Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
CKEditor cross-site scripting vulnerability in AJAX sample CVE-2023-4771, GHSA-wh5w-82f3-wrxh | Medium | 0.9% | 16 Nov, 2023 | npm ckeditor4 |
pocketmine/raklib reliable-ordered queue size is unlimited, allowing a session to hog server memory GHSA-w98g-5fmx-wm4x | Medium | Not scored | 15 Nov, 2023 | Packagist pocketmine/raklib |
TinyMCE vulnerable to mutation Cross-site Scripting via special characters in unescaped text nodes CVE-2023-48219, GHSA-v626-r774-j7f8 | Medium | 0.7% | 15 Nov, 2023 | NuGet TinyMCE Packagist tinymce/tinymce npm tinymce |
pimcore/admin-ui-classic-bundle Full Path Disclosure via re-export document CVE-2023-47636, GHSA-c8hj-w239-5gvf | Medium | 0.7% | 15 Nov, 2023 | Packagist pimcore/admin-ui-classic-bundle |
yt-dlp Generic Extractor MITM Vulnerability via Arbitrary Proxy Injection CVE-2023-46121, GHSA-3ch3-jhc6-5r8x, PYSEC-2026-2063 | Medium | 0.3% | 15 Nov, 2023 | PyPI yt-dlp |
Ansible galaxy-importer Path Traversal vulnerability CVE-2023-5189, GHSA-55g2-vm3q-7w52, PYSEC-2026-1401 | Medium | 1.0% | 14 Nov, 2023 | PyPI galaxy-importer |
Aiohttp has inconsistent interpretation of `Content-Length` vs. `Transfer-Encoding` differing in C and Python fallbacks CVE-2023-47641, GHSA-xx9p-xxvh-7g8j, PYSEC-2023-247 | Medium | 0.8% | 14 Nov, 2023 | PyPI aiohttp |
Gitsign's Rekor public keys fetched from upstream API instead of local TUF client. CVE-2023-47122, GHSA-xvrc-2wvh-49vc, GO-2023-2332 | Medium | 0.4% | 14 Nov, 2023 | Go github.com/sigstore/gitsign |
Information Disclosure in typo3/cms-install tool BIT-typo3-2023-47126, CVE-2023-47126, GHSA-p2jh-95jg-2w55 | Medium | 0.7% | 14 Nov, 2023 | Packagist typo3/cms-install |
Bypassing Cross-Site Scripting Protection in TYPO3 HTML Sanitizer BIT-typo3-2023-47125, CVE-2023-47125, GHSA-mm79-jhqm-9j54 | Medium | 0.6% | 14 Nov, 2023 | Packagist typo3/html-sanitizer |
TYPO3 vulnerable to Weak Authentication in Session Handling BIT-typo3-2023-47127, CVE-2023-47127, GHSA-3vmm-7h4j-69rm | Medium | 0.6% | 14 Nov, 2023 | Packagist typo3/cms-core |
Cross-site Scripting in cesium CVE-2023-48094, GHSA-4532-pmx7-9ww7 | Medium | 0.3% | 14 Nov, 2023 | npm cesium |
Apache Airflow allows authenticated and DAG-view authorized users to modify some DAG run detail values when submitting notes BIT-airflow-2023-47037, CVE-2023-47037, GHSA-hm9r-7f84-25c9, PYSEC-2023-232 | Medium | 1.5% | 12 Nov, 2023 | PyPI apache-airflow |
Symfony potential Cross-site Scripting in WebhookController BIT-symfony-2023-46735, CVE-2023-46735, GHSA-72x2-5c85-6wmr | Medium | 0.6% | 10 Nov, 2023 | Packagist symfony/symfony Packagist symfony/webhook |
Symfony potential Cross-site Scripting vulnerabilities in CodeExtension filters BIT-symfony-2023-46734, CVE-2023-46734, GHSA-q847-2q57-wmr3 | Medium | 0.7% | 10 Nov, 2023 | Packagist symfony/symfony Packagist symfony/twig-bridge |
