Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
XmlScanner bypass leads to XXE CVE-2024-47873, GHSA-jw4x-v69f-hh5w | High | 0.8% | 18 Nov, 2024 | Packagist phpoffice/phpexcel Packagist phpoffice/phpspreadsheet |
OpenCTI May Bypass Introspection Restriction CVE-2024-37155, GHSA-4mvw-j8r9-xcgc, PYSEC-2024-313 | High | 0.5% | 18 Nov, 2024 | PyPI pycti |
Kubernetes Nil pointer dereference in KCM after v1 HPA patch request CVE-2024-0793, GHSA-h7wq-jj8r-qm7p, GO-2024-3277 | High | 0.6% | 17 Nov, 2024 | Go k8s.io/kubernetes |
Regular Expression Denial of Service (ReDoS) in @eslint/plugin-kit CVE-2024-21539, GHSA-7q7g-4xm8-89cq | High | 0.5% | 15 Nov, 2024 | npm @eslint/plugin-kit |
Remote Code Execution in Gogs CVE-2024-44625, GHSA-phm4-wf3h-pc3r, GO-2024-3275 | High | 16.5% | 15 Nov, 2024 | Go gogs.io/gogs |
LibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/includes/html/pages/device/services.inc.php CVE-2024-52526, GHSA-8fh4-942r-jf2g | High | 0.5% | 15 Nov, 2024 | Packagist librenms/librenms |
LibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/includes/html/print-customoid.php CVE-2024-51497, GHSA-gv4m-f6fx-859x | High | 0.4% | 15 Nov, 2024 | Packagist librenms/librenms |
LibreNMS has a Reflected XSS ('Cross-site Scripting') in librenms/includes/html/pages/wireless.inc.php CVE-2024-51496, GHSA-28p7-f6h6-3jh3 | High | 0.4% | 15 Nov, 2024 | Packagist librenms/librenms |
LibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/includes/html/dev-overview-data.inc.php CVE-2024-51495, GHSA-p66q-ppwr-q5j8 | High | 0.4% | 15 Nov, 2024 | Packagist librenms/librenms |
LibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/app/Http/Controllers/Table/EditPortsController.php CVE-2024-51494, GHSA-7663-37rg-c377 | High | 0.4% | 15 Nov, 2024 | Packagist librenms/librenms |
LibreNMS has a Persistent XSS from Insecure Input Sanitization Affects Multiple Endpoints CVE-2024-50355, GHSA-4m5r-w2rq-q54q | High | 0.3% | 15 Nov, 2024 | Packagist librenms/librenms |
LibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/includes/html/pages/device/overview/services.inc.php CVE-2024-50352, GHSA-qr8f-5qqg-j3wg | High | 41.4% | 15 Nov, 2024 | Packagist librenms/librenms |
LibreNMS has a Reflected XSS ('Cross-site Scripting') in librenms/includes/functions.php CVE-2024-50351, GHSA-v7w9-63xh-6r3w | High | 0.4% | 15 Nov, 2024 | Packagist librenms/librenms |
LibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/app/Http/Controllers/Table/EditPortsController.php CVE-2024-50350, GHSA-xh4g-c9p6-5jxg | High | 0.4% | 15 Nov, 2024 | Packagist librenms/librenms |
LibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/includes/html/pages/device/capture.inc.php CVE-2024-49764, GHSA-rmr4-x6c9-jc68 | High | 0.4% | 15 Nov, 2024 | Packagist librenms/librenms |
Stored XSS ('Cross-site Scripting') in librenms/includes/html/pages/edituser.inc.php CVE-2024-49759, GHSA-888j-pjqh-fx58 | High | 0.4% | 15 Nov, 2024 | Packagist librenms/librenms |
