Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Synapse has URL deny list bypass via oEmbed and image URLs when generating previews CVE-2023-32683, GHSA-98px-6486-j7qc, PYSEC-2023-85 | Medium | 0.6% | 06 Jun, 2023 | PyPI matrix-synapse |
Synapse has improper checks for deactivated users during login CVE-2023-32682, GHSA-26c5-ppr8-f33p, PYSEC-2023-84 | Medium | 0.8% | 06 Jun, 2023 | PyPI matrix-synapse |
syncthing vulnerable to Cross-site Scripting (XSS) in Web GUI BIT-syncthing-2022-46165, CVE-2022-46165, GHSA-9rp6-23gf-4c3h | Medium | 0.8% | 06 Jun, 2023 | Go github.com/syncthing/syncthing |
Rancher UI has multiple Cross-Site Scripting (XSS) issues CVE-2022-43760, GHSA-46v3-ggjg-qq3x | Medium | 0.7% | 06 Jun, 2023 | Go github.com/rancher/rancher |
Kyverno resource with a deletionTimestamp may allow policy circumvention CVE-2023-34091, GHSA-hq4m-4948-64cc, GO-2023-1819 | Medium | 0.5% | 05 Jun, 2023 | Go github.com/kyverno/kyverno |
Admidio vulnerable to Cross-site Scripting CVE-2023-3109, GHSA-gx4r-fvwg-8678 | Medium | 0.5% | 05 Jun, 2023 | Packagist admidio/admidio |
Gitpod vulnerable to Cross-site Scripting CVE-2023-32766, GHSA-gqx9-h3w2-fprg | Medium | 0.6% | 05 Jun, 2023 | Go github.com/gitpod-io/gitpod |
TeamPass vulnerable to Improper Access Control CVE-2023-3095, GHSA-g3jr-6vj4-3x82 | Medium | 0.4% | 04 Jun, 2023 | Packagist nilsteampassnet/teampass |
Hashicorp Consul vulnerable to denial of service BIT-consul-2023-1297, CVE-2023-1297, GHSA-c57c-7hrj-6q6v, GO-2023-1827 | Medium | 0.8% | 03 Jun, 2023 | Go github.com/hashicorp/consul |
PocketMine MP vulnerable to uncontrolled resource consumption via mismatched type of 'InventoryTransactionPacket' CVE-2023-54394, GHSA-42qm-8v8m-m78c | Medium | 0.5% | 01 Jun, 2023 | Packagist pocketmine/pocketmine-mp |
nilsteampassnet/teampass vulnerable to cross-site scripting CVE-2023-3009, GHSA-h5g9-2p35-54c7 | Medium | 0.7% | 31 May, 2023 | Packagist nilsteampassnet/teampass |
Dcat-Admin vulnerable to Stored Cross-site Scripting CVE-2023-33736, GHSA-p74v-mwvg-8ghp | Medium | 0.4% | 31 May, 2023 | Packagist dcat/laravel-admin |
Algernon engine and themes vulnerable to Cross-site Scripting CVE-2023-26131, GHSA-g47h-fgcw-g4ph | Medium | 0.7% | 31 May, 2023 | Go github.com/xyproto/algernon |
thorsten/phpmyfaq vulnerable to cross-site scripting CVE-2023-2999, GHSA-94r7-63g8-c4jw | Medium | 0.5% | 31 May, 2023 | Packagist thorsten/phpmyfaq |
thorsten/phpmyfaq vulnerable to cross-site scripting CVE-2023-2998, GHSA-974q-4vvr-vg9c | Medium | 0.5% | 31 May, 2023 | Packagist thorsten/phpmyfaq |
Kyverno vulnerable due to usage of insecure cipher BIT-kyverno-2023-54356, CVE-2023-54356, GHSA-hgv6-w7r3-w4qw, GO-2023-1804 | Medium | 0.2% | 30 May, 2023 | Go github.com/kyverno/kyverno |
