Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Ruby JSON: JSON::ResumableParser#partial_value dereferences a freed input buffer and crashes on truncated duplicate-key streams CVE-2026-71847, GHSA-9hj4-r449-hfvc | Low | Not scored | 07 Aug, 2026 | RubyGems json |
MessagePack::Buffer#clear Use-After-Free that Enables Cross-Buffer Disclosure CVE-2026-54522, GHSA-4mrv-5p47-p938 | Low | Not scored | 30 Jul, 2026 | RubyGems msgpack |
ActiveRecord::Tenanted::Storage::DiskService#path_for has a possible path traversal GHSA-pmwx-rm49-xv39 | Low | Not scored | 29 Jul, 2026 | RubyGems activerecord-tenanted |
sqlite3-ruby has Use-After-Free in SQLite Aggregate Function Callbacks CVE-2026-54620, GHSA-j7fr-3v8c-3qc3 | Low | Not scored | 28 Jul, 2026 | RubyGems sqlite3 RubyGems sqlite3-ruby |
sqlite3-ruby has Use-After-Free When Redefining SQLite Functions with Different Arity CVE-2026-54619, GHSA-28hh-pr2h-2w89 | Low | Not scored | 28 Jul, 2026 | RubyGems sqlite3 RubyGems sqlite3-ruby |
Ruby json: JSON generator heap buffer overflow when streaming to an IO CVE-2026-54696, GHSA-x2f5-4prf-w687 | Low | Not scored | 23 Jul, 2026 | RubyGems json |
Loofah `allowed_uri?` does not detect `javascript:` URIs split by numeric character references without semicolons CVE-2026-73492, GHSA-5qhf-9phg-95m2 | Low | Not scored | 21 Jul, 2026 | RubyGems loofah |
Loofah `allowed_uri?` does not detect `javascript:` URIs split by named whitespace character references CVE-2026-73491, GHSA-8whx-365g-h9vv | Low | Not scored | 21 Jul, 2026 | RubyGems loofah |
fluent-plugin-s3 Vulnerable to Denial of Service (DoS) via Decompression Bomb in `in_s3` CVE-2026-44162, GHSA-xv9w-7v6q-hpjh | Low | Not scored | 26 Jun, 2026 | RubyGems fluent-plugin-s3 |
Concurrent Ruby: ReadWriteLock allows wrong-thread write release and stray read-release counter corruption CVE-2026-54906, GHSA-6wx8-w4f5-wwcr | Low | Not scored | 19 Jun, 2026 | RubyGems concurrent-ruby |
Concurrent Ruby: `ReentrantReadWriteLock` read-count overflow grants a write lock without exclusivity CVE-2026-54905, GHSA-wv3x-4vxv-whpp | Low | Not scored | 19 Jun, 2026 | RubyGems concurrent-ruby |
Nokogiri: Possible Use-After-Free when setting an attribute value via `Nokogiri::XML::Attr#value=` or `#content=` CVE-2026-57435, GHSA-phwj-rprq-35pp | Low | Not scored | 19 Jun, 2026 | RubyGems nokogiri |
Nokogiri: Possible Use-After-Free in XInclude Processing CVE-2026-57438, GHSA-wfpw-mmfh-qq69 | Low | Not scored | 19 Jun, 2026 | RubyGems nokogiri |
Nokogiri: Possible Use-After-Free when directly using `NokogirI::XML::XPathContext` beyond document lifetime CVE-2026-57437, GHSA-p67v-3w7g-wjg7 | Low | Not scored | 19 Jun, 2026 | RubyGems nokogiri |
Nokogiri: Possible Use-After-Free when setting `Document#root=` to an invalid node type CVE-2026-57436, GHSA-wjv4-x9w8-wm3h | Low | Not scored | 19 Jun, 2026 | RubyGems nokogiri |
