Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Vite Server Options (server.fs.deny) can be bypassed using double forward-slash (//) CVE-2023-34092, GHSA-353f-5xf4-qw67 | High | 3.2% | 01 Jun, 2023 | npm vite |
proxy denial of service vulnerability CVE-2023-2968, GHSA-mj6p-3pc9-wf5m | High | 1.5% | 30 May, 2023 | npm proxy |
Pimcore vulnerable to Pre-Auth Path Traversal in pimcore_log parameter CVE-2023-2984, GHSA-46g3-f9r8-xj4v | High | 0.9% | 30 May, 2023 | Packagist pimcore/pimcore |
Pimcore Privilege Defined With Unsafe Actions vulnerability CVE-2023-2983, GHSA-m4mv-rmr7-h5f5 | High | 0.9% | 30 May, 2023 | Packagist pimcore/pimcore |
Apache Airflow CNCF Kubernetes Provider: KubernetesPodOperator RCE via connection configuration CVE-2023-33234, GHSA-2rx4-9f5h-9gjf, PYSEC-2026-1143 | High | 1.5% | 30 May, 2023 | PyPI apache-airflow-providers-cncf-kubernetes |
Dolibarr vulnerable to remote code execution via uppercase manipulation BIT-dolibarr-2023-30253, CVE-2023-30253, GHSA-9wqr-5jp4-mjmh | High | 82.1% | 29 May, 2023 | Packagist dolibarr/dolibarr |
bwm-ng vulnerable to command injection CVE-2023-26129, GHSA-8vw3-vxmj-h43w | High | 1.0% | 27 May, 2023 | npm bwm-ng |
keep-module-latest vulnerable to Command Injection due to missing input sanitization CVE-2023-26128, GHSA-wxrx-pc44-rcgc | High | 1.2% | 27 May, 2023 | npm keep-module-latest |
n158 vulnerable to Command Injection due to improper input sanitization in the 'module.exports' function CVE-2023-26127, GHSA-549h-r7g9-2qpf | High | 0.9% | 27 May, 2023 | npm n158 |
Ignite Realtime Openfire Path Traversal Vulnerability CVE-2023-32315 | HighExploited | 100.0% | 26 May, 2023 | |
nfpm has incorrect default permissions CVE-2023-32698, GHSA-w7jw-q4fg-qc4c, GO-2023-1788 | High | 0.4% | 24 May, 2023 | Go github.com/goreleaser/nfpm Go github.com/goreleaser/nfpm/v2 |
Synapse Denial of service due to incorrect application of event authorization rules during state resolution CVE-2022-39374, GHSA-p9qp-c452-f9r7, PYSEC-2023-66 | High | 0.9% | 24 May, 2023 | PyPI matrix-synapse |
Synapse does not apply enough checks to servers requesting auth events of events in a room CVE-2022-39335, GHSA-45cj-f97f-ggwv, PYSEC-2023-65 | High | 0.6% | 24 May, 2023 | PyPI matrix-synapse |
Code injection in nilsteampassnet/teampass CVE-2023-2859, GHSA-h6jh-cf83-qcq5 | High | 1.6% | 24 May, 2023 | Packagist nilsteampassnet/teampass |
Insufficient validation when decoding a Socket.IO packet CVE-2023-32695, GHSA-cqmj-92xf-r6r9 | High | 1.1% | 23 May, 2023 | npm socket.io-parser |
Invalid push request payload crashes Parse Server CVE-2023-32688, GHSA-mxhg-rvwx-x993 | High | 0.9% | 22 May, 2023 | npm parse-server-push-adapter |
Double spend in snarkjs CVE-2023-33252, GHSA-xp5g-jhg3-3rg2 | High | 0.6% | 21 May, 2023 | npm snarkjs |
Craft CMS vulnerable to Remote Code Execution via unrestricted file extension CVE-2023-32679, GHSA-vqxf-r9ph-cc9c | High | 1.8% | 19 May, 2023 | Packagist craftcms/cms |
pimcore/customer-management-framework-bundle has SQL Injection vulnerability in Segment Assignment query CVE-2023-2756, GHSA-25fx-3c2q-cq46 | High | 0.9% | 17 May, 2023 | Packagist pimcore/customer-management-framework-bundle |
Starlette has Path Traversal vulnerability in StaticFiles CVE-2023-29159, GHSA-v5gw-mw7f-84px, PYSEC-2023-83 | High | 2.6% | 17 May, 2023 | PyPI starlette |
Any file can be included with the pymdown-snippets extension CVE-2023-32309, GHSA-jh85-wwv9-24hv, PYSEC-2026-1824 | High | 1.7% | 15 May, 2023 | PyPI pymdown-extensions |
git-url-parse Regular Expression Denial of Service CVE-2023-32758, GHSA-4xqq-73wg-5mjp, PYSEC-2026-1404 | High | 1.0% | 15 May, 2023 | PyPI git-url-parse |
Planet's secret file is created with excessive permissions CVE-2023-32303, GHSA-j5fj-rfh6-qj85, PYSEC-2023-71 | High | 0.3% | 12 May, 2023 | PyPI planet |
WWBN AVideo command injection vulnerability CVE-2023-32073, GHSA-2mhh-27v7-3vcx | High | 6.5% | 12 May, 2023 | Packagist wwbn/avideo |
CraftCMS allows remote attacker to execute arbitrary code via crafted script to Section parameter CVE-2023-30130, GHSA-fjx5-xm7q-whvj | High | 1.4% | 12 May, 2023 | Packagist craftcms/cms |