Symfony possible session fixation vulnerability BIT-symfony-2023-46733, CVE-2023-46733, GHSA-m2wj-r6g3-fxfx | Medium | 0.7% | 10 Nov, 2023 | Packagist symfony/security-http Packagist symfony/symfony |
Sentry Next.js vulnerable to SSRF via Next.js SDK tunnel endpoint CVE-2023-46729, GHSA-2rmr-xw8m-22q9 | Medium | 0.6% | 09 Nov, 2023 | npm @sentry/nextjs |
Moodle Improper Access Control vulnerability BIT-moodle-2023-5549, CVE-2023-5549, GHSA-fm5h-58g2-4m3f | Medium | 0.6% | 09 Nov, 2023 | Packagist moodle/moodle |
Moodle Acceptance of Extraneous Untrusted Data With Trusted Data vulnerability BIT-moodle-2023-5548, CVE-2023-5548, GHSA-cwh2-q44x-5w3c | Medium | 0.3% | 09 Nov, 2023 | Packagist moodle/moodle |
Moodle Cross-site Scripting vulnerability BIT-moodle-2023-5547, CVE-2023-5547, GHSA-9gqp-3g28-w9xc | Medium | 0.5% | 09 Nov, 2023 | Packagist moodle/moodle |
Moodle Cross-site Scripting vulnerability BIT-moodle-2023-5546, CVE-2023-5546, GHSA-9724-h8p7-r3jv | Medium | 1.3% | 09 Nov, 2023 | Packagist moodle/moodle |
Moodle Exposure of Sensitive Information to an Unauthorized Actor vulnerability BIT-moodle-2023-5545, CVE-2023-5545, GHSA-26fg-v32r-h663 | Medium | 0.6% | 09 Nov, 2023 | Packagist moodle/moodle |
Moodle Cross-site Scripting vulnerability BIT-moodle-2023-5544, CVE-2023-5544, GHSA-j5xf-gv89-g422 | Medium | 0.6% | 09 Nov, 2023 | Packagist moodle/moodle |
Moodle Improper Access Control vulnerability BIT-moodle-2023-5542, CVE-2023-5542, GHSA-8mm2-m2gp-c6x2 | Medium | 0.5% | 09 Nov, 2023 | Packagist moodle/moodle |
Moodle Cross-site Scripting vulnerability BIT-moodle-2023-5541, CVE-2023-5541, GHSA-28gc-4qq5-8q26 | Medium | 0.5% | 09 Nov, 2023 | Packagist moodle/moodle |
AsyncSSH Rogue Extension Negotiation CVE-2023-46445, GHSA-cfc2-wr2v-gxm5, PYSEC-2023-237 | Medium | 0.6% | 09 Nov, 2023 | PyPI asyncssh |
NASA Open MCT Cross Site Scripting vulnerability CVE-2023-45885, GHSA-v8fc-qxvj-f3mg | Medium | 0.5% | 09 Nov, 2023 | npm openmct |
NASA Open MCT Cross Site Request Forgery (CSRF) vulnerability CVE-2023-45884, GHSA-4g88-4hgm-m99x | Medium | 0.3% | 09 Nov, 2023 | npm openmct |
Any value can be changed in the configuration table by an employee having access to block reassurance module CVE-2023-47110, GHSA-xfm3-hjcc-gv78 | Medium | 0.4% | 09 Nov, 2023 | Packagist prestashop/blockreassurance |
Axios Cross-Site Request Forgery Vulnerability CVE-2023-45857, GHSA-wf5p-g6vw-rhxx | Medium | 0.7% | 08 Nov, 2023 | npm axios |
Ethyca Fides HTML Injection Vulnerability in HTML-Formatted DSR Packages CVE-2023-47114, GHSA-3vpf-mcj7-5h38, PYSEC-2026-1333 | Medium | 0.6% | 08 Nov, 2023 | PyPI ethyca-fides |
Microweber Cross-site Scripting vulnerability CVE-2023-47379, GHSA-jmwm-w2rm-prv9 | Medium | 0.5% | 08 Nov, 2023 | Packagist microweber/microweber |
