Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Concrete CMS Stored XSS in the Search Field CVE-2024-3181, GHSA-qgm9-rxmq-jxmq | Medium | 0.4% | 03 Apr, 2024 | Packagist concrete5/concrete5 |
Concrete CMS Stored XSS in blocks of type file CVE-2024-3180, GHSA-9qhc-pg6j-wf23 | Medium | 0.4% | 03 Apr, 2024 | Packagist concrete5/concrete5 |
Concrete CMS Stored XSS in the Custom Class page editing CVE-2024-3179, GHSA-r7q4-cw9r-vhp4 | Medium | 0.4% | 03 Apr, 2024 | Packagist concrete5/concrete5 |
Concrete CMS Cross-site Scripting (XSS) in the Advanced File Search Filter CVE-2024-3178, GHSA-xwrh-qxmc-x8c8 | Medium | 0.4% | 03 Apr, 2024 | Packagist concrete5/concrete5 |
Concrete CMS Stored XSS on the calendar color settings screen CVE-2024-2753, GHSA-pj42-r64f-4xfq | Medium | 0.4% | 03 Apr, 2024 | Packagist concrete5/concrete5 |
Vite's `server.fs.deny` did not deny requests for patterns with directories. CVE-2024-31207, GHSA-8jhw-289h-jh2g | Medium | 0.7% | 03 Apr, 2024 | npm vite |
KubeVirt NULL pointer dereference flaw CVE-2024-31420, GHSA-vjhf-6xfr-5p9g, GO-2024-2688 | Medium | 0.6% | 03 Apr, 2024 | Go kubevirt.io/kubevirt |
Temporal UI Server cross-site scripting vulnerability CVE-2024-2435, GHSA-8f25-w7qj-r7hc, GO-2024-2675 | Medium | 0.4% | 02 Apr, 2024 | Go github.com/temporalio/ui-server Go github.com/temporalio/ui-server/v2 |
OpenID Connect Authentication (oidc) Typo3 extension Authentication Bypass CVE-2024-30173, GHSA-hhf8-f5w9-g6vh | Medium | Not scored | 02 Apr, 2024 | Packagist causal/oidc |
CA17 TeamsACS Cross Site Scripting vulnerability CVE-2024-22780, GHSA-hwvw-gh23-qpvq, GO-2024-2684 | Medium | 0.6% | 02 Apr, 2024 | Go github.com/ca17/teamsacs |
LocalAI cross-site request forgery vulnerability CVE-2024-3135, GHSA-jhvf-7c85-3c9g, GO-2024-2705 | Medium | 0.3% | 01 Apr, 2024 | Go github.com/go-skynet/LocalAI |
CasaOS Username Enumeration - Bypass of CVE-2024-24766 CVE-2024-28232, GHSA-hcw2-2r9c-gc6p, GO-2024-2668 | Medium | 0.6% | 01 Apr, 2024 | Go github.com/IceWhaleTech/CasaOS-UserService |
ArgoCD's repo server has Uncontrolled Resource Consumption vulnerability BIT-argo-cd-2024-29893, CVE-2024-29893, GHSA-jhwx-mhww-rgc3, GO-2024-2667 | Medium | 1.0% | 29 Mar, 2024 | Go github.com/argoproj/argo-cd/v2 |
Incorrect Access Control in NodeBB CVE-2024-29316, GHSA-qc99-r4wh-c8h6 | Medium | 0.4% | 28 Mar, 2024 | npm nodebb |
Kimai API returns timesheet entries a user should not be authorized to view CVE-2024-29200, GHSA-cj3c-5xpm-cx94 | Medium | 0.6% | 28 Mar, 2024 | Packagist kimai/kimai |
Saleor: Customers' addresses leak when using Warehouse as a `Pickup: Local stock only` delivery method CVE-2024-29888, GHSA-mrj3-f2h4-7w45, PYSEC-2026-1890 | Medium | 0.5% | 27 Mar, 2024 | PyPI saleor |
This module enables sites to comply with the European cookie law using tarteaucitron.js.
