Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Cross-site Scripting (XSS) in microweber/microweber CVE-2023-5861, GHSA-7q5f-29gx-57ff | Medium | 0.5% | 31 Oct, 2023 | Packagist microweber/microweber |
memory leak flaw was found in ruby-magick CVE-2023-5349, GHSA-frgf-8jr5-j2jv | Medium | 0.7% | 30 Oct, 2023 | RubyGems rmagick |
/sys/devices/virtual/powercap accessible by default to containers GHSA-jq35-85cj-fj4p | Medium | Not scored | 30 Oct, 2023 | Go github.com/docker/docker |
Kube-proxy may unintentionally forward traffic CVE-2021-25736, GHSA-35c7-w35f-xwgh, GO-2023-2159 | Medium | 0.9% | 30 Oct, 2023 | Go k8s.io/kubernetes |
Cross-site Scripting (XSS) in dolibarr/dolibarr BIT-dolibarr-2023-5842, CVE-2023-5842, GHSA-9pjf-jw9q-fx49 | Medium | 0.5% | 30 Oct, 2023 | Packagist dolibarr/dolibarr |
baserCMS Directory Traversal vulnerability in Form submission data management Feature CVE-2023-43648, GHSA-hmqj-gv2m-hq55 | Medium | 1.2% | 26 Oct, 2023 | Packagist baserproject/basercms |
baserCMS Cross-site Scripting vulnerability in File upload Feature CVE-2023-43647, GHSA-ggj4-78rm-6xgv | Medium | 0.6% | 26 Oct, 2023 | Packagist baserproject/basercms |
baserCMS Cross-site Scripting Vulnerability in Favorites Feature CVE-2023-29009, GHSA-8vqx-prq4-rqrq | Medium | 0.6% | 26 Oct, 2023 | Packagist baserproject/basercms |
twisted.web has disordered HTTP pipeline response CVE-2023-46137, GHSA-xc8x-vp79-p3wm, PYSEC-2023-224 | Medium | 0.9% | 25 Oct, 2023 | PyPI twisted |
Zenario CMS Cross-site Scripting vulnerability CVE-2023-44769, GHSA-8g87-73vq-443p | Medium | 0.7% | 25 Oct, 2023 | Packagist tribalsystems/zenario |
Command Injection in pip when used with Mercurial CVE-2023-5752, GHSA-mq26-g339-26xf, PYSEC-2023-228 | Medium | 0.5% | 25 Oct, 2023 | PyPI pip |
Jumpserver Koko vulnerable to remote code execution on the host system via MongoDB shell CVE-2023-43651, GHSA-4r5x-x283-wm96 | Medium | 2.1% | 24 Oct, 2023 | Go github.com/jumpserver/koko |
Fides JavaScript Injection Vulnerability in Privacy Center URL CVE-2023-46126, GHSA-fgjj-5jmr-gh83, PYSEC-2026-1340 | Medium | 0.7% | 24 Oct, 2023 | PyPI ethyca-fides |
Fides Information Disclosure Vulnerability in Config API Endpoint CVE-2023-46125, GHSA-rjxg-rpg3-9r89, PYSEC-2026-1347 | Medium | 0.9% | 24 Oct, 2023 | PyPI ethyca-fides |
Concrete CMS Cross-site Scripting vulnerability CVE-2023-44760, GHSA-4qv6-37xq-mgq2 | Medium | 0.7% | 23 Oct, 2023 | Packagist concrete5/concrete5 |
Apache Airflow vulnerable to Exposure of Sensitive Information BIT-airflow-2023-46288, CVE-2023-46288, GHSA-9qqg-mh7c-chfq, PYSEC-2023-218 | Medium | 1.8% | 23 Oct, 2023 | PyPI apache-airflow |
WebAssembly wabt 1.0.33 has an Out-of-Bound Memory Read in in DataSegment::IsValidRange(), which lead to segmentation fault. CVE-2023-46331, PYSEC-2023-319 | Medium | 0.2% | 23 Oct, 2023 | PyPI wabt |
