Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Crass: Non-ASCII characters cause superlinear CPU consumption CVE-2026-61848, GHSA-8vfg-2r28-hvhj | Medium | Not scored | 5 days ago | RubyGems crass |
Crass: A large number of adjacent CSS comments can trigger a SystemStackError CVE-2026-61847, GHSA-wwpr-jff3-395c | Medium | Not scored | 5 days ago | RubyGems crass |
Crass: Deeply nested CSS blocks and functions can trigger a SystemStackError or excessive memory usage CVE-2026-61846, GHSA-6jxj-px6v-747w | Medium | Not scored | 5 days ago | RubyGems crass |
Crass: Incorrect tokenization of bad URLs enables CSS sanitizer bypass CVE-2026-116695, GHSA-pq4g-8rxf-4g29 | Medium | Not scored | 6 days ago | RubyGems crass |
Mechanize sends credential headers to another origin after a meta refresh CVE-2026-107399, GHSA-c6rp-p8xm-4q9f | Medium | Not scored | 26 days ago | RubyGems mechanize |
Mechanize sends credential headers to another host after an HTTP redirect CVE-2026-107715, GHSA-2mwr-xjcg-37j7 | Medium | Not scored | 26 days ago | RubyGems mechanize |
sqlite3-ruby: Use-After-Free in SQLite Aggregate Arguments in Heap-Allocated Argument Array GHSA-mwm8-39rw-8826 | Medium | Not scored | 02 Oct, 2026 | RubyGems sqlite3 |
MPXJ: Potential Path Traversal Vulnerability in Primavera P3 PRX and SureTrak STX readers CVE-2026-65829, GHSA-7952-gx68-cjqr, PYSEC-2026-4108 | Medium | 0.4% | 22 Sep, 2026 | Maven net.sf.mpxj:mpxj NuGet MPXJ.Net NuGet net.sf.mpxj NuGet net.sf.mpxj-for-csharp +3 more |
decidim-elections: Election question titles allow stored script execution CVE-2026-44282, GHSA-9mvp-w4rr-5c6x | Medium | Not scored | 09 Sep, 2026 | RubyGems decidim-elections |
Mail: Email address spoofing via malformed RFC 2047 encoded-words CVE-2026-63435, GHSA-mvxr-6m87-mv2q | Medium | Not scored | 02 Sep, 2026 | RubyGems mail |
guard-livereload has a directory traversal vulnerability CVE-2016-1000305, GHSA-g65v-27r3-5p6m | Medium | Not scored | 31 Jul, 2026 | RubyGems guard-livereload |
MCP Ruby SDK: Unbounded session retention in StreamableHTTPTransport allows memory exhaustion via initialize flood CVE-2026-67430, GHSA-52jp-gj8w-j6xh | Medium | Not scored | 30 Jul, 2026 | RubyGems mcp |
MCP Ruby SDK: Unbounded line buffer in stdio transports leads to memory exhaustion (DoS) CVE-2026-63119, GHSA-7683-3w9x-ch42 | Medium | Not scored | 30 Jul, 2026 | RubyGems mcp |
MCP Ruby SDK: Streamable HTTP transport lacks DNS-rebinding (Host/Origin) protection CVE-2026-63118, GHSA-rjr6-rcgv-9m7m | Medium | Not scored | 30 Jul, 2026 | RubyGems mcp |
Pagy I18n locale option is not validated before being used in a file path CVE-2026-54659, GHSA-2xmw-f8j8-wfxc | Medium | Not scored | 28 Jul, 2026 | RubyGems pagy |
Trix: Stored XSS via HTMLParser attribute injection on paste CVE-2026-73428, GHSA-53g2-mvcc-q9x3 | Medium | 0.4% | 24 Jul, 2026 | RubyGems action_text-trix npm trix |
Rails HTML Sanitizers: Possible XSS vulnerability with certain configurations CVE-2026-73648, GHSA-cj75-f6xr-r4g7 | Medium | Not scored | 21 Jul, 2026 | RubyGems rails-html-sanitizer |
Loofah: SVG `href` attribute bypasses local-reference restriction CVE-2026-73490, GHSA-9wjq-cp2p-hrgf | Medium | Not scored | 21 Jul, 2026 | RubyGems loofah |
ViewComponent: Reused Component Instances Retain Stale Render Context CVE-2026-54497, GHSA-9h85-g7w3-rh49 | Medium | Not scored | 15 Jul, 2026 | RubyGems view_component |
websocket-driver: Memory exhaustion in HTTP header parser CVE-2026-54465, GHSA-8j3g-f24p-4mpw | Medium | Not scored | 15 Jul, 2026 | RubyGems websocket-driver |
websocket-driver: Resource limit bypass via message compression CVE-2026-54464, GHSA-33ph-fccm-39pj | Medium | Not scored | 15 Jul, 2026 | RubyGems websocket-driver |
websocket-driver: Memory exhaustion via abuse of protocol length headers CVE-2026-54463, GHSA-ghhp-3qvg-889p | Medium | Not scored | 15 Jul, 2026 | RubyGems websocket-driver |
Decidim: Push subscriptions can be abused for server-side requests CVE-2026-45573, GHSA-2g9c-vf8h-prxx | Medium | Not scored | 13 Jul, 2026 | RubyGems decidim-core |
Decidim: HTML content blocks allow stored script execution CVE-2026-45572, GHSA-533c-2vh9-4r86 | Medium | Not scored | 13 Jul, 2026 | RubyGems decidim-core |
Decidim: CSV census record endpoints improper authorization CVE-2026-45415, GHSA-q79h-67vx-m9xg | Medium | Not scored | 13 Jul, 2026 | RubyGems decidim-verifications |
