Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Pimcore Cross-site Scripting vulnerability CVE-2023-3822, GHSA-vmpv-qjhq-r463 | Medium | 0.5% | 21 Jul, 2023 | Packagist pimcore/pimcore |
Pimcore Cross-site Scripting vulnerability CVE-2023-3821, GHSA-78q2-cv3p-x9fm | Medium | 0.6% | 21 Jul, 2023 | Packagist pimcore/pimcore |
Nomad Search API Leaks Information About CSI Plugins CVE-2023-3300, GHSA-v5fm-hr72-27hx, GO-2024-2671 | Medium | 0.6% | 20 Jul, 2023 | Go github.com/hashicorp/nomad |
Nomad ACL Policies without Label are Applied to Unexpected Resources CVE-2023-3072, GHSA-rpvr-38xv-xvxq, GO-2024-2670 | Medium | 0.4% | 20 Jul, 2023 | Go github.com/hashicorp/nomad |
keylime fails to flag device as untrusted when signature does not validate CVE-2023-3674, GHSA-g4wg-cfpf-9689, PYSEC-2023-128 | Medium | 0.2% | 19 Jul, 2023 | PyPI keylime |
Pygments vulnerable to ReDoS CVE-2022-40896, GHSA-mrwq-x4v8-fh7p, PYSEC-2023-117 | Medium | 0.5% | 19 Jul, 2023 | PyPI Pygments PyPI pygments |
Fides Webserver Vulnerable to SVG Bomb File Uploads CVE-2023-37481, GHSA-3rw2-wfc8-wmj5, PYSEC-2026-1332 | Medium | 0.7% | 18 Jul, 2023 | PyPI ethyca-fides |
Fides Webserver Vulnerable to Zip Bomb File Uploads CVE-2023-37480, GHSA-g95c-2jgm-hqc6, PYSEC-2026-1342 | Medium | 0.7% | 18 Jul, 2023 | PyPI ethyca-fides |
matrix-react-sdk vulnerable to XSS in Export Chat feature CVE-2023-37259, GHSA-c9vx-2g7w-rp65 | Medium | 0.5% | 18 Jul, 2023 | npm matrix-react-sdk |
Easy!Appointments Improper Access Control vulnerability CVE-2023-3700, GHSA-8c6q-26w6-qwhg | Medium | 0.4% | 17 Jul, 2023 | Packagist alextselegidis/easyappointments |
layui vulnerable to cross-site scripting CVE-2023-3691, GHSA-hx4h-676r-j3qp | Medium | 0.5% | 16 Jul, 2023 | npm layui |
Tokenizer vulnerable to client brute-force of token secrets GHSA-f28g-86hc-823q, GO-2023-1914 | Medium | Not scored | 13 Jul, 2023 | Go github.com/superfly/tokenizer |
ImpressCMS Cross-site Scripting vulnerability CVE-2023-37785, GHSA-667r-p4gg-7m2q | Medium | 0.5% | 13 Jul, 2023 | Packagist impresscms/impresscms |
Decidim Cross-site Scripting vulnerability in the external link redirections CVE-2023-32693, GHSA-469h-mqg8-535r | Medium | 0.8% | 11 Jul, 2023 | RubyGems decidim RubyGems decidim-core |
A stored XSS in jaeger UI might allow an attacker who controls a trace to perform arbitrary jaeger queries GHSA-2w8w-qhg4-f78j | Medium | Not scored | 11 Jul, 2023 | Go github.com/jaegertracing/jaeger |
Pimcore admin UI vulnerable to Cross-site Scripting in 2 factor authentication setup page CVE-2023-37280, GHSA-hqv9-6jqw-9g8m | Medium | 0.6% | 11 Jul, 2023 | Packagist pimcore/admin-ui-classic-bundle |
iprange may panic when parsing ranges with invalid masks GHSA-f99h-w337-mv56, GO-2023-1857 | Medium | Not scored | 11 Jul, 2023 | Go github.com/malfunkt/iprange |
