lewagon/ui-components

API keys, passwords or tokens committed into the repo.

Nothing found by this check. ✓

via Gitleaks v8.21.2 · MIT

Packages you depend on that have known security holes (CVEs).

• Serious CVE-2020-8165 rubygem-activesupport: potentially unintended unmarshalling of user-provided objects in MemCacheStore and RedisCacheStore
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2020-8165). Fix: Update that package to its patched version.
• Serious CVE-2026-54906 concurrent-ruby: rubygem-concurrent-ruby: concurrent-ruby: Synchronization flaw in ReadWriteLock allows unauthorized lock release and denial of service
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2026-54906). Fix: Update that package to its patched version.
• Serious CVE-2020-14001 rubygem-kramdown: processing template options inside documents allows unintended read access or embedded Ruby code execution
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2020-14001). Fix: Update that package to its patched version.
• Serious CVE-2021-28834 rubygem-kramdown: allows arbitrary classes to be instantiated
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2021-28834). Fix: Update that package to its patched version.
• Serious CVE-2022-30123 rubygem-rack: crafted requests can cause shell escape sequences
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2022-30123). Fix: Update that package to its patched version.
• Worth fixing CVE-2023-22796 rubygem-activesupport: Regular Expression Denial of Service
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2023-22796). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-33176 Rails: Active Support: Active Support: Denial of Service via large scientific notation strings
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2026-33176). Fix: Update that package to its patched version.
• Worth fixing CVE-2023-28120 rubygem-activesupport: Possible XSS in SafeBuffer#bytesplice
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2023-28120). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-33169 rails: rails-activesupport: Active Support: Denial of Service via crafted long digit strings
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2026-33169). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-33170 Rails: Active Support: Active Support: Cross-Site Scripting (XSS) due to improper HTML safety flag propagation in SafeBuffer#%
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2026-33170). Fix: Update that package to its patched version.
• Worth fixing CVE-2021-32740 rubygem-addressable: ReDoS in templates
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2021-32740). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-35611 addressable: Addressable: Denial of Service via crafted URI templates
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2026-35611). Fix: Update that package to its patched version.
• Worth fixing CVE-2016-10735 bootstrap: XSS in the data-target attribute
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2016-10735). Fix: Update that package to its patched version.
• Worth fixing CVE-2018-14040 bootstrap: Cross-site Scripting (XSS) in the collapse data-parent attribute
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2018-14040). Fix: Update that package to its patched version.
• Worth fixing CVE-2018-14042 bootstrap: Cross-site Scripting (XSS) in the data-container property of tooltip
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2018-14042). Fix: Update that package to its patched version.
• Worth fixing CVE-2018-20676 bootstrap: XSS in the tooltip data-viewport attribute
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2018-20676). Fix: Update that package to its patched version.
• Worth fixing CVE-2018-20677 bootstrap: XSS in the affix configuration target property
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2018-20677). Fix: Update that package to its patched version.
• Worth fixing CVE-2019-8331 bootstrap: XSS in the tooltip or popover data-template attribute
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2019-8331). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-54904 concurrent-ruby: rubygem-concurrent-ruby: concurrent-ruby: Denial of Service due to infinite loop in AtomicReference#update
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2026-54904). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-54905 concurrent-ruby: Concurrent-ruby: Incorrect write lock granting leading to broken mutual exclusion
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2026-54905). Fix: Update that package to its patched version.
• Worth fixing CVE-2014-10077 rubygem-i18n: denial of service in Hash#slice in lib/i18n/core_ext/hash.rb
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2014-10077). Fix: Update that package to its patched version.
• Worth fixing CVE-2020-8161 rubygem-rack: directory traversal in Rack::Directory
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2020-8161). Fix: Update that package to its patched version.
• Worth fixing CVE-2020-8184 rubygem-rack: percent-encoded cookies can be used to overwrite existing prefixed cookie names
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2020-8184). Fix: Update that package to its patched version.
• Worth fixing CVE-2022-30122 rubygem-rack: crafted multipart POST request may cause a DoS
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2022-30122). Fix: Update that package to its patched version.
• Worth fixing CVE-2022-44570 rubygem-rack: denial of service in Content-Disposition parsing
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2022-44570). Fix: Update that package to its patched version.

via Trivy v0.70.0 · Apache-2.0

Your dependencies cross-checked against the OSV vulnerability database.

