Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Privilege Escalation in TYPO3 CMS GHSA-v5jp-4h2p-j2p4 | Medium | Not scored | 05 Jun, 2024 | Packagist typo3/cms |
Cross-Site Scripting in TYPO3 Backend GHSA-5wx6-xwxf-q8qj | Medium | Not scored | 05 Jun, 2024 | Packagist typo3/cms |
Authentication Bypass in TYPO3 CMS GHSA-6xh8-8pfv-53vx | Medium | Not scored | 05 Jun, 2024 | Packagist typo3/cms |
Digital products download without proper payment status check CVE-2024-37296, GHSA-v4g2-cm5v-cxv7 | Medium | 0.5% | 05 Jun, 2024 | Packagist aimeos/ai-client-html |
Arbitrary file read via Playwright's screenshot feature exploiting file wrapper CVE-2024-37169, GHSA-665w-mwrr-77q3 | Medium | 0.5% | 05 Jun, 2024 | npm @jmondi/url-to-png |
Vulnerable embedded jQuery Version GHSA-jmh9-6rjq-gjh9 | Medium | Not scored | 05 Jun, 2024 | Packagist pimcore/admin-ui-classic-bundle |
Missing security headers in Action Pack on non-HTML responses BIT-rails-2024-28103, CVE-2024-28103, GHSA-fwhr-88qx-h9g7 | Medium | 0.7% | 04 Jun, 2024 | RubyGems actionpack |
ActionText ContentAttachment can Contain Unsanitized HTML BIT-rails-2024-32464, CVE-2024-32464, GHSA-prjp-h48f-jgf6 | Medium | 0.4% | 04 Jun, 2024 | RubyGems actiontext |
Owncast Path Traversal vulnerability CVE-2024-31450, GHSA-9355-27m8-h74v, GO-2024-2741 | Medium | 1.0% | 04 Jun, 2024 | Go github.com/owncast/owncast |
Denial of Service (DoS) attack possibility in TYPO3 component Indexed Search GHSA-pmxp-7224-h794 | Medium | Not scored | 04 Jun, 2024 | Packagist typo3/cms |
Typo3 Arbitrary File Disclosure in Form Component GHSA-wrpf-2x8h-82gr | Medium | Not scored | 04 Jun, 2024 | Packagist typo3/cms |
Cross-Site Scripting (XSS) in TYPO3 component CSS styled content GHSA-8j9v-4hhh-x43c | Medium | Not scored | 04 Jun, 2024 | Packagist typo3/cms |
Cross-Site Scripting (XSS) in TYPO3 component Backend GHSA-3jxq-5xhh-9jr3 | Medium | Not scored | 04 Jun, 2024 | Packagist typo3/cms |
Reflected Cross-Site Scripting (XSS) in Dolibarr CVE-2024-34051, GHSA-hv2j-6654-x74q | Medium | 12.0% | 03 Jun, 2024 | Packagist dolibarr/dolibarr |
TYPO3 Cross-Site Scripting (XSS) in form component GHSA-5j86-5xvg-7q93 | Medium | Not scored | 03 Jun, 2024 | Packagist typo3/cms |
TYPO3 Cross-Site Scripting in legacy form component GHSA-vgm8-r9gm-fw59 | Medium | Not scored | 03 Jun, 2024 | Packagist typo3/cms |
TYPO3 Cross-Site Scripting in link validator component GHSA-cg4m-qjjp-7497 | Medium | Not scored | 03 Jun, 2024 | Packagist typo3/cms |
TYPO3 Multiple Cross-Site Scripting vulnerabilities in frontend GHSA-6fc6-cj2j-h22x | Medium | Not scored | 03 Jun, 2024 | Packagist typo3/cms |
Cross-Site Scripting in TYPO3 component Indexed Search GHSA-wh8q-72cp-p5wf | Medium | Not scored | 03 Jun, 2024 | Packagist typo3/cms |
TYPO3 is susceptible to Cross-Site Flashing GHSA-qrxh-46mr-pr7q | Medium | Not scored | 03 Jun, 2024 | Packagist typo3/cms |
Multiple Cross-Site Scripting vulnerabilities in TYPO3 backend GHSA-5cxf-xx9j-54jc | Medium | Not scored | 03 Jun, 2024 | Packagist typo3/cms |
Open Redirect URL in Harbor BIT-harbor-2024-22244, CVE-2024-22244, GHSA-5757-v49g-f6r7, GO-2024-2915 | Medium | 0.4% | 02 Jun, 2024 | Go github.com/goharbor/harbor |
Moodle Unsanitized HTML in site log for config_log_created BIT-moodle-2024-34006, CVE-2024-34006, GHSA-vvh5-7v3m-j3mj | Medium | 0.4% | 31 May, 2024 | Packagist moodle/moodle |
Moodle Authenticated LFI risk in some misconfigured shared hosting environments BIT-moodle-2024-34004, CVE-2024-34004, GHSA-q3cm-ccrm-2mr6 | Medium | 0.5% | 31 May, 2024 | Packagist moodle/moodle |
Moodle Authenticated LFI risk in some misconfigured shared hosting environments BIT-moodle-2024-34003, CVE-2024-34003, GHSA-jg4f-8w9x-jv35 | Medium | 0.4% | 31 May, 2024 | Packagist moodle/moodle |
