Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Drupal Anonymous Open Redirect GHSA-gfvf-2f25-f34r | Medium | Not scored | 15 May, 2024 | Packagist drupal/core |
Drupal External URL injection through URL aliases leading to Open Redirect GHSA-7f4f-p7mq-p4fv | Medium | Not scored | 15 May, 2024 | Packagist drupal/core |
Drupal Content moderation Access bypass GHSA-f84q-mgj9-8jfc | Medium | Not scored | 15 May, 2024 | Packagist drupal/core |
wolfictl leaks GitHub tokens to remote non-GitHub git servers CVE-2024-35183, GHSA-8fg7-hp93-qhvr, GO-2024-2863 | Medium | 0.2% | 15 May, 2024 | Go github.com/wolfi-dev/wolfictl |
doctrine/doctrine-module zero-valued authentication credentials vulnerability GHSA-9wv8-3h8h-x2wc | Medium | Not scored | 15 May, 2024 | Packagist doctrine/doctrine-module |
Inadequate XSS Prevention in CodeIgniter/Framework Security Library GHSA-q9j3-4ghj-6h57 | Medium | Not scored | 15 May, 2024 | Packagist codeigniter/framework |
Denial of Service in extension "Code Highlight" (codehighlight) GHSA-4cv2-xc5f-px8h | Medium | Not scored | 15 May, 2024 | Packagist brotkrueml/codehighlight |
Denial of Service in extension "Code Highlight" (codehighlight) GHSA-65xh-hh78-6454 | Medium | Not scored | 15 May, 2024 | Packagist brotkrueml/codehighlight |
amphp/http Host Header Injection vulnerability GHSA-8v5x-6vv5-jv4g | Medium | Not scored | 15 May, 2024 | Packagist amphp/http |
amphp/artax Cookie leakage to wrong origins and non-restricted cookie acceptance GHSA-gm98-g2wf-7c68 | Medium | Not scored | 15 May, 2024 | Packagist amphp/artax |
amphp/http-client Header leakage on cross-domain redirects GHSA-8jp9-mpv9-98rj | Medium | Not scored | 15 May, 2024 | Packagist amphp/http-client |
asymmetricrypt/asymmetricrypt Padding Oracle Vulnerability in RSA Encryption GHSA-87mp-xc4x-x8rh | Medium | Not scored | 15 May, 2024 | Packagist asymmetricrypt/asymmetricrypt |
goreleaser shows environment by default GHSA-f6mm-5fc7-3g3c, GO-2024-2860 | Medium | Not scored | 15 May, 2024 | Go github.com/goreleaser/goreleaser |
source-controller leaks Azure Storage SAS token into logs CVE-2024-31216, GHSA-v554-xwgw-hc3w, GO-2024-2859 | Medium | 0.2% | 15 May, 2024 | Go github.com/fluxcd/source-controller |
azure-file-csi-driver leaks service account tokens in the logs CVE-2024-3744, GHSA-qjqg-4wg7-957h, GO-2024-2861 | Medium | 0.3% | 15 May, 2024 | Go sigs.k8s.io/azurefile-csi-driver |
sshpiper's enabling of proxy protocol without proper feature flagging allows faking source address CVE-2024-35175, GHSA-4w53-6jvp-gg52, GO-2024-2853 | Medium | 0.3% | 14 May, 2024 | Go github.com/tg123/sshpiper |
Grafana when using email as a username can block other users from signing in BIT-grafana-2022-39229, CVE-2022-39229, GHSA-gj7m-853r-289r, GO-2024-2848 | Medium | 1.1% | 14 May, 2024 | Go github.com/grafana/grafana |
Grafana Data source and plugin proxy endpoints leaking authentication tokens to some destination plugins BIT-grafana-2022-31130, CVE-2022-31130, GHSA-jv32-5578-pxjc, GO-2024-2851 | Medium | 1.3% | 14 May, 2024 | Go github.com/grafana/grafana |
Grafana API IDOR BIT-grafana-2022-21713, CVE-2022-21713, GHSA-63g3-9jq3-mccv | Medium | 1.2% | 14 May, 2024 | Go github.com/grafana/grafana |
Grafana Stored Cross-site Scripting in Unified Alerting BIT-grafana-2022-31097, CVE-2022-31097, GHSA-vw7q-p2qg-4m5f, GO-2024-2857 | Medium | 70.1% | 14 May, 2024 | Go github.com/grafana/grafana |
Grafana proxy Cross-site Scripting BIT-grafana-2022-21702, CVE-2022-21702, GHSA-xc3p-28hw-q24g | Medium | 2.3% | 14 May, 2024 | Go github.com/grafana/grafana |
Grafana directory traversal for .cvs files BIT-grafana-2021-43815, CVE-2021-43815, GHSA-7533-c8qv-jm9m | Medium | 1.9% | 14 May, 2024 | Go github.com/grafana/grafana |
Scrapy allows redirect following in protocols other than HTTP GHSA-23j4-mw76-5v7h | Medium | Not scored | 14 May, 2024 | PyPI Scrapy PyPI scrapy |
Scrapy's redirects ignoring scheme-specific proxy settings GHSA-jm3v-qxmh-hxwv | Medium | Not scored | 14 May, 2024 | PyPI Scrapy PyPI scrapy |