capsule-proxy service discloses Namespaces of colliding tenants to owners of different tenants with the same ServiceAccount name CVE-2023-46254, GHSA-6758-979h-249x | Medium | 0.4% | 07 Nov, 2023 | Go github.com/projectcapsule/capsule Go github.com/projectcapsule/capsule-proxy |
Bootbox.js Cross Site Scripting vulnerability CVE-2023-46998, GHSA-m4ch-4m5f-2gp6 | Medium | 1.4% | 07 Nov, 2023 | npm bootbox |
Microweber Improper Access Control vulnerability CVE-2023-5976, GHSA-q57g-38pc-jwv8 | Medium | 0.4% | 07 Nov, 2023 | Packagist microweber/microweber |
DOMPurify Open Redirect vulnerability CVE-2019-25155, GHSA-8hgg-xxm5-3873 | Medium | 0.6% | 07 Nov, 2023 | npm dompurify |
Mattermost denial of service vulnerability CVE-2023-5967, GHSA-xvq6-h898-wcj8 | Medium | 0.5% | 06 Nov, 2023 | Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost password hash disclosure vulnerability CVE-2023-5968, GHSA-r67m-mf7v-qp7j | Medium | 0.5% | 06 Nov, 2023 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost vulnerable to excessive memory consumption CVE-2023-5969, GHSA-w496-f5qq-m58j | Medium | 0.5% | 06 Nov, 2023 | Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Reportico Cross-site Scripting vulnerability CVE-2023-46925, GHSA-9cw9-m7hg-w8mf | Medium | 0.4% | 02 Nov, 2023 | Packagist reportico-web/reportico |
phpBB's Smiley Pack acp_icons.php main pack vulnerable to cross site scripting BIT-phpbb-2023-5917, CVE-2023-5917, GHSA-gmx8-8rff-qv6q | Medium | 0.6% | 02 Nov, 2023 | Packagist phpbb/phpbb |
Dolibarr Improper Input Validation vulnerability BIT-dolibarr-2023-4198, CVE-2023-4198, GHSA-48v2-596x-4jr9 | Medium | 0.7% | 01 Nov, 2023 | Packagist dolibarr/dolibarr |
SpiceDB leaks information in log files when URI cannot be parsed CVE-2023-46255, GHSA-jg7w-cxjv-98c2, GO-2023-2166 | Medium | 0.4% | 31 Oct, 2023 | Go github.com/authzed/spicedb |
Synapse vulnerable to leak of remote user device information CVE-2023-43796, GHSA-mp92-3jfm-3575, PYSEC-2023-230 | Medium | 1.2% | 31 Oct, 2023 | PyPI matrix-synapse |
Pimcore Admin Classic Bundle Cross-site Scripting (XSS) in PDF previews CVE-2023-46722, GHSA-jfxw-6c5v-c42f | Medium | 0.6% | 31 Oct, 2023 | Packagist pimcore/admin-ui-classic-bundle |
Possible Infinite Loop when PdfWriter(clone_from) is used with a PDF CVE-2023-46250, GHSA-wjcc-cq79-p63f, PYSEC-2026-1834 | Medium | 0.3% | 31 Oct, 2023 | PyPI pypdf |
Pimcore Cross-site Scripting vulnerability CVE-2023-5873, GHSA-j59v-hh4p-q92m | Medium | 0.4% | 31 Oct, 2023 | Packagist pimcore/pimcore |
Cross-site Scripting (XSS) in thorsten/phpmyfaq CVE-2023-5867, GHSA-prrv-r843-4p75 | Medium | 0.5% | 31 Oct, 2023 | Packagist thorsten/phpmyfaq |
Sensitive cookie in HTTPS session without 'Secure' attribute in thorsten/phpmyfaq CVE-2023-5866, GHSA-34w4-wrqp-j47g | Medium | 0.3% | 31 Oct, 2023 | Packagist thorsten/phpmyfaq |
phpMyFAQ Cross-site Scripting vulnerability CVE-2023-5863, GHSA-j4vj-w5rj-8grw | Medium | 1.1% | 31 Oct, 2023 | Packagist thorsten/phpmyfaq |