Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Cilium vulnerable to bypass of namespace restrictions in CiliumNetworkPolicy BIT-cilium-2023-41333, BIT-cilium-operator-2023-41333, BIT-cilium-proxy-2023-41333, BIT-hubble-2023-41333, BIT-hubble-relay-2023-41333, BIT-hubble-ui-2023-41333, BIT-hubble-ui-backend-2023-41333, CVE-2023-41333, GHSA-4xp2-w642-7mcx, GO-2023-2080 | Medium | 0.5% | 27 Sep, 2023 | Go github.com/cilium/cilium |
matrix-synapse vulnerable to improper validation of receipts allows forged read receipts CVE-2023-42453, GHSA-7565-cq32-vx2x, PYSEC-2023-180 | Medium | 0.8% | 26 Sep, 2023 | PyPI matrix-synapse |
Kubernetes users may update Pod labels to bypass network policy BIT-cilium-2023-39347, BIT-cilium-operator-2023-39347, BIT-cilium-proxy-2023-39347, BIT-hubble-2023-39347, BIT-hubble-relay-2023-39347, BIT-hubble-ui-2023-39347, BIT-hubble-ui-backend-2023-39347, CVE-2023-39347, GHSA-gj2r-phwg-6rww, GO-2023-2078 | Medium | 0.6% | 26 Sep, 2023 | Go github.com/cilium/cilium |
pimcore/admin-ui-classic-bundle Cross-site Scripting vulnerability in Translations CVE-2023-42817, GHSA-m988-7375-7g2c | Medium | 0.4% | 25 Sep, 2023 | Packagist pimcore/admin-ui-classic-bundle |
OpenStack Barbican information disclosure vulnerability CVE-2023-1636, GHSA-6rx9-c2rh-3qv4, PYSEC-2026-1214 | Medium | 0.5% | 24 Sep, 2023 | PyPI barbican |
OpenStack Barbican credential leak flaw CVE-2023-1633, GHSA-6qqp-4vm3-359v, PYSEC-2026-1213 | Medium | 0.2% | 24 Sep, 2023 | PyPI barbican |
Kiali content spoofing vulnerability CVE-2022-3962, GHSA-6f4m-j56w-55c3, GO-2023-2075 | Medium | 0.7% | 23 Sep, 2023 | Go github.com/kiali/kiali |
Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability CVE-2023-43770 | MediumExploited | 63.7% | 22 Sep, 2023 | |
Apple Multiple Products Improper Certificate Validation Vulnerability CVE-2023-41991 | MediumExploited | 13.4% | 21 Sep, 2023 | |
Zope vulnerable to Stored Cross Site Scripting with SVG images CVE-2023-42458, GHSA-wm8q-9975-xh5v, PYSEC-2026-2077 | Medium | 0.7% | 21 Sep, 2023 | PyPI Zope PyPI zope |
plone.namedfile vulnerable to Stored Cross Site Scripting with SVG images CVE-2023-41048, GHSA-jj7c-jrv4-c65x, PYSEC-2023-311 | Medium | 0.6% | 21 Sep, 2023 | PyPI plone-namedfile PyPI plone.namedfile |
Improper Input Validation in nocodb CVE-2023-5104, GHSA-xrpm-hccg-28x7 | Medium | 0.8% | 21 Sep, 2023 | npm nocodb |
Contao Cross-site Scripting vulnerabililty CVE-2018-5478, GHSA-mpg7-2rx9-h5qp | Medium | 0.4% | 21 Sep, 2023 | Packagist contao/core |
Sender can cause a receiver to overwrite files during ZIP extraction in Croc CVE-2023-43616, GHSA-8c8w-f7wp-2jr2, GO-2023-2071 | Medium | 0.4% | 20 Sep, 2023 | Go github.com/schollz/croc Go github.com/schollz/croc/v6 Go github.com/schollz/croc/v8 Go github.com/schollz/croc/v9 |
Cros secrets may be disclosed to untrusted relay CVE-2023-43617, GHSA-hp56-xvf4-g6wr, GO-2023-2072 | Medium | 0.8% | 20 Sep, 2023 | Go github.com/schollz/croc Go github.com/schollz/croc/v6 Go github.com/schollz/croc/v8 Go github.com/schollz/croc/v9 |
