Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Devise Gem for Ruby Unauthorized Access Using "Remember Me" Cookie CVE-2015-8314, GHSA-746g-3gfp-hfhw | High | 0.6% | 26 Jan, 2023 | RubyGems devise |
Improper Certificate Validation in pyload-ng CVE-2023-0509, GHSA-8v53-23mx-hcf9, PYSEC-2026-903 | High | 0.5% | 26 Jan, 2023 | PyPI pyload-ng |
Path traversal in binwalk CVE-2022-4510, GHSA-3cm8-v4mc-gppg, PYSEC-2026-787 | High | 22.9% | 26 Jan, 2023 | PyPI binwalk |
Command Injection in puppet-facter CVE-2022-25350, GHSA-g5qr-xgg7-8q2w | High | 1.2% | 26 Jan, 2023 | npm puppet-facter |
Command injection in smartctl CVE-2022-21810, GHSA-69f2-4375-qv9h | High | 1.2% | 26 Jan, 2023 | npm smartctl |
Directory Traversal vulnerability in serve-lite CVE-2022-21192, GHSA-5qq4-m6c3-xxmf | High | 1.4% | 26 Jan, 2023 | npm serve-lite |
Directory Traversal in onnx CVE-2022-25882, GHSA-ffxj-547x-5j7c, PYSEC-2023-38 | High | 1.7% | 26 Jan, 2023 | PyPI onnx |
symfont/process typosquatting malware spoofs symfony/process GHSA-g3j5-mpp2-2fqm | High | Not scored | 26 Jan, 2023 | Packagist symfont/process |
Command injection in Git package in Wrangler CVE-2022-31249, GHSA-qrg7-hfx7-95c5, GO-2023-1519 | High | 3.8% | 25 Jan, 2023 | Go github.com/rancher/wrangler |
Controller reconciles apps outside configured namespaces when sharding is enabled CVE-2023-22736, GHSA-6p4m-hw2h-6gmw, GO-2023-1512 | High | 0.8% | 25 Jan, 2023 | Go github.com/argoproj/argo-cd Go github.com/argoproj/argo-cd/v2 |
Rancher generated tokens not revoked after modifications made to authentication provider GHSA-c45c-39f6-6gw9 | High | Not scored | 25 Jan, 2023 | Go github.com/rancher/rancher |
Plaintext storage of sensitive data in Rancher API and cluster.management.cattle.io objects CVE-2022-43757, GHSA-cq4p-vp5q-4522 | High | 0.6% | 25 Jan, 2023 | Go github.com/rancher/rancher |
Authenticated user can gain unauthorized shell pod and kubectl access in the local cluster CVE-2022-21953, GHSA-g25r-gvq3-wrq7 | High | 0.5% | 25 Jan, 2023 | Go github.com/rancher/rancher |
Privilege escalation in project role template binding (PRTB) and -promoted roles CVE-2022-43759, GHSA-7m72-mh5r-6j3r | High | 0.7% | 25 Jan, 2023 | Go github.com/rancher/rancher |
Rancher cattle-token is predictable CVE-2022-43755, GHSA-8c69-r38j-rpfj | High | 1.7% | 25 Jan, 2023 | Go github.com/rancher/rancher |
ReDoS Vulnerability in ua-parser-js version CVE-2022-25927, GHSA-fhg7-m89q-25r3 | High | 1.8% | 24 Jan, 2023 | npm ua-parser-js |
Improper Input Validation in pyload-ng CVE-2023-0434, GHSA-x9vc-5q77-m7x4, PYSEC-2026-908 | High | 0.8% | 22 Jan, 2023 | PyPI pyload-ng |
Command injection in yiisoft/yii2-gii CVE-2020-36655, GHSA-3mpg-q26j-83j5 | High | 1.5% | 21 Jan, 2023 | Packagist yiisoft/yii2-gii |
CakePHP vulnerable to Denial of Service attack through XML payloads GHSA-q79m-c546-2g63 | High | Not scored | 20 Jan, 2023 | Packagist cakephp/cakephp |
ExifTool vulnerable to arbitrary code execution GHSA-q95h-cqrv-8jv5 | High | Not scored | 20 Jan, 2023 | RubyGems exiftool_vendored |
Kraken has arbitrary file read vulnerability via component testfs CVE-2022-47747, GHSA-hj4g-4w36-x8hp, GO-2023-1505 | High | 0.8% | 20 Jan, 2023 | Go github.com/uber/kraken |
act vulnerable to arbitrary file upload in artifact server CVE-2023-22726, GHSA-pc99-qmg4-rcff, GO-2023-1504 | High | 1.3% | 20 Jan, 2023 | Go github.com/nektos/act |
jruby-openssl gem for JRuby fails to do proper certificate validation CVE-2009-4123, GHSA-xgv7-pqqh-h2w9 | High | 0.6% | 19 Jan, 2023 | RubyGems jruby-openssl |
Velociraptor vulnerable to Missing Authorization CVE-2023-0242, GHSA-g5vm-525q-r66c, GO-2023-1527 | High | 0.6% | 18 Jan, 2023 | Go www.velocidex.com/golang/velociraptor |
Adobe Acrobat and Reader Use-After-Free Vulnerability CVE-2023-21608 | HighExploited | 59.4% | 18 Jan, 2023 | |