Nokogiri: Null Pointer Dereference calling methods on uninitialized wrapper classes CVE-2026-57434, GHSA-9cv2-cfxc-v4v2 | Low | Not scored | 19 Jun, 2026 | RubyGems nokogiri |
Nokogiri: XML::Schema on JRuby allows network requests when NONET is set, bypassing CVE-2020-26247 CVE-2026-57234, GHSA-8678-w3jw-xfc2 | Low | Not scored | 19 Jun, 2026 | RubyGems nokogiri |
Nokogiri: Possible Use-After-Free when `Nokogiri::XML::Document#encoding=` raises an exception CVE-2026-57236, GHSA-5v8h-3h3q-446p | Low | Not scored | 19 Jun, 2026 | RubyGems nokogiri |
Net::IMAP: Denial of Service via incomplete raw argument validation CVE-2026-47241, GHSA-c4fp-cxrr-mj66 | Low | Not scored | 09 Jun, 2026 | RubyGems net-imap |
Faraday has a possible incomplete fix for GHSA-33mh-2634-fwr2: protocol-relative URI objects still bypass host scoping CVE-2026-33637, GHSA-5rv5-xj5j-3484 | Low | Not scored | 18 May, 2026 | RubyGems faraday |
net-imap has quadratic complexity when reading response literals CVE-2026-42245, GHSA-q2mw-fvj9-vvcw | Low | Not scored | 04 May, 2026 | RubyGems net-imap |
Fat Free CRM has BOLA in DELETE /emails/:id - Any authenticated user can hit this endpoint and delete emails by ID GHSA-9pm8-vwc5-w2hm | Low | Not scored | 14 Apr, 2026 | RubyGems fat_free_crm |
Trix is vulnerable to XSS through JSON deserialization bypass in drag-and-drop (Level0InputController) CVE-2026-73427, GHSA-53p3-c7vp-4mcc | Low | 0.6% | 29 Mar, 2026 | RubyGems action_text-trix npm trix |
Loofah has improper detection of disallowed URIs via `allowed_uri?` GHSA-2j22-pr5w-6gq8 | Low | Not scored | 26 Mar, 2026 | RubyGems loofah |
Rails Active Storage has a possible DoS vulnerability in proxy mode via multi-range requests CVE-2026-33658, GHSA-p9fm-f462-ggrg | Low | Not scored | 25 Mar, 2026 | RubyGems activestorage |
Rails has a possible XSS vulnerability in its Action View tag helpers CVE-2026-33168, GHSA-v55j-83pf-r9cq | Low | Not scored | 23 Mar, 2026 | RubyGems actionview |
Rails has a possible XSS vulnerability in its Action Pack debug exceptions CVE-2026-33167, GHSA-pgm4-439c-5jp6 | Low | Not scored | 23 Mar, 2026 | RubyGems actionpack |
Improper detection of disallowed URIs by Loofah `allowed_uri?` GHSA-46fp-8f5p-pf2m | Low | Not scored | 18 Mar, 2026 | RubyGems loofah |
Bitcoinrb Vulnerable to Command injection via RPC GHSA-q66h-m87m-j2q6 | Low | Not scored | 10 Feb, 2026 | RubyGems bitcoinrb |
URI Credential Leakage Bypass over CVE-2025-27221 CVE-2025-61594, GHSA-j4pr-3wm6-xx2r | Low | Not scored | 30 Dec, 2025 | RubyGems uri |
Sinatra is vulnerable to ReDoS through ETag header value generation CVE-2025-61921, GHSA-mr3q-g2mv-mr4q | Low | Not scored | 10 Oct, 2025 | RubyGems sinatra |
REXML has DoS condition when parsing malformed XML file CVE-2025-58767, GHSA-c2f4-jgmc-q2r5 | Low | Not scored | 17 Sep, 2025 | RubyGems rexml |
