Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Apple Multiple Products WebKit Sandbox Escape Vulnerability CVE-2023-32409 | HighExploited | 16.5% | 23 Jun, 2023 | |
Apple Multiple Products WebKit Use-After-Free Vulnerability CVE-2023-32373 | HighExploited | 12.2% | 23 Jun, 2023 | |
Admidio Improper Neutralization of Formula Elements in a CSV File vulnerability CVE-2023-3302, GHSA-hm75-8w6h-4f8f | High | 0.5% | 23 Jun, 2023 | Packagist admidio/admidio |
RaspAP raspap-webgui Command Injection vulnerability CVE-2023-30260, GHSA-hhqm-f4m4-pq39 | High | 2.5% | 23 Jun, 2023 | Packagist billz/raspap-webgui |
Moodle vulnerable to Server Side Request Forgery BIT-moodle-2023-35133, CVE-2023-35133, GHSA-xxp4-mf4h-6cwm | High | 0.8% | 22 Jun, 2023 | Packagist moodle/moodle |
word-wrap vulnerable to Regular Expression Denial of Service CVE-2023-26115, GHSA-j8xg-fqg3-53r7 | High | 1.7% | 22 Jun, 2023 | npm word-wrap |
passport-wsfed-saml2 Signature Bypass vulnerability GHSA-5wrg-8fxp-cx9r | High | Not scored | 21 Jun, 2023 | npm passport-wsfed-saml2 |
semver vulnerable to Regular Expression Denial of Service CVE-2022-25883, GHSA-c2qf-rxjj-qqgw | High | 2.8% | 21 Jun, 2023 | npm semver |
PaperCut NG/MF Cross-Site Request Forgery (CSRF) Vulnerability CVE-2023-2533 | HighExploited | 28.8% | 20 Jun, 2023 | |
GilaCMS Cross Site Request Forgery vulnerability CVE-2020-20726, GHSA-4cw3-rhqx-vqwr | High | 0.7% | 20 Jun, 2023 | Packagist gilacms/gila |
AWS CDK EKS overly permissive trust policies CVE-2023-35165, GHSA-rx28-r23p-2qc3 | High | 0.9% | 19 Jun, 2023 | npm @aws-cdk/aws-eks npm aws-cdk-lib |
Apache Airflow vulnerable to exposure of sensitive information BIT-airflow-2023-35005, CVE-2023-35005, GHSA-mjff-wv85-hmcj, PYSEC-2023-89 | High | 1.5% | 19 Jun, 2023 | PyPI apache-airflow |
Magento Open Source allows Improper Neutralization of Special Elements Used CVE-2023-29297, GHSA-gfmm-ww6f-5mm5 | High | 1.4% | 15 Jun, 2023 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento Open Source affected by Improper Input Validation CVE-2023-22248, GHSA-5jfg-phx7-7fxg | High | 1.0% | 15 Jun, 2023 | Packagist magento/community-edition Packagist magento/project-community-edition |
Grav Server-side Template Injection (SSTI) via Twig Default Filters CVE-2023-34448, GHSA-whr7-m3f8-mpm8 | High | 4.5% | 14 Jun, 2023 | Packagist getgrav/grav |
Grav Server-side Template Injection (SSTI) via Denylist Bypass Vulnerability CVE-2023-34253, GHSA-j3v8-v77f-fvgm | High | 2.1% | 14 Jun, 2023 | Packagist getgrav/grav |
Grav Server-side Template Injection (SSTI) via Twig Default Filters CVE-2023-34252, GHSA-96xv-rmwj-6p9w | High | 2.1% | 14 Jun, 2023 | Packagist getgrav/grav |
elFinder vulnerable to path traversal in LocalVolumeDriver connector CVE-2023-35840, GHSA-wm5g-p99q-66g4 | High | 1.9% | 14 Jun, 2023 | Packagist studio-42/elfinder |
hjson stack exhaustion vulnerability CVE-2023-34620, GHSA-5wfc-hjrc-gq87, GO-2026-5157 | High | 0.8% | 14 Jun, 2023 | Go github.com/hjson/hjson-go Go github.com/hjson/hjson-go/v4 Maven org.hjson:hjson Packagist laktak/hjson |
Microsoft Streaming Service Untrusted Pointer Dereference Vulnerability CVE-2023-29360 | HighExploited | 21.6% | 14 Jun, 2023 | |
Withdrawn Advisory: CraftCMS Server-Side Template Injection vulnerability CVE-2023-30179, GHSA-3x74-v64j-qc3f | High | 2.2% | 13 Jun, 2023 | Packagist craftcms/cms |
Dolibarr vulnerable to unauthenticated database access BIT-dolibarr-2023-33568, CVE-2023-33568, GHSA-fpvg-m786-h5vr | High | 14.9% | 13 Jun, 2023 | Packagist dolibarr/dolibarr |
cheqd-node subject to Cosmos SDK "Barberry" vulnerability GHSA-8qxh-2gh8-r923 | High | Not scored | 12 Jun, 2023 | Go github.com/cheqd/cheqd-node |
dottie vulnerable to Prototype Pollution CVE-2023-26132, GHSA-4gxf-g5gf-22h4 | High | 1.1% | 10 Jun, 2023 | npm dottie |
Snowflake Golang Driver vulnerable to Command Injection CVE-2023-34231, GHSA-fwv2-65wh-2w8c | High | 2.0% | 09 Jun, 2023 | Go github.com/snowflakedb/gosnowflake |
