Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
OpenFGA vulnerable to denial of service due to circular relationship CVE-2023-35933, GHSA-hr9r-8phq-5x8j, GO-2023-1872 | Medium | 1.1% | 28 Jun, 2023 | Go github.com/openfga/openfga |
Android Pixel Information Disclosure Vulnerability CVE-2023-21237 | MediumExploited | 0.3% | 28 Jun, 2023 | |
pypdf and PyPDF2 possible Infinite Loop when a comment isn't followed by a character CVE-2023-36464, GHSA-4vvm-4w3v-6mr8, PYSEC-2026-1835, PYSEC-2026-3008 | Medium | 0.4% | 27 Jun, 2023 | PyPI PyPDF2 PyPI pypdf PyPI pypdf2 |
Shopware improper mail validation vulnerability CVE-2023-34099, GHSA-gh66-fp7j-98v5 | Medium | 0.6% | 27 Jun, 2023 | Packagist shopware/shopware |
Shopware dependency configuration exposed CVE-2023-34098, GHSA-q97c-2mh3-pgw9 | Medium | 0.6% | 27 Jun, 2023 | Packagist shopware/shopware |
Apache Airflow ODBC Provider, Apache Airflow MSSQL Provider Improper Input Validation vulnerability CVE-2023-35798, GHSA-q57w-826p-46jr, PYSEC-2026-1150, PYSEC-2026-2370 | Medium | 1.3% | 27 Jun, 2023 | PyPI apache-airflow-providers-microsoft-mssql PyPI apache-airflow-providers-odbc |
Apple Multiple Products WebKit Out-of-Bounds Read Vulnerability CVE-2023-28204 | MediumExploited | 14.3% | 23 Jun, 2023 | |
Admidio Improper Access Control vulnerability CVE-2023-3304, GHSA-x3m2-3pwj-8fj4 | Medium | 0.4% | 23 Jun, 2023 | Packagist admidio/admidio |
Moodle vulnerable to SQL Injection BIT-moodle-2023-35132, CVE-2023-35132, GHSA-49mv-vfcp-8gg9 | Medium | 0.8% | 22 Jun, 2023 | Packagist moodle/moodle |
Moodle vulnerable to Cross-site Scripting BIT-moodle-2023-35131, CVE-2023-35131, GHSA-fwfj-8p36-rc64 | Medium | 0.7% | 22 Jun, 2023 | Packagist moodle/moodle |
Shescape potential environment variable exposure on Windows with CMD CVE-2023-35931, GHSA-3g7p-8qhx-mc8r | Medium | 0.8% | 22 Jun, 2023 | npm shescape |
Flask-AppBuilder vulnerable to possible disclosure of sensitive information on user error CVE-2023-34110, GHSA-jhpr-j7cq-3jp3, PYSEC-2023-94 | Medium | 0.7% | 22 Jun, 2023 | PyPI Flask-AppBuilder PyPI flask-appbuilder |
Barberry Security Advisory - regarding x/auth periodic vesting accounts GHSA-j2cr-jc39-wpx5, GHSA-w44m-8mv2-v78h, GO-2023-1861 | Medium | Not scored | 22 Jun, 2023 | Go github.com/cosmos/cosmos-sdk |
Casdoor Cross-Site Request Forgery vulnerability CVE-2023-34927, GHSA-rwcp-qrwg-56cg | Medium | 3.1% | 22 Jun, 2023 | Go github.com/casdoor/casdoor |
When setting EntityOptions.apiPrefilter to a function, the filter is not applied to API requests for a resource by Id CVE-2023-35167, GHSA-7hh3-3x64-v2g9 | Medium | 0.5% | 20 Jun, 2023 | npm remult |
Vega's validators able to submit duplicate transactions CVE-2023-35163, GHSA-8rc9-vxjh-qjf2, GO-2023-1865 | Medium | 0.5% | 20 Jun, 2023 | Go code.vegaprotocol.io/vega |
