Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Moodle stored XSS via calendar's event title when deleting the event BIT-moodle-2024-38274, CVE-2024-38274, GHSA-p5cg-6rfr-6mx8 | Medium | 0.4% | 18 Jun, 2024 | Packagist moodle/moodle |
Moodle BigBlueButton web service leaks meeting joining information BIT-moodle-2024-38273, CVE-2024-38273, GHSA-x29x-qwvx-fxr2 | Medium | 0.4% | 18 Jun, 2024 | Packagist moodle/moodle |
Minder affected by denial of service from maliciously configured Git repository CVE-2024-37904, GHSA-hpcg-xjq5-g666, GO-2024-2934 | Medium | 0.5% | 18 Jun, 2024 | Go github.com/stacklok/minder |
Lobe Chat API Key Leak CVE-2024-37895, GHSA-p36r-qxgx-jq2v | Medium | 0.5% | 17 Jun, 2024 | npm @lobehub/chat |
Firefly III has a MFA bypass in oauth flow CVE-2024-37893, GHSA-4gm4-c4mh-4p7w | Medium | 0.6% | 17 Jun, 2024 | Packagist grumpydictator/firefly-iii |
urllib3's Proxy-Authorization request header isn't stripped during cross-origin redirects CVE-2024-37891, GHSA-34jh-p97f-mpxf, PYSEC-2026-1995 | Medium | 1.1% | 17 Jun, 2024 | PyPI urllib3 |
@akbr/update Prototype Pollution CVE-2024-36578, GHSA-mj4p-gmhr-92g3 | Medium | 0.2% | 17 Jun, 2024 | npm @akbr/update |
flatten-json Prototype Pollution CVE-2024-36574, GHSA-j8px-pjmp-325f | Medium | 0.4% | 17 Jun, 2024 | npm @allanlancioni/flatten-json |
CVE-2024-5138: snapd snapctl auth bypass CVE-2024-5138, GHSA-p9v8-q5m4-pf46, GO-2024-2906 | Medium | 0.8% | 14 Jun, 2024 | Go github.com/snapcore/snapd |
Mattermost Desktop App Remote Code Execution CVE-2024-37182, GHSA-hvxg-77mg-vrvp | Medium | 0.3% | 14 Jun, 2024 | npm mattermost-desktop |
Apache Airflow does not return the "Cache-Control" header for dynamic content BIT-airflow-2024-25142, CVE-2024-25142, GHSA-9xpj-62mm-24h2, PYSEC-2024-195 | Medium | 0.3% | 14 Jun, 2024 | PyPI apache-airflow |
Magento Open Source Incorrect Authorization vulnerability BIT-magento-2024-34106, CVE-2024-34106, GHSA-p6h9-gx5g-wg64 | Medium | 0.8% | 13 Jun, 2024 | Packagist magento/community-edition |
Magento Open Source Cross-Site Scripting (XSS) vulnerability BIT-magento-2024-34105, CVE-2024-34105, GHSA-5632-wq7m-gfq9 | Medium | 0.7% | 13 Jun, 2024 | Packagist magento/community-edition |
gqlparser denial of service vulnerability via the parserDirectives function CVE-2023-49559, GHSA-2hmf-46v7-v6fx, GO-2024-2920 | Medium | 0.6% | 12 Jun, 2024 | Go github.com/vektah/gqlparser Go github.com/vektah/gqlparser/v2 |
Invenio-Communities has a Cross-Site Scripting (XSS) vulnerability in React components GHSA-hjx6-f647-mvf9 | Medium | Not scored | 12 Jun, 2024 | PyPI invenio-communities |
SummerNote Cross Site Scripting Vulnerability CVE-2024-37629, GHSA-cc55-mvqc-g9mg | Medium | 0.5% | 12 Jun, 2024 | npm summernote |
WooCommerce has a Cross-Site Scripting (XSS) Vulnerability in checkout & registration forms CVE-2024-37297, GHSA-cv23-q6gh-xfrf | Medium | 0.5% | 12 Jun, 2024 | Packagist woocommerce/woocommerce |
@strapi/plugin-upload has a Denial-of-Service via Improper Exception Handling CVE-2024-31217, GHSA-pm9q-xj9p-96pm | Medium | 0.7% | 12 Jun, 2024 | npm @strapi/plugin-upload |
Traefik has unexpected behavior with IPv4-mapped IPv6 addresses GHSA-7jmw-8259-q9jx, GO-2024-2917 | Medium | Not scored | 11 Jun, 2024 | Go github.com/traefik/traefik Go github.com/traefik/traefik/v2 Go github.com/traefik/traefik/v3 |
Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability CVE-2024-35255, GHSA-m5vv-6r4h-3vj9, GO-2024-2918, PYSEC-2026-1209 | Medium | 0.8% | 11 Jun, 2024 | Go github.com/Azure/azure-sdk-for-go/sdk/azidentity Maven com.azure:azure-identity Maven com.microsoft.azure:msal4j NuGet Azure.Identity +4 more |
@grpc/grpc-js can allocate memory for incoming messages well above configured limits CVE-2024-37168, GHSA-7v5v-9h63-cj86 | Medium | 0.7% | 10 Jun, 2024 | npm @grpc/grpc-js |
Moby (Docker Engine) is vulnerable to Ambiguous OCI manifest parsing GHSA-xmmx-7jpf-fx42, GO-2024-2914 | Medium | Not scored | 10 Jun, 2024 | Go github.com/docker/docker Go github.com/moby/moby |
Docker CLI leaks private registry credentials to registry-1.docker.io BIT-docker-cli-2021-41092, CVE-2021-41092, GHSA-99pg-grm5-qq3v, GO-2024-2912 | Medium | 1.7% | 10 Jun, 2024 | Go github.com/docker/cli |