The module doesn't sufficiently filter user-supplied markup inside of content leading to a persistent Cross Site Scripting (XSS) vulnerability. More details are available in [CVE-2023-3620](https://nvd.nist.gov CVE-2024-13252, DRUPAL-CONTRIB-2024-016 | Medium | 0.2% | 27 Mar, 2024 | Packagist:https://packages.drupal.org/8 drupal/tacjs |
GeoNode: Stored XSS to full account takeover CVE-2024-27091, GHSA-rwcv-whm8-fmxm, PYSEC-2024-320 | Medium | 0.4% | 27 Mar, 2024 | PyPI geonode |
Apache Airflow Improper Preservation of Permissions vulnerability BIT-airflow-2024-29735, CVE-2024-29735, GHSA-cff3-5qrp-hqx7, PYSEC-2026-1132 | Medium | 1.5% | 26 Mar, 2024 | PyPI apache-airflow |
Pimcore Preview Documents are not restricted to logged in users anymore CVE-2024-29197, GHSA-5737-rqv4-v445 | Medium | 0.7% | 26 Mar, 2024 | Packagist pimcore/pimcore |
TinyMCE Cross-Site Scripting (XSS) vulnerability in handling external SVG files through Object or Embed elements CVE-2024-29881, GHSA-5359-pvf2-pw78 | Medium | 0.7% | 26 Mar, 2024 | NuGet TinyMCE Packagist tinymce/tinymce npm tinymce |
TinyMCE Cross-Site Scripting (XSS) vulnerability in handling iframes CVE-2024-29203, GHSA-438c-3975-5x3f | Medium | 0.7% | 26 Mar, 2024 | NuGet TinyMCE Packagist tinymce/tinymce npm tinymce |
LangChain's XMLOutputParser vulnerable to XML Entity Expansion CVE-2024-1455, GHSA-q84m-rmw3-4382, PYSEC-2026-1519 | Medium | 0.8% | 26 Mar, 2024 | PyPI langchain-core |
dcat-admin Cross Site Scripting vulnerability CVE-2024-29644, GHSA-mr24-cf69-5chq | Medium | 0.6% | 26 Mar, 2024 | Packagist dcat/laravel-admin |
Unauthenticated views may expose information to anonymous users CVE-2024-29199, GHSA-m732-wvh2-7cq4, PYSEC-2026-1687 | Medium | 0.6% | 26 Mar, 2024 | PyPI nautobot |
phpMyFAQ Stored Cross-site Scripting at File Attachments CVE-2024-29179, GHSA-hm8r-95g3-5hj9 | Medium | 0.5% | 25 Mar, 2024 | Packagist phpmyfaq/phpmyfaq |
CarrierWave content-Type allowlist bypass vulnerability which possibly leads to XSS remained CVE-2024-29034, GHSA-vfmv-jfc5-pjjw | Medium | 0.4% | 25 Mar, 2024 | RubyGems carrierwave |
Express.js Open Redirect in malformed URLs CVE-2024-29041, GHSA-rv95-896h-c2vc | Medium | 0.8% | 25 Mar, 2024 | npm express |
KaTeX missing normalization of the protocol in URLs allows bypassing forbidden protocols CVE-2024-28246, GHSA-3wc5-fcw2-2329 | Medium | 0.4% | 25 Mar, 2024 | npm katex |
KaTeX's `\includegraphics` does not escape filename CVE-2024-28245, GHSA-f98w-7cxr-ff2h | Medium | 0.4% | 25 Mar, 2024 | npm katex |
KaTeX's maxExpand bypassed by Unicode sub/superscripts CVE-2024-28244, GHSA-cvr6-37gx-v8wc | Medium | 2.2% | 25 Mar, 2024 | npm katex |
KaTeX's maxExpand bypassed by `\edef` CVE-2024-28243, GHSA-64fm-8hw2-v72w | Medium | 1.4% | 25 Mar, 2024 | npm katex |
