Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Magento Open Source allows Server-Side Request Forgery (SSRF) CVE-2023-26366, GHSA-8jxc-5f94-22vh | Medium | 0.9% | 13 Oct, 2023 | Packagist magento/community-edition Packagist magento/project-community-edition |
Cross-site Scripting (XSS) in froxlor/froxlor CVE-2023-5564, GHSA-j5hq-6frc-64v3 | Medium | 0.4% | 13 Oct, 2023 | Packagist froxlor/froxlor |
Defining resource name as integer may give unintended access in vantage6 CVE-2023-28635, GHSA-7x94-6g2m-3hp2, PYSEC-2023-198, PYSEC-2026-2006 | Medium | 0.5% | 11 Oct, 2023 | PyPI vantage6 PyPI vantage6-node |
vantage6 does not properly delete linked resources when deleting a collaboration CVE-2023-41881, GHSA-rf54-7qrr-96j6, PYSEC-2023-200 | Medium | 0.4% | 11 Oct, 2023 | PyPI vantage6 |
Improper Access Control in vantage6 CVE-2023-41882, GHSA-gc57-xhh5-m94r, PYSEC-2023-201 | Medium | 0.5% | 11 Oct, 2023 | PyPI vantage6 |
ZITADEL's password reset does not respect the "Ignoring unknown usernames" setting CVE-2023-44399, GHSA-v683-rcxx-vpff | Medium | 0.7% | 10 Oct, 2023 | Go github.com/zitadel/zitadel |
Cache variables with the operations when transforms exist on the root level even if variables change in the further requests with the same operation CVE-2025-27097, GHSA-rr4x-crhf-8886 | Medium | 0.4% | 10 Oct, 2023 | npm @graphql-mesh/runtime |
Harbor timing attack risk BIT-harbor-2023-20902, CVE-2023-20902, GHSA-mq6f-5xh5-hgcf, GO-2023-2109 | Medium | 0.5% | 10 Oct, 2023 | Go github.com/goharbor/harbor |
Microsoft Skype for Business Privilege Escalation Vulnerability CVE-2023-41763 | MediumExploited | 90.3% | 10 Oct, 2023 | |
Microsoft Windows Mark of the Web (MOTW) Security Feature Bypass Vulnerability CVE-2023-36584 | MediumExploited | 3.3% | 10 Oct, 2023 | |
Microsoft Common Data Model SDK Denial of Service Vulnerability CVE-2023-36566, GHSA-vm2m-7hpw-fpmq, PYSEC-2026-1261 | Medium | 3.0% | 10 Oct, 2023 | Maven com.microsoft.commondatamodel:objectmodel NuGet Microsoft.CommonDataModel.ObjectModel PyPI commondatamodel-objectmodel |
Microsoft WordPad Information Disclosure Vulnerability CVE-2023-36563 | MediumExploited | 20.3% | 10 Oct, 2023 | |
matrix-synapse vulnerable to denial of service due to malicious server ACL events CVE-2023-45129, GHSA-5chr-wjw5-3gq4, PYSEC-2023-199 | Medium | 1.4% | 10 Oct, 2023 | PyPI matrix-synapse |
ConcreteCMS vulnerable to Stored Cross-site Scripting CVE-2023-44763, GHSA-wrp2-6v6j-hfmg | Medium | 0.7% | 10 Oct, 2023 | Packagist concrete5/concrete5 |
OroCommerce Cross-site Scripting vulnerability in add note dialog of Shopping List line item CVE-2022-35950, GHSA-2jc6-3fhj-8q84 | Medium | 0.4% | 09 Oct, 2023 | Packagist oro/commerce |
Cross-site Scripting in snipe/snipe-it CVE-2023-5452, GHSA-rr5c-69c9-gj9f | Medium | 0.6% | 06 Oct, 2023 | Packagist snipe/snipe-it |
Zenario CMS Cross-site Scripting vulnerability CVE-2023-44771, GHSA-6cxv-27r2-fp3m | Medium | 0.6% | 06 Oct, 2023 | Packagist tribalsystems/zenario |
Zenario CMS Cross-site Scripting vulnerability CVE-2023-44770, GHSA-mr4w-7vm9-cgqx | Medium | 0.6% | 06 Oct, 2023 | Packagist tribalsystems/zenario |
ConcreteCMS Cross-site Scripting vulnerability CVE-2023-44766, GHSA-437p-jfm4-2387 | Medium | 0.6% | 06 Oct, 2023 | Packagist concrete5/concrete5 |
ConcreteCMS Cross-site Scripting vulnerability CVE-2023-44765, GHSA-6xx7-r8x4-fpjp | Medium | 0.6% | 06 Oct, 2023 | Packagist concrete5/concrete5 |
ConcreteCMS Cross-site Scripting vulnerability CVE-2023-44764, GHSA-j6h5-ggv2-3rfv | Medium | 0.6% | 06 Oct, 2023 | Packagist concrete5/concrete5 |
ConcreteCMS Cross-site Scripting vulnerability CVE-2023-44762, GHSA-6fm3-r6mf-j875 | Medium | 0.6% | 06 Oct, 2023 | Packagist concrete5/concrete5 |
ConcreteCMS Cross-site Scripting vulnerability CVE-2023-44761, GHSA-p4jj-gwpg-9jwh | Medium | 0.6% | 06 Oct, 2023 | Packagist concrete5/concrete5 |
Zope management interface vulnerable to stored cross site scripting via the title property CVE-2023-44389, GHSA-m755-gxxg-r5qh, PYSEC-2023-193 | Medium | 0.5% | 04 Oct, 2023 | PyPI Zope PyPI zope |