ua-parser/uap-php ReDoS vulnerability GHSA-78hm-5hjw-58mh | Medium | Not scored | 07 Jun, 2024 | Packagist ua-parser/uap-php |
Zend-developer-tools information disclosure vulnerability GHSA-qg7m-mwxm-j3h7 | Medium | Not scored | 07 Jun, 2024 | Packagist zendframework/zend-developer-tools |
Zend_Filter_StripTags vulnerable to Cross-site Scripting when comments allowed GHSA-4vf6-mq7w-3hp6 | Medium | Not scored | 07 Jun, 2024 | Packagist zendframework/zendframework1 |
Zend-Diactoros URL Rewrite vulnerability GHSA-fq4p-86hh-42v9 | Medium | Not scored | 07 Jun, 2024 | Packagist zendframework/zend-diactoros |
Zendframework potential Cross-site Scripting vector in `Zend_Service_ReCaptcha_MailHide` GHSA-4v57-pwvf-x35j | Medium | Not scored | 07 Jun, 2024 | Packagist zendframework/zendframework1 |
Zend-Form vulnerable to Cross-site Scripting GHSA-gvpp-6jrj-5pqc | Medium | Not scored | 07 Jun, 2024 | Packagist zendframework/zend-form |
Zendframework Potential XSS or HTML Injection vector in Zend_Json GHSA-vvm3-rv48-j3g5 | Medium | Not scored | 07 Jun, 2024 | Packagist zendframework/zendframework1 |
ZendFramework1 Potential Security Issues in Bundled Dojo Library GHSA-w5mj-j45q-m638 | Medium | Not scored | 07 Jun, 2024 | Packagist zendframework/zendframework1 |
ZendFramework Cross-site Scripting vector in `Zend_Filter_StripTags` GHSA-gwpm-pm6x-h7rj | Medium | Not scored | 07 Jun, 2024 | Packagist zendframework/zendframework1 |
Zend-Session session validation vulnerability GHSA-96c6-m98x-hxjx | Medium | Not scored | 07 Jun, 2024 | Packagist zendframework/zend-session |
ZendFramework Potential Cross-site Scripting in Development Environment Error View Script GHSA-g52p-86j5-xr8q | Medium | Not scored | 07 Jun, 2024 | Packagist zendframework/zendframework1 |
ZendFramework potential Cross-site Scripting vectors due to inconsistent encodings GHSA-hg35-vqp3-fv39 | Medium | Not scored | 07 Jun, 2024 | Packagist zendframework/zendframework1 |
ZendFramework potential Cross-site Scripting vector in `Zend_Dojo_View_Helper_Editor` GHSA-j543-vg33-g6vj | Medium | Not scored | 07 Jun, 2024 | Packagist zendframework/zendframework1 |
ZendFramework has potential Cross-site Scripting vector in multiple view helpers GHSA-m7hr-j867-3f34 | Medium | Not scored | 07 Jun, 2024 | Packagist zendframework/zend-view |
Zendframework URL Rewrite vulnerability GHSA-fh7r-58q4-6387 | Medium | Not scored | 07 Jun, 2024 | Packagist zendframework/zendframework |
ZendFramework vulnerable to Cross-site Scripting GHSA-5gmf-3c43-q73v | Medium | Not scored | 07 Jun, 2024 | Packagist zendframework/zendframework |
ZendFramework potential remote code execution in zend-mail via Sendmail adapter GHSA-gff2-p6vm-3p8g | Medium | Not scored | 07 Jun, 2024 | Packagist zendframework/zendframework |
ZendFramework Potential Proxy Injection Vulnerabilities GHSA-mg7h-9qfx-4r83 | Medium | Not scored | 07 Jun, 2024 | Packagist zendframework/zendframework |
ZendFramework Information Disclosure and Insufficient Entropy vulnerability GHSA-2fhr-8r8r-qp56 | Medium | Not scored | 07 Jun, 2024 | Packagist zendframework/zendframework |
Zendframework session validation vulnerability GHSA-62f6-h68r-3jpw | Medium | Not scored | 07 Jun, 2024 | Packagist zendframework/zendframework |
Zendframework has potential Cross-site Scripting vector in multiple view helpers GHSA-8q77-cv62-jj38 | Medium | Not scored | 07 Jun, 2024 | Packagist zendframework/zendframework |
TYPO3 Denial of Service in Online Media Asset Handling GHSA-f3wf-q4fj-3gxf | Medium | Not scored | 07 Jun, 2024 | Packagist typo3/cms |
TYPO3 Information Disclosure in Install Tool GHSA-6487-3qvg-8px9 | Medium | Not scored | 07 Jun, 2024 | Packagist typo3/cms |
TYPO3 Cross-Site Scripting in Frontend User Login GHSA-2rcw-9hrm-8q7q | Medium | Not scored | 07 Jun, 2024 | Packagist typo3/cms |
TYPO3 Cross-Site Scripting in Backend Modal Component GHSA-7q33-hxwj-7p8v | Medium | Not scored | 07 Jun, 2024 | Packagist typo3/cms |
TYPO3 Cross-Site Scripting in Online Media Asset Rendering GHSA-8m6j-p5jv-v69w | Medium | Not scored | 07 Jun, 2024 | Packagist typo3/cms |
TYPO3 Information Disclosure of Installed Extensions GHSA-f624-8hfq-5fh3 | Medium | Not scored | 07 Jun, 2024 | Packagist typo3/cms |