Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
vm2 vulnerable to Inspect Manipulation CVE-2023-32313, GHSA-p5gc-c584-jj6v | Medium | 0.8% | 15 May, 2023 | npm vm2 |
LavaLite CMS vulnerable to host header injection attack CVE-2023-27237, GHSA-94q4-v5g6-qp7x | Medium | 0.6% | 12 May, 2023 | Packagist lavalite/cms |
in-toto: PGP trust model not (fully) considered GHSA-jjgp-whrp-gq8m | Medium | Not scored | 11 May, 2023 | PyPI in-toto |
Improper random reading in CIRCL CVE-2023-1732, GHSA-2q89-485c-9j2x, GO-2023-1765 | Medium | 0.4% | 11 May, 2023 | Go github.com/cloudflare/circl |
github.com/ipfs/kubo affected by DOS Bitswap unbounded persistent memory leak GHSA-qvqg-6rp8-4p9h | Medium | Not scored | 11 May, 2023 | Go github.com/ipfs/kubo |
VTAdmin users that can create shards can deny access to other functions CVE-2023-29195, GHSA-pqj7-jx24-wj7w | Medium | 1.0% | 11 May, 2023 | Go vitess.io/vitess |
Gin Web Framework does not properly sanitize filename parameter of Context.FileAttachment function CVE-2023-29401, GHSA-2c4m-59x9-fr2g, GO-2023-1737 | Medium | 0.5% | 11 May, 2023 | Go github.com/gin-gonic/gin |
Cross Site Scripting (XSS) Vulnerability in Fetlife rollout-ui gem CVE-2023-25309, GHSA-5xq9-h3j2-jxvc | Medium | 0.5% | 11 May, 2023 | RubyGems rollout-ui |
Pimcore vulnerable to Business Logic Errors via Customer automation rules CVE-2023-32075, GHSA-x99j-r8vv-gwwj | Medium | 0.8% | 11 May, 2023 | Packagist pimcore/customer-management-framework-bundle |
Ibexa User Settings are accessible on the front-end for anonymous user GHSA-r3fg-3r88-6x3f | Medium | Not scored | 10 May, 2023 | Packagist ibexa/user |
in-toto vulnerable to Configuration Read From Local Directory CVE-2023-32076, GHSA-p86f-xmg6-9q4x, GHSA-wc64-c5rv-32pf, PYSEC-2023-63 | Medium | 0.2% | 10 May, 2023 | PyPI in-toto |
Pimcore Cross-site Scripting (XSS) vulnerability in Admin Translations CVE-2023-2630, GHSA-w766-3572-f2hv | Medium | 0.6% | 10 May, 2023 | Packagist pimcore/pimcore |
n8n Directory Traversal vulnerability CVE-2023-27562, GHSA-p58x-7733-vp9m | Medium | 2.3% | 10 May, 2023 | npm n8n |
Pimcore Cross-site Scripting (XSS) in Predefined Properties delete CVE-2023-2615, GHSA-q7cc-m6jw-m262 | Medium | 0.5% | 10 May, 2023 | Packagist pimcore/pimcore |
Pimcore Cross-site Scripting (XSS) in name field of Custom Reports CVE-2023-2614, GHSA-m6m9-gr85-79vm | Medium | 0.5% | 10 May, 2023 | Packagist pimcore/pimcore |
Pimcore Cross-site Scripting (XSS) in Static Routes name field CVE-2023-2616, GHSA-mhpj-7m7h-8p6x | Medium | 0.5% | 10 May, 2023 | Packagist pimcore/pimcore |
On a compromised node, the fluid-csi service account can be used to modify node specs CVE-2023-30840, GHSA-93xx-cvmc-9w3v, GO-2023-1763 | Medium | 0.2% | 09 May, 2023 | Go github.com/fluid-cloudnative/fluid |