phpMyFAQ Stored HTML Injection at contentLink CVE-2024-28108, GHSA-48vw-jpf8-hwqh | Medium | 0.5% | 25 Mar, 2024 | Packagist phpmyfaq/phpmyfaq |
phpMyFAQ Stored Cross-site Scripting at FAQ News Content CVE-2024-28106, GHSA-6p68-36m6-392r | Medium | 0.5% | 25 Mar, 2024 | Packagist phpmyfaq/phpmyfaq |
phpMyFAQ stored Cross-site Scripting at user email CVE-2024-27300, GHSA-q7g6-xfh2-vhpx | Medium | 0.7% | 25 Mar, 2024 | Packagist phpmyfaq/phpmyfaq |
Storefront user can access history and most viewed data from matching back-office user with the same ID CVE-2023-48296, GHSA-v7px-46v9-5qwp | Medium | 0.4% | 25 Mar, 2024 | Packagist oro/customer-portal |
Pinned entity creation form shows wrong data CVE-2023-45824, GHSA-vxq2-p937-3px3 | Medium | 0.4% | 25 Mar, 2024 | Packagist oro/platform |
Cross-Site Request Forgery in Anchor CMS CVE-2024-29338, GHSA-2whx-ccr7-fxqm | Medium | 0.3% | 22 Mar, 2024 | Packagist anchorcms/anchor-cms |
Slow String Operations via MultiPart Requests in Event-Driven Functions CVE-2024-29186, GHSA-j4hq-f63x-f39r | Medium | 0.7% | 22 Mar, 2024 | Packagist bref/bref |
Cache Poisoning Vulnerability CVE-2024-29042, GHSA-882j-4vj5-7vmj | Medium | 0.7% | 22 Mar, 2024 | npm translate |
Cross-site Scripting in Moodle Chat BIT-moodle-2024-28593, CVE-2024-28593, GHSA-f6mh-79vh-2hv7 | Medium | 0.6% | 22 Mar, 2024 | Packagist moodle/moodle |
VvvebJs Arbitrary File Upload vulnerability CVE-2024-29272, GHSA-pmm3-68q9-57jg | Medium | 9.4% | 22 Mar, 2024 | npm vvvebJs |
VvvebJs Reflected Cross-Site Scripting (XSS) vulnerability CVE-2024-29271, GHSA-pc95-3wgm-x28p | Medium | 0.6% | 22 Mar, 2024 | npm vvvebjs |
Denial of service while parsing a tar file due to lack of folders count validation CVE-2024-28863, GHSA-f5x3-32g6-xq36 | Medium | 0.9% | 21 Mar, 2024 | npm node-tar npm tar |
Gradio applications running locally vulnerable to 3rd party websites accessing routes and uploading files CVE-2024-1727, GHSA-48cq-79qq-6f7x, PYSEC-2026-1409 | Medium | 0.4% | 21 Mar, 2024 | PyPI gradio |
Cross site scripting in moodle BIT-moodle-2024-29374, CVE-2024-29374, GHSA-3qw5-v9cc-v262 | Medium | 0.5% | 21 Mar, 2024 | Packagist moodle/moodle |
Cross-site scripting in Survey Creator CVE-2024-28635, GHSA-xgj4-2hrf-j4xg | Medium | 0.5% | 21 Mar, 2024 | npm survey-creator |
Ibexa Kernel's files with blacklisted extensions can be still saved to drafts GHSA-9j39-4686-m3c4 | Medium | Not scored | 20 Mar, 2024 | Packagist ibexa/core |
Ibexa Kernel's files with blacklisted extensions can be still saved to drafts GHSA-mwvh-p3hx-x4gg | Medium | Not scored | 20 Mar, 2024 | Packagist ezsystems/ezplatform-kernel |
Moby's external DNS requests from 'internal' networks could lead to data exfiltration CVE-2024-29018, GHSA-mq39-4gv4-mvpx, GO-2024-2659 | Medium | 0.7% | 20 Mar, 2024 | Go github.com/docker/docker |