WebAssembly wabt 1.0.33 contains an Out-of-Bound Memory Write in DataSegment::Drop(), which lead to segmentation fault. CVE-2023-46332, PYSEC-2023-320 | Medium | 0.3% | 23 Oct, 2023 | PyPI wabt |
Wagtail CRX CodeRed Extensions vulnerable to Path Traversal CVE-2021-46897, GHSA-h454-rq3m-89rc, PYSEC-2023-210 | Medium | 0.9% | 22 Oct, 2023 | PyPI coderedcms |
Django Grappelli Open Redirect vulnerability CVE-2021-46898, GHSA-9x43-5qcq-h79q, PYSEC-2023-211 | Medium | 0.6% | 22 Oct, 2023 | PyPI django-grappelli |
svg_optimizer rubygem external XML entity (XXE) vulnerability CVE-2023-46035, GHSA-6hvg-62q8-95v7 | Medium | 0.4% | 20 Oct, 2023 | RubyGems svg_optimizer |
Home Assistant vulnerable to account takeover via auth_callback login CVE-2023-41893, GHSA-qhhj-7hrc-gqj5, PYSEC-2023-214 | Medium | 0.5% | 20 Oct, 2023 | PyPI homeassistant |
Evolution CMS Cross-site Scripting vulnerability CVE-2023-43340, GHSA-432f-967f-vxg4 | Medium | 0.5% | 19 Oct, 2023 | Packagist evolutioncms/evolution |
Subrion CMS vulnerable to Cross-site Scripting CVE-2023-43875, GHSA-646r-8fcc-p82r | Medium | 0.8% | 19 Oct, 2023 | Packagist intelliants/subrion |
Evolution CMS Cross-site Scripting vulnerability CVE-2023-43341, GHSA-5h47-9rm5-fx3f | Medium | 0.6% | 19 Oct, 2023 | Packagist evolutioncms/evolution |
ydb-go-sdk token in custom credentials object can leak through logs CVE-2023-45825, GHSA-q24m-6h38-5xj8, GO-2023-2137 | Medium | 0.2% | 19 Oct, 2023 | Go github.com/ydb-platform/ydb-go-sdk/v3 |
Artifact Hub has Incorrect Docker Hub registry check CVE-2023-45821, GHSA-g6pq-x539-7w4j, GO-2023-2135 | Medium | 0.2% | 19 Oct, 2023 | Go github.com/artifacthub/hub |
TinyMCE XSS vulnerability in notificationManager.open API CVE-2023-45819, GHSA-hgqx-r2hp-jr38 | Medium | 0.6% | 19 Oct, 2023 | NuGet TinyMCE Packagist tinymce/tinymce npm tinymce |
TinyMCE mXSS vulnerability in undo/redo, getContent API, resetContent API, and Autosave plugin CVE-2023-45818, GHSA-v65r-p3vv-jjfv | Medium | 0.8% | 19 Oct, 2023 | NuGet TinyMCE Packagist tinymce/tinymce npm tinymce |
React Developer Tools extension Improper Authorization vulnerability CVE-2023-5654, GHSA-rxrc-rgv4-jpvx | Medium | 0.6% | 19 Oct, 2023 | npm react-devtools-core |
Arduino Create Agent path traversal - arbitrary file deletion vulnerability CVE-2023-43803, GHSA-m5jc-r4gf-c6p8 | Medium | 0.3% | 18 Oct, 2023 | Go github.com/arduino/arduino-create-agent |
Arduino Create Agent path traversal - arbitrary file deletion vulnerability CVE-2023-43801, GHSA-mjq6-pv9c-qppq | Medium | 0.3% | 18 Oct, 2023 | Go github.com/arduino/arduino-create-agent |
Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability CVE-2023-5631 | MediumExploited | 76.3% | 18 Oct, 2023 | |
urllib3's request body not stripped after redirect from 303 status changes request method to GET CVE-2023-45803, GHSA-g4mx-q9vg-27p4, PYSEC-2023-212 | Medium | 0.6% | 17 Oct, 2023 | PyPI urllib3 |
