Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Drupal core Multiple vulnerabilities due to the use of the third-party library Archive_Tar GHSA-m9fv-whq2-6wmc | High | Not scored | 15 May, 2024 | Packagist drupal/drupal |
Drupal core Arbitrary PHP code execution GHSA-gxxj-g9v8-w28p | High | Not scored | 15 May, 2024 | Packagist drupal/core |
Drupal core Multiple vulnerabilities due to the use of the third-party library Archive_Tar GHSA-98h9-727m-44qv | High | Not scored | 15 May, 2024 | Packagist drupal/core |
doctrine/orm Regression in Query Parenthesis can have Security Implications GHSA-vjrg-wpm8-rhrw | High | Not scored | 15 May, 2024 | Packagist doctrine/orm |
Doctrine DBAL SQL injection possibility GHSA-76w8-mqx4-wjrf | High | Not scored | 15 May, 2024 | Packagist doctrine/dbal |
contao/core PHP object injection vulnerability allows for arbitrary code execution GHSA-wq43-8r5p-w3mc | High | Not scored | 15 May, 2024 | Packagist contao/core |
OpenCFP Framework (Sentry) Account takeover via null password reset codes GHSA-2m5g-8xpw-42vp | High | Not scored | 15 May, 2024 | Packagist cartalyst/sentry |
easyadmin-extension-bundle action case insensitivity GHSA-32rx-xvvr-4xv9 | High | Not scored | 15 May, 2024 | Packagist alterphp/easyadmin-extension-bundle |
pygmentize Remote Code Execution GHSA-77mv-mp2j-gxxh | High | Not scored | 15 May, 2024 | Packagist 3f/pygmentize |
Grafana Data source and plugin proxy endpoints could leak the authentication cookie to some destination plugins BIT-grafana-2022-39201, CVE-2022-39201, GHSA-x744-mm8v-vpgr, GO-2024-2858 | High | 1.7% | 14 May, 2024 | Go github.com/grafana/grafana |
Grafana Email addresses and usernames can not be trusted BIT-grafana-2022-39306, CVE-2022-39306, GHSA-2x6g-h2hg-rq84, GO-2024-2843 | High | 0.8% | 14 May, 2024 | Go github.com/grafana/grafana |
Grafana User enumeration via forget password BIT-grafana-2022-39307, CVE-2022-39307, GHSA-3p62-42x7-gxg5, GO-2024-2844 | High | 0.8% | 14 May, 2024 | Go github.com/grafana/grafana |
Grafana Escalation from admin to server admin when auth proxy is used BIT-grafana-2022-35957, CVE-2022-35957, GHSA-ff5c-938w-8c9q, GO-2024-2847 | High | 1.6% | 14 May, 2024 | Go github.com/grafana/grafana |
Grafana Plugin signature bypass BIT-grafana-2022-31123, CVE-2022-31123, GHSA-rhxj-gh46-jvw8, GO-2024-2855 | High | 0.3% | 14 May, 2024 | Go github.com/grafana/grafana |
Grafana account takeover via OAuth vulnerability BIT-grafana-2022-31107, CVE-2022-31107, GHSA-mx47-6497-3fv2, GO-2024-2852 | High | 2.9% | 14 May, 2024 | Go github.com/grafana/grafana |
dotmesh arbitrary file read and/or write CVE-2020-26312, GHSA-hf54-fq2m-p9v6, GO-2024-2849 | High | 0.4% | 14 May, 2024 | Go github.com/dotmesh-io/dotmesh |
Reportico Web fails to invalidate cookies upon logout CVE-2024-31556, GHSA-2q2f-h83x-cx3x | High | 0.2% | 14 May, 2024 | Packagist reportico-web/reportico |
Scrapy leaks the authorization header on same-domain but cross-origin redirects CVE-2024-1968, GHSA-4qqq-9vqf-3h3f, PYSEC-2024-258 | High | 0.7% | 14 May, 2024 | PyPI Scrapy PyPI scrapy |
Microsoft DWM Core Library Privilege Escalation Vulnerability CVE-2024-30051 | HighExploited | 5.7% | 14 May, 2024 | |
Microsoft Windows MSHTML Platform Security Feature Bypass Vulnerability CVE-2024-30040 | HighExploited | 3.9% | 14 May, 2024 | |
Google Chromium V8 Out-of-Bounds Memory Write Vulnerability CVE-2024-4761 | HighExploited | 11.0% | 14 May, 2024 | |
Uncontrolled resource consumption in braces CVE-2024-4068, GHSA-grv7-fg5c-xmjg | High | 1.5% | 14 May, 2024 | npm braces |
github.com/containers/image allows unexpected authenticated registry accesses CVE-2024-3727, GHSA-6wvf-f2vw-3425, GO-2024-2842 | High | 1.3% | 14 May, 2024 | Go github.com/containers/image Go github.com/containers/image/v5 |
Nautobot's BANNER_* configuration can be used to inject arbitrary HTML content into Nautobot pages CVE-2024-34707, GHSA-r2hr-4v48-fjv3, PYSEC-2026-1688 | High | 0.6% | 13 May, 2024 | PyPI nautobot |
NocoDB Vulnerable to Stored Cross-Site Scripting in Formula.vue CVE-2023-49781, GHSA-h6r4-xvw6-jc5h | High | 0.6% | 13 May, 2024 | npm nocodb |
