Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
OpenC3 COSMOS: Authenticated remote code execution via the user-writable config overlay (table definitions, cmd/tlm definitions, and script suites) CVE-2026-77602, GHSA-jjq7-m736-w977 | Critical | Not scored | 23 Sep, 2026 | RubyGems openc3 |
kobako Sandbox Escape: guest eval reaches host RCE via method_missing → public_send (any bound Service) CVE-2026-55107, GHSA-7pwq-q9jf-539h | Critical | Not scored | 18 Aug, 2026 | RubyGems kobako |
Active Storage has possible arbitrary file read and remote code execution in Active Storage variant processing CVE-2026-66066, GHSA-xr9x-r78c-5hrm | Critical | Not scored | 30 Jul, 2026 | RubyGems activestorage |
Fluentd is Vulnerable to Remote Code Execution (RCE) via Arbitrary File Write in `${tag}` Placeholder BIT-fluentd-2026-44024, CVE-2026-44024, GHSA-44hj-4m45-frj3 | Critical | Not scored | 26 Jun, 2026 | RubyGems fluentd |
Avo: Missing Authorization in Avo Association Attach Endpoint Allows Unauthorized Relationship Manipulation and Privilege Escalation CVE-2026-55518, GHSA-8fq9-273g-6mrg | Critical | Not scored | 17 Jun, 2026 | RubyGems avo |
OpenC3 COSMOS: Permissions Bypass Provides User Access to Unassigned Administrative Actions via Script Runner Tool CVE-2026-42088, GHSA-2wvh-87g2-89hr, PYSEC-2026-2245 | Critical | 0.3% | 23 Apr, 2026 | PyPI openc3 RubyGems openc3 |
OpenC3 COSMOS has SQL Injection in QuestDB Time-Series Database CVE-2026-42087, GHSA-v529-vhwc-wfc5, PYSEC-2026-2244 | Critical | 0.3% | 23 Apr, 2026 | PyPI openc3 RubyGems openc3 |
Decidim has a cross-site scripting (XSS) in user name CVE-2026-23891, GHSA-fc46-r95f-hq7g | Critical | Not scored | 13 Apr, 2026 | RubyGems decidim-core |
Rack::Session::Cookie secrets: decrypt failure fallback enables secretless session forgery and Marshal deserialization CVE-2026-39324, GHSA-33qg-7wpp-89cq | Critical | Not scored | 08 Apr, 2026 | RubyGems rack-session |
Graphiti Affected by Arbitrary Method Execution via Unvalidated Relationship Names CVE-2026-33286, GHSA-3m5v-4xp5-gjg2 | Critical | Not scored | 20 Mar, 2026 | RubyGems graphiti |
openc3-api Vulnerable to Unauthenticated Remote Code Execution CVE-2025-68271, GHSA-w757-4qv9-mghp | Critical | Not scored | 13 Jan, 2026 | RubyGems openc3 |
Ruby-saml allows a Libxml2 Canonicalization error to bypass Digest/Signature validation CVE-2025-66568, GHSA-x4h9-gwv3-r4m4 | Critical | Not scored | 08 Dec, 2025 | RubyGems ruby-saml |
Ruby-saml has a SAML authentication bypass due to namespace handling (parser differential) CVE-2025-66567, GHSA-9v8j-x534-2fx3 | Critical | Not scored | 08 Dec, 2025 | RubyGems ruby-saml |
Spree Commerce is vulnerable to RCE through Search API CVE-2011-10026, GHSA-x485-rhg3-cqr4 | Critical | Not scored | 20 Aug, 2025 | RubyGems rd_searchlogic RubyGems spree |
Active Storage allowed transformation methods that were potentially unsafe CVE-2025-24293, GHSA-r4mg-4433-c7g3 | Critical | Not scored | 14 Aug, 2025 | RubyGems activestorage |
