RubyGems rollout-ui |
Malicious release: Malicious code in mandrill-api-ruby (RubyGems) GHSA-x6jg-rpxx-86cf, MAL-2023-1428 | Malicious | Not scored | 09 May, 2023 | RubyGems mandrill-api-ruby |
Malicious release: Malicious code in modified_bayes (RubyGems) GHSA-wvf9-fvjw-w8w2, MAL-2023-1429 | Malicious | Not scored | 04 May, 2023 | RubyGems modified_bayes |
Malicious release: Malicious code in microsoft_kiota_http (RubyGems) GHSA-87pv-3322-v2mh, MAL-2023-11 | Malicious | Not scored | 04 May, 2023 | RubyGems microsoft_kiota_http |
Race Condition leading to logging errors CVE-2024-22047, GHSA-hjp3-5g2q-7jww | Low | 0.5% | 01 May, 2023 | RubyGems audited |
Malicious release: Malicious code in tzinfo-i18n (RubyGems) GHSA-gmqj-qh73-wphx, MAL-2023-12 | Malicious | Not scored | 26 Apr, 2023 | RubyGems tzinfo-i18n |
Malicious release: Malicious code in fluent-plugin-enhance-k8s-metadata (RubyGems) GHSA-x4w6-f7v6-mqq3, MAL-2023-1424 | Malicious | Not scored | 25 Apr, 2023 | RubyGems fluent-plugin-enhance-k8s-metadata |
Sensitive Terraform Output Values Printed At Info Logging Level In Kitchen-Terraform CVE-2023-30618, GHSA-65g2-x53q-cmf6 | Low | 0.2% | 24 Apr, 2023 | RubyGems kitchen-terraform |
sidekiq vulnerable to cross-site scripting CVE-2023-1892, GHSA-h3r8-h5qw-4r35 | High | 2.7% | 21 Apr, 2023 | RubyGems sidekiq |
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in Pay CVE-2023-30614, GHSA-cqf3-vpx7-rxhw | High | 0.4% | 20 Apr, 2023 | RubyGems pay |
Commonmarker vulnerable to to several quadratic complexity bugs that may lead to denial of service GHSA-48wp-p9qv-4j64 | Medium | Not scored | 11 Apr, 2023 | RubyGems commonmarker |
Nokogiri updates packaged libxml2 to v2.10.4 to resolve multiple CVEs CVE-2023-54354, GHSA-pxvg-2qj5-37jq | Medium | Not scored | 11 Apr, 2023 | RubyGems nokogiri |
govuk_tech_docs vulnerable to unescaped HTML on search results page CVE-2024-22048, GHSA-x2xw-hw8g-6773 | Low | 0.5% | 11 Apr, 2023 | RubyGems govuk_tech_docs |
Fluent Fluentd and Fluent-ui use default password BIT-fluentd-2020-21514, CVE-2020-21514, GHSA-wrxf-x8rm-6ggg | High | 0.8% | 04 Apr, 2023 | RubyGems fluentd-ui |
Ruby URI component ReDoS issue CVE-2023-28755, GHSA-hv5j-3h9f-99c2 | High | 2.6% | 31 Mar, 2023 | RubyGems uri |
Ruby Time component ReDoS issue BIT-ruby-2023-28756, BIT-ruby-min-2023-28756, CVE-2023-28756, GHSA-fg7x-g82r-94qc | High | 2.5% | 31 Mar, 2023 | RubyGems time |
unpoly-rails Denial of Service vulnerability CVE-2023-28846, GHSA-m875-3xf6-mf78 | Medium | 1.0% | 30 Mar, 2023 | RubyGems unpoly-rails |
Reflective Cross-site Scripting Vulnerability in twitter-bootstrap-rails CVE-2014-4920, GHSA-vpqv-mqvc-pcx2 | Medium | Not scored | 16 Mar, 2023 | RubyGems twitter-bootstrap-rails |
Possible Denial of Service Vulnerability in Rack's header parsing CVE-2023-27539, GHSA-c6qg-cjj8-47qp | Low | 1.1% | 15 Mar, 2023 | RubyGems rack |