Decidim: Private exports can be downloaded through reusable links CVE-2026-45377, GHSA-767h-63j4-5226 | Medium | Not scored | 13 Jul, 2026 | RubyGems decidim-core |
Decidim: Admin user search allows SQL injection through similarity-based sorting CVE-2026-45376, GHSA-jvqq-cvh4-xm37 | Medium | Not scored | 13 Jul, 2026 | RubyGems decidim-admin |
Decidim: Verification admins can access supplied IDs from other organizations CVE-2026-45330, GHSA-86fh-w43w-338c | Medium | Not scored | 13 Jul, 2026 | RubyGems decidim-verifications |
Decidim: Forms admin question editor lacks authorization CVE-2026-45086, GHSA-vq6j-hj8w-7v39 | Medium | Not scored | 13 Jul, 2026 | RubyGems decidim-demographics |
Excon does not redact additional sensitive/risky headers when following redirects CVE-2026-54171, GHSA-48rx-c7pg-q66r | Medium | Not scored | 10 Jul, 2026 | RubyGems excon |
Secure Headers: CSP directive injection via sandbox, plugin_types, and report_to when given untrusted input CVE-2026-54163, GHSA-rqq5-2gf9-4w4q | Medium | Not scored | 10 Jul, 2026 | RubyGems secure_headers |
Avo: Direct attachment upload endpoint lacks upload authorization and bypasses field-level upload policy CVE-2026-53769, GHSA-pqpw-cvm4-8mv9 | Medium | Not scored | 09 Jul, 2026 | RubyGems avo |
YARD static cache reads raw traversal paths before router sanitization CVE-2026-49342, GHSA-pxcc-8665-phx8 | Medium | Not scored | 26 Jun, 2026 | RubyGems yard |
fluent-plugin-opentelemetry Has Denial of Service (DoS) via Large Payloads and Decompression Bombs in `in_opentelemetry` CVE-2026-44163, GHSA-2jc5-xhx8-qj6h | Medium | Not scored | 26 Jun, 2026 | RubyGems fluent-plugin-opentelemetry |
Oj: intern.c form_attr (uninitialized stack read) CVE-2026-54500, GHSA-fm7p-mprw-wjm9 | Medium | Not scored | 19 Jun, 2026 | RubyGems oj |
Nokogiri: Possible Out-of-Bounds Read in `Nokogiri::XML::NodeSet#[]` CVE-2026-57235, GHSA-5prr-v3j2-97mh | Medium | Not scored | 19 Jun, 2026 | RubyGems nokogiri |
katello: missing repository authorization in content_uploads exposes cross-product content existence CVE-2026-12515, GHSA-c43c-rf7g-5xpg | Medium | Not scored | 17 Jun, 2026 | RubyGems katello |
Net::IMAP: Command Injection via ID command argument CVE-2026-47242, GHSA-46q3-7gv7-qmgg | Medium | Not scored | 09 Jun, 2026 | RubyGems net-imap |
Net::IMAP: Command Injection via non-synchronizing literal in "raw" argument CVE-2026-47240, GHSA-8p34-64r3-mwg8 | Medium | Not scored | 09 Jun, 2026 | RubyGems net-imap |
Spree: CSV Formula Injection in Customer Export GHSA-xf4v-w5x5-pv79 | Medium | Not scored | 04 Jun, 2026 | RubyGems spree |
Doorkeeper Openid Connect: Dynamic Client Registration feature creates public clients with client_secret CVE-2026-44476, GHSA-m6vc-f87m-cc2h | Medium | Not scored | 04 Jun, 2026 | RubyGems doorkeeper-openid_connect |
CarrierWave has a denylisted_content_type bypass via Unescaped Regex Metacharacters CVE-2026-44587, GHSA-7g26-2qgj-chfg | Medium | Not scored | 27 May, 2026 | RubyGems carrierwave |
view_component: System Test Entry Point Path Check Allows Sibling Directory Escape CVE-2026-44837, GHSA-hg3h-g7xc-f7vp | Medium | Not scored | 08 May, 2026 | RubyGems view_component |
view_component: Preview Route Can Dispatch Inherited Helper Methods CVE-2026-44836, GHSA-7f3r-gwc9-2995 | Medium | Not scored | 08 May, 2026 | RubyGems view_component |
Devise has an Open Redirect via Unvalidated `request.referrer` in Timeoutable Session Timeout Handler CVE-2026-40295, GHSA-jp94-3292-c3xv | Medium | Not scored | 08 May, 2026 | RubyGems devise |
Sidekiq-cron is vulnerable to a cross-site scripting (xss) vulnerability via crafted URL CVE-2025-67202, GHSA-xv9c-mjw8-79gf | Medium | Not scored | 07 May, 2026 | RubyGems sidekiq-cron |
CSS Parser: Improper Certificate Validation allows MITM injection of remote CSS content CVE-2026-44312, GHSA-ff6c-w6qf-7xqc | Medium | Not scored | 07 May, 2026 | RubyGems css_parser |
Nokogiri XSLT transform has a memory leak CVE-2026-79771, GHSA-v2fc-qm4h-8hqv | Medium | Not scored | 06 May, 2026 | RubyGems nokogiri |
GraphQL-Ruby's Ruby lexer does not count comment tokens for the purposes of max_query_string_tokens GHSA-3h96-34p3-xm76 | Medium | Not scored | 05 May, 2026 | RubyGems graphql |
net-imap vulnerable to command Injection via "raw" arguments to multiple commands CVE-2026-42257, GHSA-hm49-wcqc-g2xg | Medium | Not scored | 04 May, 2026 | RubyGems net-imap |