LibreNMS has a stored XSS ('Cross-site Scripting') in librenms/includes/html/pages/api-access.inc.php CVE-2024-49754, GHSA-gfwr-xqmj-j27v | High | 73.9% | 15 Nov, 2024 | Packagist librenms/librenms |
Apache Airflow: Sensitive configuration values are not masked in the logs by default BIT-airflow-2024-45784, CVE-2024-45784, GHSA-46c3-5xc5-wwhv, PYSEC-2024-182, PYSEC-2026-1112 | High | 1.3% | 15 Nov, 2024 | PyPI airflow PyPI apache-airflow |
Connecting to a malicious Codespaces via GH CLI could allow command execution on the user's computer CVE-2024-52308, GHSA-p2h2-3vg9-4p87, GO-2024-3269 | High | 0.9% | 14 Nov, 2024 | Go github.com/cli/cli Go github.com/cli/cli/v2 |
Harbor fails to validate the user permissions when updating p2p preheat policies BIT-harbor-2022-31668, CVE-2022-31668, GHSA-3wpx-625q-22j7, GHSA-r864-28pw-8682, GO-2024-3268 | High | 0.3% | 14 Nov, 2024 | Go github.com/goharbor/harbor Go github.com/goharbor/harbor/src |
Android Framework Privilege Escalation Vulnerability CVE-2024-43093 | HighExploited | 0.7% | 13 Nov, 2024 | |
Symfony has an Authentication Bypass via RememberMe CVE-2024-51996, GHSA-cg23-qf8f-62rr | High | 0.6% | 13 Nov, 2024 | Packagist symfony/security-http |
Craft CMS vulnerable to Potential Remote Code Execution via missing path normalization & Twig SSTI CVE-2024-52293, GHSA-f3cw-hg6r-chfv | High | 1.4% | 13 Nov, 2024 | Packagist craftcms/cms |
Craft CMS Arbitrary System File Read CVE-2024-52292, GHSA-cw6g-qmjq-6w2w | High | 0.7% | 13 Nov, 2024 | Packagist craftcms/cms |
Local File System Validation Bypass Leading to File Overwrite, Sensitive File Access, and Potential Code Execution CVE-2024-52291, GHSA-jrh5-vhr9-qh7q | High | 1.3% | 13 Nov, 2024 | Packagist craftcms/cms |
Zoraxy has an authenticated command injection in the Web SSH feature CVE-2024-52010, GHSA-7hpf-g48v-hw3j, GO-2024-3267 | High | 1.5% | 12 Nov, 2024 | Go github.com/tobychui/zoraxy |
Cross Site Scripting vulnerability in Snipe-IT CVE-2024-51093, GHSA-hw9x-8m75-4vjq | High | 0.4% | 12 Nov, 2024 | Packagist snipe/snipe-it |
Laravel environment manipulation via query string BIT-laravel-2024-52301, CVE-2024-52301, GHSA-gv7v-rgg6-548h | High | 44.8% | 12 Nov, 2024 | Packagist laravel/framework |
Decidim-Awesome has SQL injection in AdminAccountability CVE-2024-43415, GHSA-cxwf-qc32-375f | High | 0.7% | 12 Nov, 2024 | RubyGems decidim-decidim_awesome |
TorchGeo Remote Code Execution Vulnerability CVE-2024-49048, GHSA-ghq9-vc6f-8qjf, PYSEC-2024-204 | High | 1.2% | 12 Nov, 2024 | PyPI torchgeo |
Microsoft Windows Task Scheduler Privilege Escalation Vulnerability CVE-2024-49039 | HighExploited | 14.2% | 12 Nov, 2024 | |
LightGBM Remote Code Execution Vulnerability CVE-2024-43598, GHSA-2586-f3p4-hq84, PYSEC-2024-231 | High | 1.4% | 12 Nov, 2024 | PyPI lightgbm |
pywasm3 contains a Use-After-Free in ForEachModule CVE-2024-27530, GHSA-46r6-92jg-22jg, PYSEC-2024-306 | High | 0.2% | 08 Nov, 2024 | PyPI pywasm3 |