• Serious GHSA-2p68-f74v-9wc6 ActiveSupport potentially unintended unmarshalling of user-provided objects in MemCacheStore and RedisCacheStore
  /workdirs/scan-26951cd8-406f-488e-a4c8-ef9c967bd905/Gemfile.lock
  A package you depend on has a known security hole (CVE-2020-8165). Fix: Update that package to its patched version.
• Serious GHSA-52p9-v744-mwjj Remote code execution in Kramdown
  /workdirs/scan-26951cd8-406f-488e-a4c8-ef9c967bd905/Gemfile.lock
  A package you depend on has a known security hole (CVE-2021-28834). Fix: Update that package to its patched version.
• Serious GHSA-mqm2-cgpr-p4m6 Unintended read access in kramdown gem
  /workdirs/scan-26951cd8-406f-488e-a4c8-ef9c967bd905/Gemfile.lock
  A package you depend on has a known security hole (CVE-2020-14001). Fix: Update that package to its patched version.
• Serious GHSA-wq4h-7r42-5hrr Possible shell escape sequence injection vulnerability in Rack
  /workdirs/scan-26951cd8-406f-488e-a4c8-ef9c967bd905/Gemfile.lock
  A package you depend on has a known security hole (CVE-2022-30123). Fix: Update that package to its patched version.
• Worth fixing GHSA-2j26-frm8-cmj9 Rails Active Support has a possible DoS vulnerability in its number helpers
  /workdirs/scan-26951cd8-406f-488e-a4c8-ef9c967bd905/Gemfile.lock
  A package you depend on has a known security hole (CVE-2026-33176). Fix: Update that package to its patched version.
• Worth fixing GHSA-89vf-4333-qx8v Rails Active Support has a possible XSS vulnerability in SafeBuffer#%
  /workdirs/scan-26951cd8-406f-488e-a4c8-ef9c967bd905/Gemfile.lock
  A package you depend on has a known security hole (CVE-2026-33170). Fix: Update that package to its patched version.
• Worth fixing GHSA-cg4j-q9v8-6v38 Rails Active Support has a possible ReDoS vulnerability in number_to_delimited
  /workdirs/scan-26951cd8-406f-488e-a4c8-ef9c967bd905/Gemfile.lock
  A package you depend on has a known security hole (CVE-2026-33169). Fix: Update that package to its patched version.
• Worth fixing GHSA-pj73-v5mw-pm9j Possible XSS Security Vulnerability in SafeBuffer#bytesplice
  /workdirs/scan-26951cd8-406f-488e-a4c8-ef9c967bd905/Gemfile.lock
  A package you depend on has a known security hole (CVE-2023-28120). Fix: Update that package to its patched version.
• Worth fixing GHSA-h27x-rffw-24p4 Addressable has a Regular Expression Denial of Service in Addressable templates
  /workdirs/scan-26951cd8-406f-488e-a4c8-ef9c967bd905/Gemfile.lock
  A package you depend on has a known security hole (CVE-2026-35611). Fix: Update that package to its patched version.
• Worth fixing GHSA-jxhc-q857-3j6g Regular Expression Denial of Service in Addressable templates
  /workdirs/scan-26951cd8-406f-488e-a4c8-ef9c967bd905/Gemfile.lock
  A package you depend on has a known security hole (CVE-2021-32740). Fix: Update that package to its patched version.
• Worth fixing GHSA-3mgp-fx93-9xv5 XSS vulnerability that affects bootstrap
  /workdirs/scan-26951cd8-406f-488e-a4c8-ef9c967bd905/Gemfile.lock
  A package you depend on has a known security hole (CVE-2018-20676). Fix: Update that package to its patched version.
• Worth fixing GHSA-3wqf-4x89-9g79 Bootstrap vulnerable to Cross-Site Scripting (XSS)
  /workdirs/scan-26951cd8-406f-488e-a4c8-ef9c967bd905/Gemfile.lock
  A package you depend on has a known security hole (CVE-2018-14040). Fix: Update that package to its patched version.
• Worth fixing GHSA-4p24-vmcr-4gqj Bootstrap Cross-site Scripting vulnerability
  /workdirs/scan-26951cd8-406f-488e-a4c8-ef9c967bd905/Gemfile.lock
  A package you depend on has a known security hole (CVE-2016-10735). Fix: Update that package to its patched version.
• Worth fixing GHSA-7mvr-5x2g-wfc8 Bootstrap Cross-site Scripting vulnerability