Nokogiri updates packaged libxml2 to v2.13.8 to resolve CVE-2025-32414 and CVE-2025-32415 CVE-2025-71346, GHSA-5w6v-399v-w3cc | Low | Not scored | 21 Apr, 2025 | RubyGems nokogiri |
Publify Vulnerable To Cross-Site Scripting (XSS) Via Redirects Requiring User Interaction CVE-2024-39311, GHSA-8fm5-gg2f-f66q | Low | Not scored | 28 Mar, 2025 | RubyGems publify_core |
URI allows for userinfo Leakage in URI#join, URI#merge, and URI#+ CVE-2025-27221, GHSA-22h5-pq3x-2gf2 | Low | Not scored | 03 Mar, 2025 | RubyGems uri |
Nokogiri updates packaged libxml2 to 2.13.6 to resolve CVE-2025-24928 and CVE-2024-56171 CVE-2025-71407, GHSA-vvfq-8hwr-qm4m | Low | Not scored | 18 Feb, 2025 | RubyGems nokogiri |
Possible Content Security Policy bypass in Action Dispatch BIT-rails-2024-54133, CVE-2024-54133, GHSA-vfm5-rmrh-j26v | Low | Not scored | 10 Dec, 2024 | RubyGems actionpack |
rails-html-sanitizer has XSS vulnerability with certain configurations CVE-2024-53989, GHSA-rxv5-gxqc-xx8g | Low | Not scored | 02 Dec, 2024 | RubyGems rails-html-sanitizer |
rails-html-sanitizer has XSS vulnerability with certain configurations CVE-2024-53987, GHSA-2x5m-9ch4-qgrr | Low | Not scored | 02 Dec, 2024 | RubyGems rails-html-sanitizer |
rails-html-sanitizer has XSS vulnerability with certain configurations CVE-2024-53988, GHSA-cfjx-w229-hgx5 | Low | Not scored | 02 Dec, 2024 | RubyGems rails-html-sanitizer |
rails-html-sanitizer has XSS vulnerability with certain configurations CVE-2024-53986, GHSA-638j-pmjw-jq48 | Low | Not scored | 02 Dec, 2024 | RubyGems rails-html-sanitizer |
rails-html-sanitize has XSS vulnerability with certain configurations CVE-2024-53985, GHSA-w8gc-x259-rc7x | Low | Not scored | 02 Dec, 2024 | RubyGems rails-html-sanitizer |
Password Pusher rate limiter can be bypassed by forging proxy headers CVE-2024-52796, GHSA-ffp2-8p2h-4m5j | Low | Not scored | 20 Nov, 2024 | RubyGems pwpush |
Nokogiri updates packaged libxml2 to v2.12.7 to resolve CVE-2024-34459 CVE-2024-58377, GHSA-r95h-9x8f-r3f7 | Low | Not scored | 13 May, 2024 | RubyGems nokogiri |
RDoc RCE vulnerability with .rdoc_options CVE-2024-27281, GHSA-592j-995h-p23j | Low | Not scored | 25 Mar, 2024 | RubyGems rdoc |
Rack has possible DoS Vulnerability with Range Header CVE-2024-26141, GHSA-xj5v-6v4g-jfw6 | Low | Not scored | 28 Feb, 2024 | RubyGems rack |
Rack Header Parsing leads to Possible Denial of Service Vulnerability CVE-2024-26146, GHSA-54rr-7fvw-6x8f | Low | Not scored | 28 Feb, 2024 | RubyGems rack |
Rails has possible ReDoS vulnerability in Accept header parsing in Action Dispatch BIT-rails-2024-26142, CVE-2024-26142, GHSA-jjhx-jhvp-74wq | Low | Not scored | 27 Feb, 2024 | RubyGems actionpack |
Race condition in Endorsements CVE-2023-47634, GHSA-r275-j57c-7mf2 | Low | Not scored | 20 Feb, 2024 | RubyGems decidim |
Spina Cross-site Scripting vulnerability CVE-2023-3445, GHSA-97wh-6hmj-g8j9 | Low | Not scored | 28 Jun, 2023 | RubyGems spina |