Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Traefik incorrectly processes fragment in the URL, leads to Authorization Bypass CVE-2023-47106, GHSA-fvhj-4qfh-q2hm, GO-2023-2376 | Medium | 0.6% | 05 Dec, 2023 | Go github.com/traefik/traefik Go github.com/traefik/traefik/v2 Go github.com/traefik/traefik/v3 |
Vite XSS vulnerability in `server.transformIndexHtml` via URL payload CVE-2023-49293, GHSA-92r3-m2mg-pj97 | Medium | 1.0% | 04 Dec, 2023 | npm vite |
jupyter-server errors include tracebacks with path information CVE-2023-49080, GHSA-h56g-gq9v-vc8r, PYSEC-2023-272 | Medium | 0.8% | 04 Dec, 2023 | PyPI jupyter-server |
Logging of the firestore key within nodejs-firestore CVE-2023-6460, GHSA-4g6q-77j7-vvjc | Medium | 0.1% | 04 Dec, 2023 | npm @google-cloud/firestore |
Reflected XSS Vulnerability in dpaste CVE-2023-49277, GHSA-r8j9-5cj7-cv39, PYSEC-2026-1317 | Medium | 0.5% | 01 Dec, 2023 | PyPI Dpaste PyPI dpaste |
Apple Multiple Products WebKit Out-of-Bounds Read Vulnerability CVE-2023-42916 | MediumExploited | 17.8% | 30 Nov, 2023 | |
PHPMemcachedAdmin vulnerable to cross-site scripting (XSS) via improper encoding CVE-2023-6027, GHSA-pr4w-m4rp-gp87 | Medium | 0.4% | 30 Nov, 2023 | Packagist elijaa/phpmemcacheadmin |
CarrierWave Content-Type allowlist bypass vulnerability, possibly leading to XSS CVE-2023-49090, GHSA-gxhx-g4fq-49hj | Medium | 0.6% | 29 Nov, 2023 | RubyGems carrierwave |
October CMS safe mode bypass using Page template injection CVE-2023-44381, GHSA-q22j-5r3g-9hmh | Medium | 0.5% | 29 Nov, 2023 | Packagist october/system |
October CMS stored XSS by authenticated backend user with improper configuration CVE-2023-44383, GHSA-rvx8-p3xp-fj3p | Medium | 0.4% | 29 Nov, 2023 | Packagist october/system |
Apache Superset Allocation of Resources Without Limits or Throttling vulnerability BIT-superset-2023-42504, CVE-2023-42504, GHSA-3hp7-4qq4-v5c6, PYSEC-2026-1157 | Medium | 1.1% | 28 Nov, 2023 | PyPI apache-superset |
Apache Superset Exposure of Sensitive Information to an Unauthorized Actor vulnerability BIT-superset-2023-42505, CVE-2023-42505, GHSA-fgpw-4w69-j256, PYSEC-2026-1174 | Medium | 1.0% | 28 Nov, 2023 | PyPI apache-superset |
Apache Superset Open Redirect vulnerability BIT-superset-2023-42502, CVE-2023-42502, GHSA-hc74-9vjm-c9xv, PYSEC-2026-1182 | Medium | 0.8% | 28 Nov, 2023 | PyPI apache-superset |
OwnCast remote code execution vulnerability CVE-2023-46480, GHSA-392h-r46j-q24p | Medium | 1.6% | 28 Nov, 2023 | Go github.com/owncast/owncast |
OroCommerce get-totals-for-checkout API endpoint returns unwanted data CVE-2023-32065, GHSA-88g2-xgh9-4ph2 | Medium | 0.5% | 27 Nov, 2023 | Packagist oro/commerce |
OroCommerce Customer Portal Incorrect Customer and Customer Group Frontend Menus pages visibility CVE-2023-32064, GHSA-8gwj-68w6-7v6c | Medium | 0.5% | 27 Nov, 2023 | Packagist oro/customer-portal |
OroCRMCallBundle has incorrect call view page visibility CVE-2023-32063, GHSA-897w-jv7j-6r7g | Medium | 0.5% | 27 Nov, 2023 | Packagist oro/crm-call-bundle |
Knative Serving vulnerable to attacker-controlled pod causing denial of service of autoscaler CVE-2023-48713, GHSA-qmvj-4qr9-v547, GO-2023-2355 | Medium | 0.9% | 27 Nov, 2023 | Go knative.dev/serving |
aiohttp's ClientSession is vulnerable to CRLF injection via version CVE-2023-49081, GHSA-q3qx-c6g2-7pw2, PYSEC-2023-250 | Medium | 0.9% | 27 Nov, 2023 | PyPI aiohttp |
aiohttp's ClientSession is vulnerable to CRLF injection via method CVE-2023-49082, GHSA-qvrw-v9rv-5rjx, PYSEC-2023-251 | Medium | 0.9% | 27 Nov, 2023 | PyPI aiohttp |
aiohttp has vulnerable dependency that is vulnerable to request smuggling GHSA-pjjw-qhg8-p2p9 | Medium | Not scored | 27 Nov, 2023 | PyPI aiohttp |
OroCalendarBundle has incorrect system calendar events visibility CVE-2023-32062, GHSA-x2xm-p6vq-482g | Medium | 0.5% | 27 Nov, 2023 | Packagist oro/calendar-bundle |
github.com/go-resty/resty/v2 HTTP request body disclosure CVE-2023-45286, GHSA-xwh9-gc39-5298, GO-2023-2328 | Medium | 0.7% | 27 Nov, 2023 | Go github.com/go-resty/resty/v2 |
Uptime Kuma Authenticated remote code execution via TailscalePing GHSA-hfxh-rjv7-2369 | Medium | Not scored | 27 Nov, 2023 | npm uptime-kuma |