Phishing attack vulnerability by uploading malicious HTML file BIT-parse-2023-32689, CVE-2023-32689, GHSA-9prm-jqwx-45x9 | Medium | 0.6% | 30 May, 2023 | npm parse-server |
Go package pydio/cells vulnerable to authorization bypass CVE-2023-2978, GHSA-mv7x-27pc-8c96, GO-2023-1808 | Medium | 0.7% | 30 May, 2023 | Go github.com/pydio/cells Go github.com/pydio/cells/v4 |
Abstrium Pydio Cells Resource Injection vulnerability CVE-2023-2980, GHSA-j327-c69h-4gh8, GO-2023-2344 | Medium | 1.1% | 30 May, 2023 | Go github.com/pydio/cells Go github.com/pydio/cells/v4 |
go package pydio cells vulnerable to cross-site scripting CVE-2023-2981, GHSA-wmfc-g86p-fjvr, GO-2023-1809 | Medium | 0.7% | 30 May, 2023 | Go github.com/pydio/cells Go github.com/pydio/cells/v4 |
MindSpore vulnerable to memory corruption CVE-2023-2970, GHSA-x67g-47p3-rc7f, PYSEC-2023-81 | Medium | 0.9% | 30 May, 2023 | PyPI mindspore |
malformed proposed intoto entries can cause a panic CVE-2023-33199, GHSA-frqx-jfcm-6jjr, GO-2023-1795 | Medium | 0.7% | 26 May, 2023 | Go github.com/sigstore/rekor |
Stored cross site scripting in Craft CMS CVE-2023-2817, GHSA-7x94-jx75-3gh6 | Medium | 0.4% | 26 May, 2023 | Packagist craftcms/cms |
secrets-store-csi-driver discloses service account tokens in logs CVE-2023-2878, GHSA-g82w-58jf-gcxx, GO-2023-1793 | Medium | 0.4% | 26 May, 2023 | Go sigs.k8s.io/secrets-store-csi-driver |
Minio console object names with RIGHT-TO-LEFT OVERRIDE unicode character can be exploited CVE-2023-33955, GHSA-jv3f-7m33-qp65 | Medium | 0.6% | 26 May, 2023 | Go github.com/minio/console |
Craft CMS stored XSS in indexedVolumes CVE-2023-33197, GHSA-6qjx-787v-6pxr | Medium | 0.7% | 26 May, 2023 | Packagist craftcms/cms |
Craft CMS stored XSS in review volume CVE-2023-33196, GHSA-cjmm-x9x9-m2w5 | Medium | 0.7% | 26 May, 2023 | Packagist craftcms/cms |
Craft CMS XSS in RSS widget feed CVE-2023-33195, GHSA-qpgm-gjgf-8c2x | Medium | 0.7% | 26 May, 2023 | Packagist craftcms/cms |
CraftCMS stored XSS in Quick Post widget error message CVE-2023-33194, GHSA-3wxg-w96j-8hq9 | Medium | 0.6% | 26 May, 2023 | Packagist craftcms/cms |
html inputs of type password recorded in plaintext when converted to text inputs CVE-2023-33187, GHSA-9qpj-qq2r-5mcc | Medium | 0.3% | 26 May, 2023 | npm highlight.run |
kyverno seccomp control can be circumvented CVE-2023-33191, GHSA-33hq-f2mf-jm3c, GO-2023-1801 | Medium | 0.5% | 25 May, 2023 | Go github.com/kyverno/kyverno |
Open redirect in Tornado CVE-2023-28370, GHSA-hj3f-6gcp-jg8j, PYSEC-2023-75 | Medium | 1.1% | 25 May, 2023 | PyPI tornado |
Pimcore customers' list user password hash is disclosed CVE-2023-2881, GHSA-j65r-g7q2-f8v3 | Medium | 0.5% | 25 May, 2023 | Packagist pimcore/customer-management-framework-bundle |