Spree has Remote Command Execution vulnerability in search functionality CVE-2011-10019, GHSA-97vm-c39p-jr86 | Critical | Not scored | 13 Aug, 2025 | RubyGems spree |
JWE is missing AES-GCM authentication tag validation in encrypted JWE CVE-2025-54887, GHSA-c7p4-hx26-pr73 | Critical | Not scored | 07 Aug, 2025 | RubyGems jwe |
Nokogiri patches vendored libxml2 to resolve multiple CVEs GHSA-353f-x4gh-cqq8 | Critical | Not scored | 21 Jul, 2025 | RubyGems nokogiri |
Job Iteration API is vulnerable to OS Command Injection attack through its CsvEnumerator class CVE-2025-53623, GHSA-6qjf-g333-pv38 | Critical | Not scored | 14 Jul, 2025 | RubyGems job-iteration |
OpenC3 COSMOS Vulnerable to Directory Traversal via /script-api/scripts/ endpoint CVE-2025-28384, GHSA-p67j-387g-75wc, PYSEC-2025-257 | Critical | 0.9% | 13 Jun, 2025 | PyPI openc3 RubyGems openc3-cosmos-tool-iframe |
Camaleon CMS Vulnerable to Privilege Escalation through a Mass Assignment CVE-2025-2304, GHSA-rp28-mvq3-wf8j | Critical | Not scored | 14 Mar, 2025 | RubyGems camaleon_cms |
Ruby SAML allows a SAML authentication bypass due to namespace handling (parser differential) BIT-gitlab-2025-25292, CVE-2025-25292, GHSA-754f-8gm6-c4r2 | Critical | Not scored | 12 Mar, 2025 | RubyGems ruby-saml |
Ruby SAML allows a SAML authentication bypass due to DOCTYPE handling (parser differential) BIT-gitlab-2025-25291, CVE-2025-25291, GHSA-4vc4-m8qh-g8jm | Critical | Not scored | 12 Mar, 2025 | RubyGems ruby-saml |
omniauth-saml has dependency on ruby-saml version with Signature Wrapping Attack issue GHSA-hw46-3hmr-x9xv | Critical | Not scored | 12 Mar, 2025 | RubyGems omniauth-saml |
graphql allows remote code execution when loading a crafted GraphQL schema CVE-2025-27407, GHSA-q92j-grw3-h492 | Critical | Not scored | 12 Mar, 2025 | RubyGems graphql |
Oxidized Web RANCID migration page allows unauthenticated user to gain control over Linux user account CVE-2025-27590, GHSA-jx6p-9c26-g373 | Critical | Not scored | 03 Mar, 2025 | RubyGems oxidized-web |
omniauth-saml vulnerable to Improper Verification of Cryptographic Signature GHSA-cvp8-5r8g-fhvq | Critical | Not scored | 11 Sep, 2024 | RubyGems omniauth-saml |
SAML authentication bypass via Incorrect XPath selector BIT-gitlab-2024-45409, CVE-2024-45409, GHSA-jw9c-mfg7-9rx2 | Critical | Not scored | 10 Sep, 2024 | RubyGems ruby-saml |
Command Injection in sequenceserver CVE-2024-42360, GHSA-qv32-5wm2-p32h | Critical | Not scored | 13 Aug, 2024 | RubyGems sequenceserver |
StringIO buffer overread vulnerability CVE-2024-27280, GHSA-v5h6-c2hv-hv3r | Critical | Not scored | 25 Mar, 2024 | RubyGems stringio |
discordrb OS Command Injection vulnerability CVE-2023-28102, GHSA-8832-4mm5-x2r6 | Critical | Not scored | 14 Mar, 2024 | RubyGems discordrb |
Puppet Bolt privilege escalation vulnerability CVE-2023-5214, GHSA-289m-2964-f8q5 | Critical | Not scored | 06 Oct, 2023 | RubyGems bolt |