Buffer under-read in workerd CVE-2023-2512, GHSA-8vx6-69vg-c46f | High | 0.6% | 12 May, 2023 | npm workerd |
Mattermost Incorrect Authorization vulnerability BIT-mattermost-2023-2515, CVE-2023-2515, GHSA-7g2v-2frm-rg94 | High | 0.5% | 12 May, 2023 | Go github.com/mattermost/mattermost-server/v6 |
Froxlor vulnerable to Allocation of Resources Without Limits or Throttling CVE-2023-2666, GHSA-4gm9-c9jq-g523 | High | 0.7% | 12 May, 2023 | Packagist froxlor/froxlor |
RosarioSIS Stores Sensitive Data in a Mechanism without Access Control CVE-2023-2665, GHSA-36cm-h8gv-mg97 | High | 0.6% | 12 May, 2023 | Packagist francoisjacquet/rosariosis |
Vyper vulnerable to incorrect ordering of arguments for kwargs passed to internal calls CVE-2023-32059, GHSA-ph9x-4vc9-m39g, PYSEC-2023-79 | High | 0.7% | 11 May, 2023 | PyPI vyper |
Vyper vulnerable to integer overflow in loop CVE-2023-32058, GHSA-6r8q-pfpv-7cgj, PYSEC-2023-78 | High | 0.9% | 11 May, 2023 | PyPI vyper |
distribution catalog API endpoint can lead to OOM via malicious user input CVE-2023-2253, GHSA-hqxw-f8mx-cpmw, GO-2023-1772 | High | 0.9% | 11 May, 2023 | Go github.com/distribution/distribution Go github.com/docker/distribution |
Boxo bitswap/server: DOS unbounded persistent memory leak CVE-2023-25568, GHSA-m974-xj4j-7qv5, GHSA-q3j6-22wf-3jh9, GO-2023-1766 | High | 0.9% | 11 May, 2023 | Go github.com/ipfs/go-bitswap Go github.com/ipfs/go-libipfs |
mflow vulnerable to directory traversal BIT-mlflow-2023-30172, CVE-2023-30172, GHSA-wc6j-5g83-xfm6, PYSEC-2023-70 | High | 1.0% | 11 May, 2023 | PyPI mlflow |
Embedding untrusted input inside CSV files leads to Formula Injection/CSV Injection CVE-2023-2629, GHSA-mq3x-qgwx-3rfw | High | 0.4% | 10 May, 2023 | Packagist pimcore/customer-management-framework-bundle |
n8n Information Disclosure vulnerability CVE-2023-27564, GHSA-r9xw-p7wj-w792 | High | 1.2% | 10 May, 2023 | npm n8n |
n8n Privilege Escalation vulnerability CVE-2023-27563, GHSA-97cp-mr4m-9mcf | High | 1.2% | 10 May, 2023 | npm n8n |
m.static Directory Traversal vulnerability CVE-2023-26126, GHSA-vcxh-qvgr-9fw9 | High | 1.0% | 10 May, 2023 | npm m.static |
Microsoft Win32K Privilege Escalation Vulnerability CVE-2023-29336 | HighExploited | 41.2% | 09 May, 2023 | |
Microsoft SharePoint Server Code Injection Vulnerability CVE-2023-24955 | HighExploited | 85.0% | 09 May, 2023 | |
teampass vulnerable to code injection CVE-2023-2591, GHSA-prj5-2g2p-x2mw | High | 0.6% | 09 May, 2023 | Packagist nilsteampassnet/teampass |
vyper vulnerable to storage allocator overflow CVE-2023-30837, GHSA-mgv8-gggw-mrg6, PYSEC-2023-76 | High | 0.7% | 05 May, 2023 | PyPI vyper |
Cross Site Scripting in thorsten/phpmyfaq CVE-2023-2550, GHSA-5mf7-p346-7rm8 | High | 0.5% | 05 May, 2023 | Packagist thorsten/phpmyfaq |
Path Traversal in Ghost BIT-ghost-2023-32235, CVE-2023-32235, GHSA-wf7x-fh6w-34r6 | High | 39.1% | 05 May, 2023 | npm ghost |
Ghost vulnerable to information disclosure of private API fields BIT-ghost-2023-31133, CVE-2023-31133, GHSA-r97q-ghch-82j9 | High | 45.7% | 03 May, 2023 | npm ghost |
Rekor's compressed archives can result in OOM conditions CVE-2023-30551, GHSA-2h5h-59f5-c5x9, GO-2023-1754 | High | 1.1% | 03 May, 2023 | Go github.com/sigstore/rekor |
Moodle SQL Injection vulnerability BIT-moodle-2023-30944, CVE-2023-30944, GHSA-7mmc-22g7-3xq2 | High | 1.1% | 02 May, 2023 | Packagist moodle/moodle |
Pimcore Path Traversal Vulnerability in AdminBundle/Controller/Reports/CustomReportController.php CVE-2023-30855, GHSA-g2mc-fqqc-hxg3 | High | 0.8% | 02 May, 2023 | Packagist pimcore/pimcore |
Apache Spark UI vulnerable to Command Injection BIT-spark-2023-32007, CVE-2023-32007, GHSA-59hw-j9g6-mfg3, PYSEC-2023-72 | High | 76.0% | 02 May, 2023 | Maven org.apache.spark:spark-parent_2.12 PyPI pyspark |
WWBN/AVideo stored XSS vulnerability leads to takeover of any user's account, including admin's account CVE-2023-30860, GHSA-xr9h-p2rc-rpqm | High | 0.7% | 01 May, 2023 | Packagist wwbn/avideo |