Croc requires senders to provide local IP addresses in cleartext CVE-2023-43618, GHSA-7mp6-929p-pqhj, GO-2023-2070 | Medium | 0.5% | 20 Sep, 2023 | Go github.com/schollz/croc Go github.com/schollz/croc/v6 Go github.com/schollz/croc/v8 Go github.com/schollz/croc/v9 |
Croc may expose secret to local users CVE-2023-43621, GHSA-7g3v-4ggr-xvjf, GO-2023-2069 | Medium | 0.3% | 20 Sep, 2023 | Go github.com/schollz/croc Go github.com/schollz/croc/v6 Go github.com/schollz/croc/v8 Go github.com/schollz/croc/v9 |
graphql Uncontrolled Resource Consumption vulnerability CVE-2023-26144, GHSA-9pv7-vfvm-6vr7 | Medium | 1.5% | 20 Sep, 2023 | npm graphql |
Jodit Editor vulnerable to cross-site scripting CVE-2023-42399, GHSA-95xr-cq6h-vwr3 | Medium | 0.5% | 19 Sep, 2023 | npm jodit |
Neos CMS Cross Site Scripting vulnerability BIT-neos-2023-37611, CVE-2023-37611, GHSA-6qjf-7g3j-qx25 | Medium | 0.7% | 18 Sep, 2023 | Packagist neos/media-browser |
Vyper has incorrect re-entrancy lock when key is empty string CVE-2023-42441, GHSA-3hg2-r75x-g69m, PYSEC-2023-305 | Medium | 0.5% | 18 Sep, 2023 | PyPI vyper |
Gradio arbitrary file upload vulnerability CVE-2023-41626, GHSA-v4q9-qgqf-7jwp, PYSEC-2026-1422 | Medium | 0.4% | 15 Sep, 2023 | PyPI gradio |
LibreNMS Cross-site Scripting vulnerability CVE-2023-4982, GHSA-m6jj-fgmh-3p8r | Medium | 0.7% | 15 Sep, 2023 | Packagist librenms/librenms |
LibreNMS Cross-site Scripting vulnerability CVE-2023-4981, GHSA-5jjm-qp48-qp86 | Medium | 0.7% | 15 Sep, 2023 | Packagist librenms/librenms |
LibreNMS Cross-site Scripting vulnerability CVE-2023-4980, GHSA-qxrq-376q-p39h | Medium | 0.7% | 15 Sep, 2023 | Packagist librenms/librenms |
LibreNMS Cross-site Scripting vulnerability CVE-2023-4979, GHSA-jp3c-g46v-jg2c | Medium | 0.7% | 15 Sep, 2023 | Packagist librenms/librenms |
LibreNMS Cross-site Scripting vulnerability CVE-2023-4978, GHSA-qjpw-rg56-jh8v | Medium | 0.7% | 15 Sep, 2023 | Packagist librenms/librenms |
LibreNMS Code Injection vulnerability CVE-2023-4977, GHSA-57m2-mpc7-gwgx | Medium | 0.5% | 15 Sep, 2023 | Packagist librenms/librenms |
HashiCorp Vault Improper Input Validation vulnerability BIT-vault-2023-4680, CVE-2023-4680, GHSA-v84f-6r39-cpfc, GO-2023-2063 | Medium | 0.4% | 15 Sep, 2023 | Go github.com/hashicorp/vault |
Froala Editor Cross-site Scripting vulnerability CVE-2023-41592, GHSA-hvpq-7vcc-5hj5 | Medium | 1.0% | 14 Sep, 2023 | Packagist froala/wysiwyg-editor npm froala-editor |
sidekiq Denial of Service vulnerability CVE-2023-26141, GHSA-3qc2-v3hp-6cv8 | Medium | 0.9% | 14 Sep, 2023 | RubyGems sidekiq |
Strapi's field level permissions not being respected in relationship title CVE-2023-37263, GHSA-m284-85mf-cgrc | Medium | 0.6% | 13 Sep, 2023 | npm @strapi/plugin-content-manager |
Strapi may leak sensitive user information, user reset password, tokens via content-manager views CVE-2023-36472, GHSA-v8gg-4mq2-88q4 | Medium | 0.7% | 13 Sep, 2023 | npm @strapi/admin npm @strapi/plugin-content-manager npm @strapi/utils |
Microsoft Word Information Disclosure Vulnerability CVE-2023-36761 | MediumExploited | 19.6% | 12 Sep, 2023 | |
Cecil Cross-site Scripting vulnerability CVE-2023-4913, GHSA-p9q8-7x22-5x77 | Medium | 0.6% | 12 Sep, 2023 | Packagist cecil/cecil |