geokit-rails Command Injection vulnerability CVE-2023-26153, GHSA-7xvc-v44j-46fh | Critical | Not scored | 06 Oct, 2023 | RubyGems geokit-rails |
Puma HTTP Request/Response Smuggling vulnerability CVE-2023-40175, GHSA-68xg-gqqm-vgj8 | Critical | Not scored | 18 Aug, 2023 | RubyGems puma |
ruby-saml vulnerable to XPath injection CVE-2015-20108, GHSA-r364-2pj4-pf7f | Critical | Not scored | 27 May, 2023 | RubyGems ruby-saml |
Server-Side Template Injection in Camaleon CMS CVE-2023-30145, GHSA-x487-866m-p8hr | Critical | Not scored | 26 May, 2023 | RubyGems camaleon_cms |
Code injection in pdf_info CVE-2022-36231, GHSA-9fh3-j99m-f4v7 | Critical | Not scored | 24 Feb, 2023 | RubyGems pdf_info |
flash_tool Gem for Ruby File Download Handling Arbitrary Command Execution CVE-2013-2513, GHSA-6325-6g32-7p35 | Critical | Not scored | 26 Jan, 2023 | RubyGems flash_tool |
curupira is vulnerable to SQL injection CVE-2015-10053, GHSA-85gf-wr67-f83w | Critical | Not scored | 16 Jan, 2023 | RubyGems curupira |
Integer overflow in publify_core BIT-publify-2022-1812, CVE-2022-1812, GHSA-rc42-jghf-vr8f | Critical | Not scored | 14 Jan, 2023 | RubyGems publify_core |
Publify Improper Input Validation vulnerability BIT-publify-2023-0299, CVE-2023-0299, GHSA-q3rm-f527-ghxj | Critical | Not scored | 14 Jan, 2023 | RubyGems publify_core |
Buffer overflow in sponge queue functions BIT-libphp-2022-37454, BIT-libpython-2022-37454, BIT-php-2022-37454, BIT-php-min-2022-37454, BIT-python-2022-37454, BIT-python-min-2022-37454, CVE-2022-37454, GHSA-6w4m-2xhg-2658, PSF-2022-11, PYSEC-2026-504 | Critical | 7.4% | 21 Oct, 2022 | PyPI pysha3 RubyGems sha3 |
PDFKit vulnerable to Command Injection CVE-2022-25765, GHSA-rhwx-hjx2-x4qr | Critical | Not scored | 10 Sep, 2022 | RubyGems pdfkit |
OmniAuth's `lib/omniauth/failure_endpoint.rb` does not escape `message_key` value CVE-2020-36599, GHSA-pm55-qfxr-h247 | Critical | Not scored | 19 Aug, 2022 | RubyGems omniauth |
Active Record RCE bug with Serialized Columns CVE-2022-32224, GHSA-3hhc-qp5v-9p2j | Critical | Not scored | 12 Jul, 2022 | RubyGems activerecord |
OS Command Injection in awesome spawn CVE-2014-0156, GHSA-qpqw-mc85-qvm9 | Critical | Not scored | 01 Jul, 2022 | RubyGems awesome_spawn |
Improper handling of double quotes in file name in Diffy in Windows environment CVE-2022-33127, GHSA-5ww9-9qp2-x524 | Critical | Not scored | 24 Jun, 2022 | RubyGems diffy |
JMESPath for Ruby uses unsafe JSON.load when safe JSON.parse is preferable CVE-2022-32511, GHSA-5c5f-7vfq-3732 | Critical | Not scored | 07 Jun, 2022 | RubyGems jmespath |
Arbitrary file write in dragonfly CVE-2021-33473, GHSA-fj34-jhjx-xmvv | Critical | Not scored | 03 Jun, 2022 | RubyGems dragonfly |
Possible shell escape sequence injection vulnerability in Rack CVE-2022-30123, GHSA-wq4h-7r42-5hrr | Critical | Not scored | 27 May, 2022 | RubyGems rack |