wasm3 uncontrolled memory allocation vulnerability CVE-2024-27529, GHSA-fmq6-4w57-2w3v, PYSEC-2024-305 | High | 0.3% | 08 Nov, 2024 | PyPI pywasm3 SwiftURL github.com/shareup/wasm-interpreter-apple crates.io wasm3 |
pywasm3 has an Invalid Memory Read, Leading to DoS and Potential Code Execution CVE-2024-27528, GHSA-mhg9-mm8c-c683, PYSEC-2024-304 | High | 0.2% | 08 Nov, 2024 | PyPI pywasm3 |
wasm3 139076a is vulnerable to Denial of Service (DoS). CVE-2024-27527, PYSEC-2024-303 | High | 0.5% | 08 Nov, 2024 | PyPI pywasm3 |
Git credentials are exposed in Atlantis logs CVE-2024-52009, GHSA-gppm-hq3p-h4rp, GO-2024-3265 | High | 0.7% | 08 Nov, 2024 | Go github.com/runatlantis/atlantis |
Regular Expression Denial of Service (ReDoS) in cross-spawn CVE-2024-21538, GHSA-3xgq-45jj-v275 | High | 0.9% | 08 Nov, 2024 | npm cross-spawn |
changedetection.io path traversal using file URI scheme without supplying hostname CVE-2024-51998, GHSA-6jrf-rcjf-245r, PYSEC-2026-1239 | High | 0.7% | 07 Nov, 2024 | PyPI changedetection-io PyPI changedetection.io |
PHPExcel XXE Vulnerability CVE-2015-3542, GHSA-3m9x-2qfj-xvq4 | High | Not scored | 07 Nov, 2024 | Packagist phpoffice/phpexcel |
Devtron has SQL Injection in CreateUser API CVE-2024-45794, GHSA-q78v-cv36-8fxj, GO-2024-3260 | High | 0.7% | 07 Nov, 2024 | Go github.com/devtron-labs/devtron |
Moodle LFI vulnerability when restoring malformed block backups BIT-moodle-2024-43440, CVE-2024-43440, GHSA-qrqv-26gf-xgwh | High | 0.6% | 07 Nov, 2024 | Packagist moodle/moodle |
Moodle's IDOR in Feedback non-respondents report allows messaging arbitrary site users BIT-moodle-2024-43438, CVE-2024-43438, GHSA-p9cx-f595-h79h | High | 0.5% | 07 Nov, 2024 | Packagist moodle/moodle |
Moodle vulnerable to site administration SQL injection via XMLDB editor BIT-moodle-2024-43436, CVE-2024-43436, GHSA-mx26-62xm-2p83 | High | 0.8% | 07 Nov, 2024 | Packagist moodle/moodle |
Moodle has CSRF risk in Feedback non-respondents report BIT-moodle-2024-43434, CVE-2024-43434, GHSA-x87r-37q5-mmr8 | High | 0.6% | 07 Nov, 2024 | Packagist moodle/moodle |
Moodle's IDOR in badges allows deletion of arbitrary badges BIT-moodle-2024-43431, CVE-2024-43431, GHSA-wwjf-gwrv-wh45 | High | 0.5% | 07 Nov, 2024 | Packagist moodle/moodle |
Moodle vulnerable to cache poisoning via injection into storage BIT-moodle-2024-43428, CVE-2024-43428, GHSA-2r9m-wg35-rfvc | High | 0.2% | 07 Nov, 2024 | Packagist moodle/moodle |
Moodle has arbitrary file read risk through pdfTeX BIT-moodle-2024-43426, CVE-2024-43426, GHSA-vjmm-r9gg-425m | High | 0.7% | 07 Nov, 2024 | Packagist moodle/moodle |
Moodle Remote Code Execution vulnerability BIT-moodle-2024-43425, CVE-2024-43425, GHSA-v6f4-v8h8-3c87 | High | 87.5% | 07 Nov, 2024 | Packagist moodle/moodle |
CometBFT Vote Extensions: Panic when receiving a Pre-commit with an invalid data GHSA-p7mv-53f2-4cwj, GO-2024-3259 | High | Not scored | 06 Nov, 2024 | Go github.com/cometbft/cometbft |