Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Shopify App: Token exchange shop context confusion may allow cross-shop authorization bypass in affected apps CVE-2026-63414, GHSA-6j52-38f8-qhxr | High | Not scored | 5 days ago | RubyGems shopify_app |
Crass : Large numeric exponents cause CPU and memory denial of service CVE-2026-61845, GHSA-6wmf-3r64-vcwv | High | Not scored | 14 days ago | RubyGems crass |
OpenC3 COSMOS: Authenticated OS command injection via the `pypi_url` setting CVE-2026-77601, GHSA-vp3w-52v9-q57f | High | Not scored | 23 Sep, 2026 | RubyGems openc3 |
Spree: Broken Access Control in `PATCH /api/v3/store/carts/:id/associate` (IDOR) CVE-2026-94462, GHSA-4825-p4xm-pcf2 | High | Not scored | 22 Sep, 2026 | RubyGems spree_api |
MPXJ: XXE Vulnerability in MerlinReader CVE-2026-61570, GHSA-5vvx-3h34-f3gj, PYSEC-2026-4107 | High | 0.5% | 22 Sep, 2026 | Maven net.sf.mpxj:mpxj NuGet MPXJ.Net NuGet net.sf.mpxj NuGet net.sf.mpxj-for-csharp +3 more |
rubyzip path traversal vulnerability CVE-2026-85396, GHSA-47m2-wp7j-p9vc | High | Not scored | 03 Sep, 2026 | RubyGems rubyzip |
Savon::Model evaluates WSDL operation names as Ruby source CVE-2026-53510, GHSA-mx5j-mp4f-g8jg | High | Not scored | 31 Jul, 2026 | RubyGems savon |
MCP Ruby SDK: Ruby SSE Session Poisoning CVE-2026-67431, GHSA-5p9g-j988-pcwv | High | Not scored | 30 Jul, 2026 | RubyGems mcp |
MCP Ruby SDK: Unbounded JSON-RPC request body causes uncontrolled memory allocation in StreamableHTTPTransport CVE-2026-67432, GHSA-h669-8m4g-r2hc | High | Not scored | 30 Jul, 2026 | RubyGems mcp |
OAuth2::Client#request: Protocol-relative redirect Location overrides authority, leaking bearer Authorization to attacker host CVE-2026-54603, GHSA-pp92-crg2-gfv9 | High | Not scored | 28 Jul, 2026 | RubyGems oauth2 |
OAuth: Cross-origin token-request redirects can expose signed request metadata CVE-2026-54605, GHSA-prq8-7wvh-44qh | High | Not scored | 28 Jul, 2026 | RubyGems oauth |
websocket-driver-ruby: Denial of service via malformed Host header CVE-2026-61666, GHSA-2x63-gw47-w4mm | High | Not scored | 21 Jul, 2026 | RubyGems websocket-driver |
dd-trace-rb: Improper parsing of W3C baggage headers may lead to DoS CVE-2026-50276, GHSA-p5f6-rccc-jv98 | High | Not scored | 15 Jul, 2026 | RubyGems datadog |
ViewComponent: around_render HTML-Safety Bypass CVE-2026-54498, GHSA-97jw-64cj-jc58 | High | Not scored | 15 Jul, 2026 | RubyGems view_component |
Decidim: JWT-backed authentication can be replayed across organizations CVE-2026-45414, GHSA-r3v7-5x4c-c69q | High | Not scored | 13 Jul, 2026 | RubyGems decidim |
Decidim: Verification documents can be downloaded through reusable links CVE-2026-45378, GHSA-3mvf-82qp-8qh5 | High | Not scored | 13 Jul, 2026 | RubyGems decidim-verifications |
Ruby CSS Parser: SSRF and Local File Disclosure in `CssParser::Parser#read_remote_file` CVE-2026-53727, GHSA-9pmc-p236-855h | High | Not scored | 09 Jul, 2026 | RubyGems css_parser |