YiiCMS Cross Site Scripting vulnerability CVE-2020-21246, GHSA-gqr4-cvf4-3957 | Medium | 0.6% | 20 Jun, 2023 | Packagist sheng/yiicms |
NodCMS Cross Site Scripting vulnerability CVE-2020-20697, GHSA-7xqx-xwg9-jx34 | Medium | 0.5% | 20 Jun, 2023 | Packagist khodakhah/nodcms |
Craft CMS vulnerable to HTML injection CVE-2023-33495, GHSA-m3v5-gjj9-rg24 | Medium | 0.5% | 20 Jun, 2023 | Packagist craftcms/cms |
OpenZeppelin Contracts using MerkleProof multiproofs may allow proving arbitrary leaves for specific trees CVE-2023-34459, GHSA-wprv-93r4-jj2p | Medium | 0.4% | 16 Jun, 2023 | npm @openzeppelin/contracts npm @openzeppelin/contracts-upgradeable |
ke_search (aka Faceted Search) vulnerable to Cross-Site Scripting CVE-2023-35783, GHSA-f4m6-x2xj-jc7w | Medium | 0.3% | 16 Jun, 2023 | Packagist tpwd/ke_search |
Kubelet vulnerable to bypass of seccomp profile enforcement CVE-2023-2431, GHSA-xc8m-28vv-4pjc, GO-2023-1864 | Medium | 0.3% | 16 Jun, 2023 | Go k8s.io/kubernetes |
Mattermost Server Missing Authorization vulnerability CVE-2023-2783, GHSA-455c-vqrf-mghr | Medium | 0.4% | 16 Jun, 2023 | Go github.com/mattermost/mattermost-server/v6 |
Magento Open Source allows Incorrect Authorization CVE-2023-29296, GHSA-3qr4-w96f-672v | Medium | 0.6% | 15 Jun, 2023 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento Open Source allows Incorrect Authorization CVE-2023-29295, GHSA-354h-fpmq-68v7 | Medium | 0.6% | 15 Jun, 2023 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento Open Source has Business Logic Errors Vulnerability CVE-2023-29294, GHSA-28vp-39rf-3q2j | Medium | 0.7% | 15 Jun, 2023 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento Open Source allows Server-Side Request Forgery (SSRF) CVE-2023-29292, GHSA-4588-7x48-jrgj | Medium | 1.0% | 15 Jun, 2023 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento Open Source allows Server-Side Request Forgery (SSRF) CVE-2023-29291, GHSA-5f79-vhr4-vw2r | Medium | 1.1% | 15 Jun, 2023 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento Open Source allows Incorrect Authorization CVE-2023-29290, GHSA-qw5m-vmp3-f553 | Medium | 0.6% | 15 Jun, 2023 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento Open Source allows XML Injection CVE-2023-29289, GHSA-wh42-8r2w-873x | Medium | 0.9% | 15 Jun, 2023 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento Open Source allows Incorrect Authorization CVE-2023-29288, GHSA-f989-3fp9-q3r2 | Medium | 0.6% | 15 Jun, 2023 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento Open Source allows Information Exposure CVE-2023-29287, GHSA-85m4-g9vq-xpxj | Medium | 0.7% | 15 Jun, 2023 | Packagist magento/community-edition Packagist magento/project-community-edition |
github.com/lestrrat-go/jwx vulnerable to Potential Padding Oracle Attack GHSA-rm8v-mxj3-5rmq, GO-2023-1859 | Medium | Not scored | 14 Jun, 2023 | Go github.com/lestrrat-go/jwx Go github.com/lestrrat-go/jwx/v2 |
