Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
SQL Injection Vulnerability via ActiveRecord comments CVE-2023-22794, GHSA-hq7p-j377-6v63 | High | 2.2% | 18 Jan, 2023 | RubyGems activerecord |
Denial of service via header parsing in Rack CVE-2022-44570, GHSA-65f5-mfpf-vfhj | High | 1.6% | 18 Jan, 2023 | RubyGems rack |
Denial of service via multipart parsing in Rack CVE-2022-44572, GHSA-rqv2-275x-2jq5 | Low | 1.6% | 18 Jan, 2023 | RubyGems rack |
ReDoS based DoS vulnerability in GlobalID CVE-2023-22799, GHSA-23c2-gwp5-pxw9 | Low | 1.0% | 18 Jan, 2023 | RubyGems globalid |
Sisimai Inefficient Regular Expression Complexity vulnerability CVE-2022-4891, GHSA-vm74-j4wq-82xj | Medium | 1.4% | 17 Jan, 2023 | RubyGems sisimai |
Code injection in ruby git CVE-2022-47318, GHSA-pphf-gfrm-v32r | High | 1.4% | 17 Jan, 2023 | RubyGems git |
curupira is vulnerable to SQL injection CVE-2015-10053, GHSA-85gf-wr67-f83w | Critical | 0.8% | 16 Jan, 2023 | RubyGems curupira |
Integer overflow in publify_core BIT-publify-2022-1812, CVE-2022-1812, GHSA-rc42-jghf-vr8f | Critical | 30.8% | 14 Jan, 2023 | RubyGems publify_core |
Publify Core does not strip metadata from images BIT-publify-2022-2815, CVE-2022-2815, GHSA-79wq-g4v9-gfj4 | Medium | 0.6% | 14 Jan, 2023 | RubyGems publify_core |
Publify Improper Input Validation vulnerability BIT-publify-2023-0299, CVE-2023-0299, GHSA-q3rm-f527-ghxj | Critical | 0.9% | 14 Jan, 2023 | RubyGems publify_core |
ruby-git has potential remote code execution vulnerability CVE-2022-46648, GHSA-pfpr-3463-c6jh | High | 1.4% | 09 Jan, 2023 | RubyGems git |
Inline SVG vulnerable to Cross-site Scripting CVE-2020-36644, GHSA-p33q-4h4m-j994 | Medium | 0.7% | 07 Jan, 2023 | RubyGems inline_svg |
PgHero Allows Information Disclosure Through EXPLAIN Feature CVE-2023-22626, GHSA-vf99-xw26-86g5 | High | 0.9% | 05 Jan, 2023 | RubyGems pghero |
httparty has multipart/form-data request tampering vulnerability CVE-2024-22049, GHSA-5pq7-52mg-hr42 | Medium | 1.3% | 03 Jan, 2023 | RubyGems httparty |
keynote Cross-site Scripting vulnerability CVE-2017-20159, GHSA-399p-vq28-5hg8 | Medium | 0.7% | 31 Dec, 2022 | RubyGems keynote |
Oxidized Web vulnerable to Cross-site Scripting CVE-2019-25088, GHSA-8qwh-rm6c-jv96 | Medium | 0.6% | 27 Dec, 2022 | RubyGems oxidized-web |
text_helpers uses web link to untrusted target with window.opener access CVE-2020-36624, GHSA-74hc-57m5-83ch | Medium | 0.6% | 22 Dec, 2022 | RubyGems text_helpers |
active_attr Improper Resource Shutdown or Release vulnerability CVE-2021-4250, GHSA-4whf-rmx5-8frv | High | 1.2% | 19 Dec, 2022 | RubyGems active_attr |
Possible XSS vulnerability with certain configurations of rails-html-sanitizer CVE-2022-23520, GHSA-rrfc-7g8p-99q8 | Medium | 1.2% | 13 Dec, 2022 | RubyGems rails-html-sanitizer |
Possible XSS vulnerability with certain configurations of rails-html-sanitizer CVE-2022-23519, GHSA-9h9g-93gc-623h | Medium | 1.1% | 13 Dec, 2022 | RubyGems rails-html-sanitizer |
Improper neutralization of data URIs may allow XSS in rails-html-sanitizer CVE-2022-23518, GHSA-mcvf-2q2m-x72m | Medium | 0.9% | 13 Dec, 2022 | RubyGems rails-html-sanitizer |
Inefficient Regular Expression Complexity in rails-html-sanitizer CVE-2022-23517, GHSA-5x79-w82f-gw8w | High | 1.6% | 13 Dec, 2022 | RubyGems rails-html-sanitizer |
Uncontrolled Recursion in Loofah CVE-2022-23516, GHSA-3x8r-x6xp-q4vm | High | 1.2% | 13 Dec, 2022 | RubyGems loofah |
Improper neutralization of data URIs may allow XSS in Loofah CVE-2022-23515, GHSA-228g-948r-83gx | Medium | 0.9% | 13 Dec, 2022 | RubyGems loofah |
Inefficient Regular Expression Complexity in Loofah CVE-2022-23514, GHSA-486f-hjj9-9vhh | High | 1.8% | 13 Dec, 2022 | RubyGems loofah |
Unchecked return value from xmlTextReaderExpand CVE-2022-23476, GHSA-qv4q-mr5r-qprj | High | 1.8% | 08 Dec, 2022 | RubyGems nokogiri |
Sinatra vulnerable to Reflected File Download attack CVE-2022-45442, GHSA-2x8x-jmrp-phxw | High | 0.7% | 30 Nov, 2022 | RubyGems sinatra |
