Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Cross-site Scripting in livewire/livewire CVE-2024-21504, GHSA-389c-cf87-qmwj | Medium | 0.5% | 19 Mar, 2024 | Packagist livewire/livewire |
Black vulnerable to Regular Expression Denial of Service (ReDoS) CVE-2024-21503, GHSA-fj7x-q9j7-g6q6, PYSEC-2024-48 | Medium | 1.0% | 19 Mar, 2024 | PyPI black |
Unencrypted traffic between nodes when using WireGuard and L7 policies BIT-cilium-2024-28250, BIT-cilium-operator-2024-28250, BIT-cilium-proxy-2024-28250, BIT-hubble-2024-28250, BIT-hubble-relay-2024-28250, BIT-hubble-ui-2024-28250, BIT-hubble-ui-backend-2024-28250, CVE-2024-28250, GHSA-v6q2-4qr3-5cw6, GO-2024-2657 | Medium | 0.2% | 18 Mar, 2024 | Go github.com/cilium/cilium |
Unencrypted traffic between nodes when using IPsec and L7 policies BIT-cilium-2024-28249, BIT-cilium-operator-2024-28249, BIT-cilium-proxy-2024-28249, BIT-hubble-2024-28249, BIT-hubble-relay-2024-28249, BIT-hubble-ui-2024-28249, BIT-hubble-ui-backend-2024-28249, CVE-2024-28249, GHSA-j89h-qrvr-xc36, GO-2024-2656 | Medium | 0.3% | 18 Mar, 2024 | Go github.com/cilium/cilium |
XSS via the "Snapshot Test" feature in Classic Webcam plugin settings CVE-2024-28237, GHSA-x7mf-wrh9-r76c, PYSEC-2024-179 | Medium | 0.4% | 18 Mar, 2024 | PyPI OctoPrint PyPI octoprint |
ROTP 6.2.2 and 6.2.1 has 0666 permissions for the .rb files. CVE-2024-28862, GHSA-x2h8-qmj4-g62f | Medium | 0.2% | 18 Mar, 2024 | RubyGems rotp |
Information leakage in YAQL CVE-2024-29156, GHSA-mvf6-hwxh-7v76, PYSEC-2026-2059 | Medium | 0.7% | 18 Mar, 2024 | PyPI yaql |
Improper Privilege Management in djangorestframework-simplejwt CVE-2024-22513, GHSA-5vcc-86wm-547q, PYSEC-2026-1305 | Medium | 0.8% | 16 Mar, 2024 | PyPI djangorestframework-simplejwt |
Regular expression denial-of-service in Django BIT-django-2024-27351, CVE-2024-27351, GHSA-vm8q-m57g-pff3, PYSEC-2024-47 | Medium | 1.9% | 15 Mar, 2024 | PyPI django |
Fluid vulnerable to OS Command Injection for Fluid Users with JuicefsRuntime CVE-2023-51699, GHSA-wx8q-4gm9-rj2g, GO-2024-2644 | Medium | 0.6% | 15 Mar, 2024 | Go github.com/fluid-cloudnative/fluid |
Users with `create` but not `override` privileges can perform local sync BIT-argo-cd-2023-50726, CVE-2023-50726, GHSA-g623-jcgg-mhmm, GO-2024-2643 | Medium | 0.5% | 15 Mar, 2024 | Go github.com/argoproj/argo-cd Go github.com/argoproj/argo-cd/v2 |
vantage6 vulnerable to a username timing attack on recover password/MFA token CVE-2024-24770, GHSA-5h3x-6gwf-73jm, PYSEC-2026-2005 | Medium | 0.4% | 14 Mar, 2024 | PyPI vantage6 |
vantage6's CORS settings overly permissive CVE-2024-23823, GHSA-4946-85pr-fvxh, PYSEC-2024-326, PYSEC-2026-2004 | Medium | 0.3% | 14 Mar, 2024 | PyPI vantage6 PyPI vantage6-server |
follow-redirects' Proxy-Authorization header kept across hosts CVE-2024-28849, GHSA-cxjh-pqwp-8mfp | Medium | 1.0% | 14 Mar, 2024 | npm follow-redirects |
Bagisto vulnerable to Insecure Direct Object Reference (IDOR) CVE-2023-36238, GHSA-pmc7-hmmw-g96q | Medium | 0.5% | 13 Mar, 2024 | Packagist bagisto/bagisto |