  /workdirs/scan-26951cd8-406f-488e-a4c8-ef9c967bd905/Gemfile.lock
  A package you depend on has a known security hole (CVE-2018-14042). Fix: Update that package to its patched version.
• Worth fixing GHSA-9v3m-8fp8-mj99 Bootstrap Vulnerable to Cross-Site Scripting
  /workdirs/scan-26951cd8-406f-488e-a4c8-ef9c967bd905/Gemfile.lock
  A package you depend on has a known security hole (CVE-2019-8331). Fix: Update that package to its patched version.
• Worth fixing GHSA-ph58-4vrj-w6hr bootstrap Cross-site Scripting vulnerability
  /workdirs/scan-26951cd8-406f-488e-a4c8-ef9c967bd905/Gemfile.lock
  A package you depend on has a known security hole (CVE-2018-20677). Fix: Update that package to its patched version.
• Worth fixing GHSA-h8w8-99g7-qmvj Concurrent Ruby : `AtomicReference#update` livelocks when the stored value is `Float::NAN`
  /workdirs/scan-26951cd8-406f-488e-a4c8-ef9c967bd905/Gemfile.lock
  A package you depend on has a known security hole (CVE-2026-54904). Fix: Update that package to its patched version.
• Worth fixing GHSA-wv3x-4vxv-whpp Concurrent Ruby: `ReentrantReadWriteLock` read-count overflow grants a write lock without exclusivity
  /workdirs/scan-26951cd8-406f-488e-a4c8-ef9c967bd905/Gemfile.lock
  A package you depend on has a known security hole (CVE-2026-54905). Fix: Update that package to its patched version.
• Worth fixing GHSA-34hf-g744-jw64 i18n Vulnerable to Denial of Service Attack
  /workdirs/scan-26951cd8-406f-488e-a4c8-ef9c967bd905/Gemfile.lock
  A package you depend on has a known security hole (CVE-2014-10077). Fix: Update that package to its patched version.
• Worth fixing GHSA-22f2-v57c-j9cx Rack vulnerable to ReDoS in content type parsing (2nd degree polynomial)
  /workdirs/scan-26951cd8-406f-488e-a4c8-ef9c967bd905/Gemfile.lock
  A package you depend on has a known security hole (CVE-2024-25126). Fix: Update that package to its patched version.
• Worth fixing GHSA-3h57-hmj3-gj3p Rack has possible DoS Vulnerability in Multipart MIME parsing
  /workdirs/scan-26951cd8-406f-488e-a4c8-ef9c967bd905/Gemfile.lock
  A package you depend on has a known security hole (CVE-2023-27530). Fix: Update that package to its patched version.
• Worth fixing GHSA-5f9h-9pjv-v6j7 Directory traversal in Rack::Directory app bundled with Rack
  /workdirs/scan-26951cd8-406f-488e-a4c8-ef9c967bd905/Gemfile.lock
  A package you depend on has a known security hole (CVE-2020-8161). Fix: Update that package to its patched version.
• Worth fixing GHSA-625h-95r8-8xpm Rack has an unsafe default in Rack::QueryParser allows params_limit bypass via semicolon-separated parameters
  /workdirs/scan-26951cd8-406f-488e-a4c8-ef9c967bd905/Gemfile.lock
  A package you depend on has a known security hole (CVE-2025-59830). Fix: Update that package to its patched version.
• Worth fixing GHSA-65f5-mfpf-vfhj Denial of service via header parsing in Rack
  /workdirs/scan-26951cd8-406f-488e-a4c8-ef9c967bd905/Gemfile.lock
  A package you depend on has a known security hole (CVE-2022-44570). Fix: Update that package to its patched version.
• Worth fixing GHSA-6xw4-3v39-52mm Rack is vulnerable to a memory-exhaustion DoS through unbounded URL-encoded body parsing
  /workdirs/scan-26951cd8-406f-488e-a4c8-ef9c967bd905/Gemfile.lock
  A package you depend on has a known security hole (CVE-2025-61919). Fix: Update that package to its patched version.

via OSV-Scanner v1.9.2 · Apache-2.0

Code that can be exploited: injection, hardcoded credentials and similar.

Nothing found by this check. ✓

via Semgrep v1.147.0 · LGPL-2.1

Packages that look intentionally malicious: typosquats, sneaky install scripts.

Nothing found by this check. ✓

via Guarddog v2.10.0 · Apache-2.0