Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
KubePi session fixation attack allows an attacker to hijack a legitimate user session. CVE-2023-22479, GHSA-v4w5-r2xc-7f8h, GO-2023-1468 | High | 0.4% | 09 Jan, 2023 | Go github.com/KubeOperator/kubepi |
KubePi may allow unauthorized access to system API CVE-2023-22478, GHSA-gqx8-hxmv-c4v4, GO-2023-1463 | High | 3.7% | 09 Jan, 2023 | Go github.com/KubeOperator/kubepi |
ruby-git has potential remote code execution vulnerability CVE-2022-46648, GHSA-pfpr-3463-c6jh | High | 1.4% | 09 Jan, 2023 | RubyGems git |
PocketMine-MP has improperly handled dye colour IDs in banner NBT, leading to server crash CVE-2023-54396, GHSA-wqqv-jcfr-9f5g | High | 0.5% | 09 Jan, 2023 | Packagist pocketmine/pocketmine-mp |
Gitops Run insecure communication CVE-2022-23509, GHSA-89qm-wcmw-3mgg, GO-2023-1388 | High | 0.3% | 09 Jan, 2023 | Go github.com/weaveworks/weave-gitops |
GitOps Run allows for Kubernetes workload injection CVE-2022-23508, GHSA-wr3c-g326-486c, GO-2023-1377 | High | 0.3% | 09 Jan, 2023 | Go github.com/weaveworks/weave-gitops |
mercurius has Uncaught Exception when using subscriptions CVE-2023-22477, GHSA-cm8h-q92v-xcfc | High | 1.1% | 09 Jan, 2023 | npm mercurius |
debug Inefficient Regular Expression Complexity vulnerability CVE-2017-20165, GHSA-9vvw-cc9w-f27h | High | 2.1% | 09 Jan, 2023 | npm debug |
terminal-kit Inefficient Regular Expression Complexity vulnerability CVE-2021-4306, GHSA-wxgh-8gmr-3qh3 | High | 1.0% | 07 Jan, 2023 | npm terminal-kit |
robots-txt-guard Inefficient Regular Expression Complexity vulnerability CVE-2021-4305, GHSA-6g33-8w2q-4hxv | High | 1.0% | 05 Jan, 2023 | npm robots-txt-guard |
PgHero Allows Information Disclosure Through EXPLAIN Feature CVE-2023-22626, GHSA-vf99-xw26-86g5 | High | 0.9% | 05 Jan, 2023 | RubyGems pghero |
Luxon Inefficient Regular Expression Complexity vulnerability CVE-2023-22467, GHSA-3xq5-wjfh-ppjc | High | 1.9% | 04 Jan, 2023 | npm luxon |
window-control vulnerable to Command Injection due to improper input sanitization CVE-2022-25926, GHSA-9mjx-wfqp-j5ph | High | 1.1% | 04 Jan, 2023 | npm window-control |
Uniswap Universal Router Incorrect Authorization vulnerability CVE-2022-48216, GHSA-7m37-cx35-qgmr | High | 0.8% | 04 Jan, 2023 | npm @uniswap/universal-router |
@mattkrick/sanitize-svg vulnerable to Cross-Site Scripting (XSS) CVE-2023-22461, GHSA-h857-2g56-468g | High | 0.6% | 04 Jan, 2023 | npm @mattkrick/sanitize-svg |
MooTools Regular Expression Denial of Service CVE-2021-32821, GHSA-v63q-hgqc-qvpg | High | 0.7% | 03 Jan, 2023 | npm mootools |
FrameworkUserBundle Generates Error Message Containing Sensitive Information CVE-2015-10012, GHSA-6m7c-45ff-3328 | High | 0.9% | 03 Jan, 2023 | Packagist sumocoders/framework-user-bundle |
string-kit Inefficient Regular Expression Complexity vulnerability CVE-2021-4299, GHSA-pfrm-4rjw-g9q5 | High | 1.0% | 02 Jan, 2023 | npm string-kit |
rgb2hex vulnerable to inefficient regular expression complexity CVE-2018-25061, GHSA-7599-fqgm-v84p | High | 1.0% | 31 Dec, 2022 | npm rgb2hex |
Elrond-GO processing: fallback search of SCRs when not found in the main cache CVE-2022-46173, GHSA-p228-4mrh-ww7r, GO-2022-1200 | High | 0.8% | 30 Dec, 2022 | Go github.com/ElrondNetwork/elrond-go |
Macaron csrf missing encryption and has sensitive cookies in HTTP session without secure attribute CVE-2018-25060, GHSA-hhxg-px5h-jc32, GO-2022-1213 | High | 0.6% | 30 Dec, 2022 | Go github.com/go-macaron/csrf |
usememos/memos Cross-Site Request Forgery vulnerability CVE-2022-4844, GHSA-5jqp-wmhj-g33f | High | 0.3% | 29 Dec, 2022 | Go github.com/usememos/memos |
Yapscan's report receiver server vulnerable to path traversal and log injection GHSA-9h6h-9g78-86f7, GO-2022-1204 | High | Not scored | 29 Dec, 2022 | Go github.com/fkie-cad/yapscan |
usememos/memos Improper Privilege Management vulnerability CVE-2022-4808, GHSA-r3p3-5f35-h6mf, GO-2023-1449 | High | 0.4% | 28 Dec, 2022 | Go github.com/usememos/memos |