Denial of Service Vulnerability in ActiveRecord's PostgreSQL adapter CVE-2022-44566, GHSA-579w-22j4-4749 | High | 1.3% | 18 Jan, 2023 | RubyGems activerecord |
SQL Injection Vulnerability via ActiveRecord comments CVE-2023-22794, GHSA-hq7p-j377-6v63 | High | 2.2% | 18 Jan, 2023 | RubyGems activerecord |
Denial of service via header parsing in Rack CVE-2022-44570, GHSA-65f5-mfpf-vfhj | High | 1.6% | 18 Jan, 2023 | RubyGems rack |
cookiejar Regular Expression Denial of Service via Cookie.parse function CVE-2022-25901, GHSA-h452-7996-h45h | High | 1.6% | 18 Jan, 2023 | Maven org.webjars.npm:cookiejar npm cookiejar |
Path Traversal in web-node-server CVE-2020-36651, GHSA-3fwq-qv5v-2wxf | High | 0.9% | 18 Jan, 2023 | npm web-node-server |
mel-spintax has Inefficient Regular Expression Complexity CVE-2018-25077, GHSA-qjm7-55vv-3c5f | High | 0.9% | 18 Jan, 2023 | npm mel-spintax |
Oracle WebLogic Server Unspecified Vulnerability CVE-2023-21839 | HighExploited | 99.9% | 18 Jan, 2023 | |
Shopware has Improper Input Validation issue in newsletter subscription CVE-2023-22734, GHSA-46h7-vj7x-fxg2 | High | 0.6% | 17 Jan, 2023 | Packagist shopware/core Packagist shopware/platform |
Shopware vulnerable to Improper Input Validation of Clearance sale in cart CVE-2023-22730, GHSA-8r6h-m72v-38fg | High | 0.7% | 17 Jan, 2023 | Packagist shopware/core Packagist shopware/platform |
mechanize Regular Expression Denial of Service vulnerability CVE-2021-32837, GHSA-g3pv-pj5f-3hfq, PYSEC-2023-25 | High | 28.7% | 17 Jan, 2023 | PyPI mechanize |
Code injection in ruby git CVE-2022-47318, GHSA-pphf-gfrm-v32r | High | 1.4% | 17 Jan, 2023 | RubyGems git |
Apache Superset vulnerable to Cross-Site Request Forgery via legacy REST API endpoints BIT-superset-2022-43719, CVE-2022-43719, GHSA-7222-r37x-8q3m, PYSEC-2026-775 | High | 0.6% | 16 Jan, 2023 | PyPI apache-superset |
Froxlor vulnerable to Command Injection CVE-2023-0315, GHSA-cp68-42pf-6627 | High | 97.7% | 16 Jan, 2023 | Packagist froxlor/froxlor |
golang.org/x/net/http2/h2c vulnerable to request smuggling attack CVE-2022-41721, GHSA-fxg5-wq6x-vr4w, GO-2023-1495 | High | 1.8% | 13 Jan, 2023 | Go golang.org/x/net |
Bloom Uncontrolled Search Path Element vulnerability CVE-2023-0247, GHSA-fgwp-pwqq-g3w4 | High | 0.4% | 12 Jan, 2023 | Go github.com/bits-and-blooms/bloom |
RSSHub SSRF vulnerability CVE-2023-22493, GHSA-64wp-jh9p-5cg2 | High | 0.8% | 11 Jan, 2023 | npm rsshub |
gatsby-transformer-remark has possible unsanitized JavaScript code injection CVE-2023-22491, GHSA-7ch4-rr99-cqcw | High | 0.6% | 11 Jan, 2023 | npm gatsby-transformer-remark |
sviehb/jefferson vulnerable to path traversal CVE-2022-4885, GHSA-7jrw-p8jc-v6qw, PYSEC-2026-826 | High | 0.8% | 11 Jan, 2023 | PyPI jefferson |
gry vulnerable to Command Injection CVE-2020-36650, GHSA-w5mw-f2hq-5fw8 | High | 2.2% | 11 Jan, 2023 | npm gry |
skeemas Inefficient Regular Expression Complexity vulnerability CVE-2018-25074, GHSA-qv66-f876-vjvr | High | 1.0% | 11 Jan, 2023 | npm skeemas |
Multiple SugarCRM Products Remote Code Execution Vulnerability CVE-2023-22952 | HighExploited | 80.1% | 11 Jan, 2023 | |
Flarum post mentions can be used to read any post on the forum without access control CVE-2023-22487, GHSA-22m9-m3ww-53h3 | High | 0.7% | 10 Jan, 2023 | Packagist flarum/mentions |
Microsoft Windows Advanced Local Procedure Call (ALPC) Privilege Escalation Vulnerability CVE-2023-21674 | HighExploited | 34.2% | 10 Jan, 2023 | |
convict vulnerable to Prototype Pollution CVE-2023-0163, GHSA-4jrm-c32x-w4jf | High | 0.3% | 10 Jan, 2023 | npm convict |
KubeOperator allows unauthorized access to system API CVE-2023-22480, GHSA-jxgp-jgh3-8jc8 | High | 66.8% | 09 Jan, 2023 | Go github.com/KubeOperator/KubeOperator |