Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Apache Airflow Improper Access Control vulnerability BIT-airflow-2023-50783, CVE-2023-50783, GHSA-5938-79hg-xh3q, PYSEC-2023-267 | Medium | 1.4% | 21 Dec, 2023 | PyPI apache-airflow |
jose2go vulnerable to denial of service via large p2c value CVE-2023-50658, GHSA-6294-6rgp-fr7r, GHSA-mhpq-9638-x6pw, GO-2023-2409 | Medium | 0.8% | 20 Dec, 2023 | Go github.com/dvsekhvalnov/jose2go |
containerd allows RAPL to be accessible to a container GHSA-7ww5-4wqc-m92c, GO-2023-2412 | Medium | Not scored | 19 Dec, 2023 | Go github.com/containerd/containerd |
Phpsysinfo Cross Site Request Forgery (CSRF) vulnerability CVE-2023-49006, GHSA-67gv-xrw7-p72w | Medium | 0.5% | 19 Dec, 2023 | Packagist phpsysinfo/phpsysinfo |
Apache Superset uncontrolled resource consumption BIT-superset-2023-46104, CVE-2023-46104, GHSA-95mg-jgfx-54v9, PYSEC-2026-1167 | Medium | 1.7% | 19 Dec, 2023 | PyPI apache-superset |
Corveda PHPSandbox Protection Mechanism Failure vulnerability CVE-2014-125107, GHSA-625p-jwcp-r2r5 | Medium | 0.8% | 19 Dec, 2023 | Packagist corveda/phpsandbox |
Resque vulnerable to Reflected Cross Site Scripting through pathnames CVE-2023-50724, GHSA-r8xx-8vm8-x6wj | Medium | 0.5% | 18 Dec, 2023 | RubyGems resque |
Resque vulnerable to reflected XSS in resque-web failed and queues lists CVE-2023-50725, GHSA-gc3j-vvwf-4rp8 | Medium | 0.5% | 18 Dec, 2023 | RubyGems resque |
Resque vulnerable to reflected XSS in Queue Endpoint CVE-2023-50727, GHSA-r9mq-m72x-257g | Medium | 0.5% | 18 Dec, 2023 | RubyGems resque |
Maloja error page XSS vulnerability GHSA-4h72-34j6-j8x7 | Medium | Not scored | 18 Dec, 2023 | PyPI malojaserver |
Resque Scheduler Reflected XSS In Delayed Jobs View CVE-2022-44303, GHSA-9hmq-fm33-x4xx | Medium | 0.7% | 18 Dec, 2023 | RubyGems resque-scheduler |
AsyncSSH vulnerable to Prefix Truncation Attack (a.k.a. Terrapin Attack) against ChaCha20-Poly1305 and Encrypt-then-MAC GHSA-hfmc-7525-mj55 | Medium | Not scored | 18 Dec, 2023 | PyPI asyncssh |
Prefix Truncation Attack against ChaCha20-Poly1305 and Encrypt-then-MAC aka Terrapin CVE-2023-48795, GHSA-45x7-px36-x8w8, GO-2023-2402, PYSEC-2026-1758 | Medium | 93.5% | 18 Dec, 2023 | Go golang.org/x/crypto PyPI paramiko crates.io russh |
Ansible symlink attack vulnerability CVE-2023-5115, GHSA-jpvw-p8pr-9g2x, PYSEC-2026-1120 | Medium | 1.0% | 18 Dec, 2023 | PyPI ansible |
phpMyFAQ Cross-site Scripting vulnerability CVE-2023-6890, GHSA-4h37-q5j3-hw96 | Medium | 0.5% | 16 Dec, 2023 | Packagist thorsten/phpmyfaq |
phpMyFAQ Cross-site Scripting vulnerability CVE-2023-6889, GHSA-w8xj-992g-842f | Medium | 0.5% | 16 Dec, 2023 | Packagist thorsten/phpmyfaq |