tarteaucitron.js vulnerable to Cross-site Scripting CVE-2023-3620, GHSA-f44m-65h3-99vc | Medium | 0.5% | 11 Jul, 2023 | npm tarteaucitronjs |
Whatsapp-Chat-Exporter has Cross-Site Scripting vulnerability in HTML output of chats. GHSA-8c6x-g4fw-8rf4 | Medium | Not scored | 10 Jul, 2023 | PyPI Whatsapp-Chat-Exporter PyPI whatsapp-chat-exporter |
ckeditor-wordcount-plugin vulnerable to Cross-site Scripting in Source Mode of Editor CVE-2023-37905, GHSA-q9w4-w667-qqj4 | Medium | 0.6% | 10 Jul, 2023 | npm ckeditor-wordcount-plugin |
Pimcore Customer Management Framework vulnerable to Improper Authorization in Rules Controller CVE-2023-3574, GHSA-vx35-f379-4q49 | Medium | 0.5% | 10 Jul, 2023 | Packagist pimcore/customer-management-framework-bundle |
Wallabag vulnerable to Allocation of Resources Without Limits or Throttling CVE-2023-3566, GHSA-6qq7-3hqc-p5w4 | Medium | 1.4% | 10 Jul, 2023 | Packagist wallabag/wallabag |
TeamPass Cross-site Scripting vulnerability CVE-2023-3565, GHSA-524r-w8fx-hqg3 | Medium | 0.6% | 10 Jul, 2023 | Packagist nilsteampassnet/teampass |
Winter CMS stored XSS through privileged upload of SVG file CVE-2023-37269, GHSA-wjw2-4j7j-6gc3 | Medium | 2.7% | 07 Jul, 2023 | Packagist wintercms/winter |
Sentry CORS misconfiguration CVE-2023-36829, GHSA-4xqm-4p72-87h6, PYSEC-2023-115 | Medium | 0.7% | 06 Jul, 2023 | PyPI sentry |
Hashicorp Nomad ACLs Cannot Deny Access to Workload’s Own Variables CVE-2023-1296, GHSA-hhvx-8755-4cvw, GO-2023-1899 | Medium | 0.5% | 06 Jul, 2023 | Go github.com/hashicorp/nomad |
HashiCorp Vault's revocation list not respected BIT-vault-2022-41316, CVE-2022-41316, GHSA-9mh8-9j64-443f, GO-2023-1897 | Medium | 0.5% | 06 Jul, 2023 | Go github.com/hashicorp/vault |
Zinc Cross-site Scripting vulnerability CVE-2022-32171, GHSA-4fgv-8448-gf82, GO-2023-1895 | Medium | 0.7% | 06 Jul, 2023 | Go github.com/zinclabs/zinc Go github.com/zincsearch/zincsearch |
Zinc Cross-site Scripting vulnerability CVE-2022-32172, GHSA-7j6x-42mm-p7jm, GO-2023-1896 | Medium | 0.7% | 06 Jul, 2023 | Go github.com/zinclabs/zinc Go github.com/zincsearch/zincsearch |
@vendure/admin-ui-plugin authenticated Cross-site Scripting vulnerability GHSA-gm68-572p-q28r | Medium | Not scored | 06 Jul, 2023 | npm @vendure/admin-ui-plugin |
Connect-CMS Privilege Escalation Vulnerability GHSA-qxh3-jgvh-x55j | Medium | Not scored | 05 Jul, 2023 | Packagist opensource-workshop/connect-cms |
Statamic's Antlers sanitizer cannot effectively sanitize malicious SVG CVE-2023-36828, GHSA-6r5g-cq4q-327g | Medium | 0.7% | 05 Jul, 2023 | Packagist statamic/cms |
1Panel vulnerable to command injection when entering the container terminal CVE-2023-36458, GHSA-7x2c-fgx6-xf9h, GO-2023-1888 | Medium | 2.3% | 05 Jul, 2023 | Go github.com/1Panel-dev/1Panel |
