Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Margox Braft-Editor Cross-site Scripting Vulnerability CVE-2021-27524, GHSA-jfrf-vv54-j2jg | Medium | 0.6% | 11 Aug, 2023 | npm braft-editor |
ThinkCMF Cross-site Scripting Vulnerability CVE-2020-25915, GHSA-4847-gqxx-v9xp | Medium | 0.4% | 11 Aug, 2023 | Packagist thinkcmf/thinkcmf |
Gila CMS Cross-site Scripting Vulnerability CVE-2020-20523, GHSA-rvjp-j5j4-c9j5 | Medium | 0.7% | 11 Aug, 2023 | Packagist gilacms/gila |
Mattermost fails to check if user is a guest before performing actions on public playbooks CVE-2023-4106, GHSA-p267-jjfq-pphf | Medium | 0.4% | 11 Aug, 2023 | Go github.com/mattermost/mattermost-server/v6 |
Mattermost does not validate requesting user permissions before updating admin details CVE-2023-4107, GHSA-6xjj-v76v-fwpj | Medium | 0.5% | 11 Aug, 2023 | Go github.com/mattermost/mattermost-server/v6 |
Mattermost fails to sanitize post metadata CVE-2023-4108, GHSA-9rww-66w7-7vjx | Medium | 0.6% | 11 Aug, 2023 | Go github.com/mattermost/mattermost-server/v6 |
OpenZeppelin Contracts vulnerable to Improper Escaping of Output CVE-2023-40014, GHSA-g4vp-m682-qqmp | Medium | 0.7% | 10 Aug, 2023 | npm @openzeppelin/contracts npm @openzeppelin/contracts-upgradeable |
1Panel Arbitrary File Download vulnerability CVE-2023-39965, GHSA-85cf-gj29-f555, GO-2023-2005 | Medium | 0.4% | 10 Aug, 2023 | Go github.com/1Panel-dev/1Panel |
The WireGuard client 0.5.3 on Windows insecurely configures the operating system and firewall such that traffic to a local network that uses non-RFC1918 IP addresses is blocked. This allows an adversary to trick the victim into blocking IP traffic to selected IP addresses and services even while the CVE-2023-35838, PYSEC-2023-321 | Medium | 0.7% | 09 Aug, 2023 | PyPI wireguard |
Blst has logical error in SigValidate in Go bindings GHSA-8c37-7qx3-4c4p, GO-2023-2003 | Medium | Not scored | 09 Aug, 2023 | Go github.com/supranational/blst |
Sentry vulnerable to incorrect credential validation on OAuth token requests CVE-2023-39531, GHSA-hgj4-h2x3-rfx4, PYSEC-2026-1915 | Medium | 0.4% | 09 Aug, 2023 | PyPI sentry |
Magento Open Source allows Incorrect Authorization CVE-2023-38209, GHSA-3vg2-v639-6ch9 | Medium | 1.0% | 09 Aug, 2023 | Packagist magento/community-edition Packagist magento/project-community-edition |
Several quadratic complexity bugs may lead to denial of service in Commonmarker GHSA-7vh7-fw88-wj87 | Medium | Not scored | 08 Aug, 2023 | RubyGems commonmarker |
wger Workout Manager Cross-site Scripting vulnerability CVE-2023-38758, GHSA-8m9p-3926-gffr, PYSEC-2023-143 | Medium | 0.6% | 08 Aug, 2023 | PyPI wger |
Gitea erroneous repo clones BIT-gitea-2022-38795, CVE-2022-38795, GHSA-8j3v-68w3-3848, GO-2023-1999 | Medium | 0.6% | 07 Aug, 2023 | Go code.gitea.io/gitea |