pay-rails/pay: non-constant-time HMAC comparison in Paddle Billing webhook signature verifier CVE-2026-70658, GHSA-mjgf-xj26-9qf9 | High | Not scored | 01 Jul, 2026 | RubyGems pay |
Fluentd is Vulnerable to Server-Side Request Forgery (SSRF) via Placeholder Expansion in `out_http` BIT-fluentd-2026-44161, CVE-2026-44161, GHSA-72f5-rr8c-r6gr | High | Not scored | 26 Jun, 2026 | RubyGems fluentd |
Fluentd is Vulnerable to Denial of Service (DoS) via Gzip Decompression Bomb in `in_http` and `in_forward` BIT-fluentd-2026-44160, CVE-2026-44160, GHSA-j9cw-hwqf-85w7 | High | Not scored | 26 Jun, 2026 | RubyGems fluentd |
Fluentd is Vulnerable to Exposure of Sensitive Information via Monitor Agent API BIT-fluentd-2026-44025, CVE-2026-44025, GHSA-pr7j-96cj-549h | High | Not scored | 26 Jun, 2026 | RubyGems fluentd |
Concurrent Ruby : `AtomicReference#update` livelocks when the stored value is `Float::NAN` CVE-2026-54904, GHSA-h8w8-99g7-qmvj | High | Not scored | 19 Jun, 2026 | RubyGems concurrent-ruby |
Oj: Integer Overflow in Oj.load 2GB String Handling CVE-2026-54903, GHSA-475m-ph3x-64gp | High | Not scored | 19 Jun, 2026 | RubyGems oj |
Oj: Use-After-Free in Oj::Parser SAJ Long Key Callback CVE-2026-54902, GHSA-m578-w5vf-rfcm | High | Not scored | 19 Jun, 2026 | RubyGems oj |
Oj: Use-After-Free in Oj::Parser array_class/hash_class GC Marking CVE-2026-54901, GHSA-vwm4-62gf-x745 | High | Not scored | 19 Jun, 2026 | RubyGems oj |
Oj: Negative-Size memcpy in Oj::Parser create_id Attribute Handling CVE-2026-54900, GHSA-9cv6-qcjw-4grx | High | Not scored | 19 Jun, 2026 | RubyGems oj |
Oj: Use-After-Free in Oj::Parser SAJ Callback via Input Mutation CVE-2026-54898, GHSA-q2gm-54r6-8fwm | High | Not scored | 19 Jun, 2026 | RubyGems oj |
Oj: Use-After-Free in Oj::Doc Iterators via Reentrant Close CVE-2026-54897, GHSA-9ppp-w3g4-fh4q | High | Not scored | 19 Jun, 2026 | RubyGems oj |
Oj: Heap Buffer Overflow in Oj.dump Exception Serialization via Large Indent CVE-2026-54896, GHSA-35w3-pjm6-wj95 | High | Not scored | 19 Jun, 2026 | RubyGems oj |
Oj: Stack Buffer Overflow in Oj::Doc#each_child via Deeply Nested Input CVE-2026-54592, GHSA-3m6q-jj5j-38c9 | High | Not scored | 19 Jun, 2026 | RubyGems oj |
Faraday: Uncontrolled recursion in NestedParamsEncoder allows stack exhaustion DoS via deeply nested query parameters CVE-2026-54297, GHSA-98m9-hrrm-r99r | High | Not scored | 19 Jun, 2026 | RubyGems faraday |
Oj: Stack Buffer Overflow in Oj.dump via Large Indent CVE-2026-54502, GHSA-3v45-f3vh-wg7m | High | Not scored | 19 Jun, 2026 | RubyGems oj |
Oj: Use-After-Free in Oj::Parser Symbol Key Cache Toggle CVE-2026-54899, GHSA-2cw7-v8ff-p88r | High | Not scored | 19 Jun, 2026 | RubyGems oj |
AlchemyCMS: Unauthenticated nested page API leaks restricted & unpublished content CVE-2026-57579, GHSA-mqq5-j7w8-2hgh | High | Not scored | 19 Jun, 2026 | RubyGems alchemy_cms |