Ingress-nginx `path` sanitization can be bypassed with newline character CVE-2021-25748, GHSA-863x-868h-968x | Medium | 0.7% | 24 May, 2023 | Go k8s.io/ingress-nginx |
Synapse Outgoing federation to specific hosts can be disabled by sending malicious invites CVE-2023-32323, GHSA-f3wc-3vxv-xmvr, PYSEC-2023-67 | Medium | 1.0% | 24 May, 2023 | PyPI matrix-synapse |
Unintended leak of Proxy-Authorization header in requests CVE-2023-32681, GHSA-j8r2-6x86-q33q, PYSEC-2023-74 | Medium | 3.0% | 22 May, 2023 | PyPI requests |
Potential for cross-site scripting in PostHog-js CVE-2023-32325, GHSA-8775-5hwv-wr6v | Medium | 0.4% | 22 May, 2023 | npm posthog-js |
Potential HTTP policy bypass when using header rules in Cilium BIT-cilium-2023-30851, BIT-cilium-operator-2023-30851, BIT-cilium-proxy-2023-30851, BIT-hubble-2023-30851, BIT-hubble-relay-2023-30851, BIT-hubble-ui-2023-30851, BIT-hubble-ui-backend-2023-30851, CVE-2023-30851, GHSA-2h44-x2wx-49f4, GO-2023-1785 | Medium | 0.7% | 22 May, 2023 | Go github.com/cilium/cilium |
ginuerzh/gost vulnerable to Timing Attack CVE-2023-32691, GHSA-qjrq-hm79-49ww | Medium | 0.6% | 22 May, 2023 | Go github.com/ginuerzh/gost |
Incorrect signature verification in django-ses CVE-2023-33185, GHSA-qg36-9jxh-fj25, PYSEC-2023-82 | Medium | 0.2% | 22 May, 2023 | PyPI django-ses |
kiwitcms vulnerable to stored XSS via unrestricted files upload CVE-2023-32686, GHSA-x7c2-7wvg-jpx7, PYSEC-2026-1500 | Medium | 0.4% | 22 May, 2023 | PyPI kiwitcms |
Vyper's nonpayable default functions are sometimes payable CVE-2023-32675, GHSA-vxmm-cwh2-q762, PYSEC-2023-80 | Medium | 0.6% | 19 May, 2023 | PyPI vyper |
transformers has Insecure Temporary File CVE-2023-2800, GHSA-282v-666c-3fvg, PYSEC-2023-299 | Medium | 0.3% | 18 May, 2023 | PyPI transformers |
LavaLite vulnerable to Cross Site Scripting CVE-2023-30124, GHSA-h538-r9x6-rcmc | Medium | 0.4% | 18 May, 2023 | Packagist lavalite/cms |
ReactPHP's HTTP server continues parsing unused multipart parts after reaching input field and file upload limits CVE-2023-26044, GHSA-95x4-j7vc-h8mf | Medium | 0.7% | 17 May, 2023 | Packagist react/http |
Dgraph Audit Log Encryption Vulnerability CVE-2023-31135, GHSA-92wq-q9pq-gw47 | Medium | 0.2% | 17 May, 2023 | Go github.com/dgraph-io/dgraph |
phpMyFAQ vulnerable to stored Cross-site Scripting CVE-2023-2753, GHSA-vppq-6ff8-2m8w | Medium | 0.6% | 17 May, 2023 | Packagist thorsten/phpmyfaq |
phpMyFAQ vulnerable to stored Cross-site Scripting CVE-2023-2752, GHSA-j657-pjgc-c4h6 | Medium | 0.5% | 17 May, 2023 | Packagist thorsten/phpmyfaq |
Moodle vulnerable to stored Cross-site Scripting BIT-moodle-2021-27131, CVE-2021-27131, GHSA-w2pm-fr62-jgv4 | Medium | 0.7% | 16 May, 2023 | Packagist moodle/moodle |
Pimcore Cross-site Scripting vulnerability CVE-2023-2730, GHSA-q3p4-v2cm-q945 | Medium | 0.5% | 16 May, 2023 | Packagist pimcore/pimcore |