TYPO3 extension femanager Broken Access Control vulnerability CVE-2023-45023, GHSA-93j4-v838-8767 | Medium | 0.2% | 04 Oct, 2023 | Packagist in2code/femanager |
gnark unsoundness in variable comparison / non-unique binary decomposition CVE-2023-44378, GHSA-498w-5j49-vqjg, GO-2023-2098 | Medium | 0.2% | 04 Oct, 2023 | Go github.com/consensys/gnark |
Wallabag user can disable 2FA unintentionally GHSA-56fm-hfp3-x3w3 | Medium | Not scored | 02 Oct, 2023 | Packagist wallabag/wallabag |
pretix potential IP address spoofing vulnerability CVE-2023-44463, GHSA-j9gq-w73w-9h6c, PYSEC-2023-187 | Medium | 0.6% | 02 Oct, 2023 | PyPI pretix |
Arm Mali GPU Kernel Driver Use-After-Free Vulnerability CVE-2023-4211 | MediumExploited | 1.0% | 01 Oct, 2023 | |
Dolibarr Cross-site Scripting vulnerability BIT-dolibarr-2023-5323, CVE-2023-5323, GHSA-39m3-cj8c-886r | Medium | 0.4% | 01 Oct, 2023 | Packagist dolibarr/dolibarr |
phpMyFaq Cross-site Scripting vulnerability CVE-2023-5317, GHSA-5jwv-m8h3-69cg | Medium | 0.4% | 30 Sep, 2023 | Packagist thorsten/phpmyfaq |
PostCSS line return parsing error CVE-2023-44270, GHSA-7fh5-64p2-3v2j | Medium | 1.0% | 29 Sep, 2023 | npm postcss |
Mattermost Incorrect Authorization vulnerability CVE-2023-5194, GHSA-h69v-mvh9-hfrq | Medium | 0.4% | 29 Sep, 2023 | Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost Incorrect Authorization vulnerability CVE-2023-5195, GHSA-9hwp-cj7m-wjw4 | Medium | 0.5% | 29 Sep, 2023 | Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost Uncontrolled Resource Consumption vulnerability CVE-2023-5196, GHSA-33r7-wjfc-7w98 | Medium | 0.7% | 29 Sep, 2023 | Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
OpenFGA Vulnerable to DoS from circular relationship definitions CVE-2023-43645, GHSA-2hm9-h873-pgqh, GO-2023-2084 | Medium | 0.9% | 28 Sep, 2023 | Go github.com/openfga/openfga |
PrestaShop allows users to uninstall modules from backoffice, even with low rights CVE-2023-43663, GHSA-6jmf-2pfc-q9m7 | Medium | 0.4% | 28 Sep, 2023 | Packagist prestashop/prestashop |
PrestaShop allows employee without any access rights to list all installed modules CVE-2023-43664, GHSA-gvrg-62jp-rf7j | Medium | 0.5% | 28 Sep, 2023 | Packagist prestashop/prestashop |
Subrion CMS Cross-site Scripting vulnerability CVE-2023-43884, GHSA-7vff-rv2f-cj79 | Medium | 0.5% | 28 Sep, 2023 | Packagist intelliants/subrion |
Withdrawn Advisory: October Cross-site Scripting vulnerability CVE-2023-43876, GHSA-2g8p-j2r6-vqpj | Medium | 0.5% | 28 Sep, 2023 | Packagist october/cms |
quill-mention Cross-site Scripting vulnerability CVE-2023-26149, GHSA-jgw5-rp4p-qhp6 | Medium | 0.7% | 28 Sep, 2023 | npm quill-mention |
Economizzer vulnerable to Clickjacking CVE-2023-38873, GHSA-gc95-5mmp-mp6j | Medium | 0.8% | 28 Sep, 2023 | Packagist gugoan/economizzer |
Economizzer user enumeration vulnerability CVE-2023-38871, GHSA-h3qf-v68r-35jg | Medium | 0.8% | 28 Sep, 2023 | Packagist gugoan/economizzer |
Microweber Cross-site Scripting vulnerability CVE-2023-5244, GHSA-rgf9-j7gv-rq22 | Medium | 1.1% | 28 Sep, 2023 | Packagist microweber/microweber |
Path traversal allows leaking out-of-bound Helm charts from Argo CD repo-server CVE-2023-40026, GHSA-6jqw-jwf5-rp8h, GO-2023-2085 | Medium | 0.6% | 27 Sep, 2023 | Go github.com/argoproj/argo-cd Go github.com/argoproj/argo-cd/v2 |
Cisco IOS and IOS XE Group Encrypted Transport VPN Out-of-Bounds Write Vulnerability CVE-2023-20109 | MediumExploited | 2.5% | 27 Sep, 2023 | |
Pimcore Demo Allows GraphQL Introspection CVE-2023-5192, GHSA-p76j-h4m8-hx5c | Medium | 1.0% | 27 Sep, 2023 | Packagist pimcore/demo |
Subrion CMS XSS in /panel/configuration/financial/ CVE-2023-43830, GHSA-q832-2275-rfqh | Medium | 0.6% | 27 Sep, 2023 | Packagist intelliants/subrion |
Subrion CMS Cross-site Scripting vulnerability in /panel/languages CVE-2023-43828, GHSA-4w2j-wj9q-6wpx | Medium | 0.6% | 27 Sep, 2023 | Packagist intelliants/subrion |
Juniper Junos OS SRX Series Missing Authentication for Critical Function Vulnerability CVE-2023-36851 | MediumExploited | 1.1% | 27 Sep, 2023 |