Potential log injection in reset user endpoint in CKAN CVE-2024-27097, GHSA-8g38-3m6v-232j, PYSEC-2026-1251 | Medium | 0.4% | 13 Mar, 2024 | PyPI ckan |
aiosmtpd vulnerable to SMTP smuggling CVE-2024-27305, GHSA-pr2m-px7j-xg65, PYSEC-2024-221 | Medium | 0.4% | 12 Mar, 2024 | PyPI aiosmtpd |
URL Redirection to Untrusted Site in OAuth2/OpenID in directus CVE-2024-28239, GHSA-fr3w-2p22-6w7p | Medium | 0.6% | 12 Mar, 2024 | npm directus |
1Panel is vulnerable to command injection CVE-2024-2352, GHSA-x2vg-5wrf-vj6v, GO-2024-2636 | Medium | 3.0% | 10 Mar, 2024 | Go github.com/1Panel-dev/1Panel |
LibOSDP RMAC revert to the beginning of the session CVE-2024-52288, GHSA-xhjw-7vh5-qxqm, PYSEC-2026-1535 | Medium | 0.1% | 08 Mar, 2024 | PyPI libosdp |
LibOSDP vulnerable to a null pointer deref in osdp_reply_name CVE-2024-52296, GHSA-7945-5mcv-f2pp, PYSEC-2026-1534 | Medium | 0.3% | 08 Mar, 2024 | PyPI libosdp |
JWX vulnerable to a denial of service attack using compressed JWE message CVE-2024-28122, GHSA-hj3v-m684-v259, GO-2024-2632 | Medium | 0.6% | 08 Mar, 2024 | Go github.com/lestrrat-go/jwx Go github.com/lestrrat-go/jwx/v2 |
Django MarkdownX Cross-Site Scripting (XSS) vulnerability CVE-2024-2319, GHSA-fvx8-79hx-x82f, PYSEC-2026-1299 | Medium | 0.4% | 08 Mar, 2024 | PyPI django-markdownx |
Go JOSE vulnerable to Improper Handling of Highly Compressed Data (Data Amplification) CVE-2024-28180, GHSA-c5q2-7r4c-mv6g, GO-2024-2631 | Medium | 2.0% | 07 Mar, 2024 | Go github.com/go-jose/go-jose/v3 Go github.com/go-jose/go-jose/v4 Go gopkg.in/go-jose/go-jose.v2 Go gopkg.in/square/go-jose.v2 |
jose vulnerable to resource exhaustion via specifically crafted JWE with compressed plaintext CVE-2024-28176, GHSA-hhhv-q57g-882q | Medium | 2.1% | 07 Mar, 2024 | npm jose npm jose-node-cjs-runtime npm jose-node-esm-runtime |
JWCrypto vulnerable to JWT bomb Attack in `deserialize` function CVE-2024-28102, GHSA-j857-7rvv-vj97, PYSEC-2026-1484 | Medium | 1.0% | 06 Mar, 2024 | PyPI jwcrypto |
RSSHub vulnerable to Server-Side Request Forgery CVE-2024-27927, GHSA-3p3p-cgj7-vgw3 | Medium | 1.0% | 06 Mar, 2024 | npm rsshub |
RSSHub Cross-site Scripting vulnerability caused by internal media proxy CVE-2024-27926, GHSA-2wqw-hr4f-xrhh | Medium | 0.5% | 06 Mar, 2024 | npm rsshub |
1Panel open source panel project has an unauthorized vulnerability. CVE-2024-27288, GHSA-26w3-q4j8-4xjp, GO-2024-2613 | Medium | 0.5% | 06 Mar, 2024 | Go github.com/1Panel-dev/1Panel |
CasaOS Username Enumeration CVE-2024-24766, GHSA-c967-2652-gfjm, GO-2024-2615 | Medium | 0.8% | 06 Mar, 2024 | Go github.com/IceWhaleTech/CasaOS-UserService |
Concrete CMS Stored Cross-site Scripting vulnerability CVE-2024-2179, GHSA-4m7h-34xm-4wjv | Medium | 0.3% | 05 Mar, 2024 | Packagist concrete5/concrete5 |
Golang protojson.Unmarshal function infinite loop when unmarshaling certain forms of invalid JSON CVE-2024-24786, GHSA-8r3f-844c-mc37, GO-2024-2611 | Medium | 1.3% | 05 Mar, 2024 | Go google.golang.org/protobuf Go google.golang.org/protobuf/encoding/protojson Go google.golang.org/protobuf/internal/encoding/json |
