Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Express Open Redirect vulnerability CVE-2024-9266, GHSA-jj78-5fmv-mv28 | Medium | 0.5% | 03 Oct, 2024 | npm express |
Sentry SDK Prototype Pollution gadget in JavaScript SDKs GHSA-593m-55hh-j8gv | Medium | Not scored | 03 Oct, 2024 | npm @sentry/browser |
Vulnerable juju introspection abstract UNIX domain socket CVE-2024-8038, GHSA-xwgj-vpm9-q2rq, GO-2024-3175 | Medium | Not scored | 03 Oct, 2024 | Go github.com/juju/juju |
Vulnerable juju hook tool abstract UNIX domain socket CVE-2024-8037, GHSA-8v4w-f4r9-7h6x, GO-2024-3174 | Medium | Not scored | 03 Oct, 2024 | Go github.com/juju/juju |
Unexpected visibility of environment variable configurations in @backstage/plugin-app-backend CVE-2024-47762, GHSA-qc4v-xq2m-65wc | Medium | 0.4% | 03 Oct, 2024 | npm @backstage/plugin-app-backend |
JUJU_CONTEXT_ID is a predictable authentication secret CVE-2024-7558, GHSA-mh98-763h-m9v4, GO-2024-3173 | Medium | Not scored | 03 Oct, 2024 | Go github.com/juju/juju |
Cross-site Scripting via uploaded SVG CVE-2024-47618, GHSA-255w-87rh-rg44 | Medium | 0.4% | 03 Oct, 2024 | Packagist sulu/sulu |
Injection of arbitrary HTML/JavaScript code through the media download URL CVE-2024-47617, GHSA-6784-9c82-vr85 | Medium | 0.4% | 03 Oct, 2024 | Packagist sulu/sulu |
Duplicate Advisory: Contao allows admin an account to upload SVG file containing malicious JavaScript CVE-2024-45965, GHSA-mrw8-5368-phm3 | Medium | 0.3% | 02 Oct, 2024 | Packagist contao/contao |
Zenario Cross Site Scripting in the Image library CVE-2024-45964, GHSA-2cc5-429x-p387 | Medium | 0.4% | 02 Oct, 2024 | Packagist tribalsystems/zenario |
October allows an admin account to upload PDF containing malicious JavaScript CVE-2024-45962, GHSA-hxpp-g76m-qhvg | Medium | 0.5% | 02 Oct, 2024 | Packagist october/october |
Zenario allows authenticated admin users to upload PDF files containing malicious code CVE-2024-45960, GHSA-3636-hx62-pv26 | Medium | 0.4% | 02 Oct, 2024 | Packagist tribalsystems/zenario |
OpenC3 stores passwords in clear text (`GHSL-2024-129`) CVE-2024-47529, GHSA-4xqv-47rm-37mm, PYSEC-2024-121 | Medium | 0.4% | 02 Oct, 2024 | PyPI openc3 RubyGems openc3 npm @openc3/tool-common |
OpenC3 Cross-site Scripting in Login functionality (`GHSL-2024-128`) CVE-2024-43795, GHSA-vfj8-5pj7-2f9g, PYSEC-2024-100 | Medium | 0.5% | 02 Oct, 2024 | PyPI openc3 RubyGems openc3 npm @openc3/tool-common |
Slim Select has potential Cross-site Scripting issue CVE-2024-9440, GHSA-qvqv-mcxr-x8qw | Medium | 0.4% | 02 Oct, 2024 | npm slim-select |
Inventree Server-Side Request Forgery vulnerability exposes server port/internal IP GHSA-vx3h-qwqw-r2wq | Medium | Not scored | 02 Oct, 2024 | PyPI inventree |
Improper Input Validation in Buildah and Podman CVE-2024-9407, GHSA-fhqq-8f65-5xfc, GO-2024-3169 | Medium | Not scored | 01 Oct, 2024 | Go github.com/containers/buildah Go github.com/containers/podman Go github.com/containers/podman/v2 Go github.com/containers/podman/v3 +2 more |