User accounts disclosed to unauthenticated actors on the LAN CVE-2023-50715, GHSA-jqpc-rc7g-vf83, PYSEC-2026-1451 | Medium | 0.9% | 15 Dec, 2023 | PyPI homeassistant |
Business Logic Errors in microweber/microweber CVE-2023-6832, GHSA-qjfx-fvx7-3wvw | Medium | 0.5% | 15 Dec, 2023 | Packagist microweber/microweber |
Named path parameters can be overridden in TrieRouter CVE-2023-50710, GHSA-f6gv-hh8j-q8vq | Medium | 0.6% | 14 Dec, 2023 | npm hono |
Insecure Direct Object Reference in extension "Content Consent" (content_consent) CVE-2023-50462, GHSA-j8cw-ppmv-wj85 | Medium | 0.3% | 13 Dec, 2023 | Packagist t3s/content-consent |
Broken Access Control in extension "femanager" CVE-2023-50459, GHSA-4xp5-hr35-84cx | Medium | 0.3% | 13 Dec, 2023 | Packagist in2code/femanager |
Scrypted Cross-site Scripting vulnerability CVE-2023-47623, GHSA-ww7p-8gfg-v82r | Medium | 0.4% | 13 Dec, 2023 | npm @scrypted/core |
Scrypted Cross-site Scripting vulnerability CVE-2023-47620, GHSA-xmhh-xrcc-mx36 | Medium | 0.5% | 13 Dec, 2023 | npm @scrypted/server |
Out of memory error when submitting the dataset form with a specially-crafted field CVE-2023-50248, GHSA-7fgc-89cx-w8j5, PYSEC-2026-1249 | Medium | 0.6% | 13 Dec, 2023 | PyPI ckan |
Unauthenticated db-file-storage views CVE-2023-50263, GHSA-75mc-3pjc-727q, PYSEC-2023-286 | Medium | 0.7% | 12 Dec, 2023 | PyPI nautobot |
Elastic Beats inserts sensitive information into log file CVE-2023-49922, GHSA-hj4r-2c9c-29h3, GO-2023-2413 | Medium | 0.7% | 12 Dec, 2023 | Go github.com/elastic/beats Go github.com/elastic/beats/v7 |
Exposure of Sensitive Information in mltable CVE-2023-35625, GHSA-m5pc-86x8-wcxg, PYSEC-2026-1664 | Medium | 0.7% | 12 Dec, 2023 | PyPI mltable |
User with permission to write actions can impersonate another user when auth token is configured in environment variable GHSA-26hr-q2wp-rvc5, GO-2023-2397 | Medium | Not scored | 12 Dec, 2023 | Go github.com/treeverse/lakefs |
Improper Input Validation in mindsdb CVE-2023-49796, GHSA-crhp-7c74-cg4c, PYSEC-2023-278 | Medium | 0.5% | 11 Dec, 2023 | PyPI mindsdb |
Server-Side Request Forgery in mindsdb CVE-2023-49795, GHSA-34mr-6q8x-g9r6, PYSEC-2023-277 | Medium | 0.4% | 11 Dec, 2023 | PyPI mindsdb |
Header spoofing in caddy-geo-ip CVE-2023-50463, GHSA-rxg9-hgq7-8pwx, GO-2023-2394 | Medium | 0.7% | 11 Dec, 2023 | Go github.com/shift72/caddy-geo-ip |
Cross-site Scripting in Semantic MediaWiki CVE-2022-48614, GHSA-hj4c-vfc4-5f9c | Medium | 0.4% | 10 Dec, 2023 | Packagist mediawiki/semantic-media-wiki |
Cross-site Scripting in evershop CVE-2023-46499, GHSA-gjj8-m83c-qv9h | Medium | 0.5% | 08 Dec, 2023 | npm @evershop/evershop |
Directory Traversal in evershop CVE-2023-46497, GHSA-7443-5962-wp4r | Medium | 0.8% | 08 Dec, 2023 | npm @evershop/evershop |