Possible XSS Security Vulnerability in SafeBuffer#bytesplice CVE-2023-28120, GHSA-pj73-v5mw-pm9j | Medium | 0.9% | 15 Mar, 2023 | RubyGems activesupport |
Rack has possible DoS Vulnerability in Multipart MIME parsing CVE-2023-27530, GHSA-3h57-hmj3-gj3p | High | 1.8% | 08 Mar, 2023 | RubyGems rack |
Code injection in pdf_info CVE-2022-36231, GHSA-9fh3-j99m-f4v7 | Critical | 3.0% | 24 Feb, 2023 | RubyGems pdf_info |
Withdrawn: Fortra GoAnywhere MFT Deserialization of Untrusted Data vulnerability affects metasploit-framework CVE-2023-0669, GHSA-6pm2-j2v8-h3cj | HighExploited | 100.0% | 06 Feb, 2023 | RubyGems metasploit-framework |
Clockwork Web contains a Cross-Site Request Forgery Vulnerability with Rails < 5.2 CVE-2023-25015, GHSA-p4xx-w6fr-c4w9 | Medium | 0.4% | 02 Feb, 2023 | RubyGems clockwork_web |
Publify contains Weak Password Requirements BIT-publify-2023-0569, CVE-2023-0569, GHSA-g7gf-2rqw-5rwx | Medium | 0.7% | 29 Jan, 2023 | RubyGems publify_core |
Improper neutralization of `noscript` element content may allow XSS in Sanitize CVE-2023-23627, GHSA-fw3g-2h3j-qmm7 | Medium | 0.5% | 28 Jan, 2023 | RubyGems sanitize |
flash_tool Gem for Ruby File Download Handling Arbitrary Command Execution CVE-2013-2513, GHSA-6325-6g32-7p35 | Critical | 1.7% | 26 Jan, 2023 | RubyGems flash_tool |
Devise Gem for Ruby Unauthorized Access Using "Remember Me" Cookie CVE-2015-8314, GHSA-746g-3gfp-hfhw | High | 0.6% | 26 Jan, 2023 | RubyGems devise |
xaviershay-dm-rails Gem for Ruby exposes sensitive information via the process table CVE-2015-2179, GHSA-88p8-4vv5-82j7 | Medium | 0.4% | 26 Jan, 2023 | RubyGems xaviershay-dm-rails |
Several quadratic complexity bugs may lead to denial of service in Commonmarker GHSA-636f-xm5j-pj9m | Medium | Not scored | 24 Jan, 2023 | RubyGems commonmarker |
ExifTool vulnerable to arbitrary code execution GHSA-q95h-cqrv-8jv5 | High | Not scored | 20 Jan, 2023 | RubyGems exiftool_vendored |
jruby-openssl gem for JRuby fails to do proper certificate validation CVE-2009-4123, GHSA-xgv7-pqqh-h2w9 | High | 0.6% | 19 Jan, 2023 | RubyGems jruby-openssl |
Denial of Service Vulnerability in Rack Content-Disposition parsing CVE-2022-44571, GHSA-93pm-5p5f-3ghx | Low | 1.5% | 18 Jan, 2023 | RubyGems rack |
ReDoS based DoS vulnerability in Action Dispatch CVE-2023-22792, GHSA-p84v-45xj-wwqj | Low | 1.7% | 18 Jan, 2023 | RubyGems actionpack |
ReDoS based DoS vulnerability in Active Support's underscore CVE-2023-22796, GHSA-j6gc-792m-qgm2 | Low | 1.7% | 18 Jan, 2023 | RubyGems activesupport |
Open Redirect Vulnerability in Action Pack CVE-2023-22797, GHSA-9445-4cr6-336r | Medium | 0.6% | 18 Jan, 2023 | RubyGems actionpack |
Denial of Service Vulnerability in ActiveRecord's PostgreSQL adapter CVE-2022-44566, GHSA-579w-22j4-4749 | High | 1.3% | 18 Jan, 2023 | RubyGems activerecord |
ReDoS based DoS vulnerability in Action Dispatch CVE-2023-22795, GHSA-8xww-x3g3-6jcv | Low | 2.3% | 18 Jan, 2023 | RubyGems actionpack |