Piccolo's current `BaseUser.login` implementation is vulnerable to time based user enumeration CVE-2023-41885, GHSA-h7cm-mrvq-wcfr, PYSEC-2023-173 | Medium | 0.6% | 12 Sep, 2023 | PyPI piccolo |
Apache Airflow Incorrect Authorization vulnerability BIT-airflow-2023-40611, CVE-2023-40611, GHSA-wpg8-mf6h-gm92, PYSEC-2023-170 | Medium | 1.7% | 12 Sep, 2023 | PyPI apache-airflow |
The Create Single Payment application of SAP S/4HANA - versions 100, 101, 102, 103, 104, 105, 106, 107, 108, allows an attacker to upload the XML file as an attachment. When clicked on the XML file in the attachment section, the file gets opened in the browser to cause the entity loops to slow down CVE-2023-41369, PYSEC-2023-172 | Medium | 0.5% | 12 Sep, 2023 | PyPI hana-ml |
Prevent injection of invalid entity ids for "autocomplete" fields CVE-2023-41336, GHSA-4cpv-669c-r79x | Medium | 0.6% | 11 Sep, 2023 | Packagist symfony/ux-autocomplete |
Argo CD repo-server Denial of Service vulnerability BIT-argo-cd-2023-40584, CVE-2023-40584, GHSA-g687-f2gx-6wm8, GO-2023-2050 | Medium | 1.4% | 11 Sep, 2023 | Go github.com/argoproj/argo-cd Go github.com/argoproj/argo-cd/v2 |
Cockpit CMS arbitrary file upload vulnerability CVE-2023-41564, GHSA-38vf-35cg-m73w | Medium | 1.0% | 08 Sep, 2023 | Packagist cockpit-hq/cockpit |
Terraform allows arbitrary file write during the `init` operation CVE-2023-4782, GHSA-h626-pv66-hhm7, GO-2023-2055 | Medium | 0.3% | 08 Sep, 2023 | Go github.com/hashicorp/terraform |
Fiber unauthorized access vulnerability in `ctx.IsFromLocal()` CVE-2023-41338, GHSA-3q5p-3558-364f, GO-2023-2052 | Medium | 0.7% | 08 Sep, 2023 | Go github.com/gofiber/fiber Go github.com/gofiber/fiber/v2 |
matrix-media-repo: Unsafe media served inline on download endpoints CVE-2023-41318, GHSA-5crw-6j7v-xc72, GO-2023-2053 | Medium | 0.5% | 08 Sep, 2023 | Go github.com/turt2live/matrix-media-repo |
Buttercup allows attackers to obtain the hash of the master password CVE-2023-41646, GHSA-7cwq-p8cr-h9qg | Medium | 0.5% | 07 Sep, 2023 | npm buttercup |
SecureJoin: on windows, paths outside of the rootfs could be inadvertently produced GHSA-6xv5-86q9-7xr8, GO-2023-2048 | Medium | Not scored | 07 Sep, 2023 | Go github.com/cyphar/filepath-securejoin |
Domain restrictions bypass via DNS Rebinding in WireMock and WireMock Studio webhooks, proxy and recorder modes BIT-wiremock-2023-41329, CVE-2023-41329, GHSA-pmxq-pj47-j8j4, PYSEC-2026-2050 | Medium | 0.6% | 06 Sep, 2023 | Maven com.github.tomakehurst:wiremock-jre8 Maven com.github.tomakehurst:wiremock-jre8-standalone Maven org.wiremock:wiremock Maven org.wiremock:wiremock-standalone +1 more |
Cosmos-SDK Cosmovisor component may be vulnerable to denial of service GHSA-23px-mw2p-46qm | Medium | Not scored | 06 Sep, 2023 | Go github.com/cosmos/cosmos-sdk |
Electron vulnerable to out-of-package code execution when launched with arbitrary cwd CVE-2023-39956, GHSA-7x97-j373-85x5 | Medium | 0.5% | 06 Sep, 2023 | npm electron |
Apache Superset Improper Input Validation vulnerability BIT-superset-2023-39265, CVE-2023-39265, GHSA-fm4q-j8g4-c9j4, PYSEC-2026-1177 | Medium | 86.0% | 06 Sep, 2023 | PyPI apache-superset |