@udecode/plate-link does not sanitize URLs to prevent use of the `javascript:` scheme CVE-2023-34245, GHSA-4882-hxpr-hrvm | High | 0.4% | 09 Jun, 2023 | npm @udecode/plate-link |
Connection confusion in gRPC CVE-2023-32731, GHSA-cfgp-2977-2fmm, PYSEC-2026-1427 | High | 0.5% | 09 Jun, 2023 | Maven io.grpc:grpc-protobuf PyPI grpcio RubyGems grpc |
gRPC Reachable Assertion issue CVE-2023-1428, GHSA-6628-q6j9-w8vg, PYSEC-2026-1425 | High | 0.4% | 09 Jun, 2023 | Maven io.grpc:grpc-protobuf PyPI grpcio RubyGems grpc |
Froxlor vulnerable to Path Traversal CVE-2023-3172, GHSA-ghqq-jfx7-f6m9 | High | 1.2% | 09 Jun, 2023 | Packagist froxlor/froxlor |
Snowflake NodeJS Driver vulnerable to Command Injection CVE-2023-34232, GHSA-h53w-7qw7-vh5c | High | 1.9% | 08 Jun, 2023 | npm snowflake-sdk |
Snowflake Python Connector vulnerable to Command Injection CVE-2023-34233, GHSA-5w5m-pfw9-c8fp, PYSEC-2023-88 | High | 1.8% | 08 Jun, 2023 | PyPI snowflake-connector-python |
alist Incorrect Access Control vulnerability CVE-2023-33498, GHSA-hh54-53m7-7ffj | High | 0.7% | 07 Jun, 2023 | Go github.com/alist-org/alist/v3 |
TP-Link Multiple Routers Command Injection Vulnerability CVE-2023-33538 | HighExploited | 41.6% | 07 Jun, 2023 | |
Grafana Missing Synchronization vulnerability BIT-grafana-2023-2801, CVE-2023-2801, GHSA-x2w4-c67p-g44j | High | 0.7% | 06 Jun, 2023 | Go github.com/grafana/grafana |
RedCloth Regular Expression Denial of Service issue CVE-2023-31606, GHSA-qcm3-vfq5-wfr2 | High | 1.5% | 06 Jun, 2023 | RubyGems RedCloth |
fast-xml-parser vulnerable to Regex Injection via Doctype Entities CVE-2023-34104, GHSA-6w63-h3fj-q4vw | High | 1.1% | 06 Jun, 2023 | npm fast-xml-parser |
avo possible unsafe reflection / partial DoS vulnerability CVE-2023-34102, GHSA-86h2-2g4g-29qx | High | 1.6% | 06 Jun, 2023 | RubyGems avo |
kiwitcms vulnerable to stored cross-site scripting via unrestricted file upload CVE-2023-33977, GHSA-2fqm-m4r2-fh98, PYSEC-2026-1495 | High | 0.9% | 06 Jun, 2023 | PyPI kiwitcms |
notation-go's verification bypass can cause users to verify the wrong artifact CVE-2023-33959, GHSA-xhg5-42rf-296r, GO-2023-1832 | High | 0.4% | 06 Jun, 2023 | Go github.com/notaryproject/notation-go |
avo vulnerable to Stored XSS (Cross Site Scripting) in html content based fields CVE-2023-34103, GHSA-5cr9-5jx3-2g39 | High | 0.6% | 06 Jun, 2023 | RubyGems avo |
Rancher users retain access after moving namespaces into projects they don't have access to CVE-2020-10676, GHSA-8vhc-hwhc-cpj4 | High | 1.0% | 06 Jun, 2023 | Go github.com/rancher/rancher |
PocketMine-MP vulnerable to improperly checked dropped item count leading to server crash CVE-2023-7332, GHSA-h87r-f4vc-mchv | High | 0.4% | 06 Jun, 2023 | Packagist pocketmine/pocketmine-mp |
PocketMine-MP vulnerable to server crash with certain invalid JSON payloads in `LoginPacket` due to vulnerable dependency CVE-2023-54393, GHSA-pqp3-8rrw-g8vm | High | 0.6% | 06 Jun, 2023 | Packagist pocketmine/pocketmine-mp |
SQL injection when using MySQL/PostgreSQL data checking CVE-2023-33967, GHSA-4c32-w6c7-77x4 | High | 0.7% | 06 Jun, 2023 | Go github.com/megaease/easeprobe |
Google Chromium V8 Type Confusion Vulnerability CVE-2023-3079 | HighExploited | 37.9% | 05 Jun, 2023 | |
Reportlab vulnerable to remote code execution CVE-2023-33733, GHSA-9q9m-c65c-37pq, PYSEC-2026-1871 | High | 2.1% | 05 Jun, 2023 | PyPI reportlab |
TeamPass vulnerable to stored Cross-site Scripting CVE-2023-3084, GHSA-8vm8-38pc-8xhh | High | 0.8% | 03 Jun, 2023 | Packagist nilsteampassnet/teampass |
TeamPass vulnerable to stored Cross-site Scripting CVE-2023-3083, GHSA-c6fv-3jm9-6r8f | High | 0.7% | 03 Jun, 2023 | Packagist nilsteampassnet/teampass |
Hashicorp Consul allows user with service:write permissions to patch remote proxy instances BIT-consul-2023-2816, CVE-2023-2816, GHSA-rqjq-ww83-wv5c, GO-2023-1828 | High | 0.6% | 03 Jun, 2023 | Go github.com/hashicorp/consul |
mx-chain-go does not treat invalid transaction with wrong username correctly CVE-2023-33964, GHSA-7xpv-4pm9-xch2, GO-2023-1806 | High | 0.6% | 02 Jun, 2023 | Go github.com/multiversx/mx-chain-go |