nocodb SQL Injection vulnerability CVE-2023-43794, GHSA-3m5q-q39v-xf8f | Medium | 0.9% | 17 Oct, 2023 | npm nocodb |
MantisBT may disclose project names to unauthorized users CVE-2023-44394, GHSA-v642-mh27-8j6m | Medium | 0.7% | 16 Oct, 2023 | Packagist mantisbt/mantisbt |
Google Sheets data source plugin for Grafana information disclosure vulnerability CVE-2023-4457, GHSA-37x5-qpm8-53rq, GO-2023-2158 | Medium | 0.5% | 16 Oct, 2023 | Go github.com/grafana/google-sheets-datasource |
Grafana privilege escalation vulnerability BIT-grafana-2023-4822, CVE-2023-4822, GHSA-fw9c-75hh-89p6 | Medium | 1.3% | 16 Oct, 2023 | Go github.com/grafana/grafana |
Authorization Header forwarded on redirect CVE-2018-25091, GHSA-gwvm-45gx-3cf8, PYSEC-2023-207 | Medium | 0.6% | 15 Oct, 2023 | PyPI urllib3 |
Apache Airflow vulnerable to sensitive information exposure BIT-airflow-2023-42663, CVE-2023-42663, GHSA-32wr-qqw6-5mfp, PYSEC-2023-197 | Medium | 2.0% | 14 Oct, 2023 | PyPI apache-airflow |
Apache Airflow vulnerable to sensitive information exposure when users list warnings for all DAGs BIT-airflow-2023-42780, CVE-2023-42780, GHSA-cgx2-rrmr-jx43, PYSEC-2023-202 | Medium | 1.4% | 14 Oct, 2023 | PyPI apache-airflow |
Apache Airflow vulnerable to privilege escalation BIT-airflow-2023-42792, CVE-2023-42792, GHSA-j3w8-2p2h-mrr9, PYSEC-2023-203 | Medium | 1.9% | 14 Oct, 2023 | PyPI apache-airflow |
Apache Airflow vulnerable to sensitive information exposure when expose-config is set to non-sensitive-only BIT-airflow-2023-45348, CVE-2023-45348, GHSA-fpxx-xv4c-gxqp, PYSEC-2023-204 | Medium | 1.6% | 14 Oct, 2023 | PyPI apache-airflow |
Cross-site Scripting (XSS) in froxlor/froxlor CVE-2023-4829, GHSA-cvwv-h85m-w37h | Medium | 0.4% | 13 Oct, 2023 | Packagist froxlor/froxlor |
Allocation of Resources Without Limits or Throttling in vriteio/vrite CVE-2023-5573, GHSA-5ghm-h2wq-g3mh | Medium | 0.6% | 13 Oct, 2023 | npm @vrite/sdk |
Magento Open Source allows Uncontrolled Resource Consumption CVE-2023-38251, GHSA-7pfc-834q-h497 | Medium | 0.8% | 13 Oct, 2023 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento Open Source allows SQL Injection CVE-2023-38250, GHSA-h3g9-cwr6-hphx | Medium | 0.8% | 13 Oct, 2023 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento Open Source allows SQL Injection CVE-2023-38249, GHSA-rq36-9f5f-2gw7 | Medium | 0.8% | 13 Oct, 2023 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento Open Source allows SQL Injection CVE-2023-38221, GHSA-ggr8-3hwx-4f2m | Medium | 0.8% | 13 Oct, 2023 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento Open Source has Improper Input Validation Vulnerability CVE-2023-26367, GHSA-9mx6-4gg4-85xj | Medium | 0.8% | 13 Oct, 2023 | Packagist magento/community-edition Packagist magento/project-community-edition |