Cross-site Scripting in evershop CVE-2023-46495, GHSA-2xcj-557c-hf8r | Medium | 0.5% | 08 Dec, 2023 | npm @evershop/evershop |
Cross Site Scripting in evershop CVE-2023-46494, GHSA-m6vm-ff9v-jp3r | Medium | 0.5% | 08 Dec, 2023 | npm @evershop/evershop |
Directory Traversal in evershop CVE-2023-46493, GHSA-4wrm-qmq2-5fjx | Medium | 1.0% | 08 Dec, 2023 | npm @evershop/evershop |
Always incorrect control flow in github.com/mojocn/base64Captcha CVE-2023-45292, GHSA-5mmw-p5qv-w3x5, GO-2023-2386 | Medium | 0.3% | 08 Dec, 2023 | Go github.com/mojocn/base64Captcha |
DockerSpawner allows any image by default CVE-2023-48311, GHSA-hfgr-h3vc-p6c2, PYSEC-2026-1312 | Medium | 0.6% | 08 Dec, 2023 | PyPI dockerspawner |
Microweber missing standardized error handling mechanism CVE-2023-6599, GHSA-9r6p-hg4g-5gxp | Medium | 0.5% | 08 Dec, 2023 | Packagist microweber/microweber |
Directory Traversal in Gladys Assistant CVE-2023-47440, GHSA-c79f-pqgf-fhp3 | Medium | 1.0% | 07 Dec, 2023 | npm gladys |
Cross-site Scripting (XSS) in MLflow BIT-mlflow-2023-6568, CVE-2023-6568, GHSA-vwhf-3v6x-wff8, PYSEC-2023-260 | Medium | 1.7% | 07 Dec, 2023 | PyPI mlflow |
Microweber Business Logic Errors CVE-2023-6566, GHSA-3rpx-pgmf-j96h | Medium | 0.5% | 07 Dec, 2023 | Packagist microweber/microweber |
Mattermost Exposure of Sensitive Information to an Unauthorized Actor vulnerability BIT-mattermost-2023-6459, CVE-2023-6459, GHSA-63cv-4pc2-4fcf | Medium | 0.5% | 06 Dec, 2023 | Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
pubnub Insufficient Entropy vulnerability CVE-2023-26154, GHSA-5844-q3fc-56rh, GO-2023-2385, PYSEC-2026-1807 | Medium | 1.0% | 06 Dec, 2023 | Go github.com/pubnub/go Go github.com/pubnub/go/v5 Go github.com/pubnub/go/v6 Go github.com/pubnub/go/v7 +10 more |
lestrrat-go/jwx's malicious parameters in JWE can cause a DOS CVE-2023-49290, GHSA-7f9x-gw85-8grf, GO-2023-2379 | Medium | 0.7% | 05 Dec, 2023 | Go github.com/lestrrat-go/jwx Go github.com/lestrrat-go/jwx/v2 |
Test code in published microsoft-graph-beta package exposes phpinfo() GHSA-7mc6-x925-7qvx | Medium | Not scored | 05 Dec, 2023 | Packagist microsoft/microsoft-graph-beta |
Test code in published microsoft-graph-core package exposes phpinfo() CVE-2023-49283, GHSA-mhhp-c3cm-2r86 | Medium | 2.2% | 05 Dec, 2023 | Packagist microsoft/microsoft-graph-core |
Test code in published microsoft-graph package exposes phpinfo() CVE-2023-49282, GHSA-cgwq-6prq-8h9q | Medium | 2.2% | 05 Dec, 2023 | Packagist microsoft/microsoft-graph |
Traefik vulnerable to potential DDoS via ACME HTTPChallenge CVE-2023-47124, GHSA-8g85-whqh-cr2f, GO-2023-2381 | Medium | 0.8% | 05 Dec, 2023 | Go github.com/traefik/traefik Go github.com/traefik/traefik/v2 Go github.com/traefik/traefik/v3 |