Admidio Insufficient Session Expiration vulnerability CVE-2023-4190, GHSA-qq8m-9rpx-w2fm | Medium | 0.6% | 06 Aug, 2023 | Packagist admidio/admidio |
omeka/omeka-s Improper Input Validation vulnerability CVE-2023-4157, GHSA-fxc5-pr68-2px3 | Medium | 0.5% | 04 Aug, 2023 | Packagist omeka/omeka-s |
matrix-appservice-bridge doesn't verify the sub parameter of an openId token exhange, allowing unauthorized access to provisioning APIs CVE-2023-38691, GHSA-vc7j-h8xg-fv5x | Medium | 0.5% | 04 Aug, 2023 | npm matrix-appservice-bridge |
Sulu Observable Response Discrepancy on Admin Login CVE-2023-39343, GHSA-wmwf-49vv-p3mr | Medium | 0.6% | 03 Aug, 2023 | Packagist sulu/sulu |
protocol-http1 HTTP Request/Response Smuggling vulnerability CVE-2023-38697, GHSA-6jwc-qr2q-7xwj | Medium | 0.8% | 03 Aug, 2023 | RubyGems protocol-http1 |
pimcore/customer-management-framework-bundle Cross-site Scripting vulnerability in Segment name CVE-2023-4145, GHSA-735f-w79p-282x | Medium | 0.6% | 03 Aug, 2023 | Packagist pimcore/customer-management-framework-bundle |
RDiffWeb vulnerable to Allocation of Resources Without Limits or Throttling CVE-2023-4138, GHSA-wwrg-2w5j-grvx, PYSEC-2026-1863 | Medium | 0.4% | 03 Aug, 2023 | PyPI rdiffweb |
Cloudflare Wrangler directory traversal vulnerability CVE-2023-3348, GHSA-8c93-4hch-xgxp | Medium | 0.8% | 03 Aug, 2023 | npm wrangler |
Answer has Race Condition within a Thread CVE-2023-4127, GHSA-52h8-c876-989c, GO-2023-1995 | Medium | 0.5% | 03 Aug, 2023 | Go github.com/answerdev/answer |
Answer Insufficient Session Expiration vulnerability CVE-2023-4126, GHSA-ggcf-hwxp-rc77, GO-2023-1996 | Medium | 0.6% | 03 Aug, 2023 | Go github.com/answerdev/answer |
Improper rendering of text nodes in golang.org/x/net/html CVE-2023-3978, GHSA-2wrh-6pvc-2jm9, GO-2023-1988 | Medium | 0.9% | 02 Aug, 2023 | Go golang.org/x/net |
Golang TIFF decoder vulnerable to excessive CPU consumption CVE-2023-29407, GHSA-j3p8-6mrq-6g7h, GO-2023-1990 | Medium | 0.9% | 02 Aug, 2023 | Go golang.org/x/image |
Golang TIFF decoder does not place a limit on the size of compressed tile data CVE-2023-29408, GHSA-x92r-3vfx-4cv3, GO-2023-1989 | Medium | 0.9% | 02 Aug, 2023 | Go golang.org/x/image |
.eth registrar controller can shorten the duration of registered names CVE-2023-38698, GHSA-rrxv-q8m4-wch3 | Medium | 0.8% | 01 Aug, 2023 | npm @ensdomains/ens-contracts |
@simonsmith/cypress-image-snapshothas fix for insecure snapshot file names CVE-2023-38695, GHSA-vxjg-hchx-cc4g | Medium | 1.0% | 01 Aug, 2023 | npm @simonsmith/cypress-image-snapshot |
HashiCorp Vault and Vault Enterprise vulnerable to user enumeration BIT-vault-2023-3462, CVE-2023-3462, GHSA-9v3w-w2jh-4hff, GO-2023-1986 | Medium | 0.6% | 01 Aug, 2023 | Go github.com/hashicorp/vault |
Silverstripe has Cross-site Scripting (XSS) vulnerabilities inherited from TinyMCE GHSA-4q66-g4mm-8rg5 | Medium | Not scored | 31 Jul, 2023 | Packagist silverstripe/admin |
Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability CVE-2023-37580 | MediumExploited | 49.1% | 31 Jul, 2023 | |
Cross-site scripting (XSS) from MIME type auto-detection of uploaded files CVE-2023-38491, GHSA-8fv7-wq38-f5c9 | Medium | 0.6% | 27 Jul, 2023 | Packagist getkirby/cms |
Apple Multiple Products Kernel Unspecified Vulnerability CVE-2023-38606 | MediumExploited | 2.9% | 27 Jul, 2023 | |
Stored Cross-Site Scripting October CMS CVE-2023-37692, GHSA-r47v-rxcg-p28j | Medium | 0.5% | 26 Jul, 2023 | Packagist october/october |
Incorrect Permission Checking for GraphQL Subscriptions CVE-2023-38503, GHSA-gggm-66rh-pp98 | Medium | 0.5% | 25 Jul, 2023 | npm directus |
Cross-Site Scripting in CKEditor4 WordCount Plugin GHSA-m8fw-p3cr-6jqc | Medium | Not scored | 25 Jul, 2023 | Packagist typo3/cms-rte-ckeditor |
By-passing Cross-Site Scripting Protection in HTML Sanitizer CVE-2023-38500, GHSA-59jf-3q9v-rh6g | Medium | 0.5% | 25 Jul, 2023 | Packagist typo3/html-sanitizer |
Information Disclosure due to Out-of-scope Site Resolution BIT-typo3-2023-38499, CVE-2023-38499, GHSA-jq6g-4v5m-wm9r | Medium | 1.1% | 25 Jul, 2023 | Packagist typo3/cms-core |
copyparty vulnerable to reflected cross-site scripting via k304 parameter CVE-2023-38501, GHSA-f54q-j679-p9hh, PYSEC-2023-132 | Medium | 9.2% | 25 Jul, 2023 | PyPI copyparty |
ecrecover can return undefined data if signature does not verify CVE-2023-37902, GHSA-f5x6-7qgp-jhf3, PYSEC-2023-133 | Medium | 0.6% | 25 Jul, 2023 | PyPI vyper |
Cross site scripting via input unit widget CVE-2023-36806, GHSA-4gpr-p634-922x | Medium | 0.6% | 25 Jul, 2023 | Packagist contao/core-bundle |
Ineffective privileges drop when requesting container network CVE-2023-38496, GHSA-mmx5-32m4-wxvx, GO-2023-1965 | Medium | 0.3% | 25 Jul, 2023 | Go github.com/apptainer/apptainer |
Denial of service in neutron CVE-2023-3637, GHSA-r3jh-qhgj-gvr8, PYSEC-2026-1694 | Medium | 1.3% | 25 Jul, 2023 | PyPI neutron |
Unintentional leakage of private information via cross-origin websocket session hijacking CVE-2023-2850, GHSA-4qcv-qf38-5j3j | Medium | 0.3% | 25 Jul, 2023 | npm nodebb |
copyparty vulnerable to reflected cross-site scripting via hc parameter GHSA-cw7j-v52w-fp5r | Medium | Not scored | 21 Jul, 2023 | PyPI copyparty |
KubePi may leak password hash of any user CVE-2023-37916, GHSA-87f6-8gr7-pc6h, GO-2023-1957 | Medium | 0.8% | 21 Jul, 2023 | Go github.com/KubeOperator/kubepi |
Dapr API token authentication bypass in HTTP endpoints CVE-2023-37918, GHSA-59m6-82qm-vqgj, GO-2023-1955 | Medium | 1.4% | 21 Jul, 2023 | Go github.com/dapr/dapr |
Indico vulnerable to Cross-Site-Scripting via confirmation prompts CVE-2023-37901, GHSA-fmqq-25x9-c6hm, PYSEC-2023-129 | Medium | 0.5% | 21 Jul, 2023 | PyPI indico |