Unsanitized input leading to code injection in Dalli CVE-2022-4064, GHSA-3xg8-cc8f-9wv2 | Low | 1.4% | 19 Nov, 2022 | RubyGems dalli |
HTTP response splitting in CGI BIT-ruby-2021-33621, BIT-ruby-min-2021-33621, CVE-2021-33621, GHSA-vc47-6rqg-c7f5 | High | 2.5% | 19 Nov, 2022 | RubyGems cgi |
fluentd vulnerable to remote code execution due to insecure deserialization (in non-default configuration) BIT-fluentd-2022-39379, CVE-2022-39379, GHSA-fppq-mj76-fpj2 | Low | 45.0% | 02 Nov, 2022 | RubyGems fluentd |
Buffer overflow in sponge queue functions BIT-libphp-2022-37454, BIT-libpython-2022-37454, BIT-php-2022-37454, BIT-php-min-2022-37454, BIT-python-2022-37454, BIT-python-min-2022-37454, CVE-2022-37454, GHSA-6w4m-2xhg-2658, PSF-2022-11, PYSEC-2026-504 | Critical | 7.4% | 21 Oct, 2022 | PyPI pysha3 RubyGems sha3 |
Update bundled libxml2 to v2.10.3 to resolve multiple CVEs CVE-2022-50998, GHSA-2qc6-mcvw-92cw | Medium | Not scored | 18 Oct, 2022 | RubyGems nokogiri |
Fat Free CRM vulnerable to Remote Denial of Service via Tasks endpoint CVE-2022-39281, GHSA-p75c-5x3h-cxcg | Medium | 1.8% | 07 Oct, 2022 | RubyGems fat_free_crm |
protobuf-java has a potential Denial of Service issue CVE-2022-3171, GHSA-h4h5-3hr4-j3g2 | Medium | 1.3% | 04 Oct, 2022 | Maven com.google.protobuf:protobuf-java Maven com.google.protobuf:protobuf-javalite Maven com.google.protobuf:protobuf-kotlin Maven com.google.protobuf:protobuf-kotlin-lite +1 more |
SQLite3 addresses vulnerability in packaged version of libsqlite GHSA-mgvv-5mxp-xq67 | Low | Not scored | 03 Oct, 2022 | RubyGems sqlite3 |
Unbounded resource exhaustion in cmark-gfm autolink extension may lead to denial of service GHSA-4qw4-jpp4-8gvp | Medium | Not scored | 21 Sep, 2022 | RubyGems commonmarker |
arr-pm vulnerable to arbitrary shell execution when extracting or listing files contained in a malicious rpm. CVE-2022-39224, GHSA-88cv-mj24-8w3q | High | 1.5% | 21 Sep, 2022 | RubyGems arr-pm |
Pageflow vulnerable to insecure direct object reference in membership update endpoint GHSA-qcqv-38jg-2r43 | High | Not scored | 15 Sep, 2022 | RubyGems pageflow |
Pageflow vulnerable to sensitive user data extraction via Ransack query injection GHSA-wrrw-crp8-979q | High | Not scored | 15 Sep, 2022 | RubyGems pageflow |
PDFKit vulnerable to Command Injection CVE-2022-25765, GHSA-rhwx-hjx2-x4qr | Critical | 42.5% | 10 Sep, 2022 | RubyGems pdfkit |
OmniAuth's `lib/omniauth/failure_endpoint.rb` does not escape `message_key` value CVE-2020-36599, GHSA-pm55-qfxr-h247 | Critical | 1.2% | 19 Aug, 2022 | RubyGems omniauth |
update_by_case before 0.1.3 can be vulnerable to sql injection CVE-2022-35956, GHSA-33wh-w4m7-c6r8 | Medium | 0.6% | 11 Aug, 2022 | RubyGems update_by_case |
administrate vulnerable to Cross-Site Request Forgery CVE-2016-3098, GHSA-cc8c-26rj-v2vx | Medium | 0.4% | 05 Aug, 2022 | RubyGems administrate |
TZInfo relative path traversal vulnerability allows loading of arbitrary files CVE-2022-31163, GHSA-5cm2-9h8c-rvfx | High | 2.4% | 21 Jul, 2022 | RubyGems tzinfo |
jQuery UI vulnerable to XSS when refreshing a checkboxradio with an HTML-like initial text label CVE-2022-31160, GHSA-h6gj-6jjq-h8g9 | Medium | 2.7% | 18 Jul, 2022 | Maven org.webjars.npm:jquery-ui NuGet jQuery.UI.Combined RubyGems jquery-ui-rails npm jquery-ui |
Gollum Cross-site Scripting vulnerability via filename parameter to New Page dialog CVE-2020-35305, GHSA-fj2w-qmjp-3rjm | Medium | 0.8% | 16 Jul, 2022 | RubyGems gollum |
Active Record RCE bug with Serialized Columns CVE-2022-32224, GHSA-3hhc-qp5v-9p2j | Critical | 2.6% | 12 Jul, 2022 | RubyGems activerecord |
opensearch-ruby 2.x before 2.0.2 vulnerable to unsafe YAML deserialization CVE-2022-31115, GHSA-977c-63xq-cgw3 | High | 1.6% | 05 Jul, 2022 | RubyGems opensearch-ruby |
OS Command Injection in awesome spawn CVE-2014-0156, GHSA-qpqw-mc85-qvm9 | Critical | 2.9% | 30 Jun, 2022 | RubyGems awesome_spawn |
Ember.js Potential XSS Exploit When Binding `tagName` to User-Supplied Data CVE-2013-4170, GHSA-5m48-c37x-f792 | Medium | 0.9% | 30 Jun, 2022 | RubyGems ember-source |