usememos/memos Improper Access Control vulnerability CVE-2022-4809, GHSA-6w5w-wx8w-2cq9, GO-2022-1252 | High | 1.0% | 28 Dec, 2022 | Go github.com/usememos/memos |
usememos/memos makes Incorrect Use of Privileged APIs CVE-2022-4796, GHSA-ghx2-6v4g-9wmm, GO-2022-1236 | High | 0.8% | 28 Dec, 2022 | Go github.com/usememos/memos |
usememos/memos Improper Access Control vulnerability CVE-2022-4803, GHSA-mfmp-8mqg-q4wm, GO-2023-1291 | High | 0.9% | 28 Dec, 2022 | Go github.com/usememos/memos |
usememos/memos Denial of Service vulnerability CVE-2022-4767, GHSA-33m8-f4hw-wm3q, GO-2022-1219 | High | 0.7% | 27 Dec, 2022 | Go github.com/usememos/memos |
SentinelOne impersonated via PyPI packages GHSA-g86j-hwg9-77q5 | High | Not scored | 27 Dec, 2022 | PyPI SentinelOne PyPI Sentinelone PyPI SentineloneSDK PyPI sentinelone +2 more |
Microweber vulnerable to unrestricted malicious uploads CVE-2022-4732, GHSA-8h43-xg5g-9cj7 | High | 38.2% | 27 Dec, 2022 | Packagist microweber/microweber |
rdiffweb vulnerable to Open Redirect CVE-2022-4720, GHSA-h5wp-jrqc-cwwx, PYSEC-2022-43006 | High | 0.5% | 27 Dec, 2022 | PyPI rdiffweb |
rdiffweb vulnerable to Authentication Bypass by Primary Weakness CVE-2022-4722, GHSA-wf33-6x33-wcf9, PYSEC-2022-43008 | High | 1.2% | 27 Dec, 2022 | PyPI rdiffweb |
rdiffweb has no rate limit on resend email feature CVE-2022-4723, GHSA-7q4r-x5qg-mmcp, PYSEC-2022-43009 | High | 0.7% | 27 Dec, 2022 | PyPI rdiffweb |
cocagne pysrp vulnerable to side channel leaks CVE-2021-4286, GHSA-xmc3-9m9j-w9x4, PYSEC-2022-43014 | High | 0.8% | 27 Dec, 2022 | PyPI srp |
email-existence Inefficient Regular Expression Complexity vulnerability CVE-2018-25049, GHSA-p27h-4cpf-fw48 | High | 0.8% | 27 Dec, 2022 | npm email-existence |
markdown-it vulnerable to Inefficient Regular Expression Complexity CVE-2015-10005, GHSA-j5p7-jf4q-742q | High | 1.0% | 27 Dec, 2022 | npm markdown-it |
tree-kit vulnerable to Prototype Pollution CVE-2021-4278, GHSA-mw4x-g2x8-qcvf | High | 0.4% | 25 Dec, 2022 | npm tree-kit |
SimbCo httpster vulnerable to Path Traversal CVE-2020-36629, GHSA-p8j8-wxvp-h695 | High | 0.9% | 25 Dec, 2022 | npm httpster |
Slixmpp lacks SSL Certificate hostname validation in XMLStream CVE-2022-45197, GHSA-q6cq-m9gm-6q2f, PYSEC-2022-43013 | High | 0.5% | 25 Dec, 2022 | PyPI slixmpp |
Prototype Pollution in JSON5 via Parse Method CVE-2022-46175, GHSA-9c47-m6qq-7p4h | High | 9.7% | 24 Dec, 2022 | npm json5 |
usememos/memos Improper Access Control vulnerability CVE-2022-4684, GHSA-qr52-59r6-49f4, GO-2022-1218 | High | 0.6% | 23 Dec, 2022 | Go github.com/usememos/memos |
usememos/memos makes Incorrect Use of Privileged APIs CVE-2022-4687, GHSA-fv6c-rfg3-gvjw, GO-2022-1217 | High | 0.7% | 23 Dec, 2022 | Go github.com/usememos/memos |
usememos/memos vulnerable to improper authorization CVE-2022-4688, GHSA-vwg4-846x-f94v, GO-2022-1190 | High | 0.8% | 23 Dec, 2022 | Go github.com/usememos/memos |
usememos/memos vulnerable to account takeover due to improper access control CVE-2022-4689, GHSA-w57v-6xp4-rm2v, GO-2022-1191 | High | 0.8% | 23 Dec, 2022 | Go github.com/usememos/memos |
pypa/setuptools vulnerable to Regular Expression Denial of Service (ReDoS) BIT-setuptools-2022-40897, CVE-2022-40897, GHSA-r9hx-vwmv-q579, PYSEC-2022-43012 | High | 2.6% | 23 Dec, 2022 | PyPI setuptools |
pypa/wheel vulnerable to Regular Expression denial of service (ReDoS) CVE-2022-40898, GHSA-qwmp-2cf2-g9g6, PYSEC-2022-43017 | High | 2.8% | 23 Dec, 2022 | PyPI wheel |
Python Charmers Future denial of service vulnerability CVE-2022-40899, GHSA-v3c5-jqr6-7qm8, PYSEC-2022-42991 | High | 1.9% | 23 Dec, 2022 | PyPI future |
is_js vulnerable to Regular Expression Denial of Service CVE-2020-26302, GHSA-pvrw-g6fx-mcx2 | High | 0.9% | 22 Dec, 2022 | npm is_js |
Mozilla Firefox Use-After-Free Vulnerability CVE-2022-26485 | HighExploited | 14.3% | 22 Dec, 2022 | |
CodeIgniter4 allows spoofing of IP address when using proxy BIT-codeigniter-2022-23556, CVE-2022-23556, GHSA-ghw3-5qvm-3mqc | High | 0.4% | 22 Dec, 2022 | Packagist codeigniter4/framework |