PHP Censor uses a weak hashing algorithm for the remember me key CVE-2024-34914, GHSA-fqw7-839j-hvxj | Medium | 0.3% | 14 May, 2024 | Packagist php-censor/php-censor |
Anonymous PrestaShop customer can download other customers' invoices CVE-2024-34717, GHSA-7pjr-2rgh-fc5g | Medium | 0.5% | 14 May, 2024 | Packagist prestashop/prestashop |
Oceanic allows unsanitized user input to lead to path traversal in URLs CVE-2024-34712, GHSA-5h5v-hw44-f6gg | Medium | 0.6% | 14 May, 2024 | npm oceanic.js |
TYPO3 vulnerable to an Uncontrolled Resource Consumption in the ShowImageController CVE-2024-34358, GHSA-36g8-62qv-5957 | Medium | 0.5% | 14 May, 2024 | Packagist typo3/cms-core |
TYPO3 vulnerable to Cross-Site Scripting in the ShowImageController CVE-2024-34357, GHSA-hw6c-6gwq-3m3m | Medium | 0.5% | 14 May, 2024 | Packagist typo3/cms-core |
TYPO3 vulnerable to Cross-Site Scripting in the Form Manager Module CVE-2024-34356, GHSA-v6mw-h7w6-59w3 | Medium | 0.5% | 14 May, 2024 | Packagist typo3/cms-core |
TYPO3 vulnerable to an HTML Injection in the History Module CVE-2024-34355, GHSA-xjwx-78x7-q6jc | Medium | 0.6% | 14 May, 2024 | Packagist typo3/cms-core |
Konga is vulnerable to Cross Site Scripting (XSS) attacks CVE-2024-34243, GHSA-93pf-mrc8-4g3h | Medium | 0.4% | 14 May, 2024 | npm kongadmin |
Apache Airflow: XSS vulnerability in Task Instance Log/Log Details BIT-airflow-2024-32077, CVE-2024-32077, GHSA-52gm-qmg3-r4qp, PYSEC-2024-264 | Medium | 1.6% | 14 May, 2024 | PyPI apache-airflow |
Regular Expression Denial of Service (ReDoS) in micromatch CVE-2024-4067, GHSA-952p-6rrq-rcjv | Medium | 1.4% | 14 May, 2024 | npm micromatch |
AVideo cross-site scripting vulnerability in the view/about.php page CVE-2024-34899, GHSA-f98p-2hc5-fm7v | Medium | 0.5% | 14 May, 2024 | Packagist wwbn/avideo |
Apple Multiple Products Improper Authentication Vulnerability CVE-2024-27834 | MediumExploited | 1.4% | 14 May, 2024 | |
Directus Lacks Session Tokens Invalidation CVE-2024-34709, GHSA-g65h-35f3-x2w3 | Medium | 0.4% | 13 May, 2024 | npm directus |
Directus allows redacted data extraction on the API through "alias" CVE-2024-34708, GHSA-p8v3-m643-4xqx | Medium | 0.8% | 13 May, 2024 | npm directus |
NocoDB SQL Injection vulnerability CVE-2023-50718, GHSA-8fxg-mr34-jqr8 | Medium | 0.7% | 13 May, 2024 | npm nocodb |
NocoDB Allows Preview of Files with Dangerous Content CVE-2023-50717, GHSA-qg73-g3cf-vhhh | Medium | 0.6% | 13 May, 2024 | npm nocodb |
Mantis Bug Tracker (MantisBT) vulnerable to cross-site scripting CVE-2024-34081, GHSA-wgx7-jp56-65mq | Medium | 0.6% | 13 May, 2024 | Packagist mantisbt/mantisbt |
MantisBT Vulnerable to Exposure of Sensitive Information to an Unauthorized Actor CVE-2024-34080, GHSA-99jc-wqmr-ff2q | Medium | 0.7% | 13 May, 2024 | Packagist mantisbt/mantisbt |
Sylius potentially vulnerable to Cross Site Scripting via "Name" field (Taxons, Products, Options, Variants) in Admin Panel CVE-2024-34349, GHSA-v2f9-rv6w-vw8r | Medium | 0.4% | 10 May, 2024 | Packagist sylius/sylius |
1Panel arbitrary file write vulnerability CVE-2024-34352, GHSA-f8ch-w75v-c847, GO-2024-2830 | Medium | 1.3% | 09 May, 2024 | Go github.com/1Panel-dev/1Panel |
Vitess vulnerable to infinite memory consumption and vtgate crash CVE-2024-32886, GHSA-649x-hxfx-57j2, GO-2024-2826 | Medium | 0.8% | 08 May, 2024 | Go github.com/vitessio/vitess Go vitess.io/vitess |
Kimai information disclosure vulnerability CVE-2024-4596, GHSA-6f3v-2r2j-2rpr | Medium | 0.8% | 07 May, 2024 | Packagist kimai/kimai |
Trix Editor Arbitrary Code Execution Vulnerability CVE-2024-34341, GHSA-qjqp-xr96-cj99 | Medium | 0.8% | 07 May, 2024 | RubyGems actiontext npm trix |
Apache Superset Incorrect Authorization vulnerability BIT-superset-2024-28148, CVE-2024-28148, GHSA-299q-3p96-5898, PYSEC-2026-1153 | Medium | 0.7% | 07 May, 2024 | PyPI apache-superset |
Jinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filter CVE-2024-34064, GHSA-h75v-3vvj-5mfj, PYSEC-2026-1474 | Medium | 1.0% | 06 May, 2024 | PyPI Jinja2 PyPI jinja2 |
Nebari prints temporary Keycloak root password CVE-2024-34529, GHSA-vjc4-3vgx-pq9h, PYSEC-2024-185 | Medium | 0.4% | 06 May, 2024 | PyPI nebari |