1Panel vulnerable to command injection when adding container repositories CVE-2023-36457, GHSA-q2mx-gpjf-3h8x, GO-2023-1887 | Medium | 2.3% | 05 Jul, 2023 | Go github.com/1Panel-dev/1Panel |
CometBFT PeerState JSON serialization deadlock CVE-2023-34450, GHSA-mvj3-qrqh-cjvr, GO-2023-1882 | Medium | 0.9% | 05 Jul, 2023 | Go github.com/cometbft/cometbft |
Withdrawn: scipy memory leak vulnerability CVE-2023-25399, GHSA-9jx5-6pgf-crrp, PYSEC-2023-102 | Medium | 0.4% | 05 Jul, 2023 | PyPI scipy |
kube-apiserver vulnerable to policy bypass CVE-2023-2727, GHSA-qc2g-gmh6-95p4, GO-2023-1891 | Medium | 1.1% | 03 Jul, 2023 | Go k8s.io/kubernetes |
Kubernetes mountable secrets policy bypass CVE-2023-2728, GHSA-cgcv-5272-97pr, GO-2023-1892 | Medium | 2.2% | 03 Jul, 2023 | Go k8s.io/kubernetes |
WPGraphQL Plugin vulnerable to Server Side Request Forgery (SSRF) CVE-2023-23684, GHSA-cfh4-7wq9-6pgg | Medium | 0.4% | 30 Jun, 2023 | Packagist wp-graphql/wp-graphql |
hnswlib Double Free vulnerability CVE-2023-37365, GHSA-xwc8-rf6m-xr86, PYSEC-2026-1450 | Medium | 0.6% | 30 Jun, 2023 | PyPI hnswlib |
PyPDF2 quadratic runtime with malformed PDF missing xref marker CVE-2023-36810, GHSA-jrm6-h9cq-8gqw, PYSEC-2026-1837 | Medium | 0.6% | 30 Jun, 2023 | PyPI PyPDF2 PyPI pypdf2 |
PyPDF2 vulnerable to possible Infinite Loop when reading malformed objects CVE-2023-36807, GHSA-hm9v-vj3r-r55m, PYSEC-2026-1836 | Medium | 0.6% | 30 Jun, 2023 | PyPI PyPDF2 PyPI pypdf2 |
pacparser_find_proxy in Pacparser before 1.4.2 allows JavaScript injection, and possibly privilege escalation, when the attacker controls the URL (which may be realistic within enterprise security products). CVE-2023-37360, GHSA-62q6-v997-f7v9, PYSEC-2023-93 | Medium | 0.4% | 30 Jun, 2023 | PyPI pacparser |
MediaWiki Cross-site Scripting vulnerability BIT-mediawiki-2023-37302, CVE-2023-37302, GHSA-fmrf-p77g-vv5c | Medium | 0.7% | 30 Jun, 2023 | Packagist wikibase/wikibase |
angular-ui-notification Cross-site Scripting vulnerability CVE-2023-34840, GHSA-mrcj-5qxr-vhp2 | Medium | 0.6% | 30 Jun, 2023 | npm angular-ui-notification |
Joplin Cross-site Scripting vulnerability CVE-2023-37299, GHSA-4jjv-p8x9-rrf7 | Medium | 0.6% | 30 Jun, 2023 | npm joplin |
Joplin Cross-site Scripting vulnerability CVE-2023-37298, GHSA-7grw-xfx6-qhx6 | Medium | 0.6% | 30 Jun, 2023 | npm joplin |
phpMyFAQ Cross-site Scripting CVE-2023-3469, GHSA-v6g2-jwrm-h5r5 | Medium | 0.6% | 30 Jun, 2023 | Packagist thorsten/phpmyfaq |
URI gem has ReDoS vulnerability CVE-2023-36617, GHSA-hww2-5g85-429m | Medium | 1.7% | 29 Jun, 2023 | RubyGems uri |
Actionpack has possible cross-site scripting vulnerability via User Supplied Values to redirect_to CVE-2023-28362, GHSA-4g8v-vg43-wpgf | Medium | 0.3% | 29 Jun, 2023 | RubyGems actionpack |