Mattermost Uncontrolled Resource Consumption vulnerability CVE-2023-48369, GHSA-3487-3j7c-7gwj | Medium | 0.6% | 27 Nov, 2023 | Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost Improper Access Control vulnerability CVE-2023-6202, GHSA-85jj-c9jr-9jhx | Medium | 0.4% | 27 Nov, 2023 | Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost Uncontrolled Resource Consumption vulnerability CVE-2023-40703, GHSA-c37r-v8jx-7cv2 | Medium | 0.7% | 27 Nov, 2023 | Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost Exposure of Sensitive Information to an Unauthorized Actor vulnerability CVE-2023-43754, GHSA-jjr7-372r-cx7x | Medium | 0.5% | 27 Nov, 2023 | Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost Exposure of Sensitive Information to an Unauthorized Actor vulnerability CVE-2023-45223, GHSA-p5pr-vm3j-jxxf | Medium | 0.5% | 27 Nov, 2023 | Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost Open Redirect vulnerability CVE-2023-47168, GHSA-4ghx-8jw8-p76q | Medium | 0.4% | 27 Nov, 2023 | Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost Improper Access Control vulnerability CVE-2023-47865, GHSA-jj46-9cgh-qmfx | Medium | 0.4% | 27 Nov, 2023 | Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost Uncontrolled Resource Consumption vulnerability CVE-2023-48268, GHSA-j4c3-3h73-74m9 | Medium | 0.7% | 27 Nov, 2023 | Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Apache Superset Cross-site Scripting vulnerability BIT-superset-2023-43701, CVE-2023-43701, GHSA-wq8q-99p5-xfrw, PYSEC-2026-1190 | Medium | 1.0% | 27 Nov, 2023 | PyPI apache-superset |
Apache Superset has Incorrect Default Permissions BIT-superset-2023-42501, CVE-2023-42501, GHSA-vv65-fjfj-4736, PYSEC-2026-1188 | Medium | 0.9% | 27 Nov, 2023 | PyPI apache-superset |
Attribute Injection leading to XSS(Cross-Site-Scripting) CVE-2023-49276, GHSA-v4v2-8h88-65qj | Medium | 0.5% | 24 Nov, 2023 | npm uptime-kuma |
Ethereum ABI decoder DoS when parsing ZST GHSA-rqr8-pxh7-cq3g | Medium | Not scored | 24 Nov, 2023 | PyPI eth-abi |
Cleartext Storage of Sensitive Information in HMAC SHA256 Authentication CVE-2023-48707, GHSA-v427-c49j-8w6x | Medium | 0.3% | 23 Nov, 2023 | Packagist codeigniter4/shield |
Insertion of Sensitive Information into Log CVE-2023-48708, GHSA-j72f-h752-mx4w | Medium | 0.6% | 23 Nov, 2023 | Packagist codeigniter4/shield |
Cross-site Scripting in DOMSanitizer CVE-2023-49146, GHSA-2ghm-r75j-pjx2 | Medium | 0.4% | 22 Nov, 2023 | Packagist rhukster/dom-sanitizer |
Cross-site Scripting in Admidio CVE-2023-47380, GHSA-vm4p-gh82-xq96 | Medium | 0.7% | 22 Nov, 2023 | Packagist admidio/admidio |
Clear Text Credentials Exposed via Onboarding Task CVE-2023-48700, GHSA-qf3c-rw9f-jh7v, PYSEC-2023-288 | Medium | 0.4% | 21 Nov, 2023 | PyPI nautobot-device-onboarding |
Decryption of malicious PBES2 JWE objects can consume unbounded system resources GHSA-2c7c-3mj9-8fqh, GO-2023-2334 | Medium | Not scored | 21 Nov, 2023 | Go github.com/go-jose/go-jose/v3 Go github.com/square/go-jose |
TorchServe ZipSlip CVE-2023-48299, GHSA-m2mj-pr4f-h9jp, PYSEC-2026-1972 | Medium | 0.7% | 21 Nov, 2023 | PyPI torchserve |
Possible user mocking that bypasses basic authentication CVE-2023-48309, GHSA-v64w-49xw-qq89 | Medium | 0.7% | 20 Nov, 2023 | npm next-auth |
JWT Algorithm Confusion CVE-2023-48223, GHSA-c2ff-88x2-x9pg | Medium | 0.7% | 20 Nov, 2023 | npm fast-jwt |
Bypass of field access control in strapi-plugin-protected-populate CVE-2023-48218, GHSA-6h67-934r-82g7 | Medium | 0.6% | 20 Nov, 2023 | npm strapi-plugin-protected-populate |
LibreNMS has Broken Access control on Graphs Feature CVE-2023-48294, GHSA-fpq5-4vwm-78x4 | Medium | 0.7% | 17 Nov, 2023 | Packagist librenms/librenms |
@vendure/core's insecure currencyCode handling allows wrong payment amounts GHSA-wm63-7627-ch33 | Medium | Not scored | 17 Nov, 2023 | npm @vendure/core |
LibreNMS Cross-site Scripting at Device groups Deletion feature CVE-2023-48295, GHSA-8phr-637g-pxrg | Medium | 0.6% | 17 Nov, 2023 | Packagist librenms/librenms |
Concrete CMS Cross-site Scripting vulnerability CVE-2023-48649, GHSA-36fr-3wg8-q5v8 | Medium | 0.6% | 17 Nov, 2023 | Packagist concrete5/concrete5 |