@keystone-6/auth Open Redirect vulnerability CVE-2023-34247, GHSA-jqxr-vjvv-899m | Medium | 0.4% | 13 Jun, 2023 | npm @keystone-6/auth |
fast-xml-parser vulnerable to Prototype Pollution through tag or attribute name CVE-2021-26920, CVE-2023-26920, GHSA-793h-6f7r-6qvm, GHSA-x3cc-x39p-42qx | Medium | 9.5% | 13 Jun, 2023 | npm fast-xml-parser |
Grafana has Broken Access Control in Alert manager: Viewer can send test alerts BIT-grafana-2023-2183, CVE-2023-2183, GHSA-cvm3-pp2j-chr3 | Medium | 1.0% | 12 Jun, 2023 | Go github.com/grafana/grafana |
Doorkeeper Improper Authentication vulnerability CVE-2023-34246, GHSA-7w2c-w47h-789w | Medium | 0.7% | 12 Jun, 2023 | RubyGems doorkeeper |
crypto-js uses insecure random numbers CVE-2020-36732, GHSA-3w3w-pxmm-2w2j | Medium | 1.1% | 12 Jun, 2023 | npm crypto-js |
Froxlor Session Fixation vulnerability CVE-2023-3192, GHSA-jr66-9ghf-6gp3 | Medium | 0.4% | 11 Jun, 2023 | Packagist froxlor/froxlor |
Teampass Cross-site Scripting vulnerability CVE-2023-3191, GHSA-qmw8-x364-xxxm | Medium | 0.5% | 10 Jun, 2023 | Packagist nilsteampassnet/teampass |
Teampass Cross-site Scripting vulnerability CVE-2023-3190, GHSA-p7xm-g427-jxfc | Medium | 0.5% | 10 Jun, 2023 | Packagist nilsteampassnet/teampass |
rails-ujs vulnerable to DOM Based Cross-site Scripting contenteditable HTML Elements CVE-2023-23913, GHSA-xp5h-f8jf-rc8q | Medium | 0.6% | 09 Jun, 2023 | RubyGems actionview |
Kredis JSON Possible Deserialization of Untrusted Data Vulnerability CVE-2023-27531, GHSA-h2wm-p2vg-6pw4 | Medium | 0.5% | 09 Jun, 2023 | RubyGems kredis |
Hashicorp Vault vulnerable to Cross-site Scripting BIT-vault-2023-2121, CVE-2023-2121, GHSA-gq98-53rq-qr5h, GO-2023-1849 | Medium | 0.4% | 09 Jun, 2023 | Go github.com/hashicorp/vault |
gRPC connection termination issue CVE-2023-32732, GHSA-9hxf-ppjv-w6rq, PYSEC-2026-1426 | Medium | 0.5% | 09 Jun, 2023 | Maven io.grpc:grpc-protobuf PyPI grpcio RubyGems grpc |
Gatsby develop server has Local File Inclusion vulnerability CVE-2023-34238, GHSA-c6f8-8r25-c4gc | Medium | 0.9% | 08 Jun, 2023 | npm gatsby |
OpenZeppelin Contracts's governor proposal creation may be blocked by frontrunning CVE-2023-34234, GHSA-5h3x-9wvq-w4m2 | Medium | 0.6% | 07 Jun, 2023 | npm @openzeppelin/contracts npm @openzeppelin/contracts-upgradeable |
Microweber Cross-site Scripting vulnerability CVE-2023-3142, GHSA-fqcv-rfp6-wv92 | Medium | 0.3% | 07 Jun, 2023 | Packagist microweber/microweber |
Notation's default `maxSignatureAttempts` in `notation verify` enables an endless data attack CVE-2023-33958, GHSA-rvrx-rrwh-r9p6, GO-2023-1831 | Medium | 0.5% | 06 Jun, 2023 | Go github.com/notaryproject/notation |
Notation vulnerable to denial of service from high number of artifact signatures CVE-2023-33957, GHSA-9m3v-v4r5-ppx7, GO-2023-1829 | Medium | 0.5% | 06 Jun, 2023 | Go github.com/notaryproject/notation |