Puma PROXY Protocol v1 Accepts Repeated Protocol Headers on Persistent Connections CVE-2026-47737, GHSA-2vqw-3mp8-cgmx | High | Not scored | 09 Jun, 2026 | RubyGems puma |
Puma PROXY Protocol v1 Parser Allows Remote Memory Exhaustion CVE-2026-47736, GHSA-qpgp-93vx-g8v8 | High | Not scored | 08 Jun, 2026 | RubyGems puma |
ruby-jwt: Empty-key HMAC bypass; cross-language sibling of CVE-2026-44351 CVE-2026-45363, GHSA-c32j-vqhx-rx3x | High | Not scored | 18 May, 2026 | RubyGems jwt |
katalyst-koi: Session cookies can be replayed after user logout CVE-2026-44511, GHSA-4cx3-3c38-j9vv | High | Not scored | 07 May, 2026 | RubyGems katalyst-koi |
Nokogiri CSS selector tokenizer has regular expression backtracking CVE-2026-79770, GHSA-c4rq-3m3g-8wgx | High | Not scored | 06 May, 2026 | RubyGems nokogiri |
net-imap vulnerable to STARTTLS stripping via invalid response timing CVE-2026-42246, GHSA-vcgp-9326-pqcp | High | Not scored | 04 May, 2026 | RubyGems net-imap |
Avo: Broken Access Control Through Unauthorized Execution of Arbitrary Action Classes Across Resources CVE-2026-42205, GHSA-qc5p-3mg5-9fh8 | High | Not scored | 24 Apr, 2026 | RubyGems avo |
ERB has an @_init deserialization guard bypass via def_module / def_method / def_class CVE-2026-41316, GHSA-q339-8rmv-2mhv | High | Not scored | 24 Apr, 2026 | RubyGems erb |
OpenC3 COSMOS: Hijacked session token can be used to reset password for persistence CVE-2026-42084, GHSA-wgx6-g857-jjf7, PYSEC-2026-2242 | High | 0.3% | 22 Apr, 2026 | PyPI openc3 RubyGems openc3 |
Uncontrolled resource consumption and loop with unreachable exit condition in facil.io and downstream iodine ruby gem CVE-2026-41146, GHSA-2x79-gwq3-vxxm | High | Not scored | 14 Apr, 2026 | RubyGems iodine |
Decidim amendments can be accepted or rejected by anyone CVE-2026-40869, GHSA-w5xj-99cg-rccm | High | Not scored | 14 Apr, 2026 | RubyGems decidim-core |
bsv-sdk ARC broadcaster treats INVALID/MALFORMED/ORPHAN responses as successful broadcasts CVE-2026-40069, GHSA-9hfr-gw99-8rhx | High | Not scored | 09 Apr, 2026 | RubyGems bsv-sdk |
bsv-sdk and bsv-wallet persist unverified certifier signatures in acquire_certificate (direct and issuance paths) CVE-2026-40070, GHSA-hc36-c89j-5f4j | High | Not scored | 09 Apr, 2026 | RubyGems bsv-sdk RubyGems bsv-wallet |
Addressable has a Regular Expression Denial of Service in Addressable templates CVE-2026-35611, GHSA-h27x-rffw-24p4 | High | Not scored | 08 Apr, 2026 | RubyGems addressable |
Rack's multipart parsing without Content-Length header allows unbounded chunked file uploads CVE-2026-34829, GHSA-8vqr-qjwx-82mw | High | Not scored | 02 Apr, 2026 | RubyGems rack |
Rack has quadratic complexity in Rack::Utils.select_best_encoding via wildcard Accept-Encoding header CVE-2026-34230, GHSA-v569-hp3g-36wr | High | Not scored | 02 Apr, 2026 | RubyGems rack |