eth-abi is vulnerable to recursive DoS GHSA-3qwc-47jf-5rf7 | Medium | Not scored | 05 Mar, 2024 | PyPI eth-abi |
hexo-theme-anzhiyu Cross-site Scripting vulnerability CVE-2024-25865, GHSA-82jf-8f24-xq9m | Medium | 0.5% | 02 Mar, 2024 | npm hexo-theme-anzhiyu |
Bagist Cross-site Scripting vulnerability CVE-2024-27499, GHSA-w5mx-334j-6fwv | Medium | 0.5% | 01 Mar, 2024 | Packagist bagisto/bagisto |
Directus version number disclosure CVE-2024-27296, GHSA-5mhg-wv8w-p59j | Medium | 0.6% | 01 Mar, 2024 | npm directus |
Apache Airflow: Incorrect Default Permissions in audit logs for Ops and Viewers users BIT-airflow-2024-26280, CVE-2024-26280, GHSA-6xwf-xvf3-v459, PYSEC-2024-42 | Medium | 1.9% | 01 Mar, 2024 | PyPI apache-airflow |
mongo-express Cross-site Request Forgery vulnerability CVE-2023-52555, GHSA-fffg-cwc9-xvj7 | Medium | 0.2% | 01 Mar, 2024 | npm mongo-express |
Docassemble HTML and javascript injection CVE-2024-27290, GHSA-pcfx-g2j2-f6f6, PYSEC-2026-1311 | Medium | 0.4% | 29 Feb, 2024 | PyPI docassemble-webapp PyPI docassemble.webapp |
Docassemble open redirect CVE-2024-27291, GHSA-7wxf-r2qv-9xwr, PYSEC-2026-1310 | Medium | 0.4% | 29 Feb, 2024 | PyPI docassemble-webapp PyPI docassemble.webapp |
Cockpit CMS Cross-Site Scripting vulnerability CVE-2024-2001, GHSA-q76r-7p4q-mqpw | Medium | 0.3% | 29 Feb, 2024 | Packagist cockpit-hq/cockpit |
Mattermost allows attackers access to posts in channels they are not a member of BIT-mattermost-2024-1942, CVE-2024-1942, GHSA-hwjf-4667-gqwx, GO-2024-2592 | Medium | 0.4% | 29 Feb, 2024 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost fails to limit the number of role names BIT-mattermost-2024-1953, CVE-2024-1953, GHSA-vm9m-57jr-4pxh, GO-2024-2594 | Medium | 0.5% | 29 Feb, 2024 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Apache Airflow: DAG Code and Import Error Permissions Ignored BIT-airflow-2024-27906, CVE-2024-27906, GHSA-6v6w-h8m6-7mv2, PYSEC-2024-245 | Medium | 0.3% | 29 Feb, 2024 | PyPI apache-airflow |
Mattermost fails to check the "invite_guest" permission CVE-2024-1888, GHSA-pfw6-5rx3-xh3c, GO-2024-2593 | Medium | 0.3% | 29 Feb, 2024 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost leaks details of AD/LDAP groups of a teams BIT-mattermost-2024-23493, CVE-2024-23493, GHSA-7v3v-984v-h74r, GO-2024-2590 | Medium | 0.4% | 29 Feb, 2024 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost denial of service through long emoji value BIT-mattermost-2024-24988, CVE-2024-24988, GHSA-6mx3-9qfh-77gj, GO-2024-2589 | Medium | 0.7% | 29 Feb, 2024 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
json-jwt allows bypass of identity checks via a sign/encryption confusion attack CVE-2023-51774, GHSA-c8v6-786g-vjx6 | Medium | 0.2% | 29 Feb, 2024 | RubyGems json-jwt |
Concrete CMS Stored XSS CVE-2023-49337, GHSA-9xxv-q6pp-96wq | Medium | 0.5% | 29 Feb, 2024 | Packagist concrete5/concrete5 |
Concrete CMS Cross Site Request Forgery (CSRF) vulnerability CVE-2023-48653, GHSA-3rxx-8f33-7p6p | Medium | 0.3% | 29 Feb, 2024 | Packagist concrete5/concrete5 |