Mantis Bug Tracker (MantisBT) allows user account takeover in the signup/reset password process CVE-2024-34077, GHSA-93x3-m7pw-ppqm | High | 1.2% | 13 May, 2024 | Packagist mantisbt/mantisbt |
Previous ATX is not checked to be the newest valid ATX by Smesher when validating incoming ATX CVE-2024-34360, GHSA-jcqq-g64v-gcm7, GO-2024-2831 | High | 0.7% | 10 May, 2024 | Go github.com/spacemeshos/api Go github.com/spacemeshos/api/release/go Go github.com/spacemeshos/go-spacemesh |
Next.js Server-Side Request Forgery in Server Actions CVE-2024-34351, GHSA-fr5h-rqp8-mj6g | High | 5.5% | 09 May, 2024 | npm next |
Next.js Vulnerable to HTTP Request Smuggling CVE-2024-34350, GHSA-77r5-gw3j-2mpf | High | 1.2% | 09 May, 2024 | npm next |
@cyclonedx/cyclonedx-library Improper Restriction of XML External Entity Reference vulnerability CVE-2024-34345, GHSA-38gf-rh2w-gmj7 | High | 0.9% | 08 May, 2024 | npm @cyclonedx/cyclonedx-library |
react-pdf vulnerable to arbitrary JavaScript execution upon opening a malicious PDF with PDF.js CVE-2024-34342, GHSA-87hq-q4gp-9wr4 | High | 1.1% | 07 May, 2024 | npm react-pdf |
Minder's GitHub Webhook Handler vulnerable to DoS from un-validated requests CVE-2024-34084, GHSA-9c5w-9q3f-3hv7, GO-2024-2821 | High | 0.6% | 07 May, 2024 | Go github.com/stacklok/minder |
PDF.js vulnerable to arbitrary JavaScript execution upon opening a malicious PDF CVE-2024-4367, GHSA-wgrm-67xf-hhpq | High | 70.7% | 07 May, 2024 | npm pdfjs-dist |
wasm3 v0.5.0 was discovered to contain an out-of-bound memory read which leads to segmentation fault via the function "main" in wasm3/platforms/app/main.c. CVE-2024-34246, PYSEC-2024-307 | High | 0.5% | 06 May, 2024 | PyPI pywasm3 |
Arbitrary HTML present after sanitization because of unicode normalization CVE-2024-34078, GHSA-wvhx-q427-fgh3, PYSEC-2026-1455 | High | 0.6% | 06 May, 2024 | PyPI html-sanitizer |
Werkzeug debugger vulnerable to remote execution when interacting with attacker controlled domain CVE-2024-34069, GHSA-2g68-c3qc-8985, PYSEC-2026-2043 | High | 3.4% | 06 May, 2024 | PyPI Werkzeug PyPI werkzeug |
Litestar and Starlite vulnerable to Path Traversal CVE-2024-32982, GHSA-83pv-qr33-2vcf, PYSEC-2026-1552, PYSEC-2026-2605 | High | 0.7% | 06 May, 2024 | PyPI litestar PyPI starlite |
go-ethereum vulnerable to DoS via malicious p2p message CVE-2024-32972, GHSA-4xc9-8hmq-j652, GO-2024-2819 | High | 0.8% | 06 May, 2024 | Go github.com/ethereum/go-ethereum |
WordOps has TOCTOU race condition CVE-2024-34528, GHSA-23qq-p4gq-gc2g, PYSEC-2024-175 | High | 0.2% | 06 May, 2024 | PyPI wordops |
image-optimizer allows PHAR deserialization CVE-2024-34515, GHSA-6pjm-hmvf-h4rr | High | 1.9% | 05 May, 2024 | Packagist spatie/image-optimizer |
Gradio allows credential leakage on Windows CVE-2024-34510, GHSA-rvfh-h6c7-fc3c, PYSEC-2024-255 | High | 0.7% | 05 May, 2024 | PyPI gradio |
Ryu Infinite Loop vulnerability CVE-2024-34489, GHSA-59p2-v62x-gxj8, PYSEC-2026-1877 | High | 0.7% | 05 May, 2024 | PyPI ryu |
Ryu Infinite Loop vulnerability CVE-2024-34488, GHSA-ffp9-pfq9-g2ww, PYSEC-2026-1881 | High | 0.7% | 05 May, 2024 | PyPI ryu |
Ryu Infinite Loop vulnerability CVE-2024-34487, GHSA-m9vm-8mv9-v5v3, PYSEC-2026-1883 | High | 0.7% | 05 May, 2024 | PyPI ryu |
Ryu Infinite Loop vulnerability CVE-2024-34486, GHSA-fgpw-cx3v-wj95, PYSEC-2026-1882 | High | 0.6% | 05 May, 2024 | PyPI ryu |
Ryu Infinite Loop vulnerability CVE-2024-34483, GHSA-7hmm-wg23-2w7m, PYSEC-2026-1879 | High | 0.7% | 05 May, 2024 | PyPI ryu |
Pterodactyl Wings vulnerable to Arbitrary File Write/Read CVE-2024-34066, GHSA-gqmf-jqgv-v8fw, GO-2024-2814 | High | 0.5% | 03 May, 2024 | Go github.com/pterodactyl/wings |
piraeus-operator allows attacker to impersonate service account CVE-2024-33398, GHSA-6fg2-hvj9-832f, GO-2024-2811 | High | 0.6% | 03 May, 2024 | Go github.com/piraeusdatastore/piraeus-operator Go github.com/piraeusdatastore/piraeus-operator/v2 |
sagemaker-python-sdk Command Injection vulnerability CVE-2024-34073, GHSA-7pc3-pr3q-58vg, PYSEC-2026-1887 | High | 1.2% | 03 May, 2024 | PyPI sagemaker |
sagemaker-python-sdk vulnerable to Deserialization of Untrusted Data CVE-2024-34072, GHSA-wjvx-jhpj-r54r, PYSEC-2026-1889 | High | 0.4% | 03 May, 2024 | PyPI sagemaker |