Moodle Cross-site Scripting (XSS) BIT-moodle-2024-34000, CVE-2024-34000, GHSA-8qwh-4vwv-7c5m | Medium | 0.5% | 31 May, 2024 | Packagist moodle/moodle |
Moodle Cross-site Scripting (XSS) BIT-moodle-2024-33998, CVE-2024-33998, GHSA-xqhh-253w-4q5f | Medium | 0.4% | 31 May, 2024 | Packagist moodle/moodle |
Moodle stored Cross-site Scripting (XSS) BIT-moodle-2024-33997, CVE-2024-33997, GHSA-9qgq-93c7-9hm4 | Medium | 0.4% | 31 May, 2024 | Packagist moodle/moodle |
Moodle broken access control when setting calendar event type BIT-moodle-2024-33996, CVE-2024-33996, GHSA-4qww-rxq6-x7gf | Medium | 0.4% | 31 May, 2024 | Packagist moodle/moodle |
wangEditor was discovered to contain a cross-site scripting (XSS) vulnerability via the image upload function CVE-2022-25037, GHSA-9hfw-cvf4-5x25 | Medium | 0.3% | 31 May, 2024 | npm @wangeditor/editor |
Ollama does not validate the format of the digest (sha256 with 64 hex digits) CVE-2024-37032, GHSA-8hqg-whrw-pv92, GO-2024-2901 | Medium | 89.6% | 31 May, 2024 | Go github.com/ollama/ollama |
TYPO3 Frontend vulnerable to Unauthenticated Path Disclosure GHSA-pqfv-97hj-g97g | Medium | Not scored | 30 May, 2024 | Packagist typo3/cms |
TYPO3 Brute Force Protection Bypass in backend login GHSA-jqr8-q455-xx45 | Medium | Not scored | 30 May, 2024 | Packagist typo3/cms |
TYPO3 Information Disclosure Vulnerability Exploitable by Editors GHSA-r287-hc8j-w56h | Medium | Not scored | 30 May, 2024 | Packagist typo3/cms |
TYPO3 Cross-Site Scripting Vulnerability Exploitable by Editors GHSA-wp8j-c736-c5r3 | Medium | Not scored | 30 May, 2024 | Packagist typo3/cms |
Sensitive Data Disclosure Vulnerability in Connection Configuration Endpoints CVE-2024-35189, GHSA-rcvg-jj3g-rj7c, PYSEC-2026-1346 | Medium | 0.6% | 30 May, 2024 | PyPI ethyca-fides |
Reflected Cross-site Scripting in yiisoft/yii2 Debug mode CVE-2024-32877, GHSA-qg5r-95m4-mjgj | Medium | 0.3% | 30 May, 2024 | Packagist yiisoft/yii2 |
ExtJS JavaScript framework used in TYPO3 vulnerable to Cross-site Scripting GHSA-mxjf-hc9v-xgv2 | Medium | Not scored | 30 May, 2024 | Packagist typo3/cms |
Improper Handling of Insufficient Permissions in `wagtail.contrib.settings` CVE-2024-35228, GHSA-xxfm-vmcf-g33f, PYSEC-2026-2032 | Medium | 0.3% | 30 May, 2024 | PyPI wagtail |
TYPO3 Cross-Site Scripting in Filelist Module GHSA-6xwf-7rfm-4gwc | Medium | Not scored | 30 May, 2024 | Packagist typo3/cms-core |
TYPO3 Cross-Site Scripting in Link Handling GHSA-4ppr-jw47-9qm5 | Medium | Not scored | 30 May, 2024 | Packagist typo3/cms-core |
TYPO3 Cross-Site Scripting in Form Framework validation handling GHSA-95qm-3xp7-vfj5 | Medium | Not scored | 30 May, 2024 | Packagist typo3/cms-core |
TYPO3 Broken Access Control in Import Module GHSA-g776-759r-pf6x | Medium | Not scored | 30 May, 2024 | Packagist typo3/cms-core |
TYPO3 Information Disclosure in Backend User Interface GHSA-rv8r-8mh5-5376 | Medium | Not scored | 30 May, 2024 | Packagist typo3/cms-core |
TYPO3 Information Disclosure in User Authentication GHSA-wj85-rg5g-v8jm | Medium | Not scored | 30 May, 2024 | Packagist typo3/cms-core |
TYPO3 Disclosure of Information about Installed Extensions GHSA-p2h4-7fp3-cmh8 | Medium | Not scored | 30 May, 2024 | Packagist typo3/cms-core |
TYPO3 Information Disclosure in Page Tree GHSA-wvvp-jwf5-qcpc | Medium | Not scored | 30 May, 2024 | Packagist typo3/cms-core |
TYPO3 Security Misconfiguration in User Session Handling GHSA-xmgr-jff3-fcfv | Medium | Not scored | 30 May, 2024 | Packagist typo3/cms-core |
TYPO3 Cross-Site Scripting in Form Framework GHSA-4459-qrcc-vfcf | Medium | Not scored | 30 May, 2024 | Packagist typo3/cms-core |
TYPO3 Cross-Site Scripting in Language Pack Handling GHSA-76r3-m635-p3vc | Medium | Not scored | 30 May, 2024 | Packagist typo3/cms-core |