Link Following in github.com/containers/common CVE-2024-9341, GHSA-mc76-5925-c5p6, GO-2024-3171 | Medium | Not scored | 01 Oct, 2024 | Go github.com/containers/common |
LibreNMS vulnerable to Stored Cross-site Scripting via File Upload CVE-2024-47528, GHSA-x8gm-j36p-fppf | Medium | 0.4% | 01 Oct, 2024 | Packagist librenms/librenms |
LibreNMS has Stored Cross-site Scripting vulnerability in "Alert Transports" feature CVE-2024-47523, GHSA-7f84-28qh-9486 | Medium | 0.6% | 01 Oct, 2024 | Packagist librenms/librenms |
LibreNMS has Stored Cross-site Scripting vulnerability in "Alert Rules" feature CVE-2024-47525, GHSA-j2j9-7pr6-xqwv | Medium | 29.6% | 01 Oct, 2024 | Packagist librenms/librenms |
LibreNMS has Stored Cross-site Scripting vulnerability in "Device Dependencies" feature CVE-2024-47527, GHSA-rwwc-2v8q-gc9v | Medium | 0.5% | 01 Oct, 2024 | Packagist librenms/librenms |
Pagekit Cross-site Scripting vulnerability CVE-2024-45967, GHSA-xw32-6422-frqm | Medium | 0.4% | 01 Oct, 2024 | Packagist pagekit/pagekit |
git-shallow-clone Argument Injection vulnerability CVE-2024-21531, GHSA-qwrq-vxvw-537r | Medium | 1.0% | 01 Oct, 2024 | npm git-shallow-clone |
starcitizentools/citizen-skin vulnerable to stored, self-XSS in the "real name" field CVE-2024-47536, GHSA-62r2-gcxr-426x | Medium | 0.5% | 30 Sep, 2024 | Packagist starcitizentools/citizen-skin |
MantisBT vulnerable to information disclosure with user profiles CVE-2024-45792, GHSA-h5q3-fjp4-2x7r | Medium | 0.5% | 30 Sep, 2024 | Packagist mantisbt/mantisbt |
Filament has unvalidated ColorColumn and ColorEntry values that can be used for Cross-site Scripting CVE-2024-47186, GHSA-9h9q-qhxg-89xr | Medium | 0.4% | 27 Sep, 2024 | Packagist filament/infolists Packagist filament/tables |
ReLaXed Cross-site Scripting vulnerability CVE-2024-9283, GHSA-gj3p-j74v-3x57 | Medium | 0.3% | 27 Sep, 2024 | npm relaxedjs |
Inefficient Regular Expression Complexity in langflow CVE-2024-9277, GHSA-355v-2rjx-fpx7, PYSEC-2026-1521 | Medium | 1.0% | 27 Sep, 2024 | PyPI langflow |
Agnai vulnerable to Relative Path Traversal in Image Upload CVE-2024-47171, GHSA-g54f-66mw-hv66 | Medium | 0.5% | 26 Sep, 2024 | npm agnai |
Agnai File Disclosure Vulnerability: JSON via Path Traversal CVE-2024-47170, GHSA-h355-hm5h-cm8h | Medium | 0.5% | 26 Sep, 2024 | npm agnai |
Layui has DOM Clobbering gadgets that leads to Cross-site Scripting CVE-2024-47075, GHSA-j827-6rgf-9629 | Medium | 0.3% | 26 Sep, 2024 | npm layui |
Ory Kratos's setting required_aal `highest_available` does not properly respect code + mfa credentials CVE-2024-45042, GHSA-wc43-73w7-x2f5, GO-2024-3160 | Medium | Not scored | 26 Sep, 2024 | Go github.com/ory/kratos |
Assimp v5.4.3 is vulnerable to Buffer Overflow via the MD5Importer::LoadMD5MeshFile function. CVE-2024-46632, PYSEC-2024-291 | Medium | 0.5% | 26 Sep, 2024 | PyPI pyassimp |
IDOR vulnerability in account profile page CVE-2024-39319, GHSA-rw3j-574h-mrcq | Medium | 0.5% | 26 Sep, 2024 | Packagist aimeos/ai-controller-frontend |
Mattermost fails to strip `embeds` from `metadata` when broadcasting `posted` events BIT-mattermost-2024-47003, CVE-2024-47003, GHSA-59hf-mpf8-pqjh, GO-2024-3164 | Medium | Not scored | 26 Sep, 2024 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Camaleon CMS vulnerable to stored XSS through user file upload (GHSL-2024-184) GHSA-75j2-9gmc-m855 | Medium | Not scored | 25 Sep, 2024 | RubyGems camaleon_cms |
Grafana Alloy on Windows has Unquoted Search Path or Element vulnerability BIT-grafana-alloy-2024-8975, CVE-2024-8975, GHSA-chqx-36rm-rf8h, GO-2024-3168 | Medium | Not scored | 25 Sep, 2024 | Go github.com/grafana/alloy |
Grafana Agent (Flow mode) on Windows has Unquoted Search Path or Element vulnerability CVE-2024-8996, GHSA-m5gv-m5f9-wgv4, GO-2024-3170 | Medium | Not scored | 25 Sep, 2024 | Go github.com/grafana/agent |
Cross-site scripting (XSS) in the clipboard package CVE-2024-45613, GHSA-rgg8-g5x8-wr9v | Medium | 0.5% | 25 Sep, 2024 | npm @ckeditor/ckeditor5-clipboard npm ckeditor5 |
Apache Answer: Avatar URL leaked user email addresses CVE-2024-40761, GHSA-48cr-j2cx-mcr8, GO-2024-3158 | Medium | Not scored | 25 Sep, 2024 | Go github.com/apache/incubator-answer |
Flowise and Flowise Chat Embed vulnerable to Stored Cross-site Scripting CVE-2024-9148, GHSA-m5p9-xvxj-64c8 | Medium | 0.6% | 25 Sep, 2024 | npm flowise npm flowise-embed |
Cross site scripting in Concrete CMS CVE-2024-8291, GHSA-q7qr-22qw-pqgx | Medium | 0.5% | 25 Sep, 2024 | Packagist concrete5/concrete5 |
Cross site scripting in Concrete CMS CVE-2024-7398, GHSA-x8h2-255q-jg4x | Medium | 0.5% | 25 Sep, 2024 | Packagist concrete5/concrete5 |
Camaleon CMS vulnerable to stored XSS through user file upload (GHSL-2024-184) GHSA-8fx8-3rg2-79xw | Medium | Not scored | 23 Sep, 2024 | RubyGems camaleon_cms |
A stored cross-site scripting (XSS) vulnerability exists in NetBox 4.1.0 within the "Configuration History" feature of the "Admin" panel via a /core/config-revisions/ Add action. An authenticated user can inject arbitrary JavaScript or HTML into the "Top banner" field. NOTE: Multiple third parties h CVE-2024-47226, PYSEC-2024-325 | Medium | 0.3% | 22 Sep, 2024 | PyPI pynetbox |
Galaxy is a free, open-source system for analyzing data, authoring workflows, training and education, publishing tools, managing infrastructure, and more. The editor visualization, /visualizations endpoint, can be used to store HTML tags and trigger javascript execution upon edit operation. All supp CVE-2024-42346, GHSA-x6w7-3gwf-qr9r, PYSEC-2024-272, PYSEC-2024-273 | Medium | 0.8% | 20 Sep, 2024 | PyPI galaxy-auth PyPI galaxy-data |
Prevent XSS from Confidant API call CVE-2024-45793, GHSA-rxq8-q85f-m866, PYSEC-2026-1269 | Medium | 0.4% | 20 Sep, 2024 | PyPI confidant |
Puma's header normalization allows for client to clobber proxy set headers CVE-2024-45614, GHSA-9hf4-67fc-4vf4 | Medium | Not scored | 20 Sep, 2024 | RubyGems puma |
DOM Clobbering Gadget found in Rspack's AutoPublicPathRuntimeModule that leads to XSS GHSA-84jw-g43v-8gjm | Medium | Not scored | 19 Sep, 2024 | npm @rspack/core |