imgproxy is vulnerable to Server-Side Request Forgery CVE-2023-30019, GHSA-9x7h-ggc3-xg47, GO-2023-1761 | Medium | 2.2% | 08 May, 2023 | Go github.com/imgproxy/imgproxy Go github.com/imgproxy/imgproxy/v2 Go github.com/imgproxy/imgproxy/v3 |
Apache Airflow vulnerable to stored Cross-site Scripting BIT-airflow-2023-29247, CVE-2023-29247, GHSA-vcf6-3wv2-5vcr, PYSEC-2023-60 | Medium | 2.0% | 08 May, 2023 | PyPI apache-airflow |
craftcms/cms vulnerable to cross site scripting in RSS feed widget CVE-2023-31144, GHSA-j4mx-98hw-6rv6 | Medium | 0.4% | 05 May, 2023 | Packagist craftcms/cms |
Cross Site Scripting in nilsteampassnet/teampass CVE-2023-2516, GHSA-2ffp-w665-9mgx | Medium | 0.6% | 05 May, 2023 | Packagist nilsteampassnet/teampass |
Cross Site Scripting in thorsten/phpmyfaq CVE-2023-2427, GHSA-5xq3-7mw9-wj5p | Medium | 0.5% | 05 May, 2023 | Packagist thorsten/phpmyfaq |
libheif vulnerable to segmentation fault via floating point exception CVE-2023-29659, GHSA-22fx-6r9m-r8h9 | Medium | 0.9% | 05 May, 2023 | Go github.com/strukturag/libheif |
Samsung Mobile Devices Insertion of Sensitive Information Into Log File Vulnerability CVE-2023-21492 | MediumExploited | 2.6% | 04 May, 2023 | |
Cross-site scripting in TotalJS CVE-2023-30094, GHSA-jj45-24rw-v6jw | Medium | 0.7% | 04 May, 2023 | npm total4 |
Improper input validation in github.com/gin-gonic/gin CVE-2023-26125, GHSA-3vp4-m3rf-835h | Medium | 0.9% | 04 May, 2023 | Go github.com/gin-gonic/gin |
engine.io Uncaught Exception vulnerability CVE-2023-31125, GHSA-q9mw-68c2-j6m5 | Medium | 1.3% | 03 May, 2023 | npm engine.io |
Moodle External Control of File Name or Path vulnerability BIT-moodle-2023-30943, CVE-2023-30943, GHSA-22gj-8qj2-fj46 | Medium | 6.8% | 02 May, 2023 | Packagist moodle/moodle |
@mittwald/kubernetes's secret contents leaked via debug logging GHSA-g35x-j6jj-8g7j | Medium | Not scored | 02 May, 2023 | npm @mittwald/kubernetes |
RosarioSIS vulnerable to CSV Injection CVE-2023-29918, GHSA-f8hp-grmr-pp7j | Medium | 2.2% | 02 May, 2023 | Packagist francoisjacquet/rosariosis |
editor.md vulnerable to Cross-site Scripting CVE-2023-29641, GHSA-847g-34c5-vvm8 | Medium | 0.4% | 01 May, 2023 | npm editor.md |
phpMyFAQ vulnerable to Stored Cross-site Scripting CVE-2023-2428, GHSA-8595-6653-96p2 | Medium | 0.6% | 30 Apr, 2023 | Packagist thorsten/phpmyfaq |
Missing rate limit for password resets CVE-2023-28821, GHSA-ph6g-6v8w-8p6m | Medium | 0.7% | 28 Apr, 2023 | Packagist concrete5/concrete5 |
Stored cross site scripting in RSS displayer CVE-2023-28820, GHSA-fgxj-g7x3-85cq | Medium | 0.4% | 28 Apr, 2023 | Packagist concrete5/concrete5 |
Concrete CMS (previously concrete5) is vulnerable to stored XSS in uploaded file and folder names CVE-2023-28819, GHSA-474f-mcjv-pgrm | Medium | 0.6% | 28 Apr, 2023 | Packagist concrete5/concrete5 |
Stored cross site scripting on API integration CVE-2023-28477, GHSA-xfmj-r86m-j2hr | Medium | 0.6% | 28 Apr, 2023 | Packagist concrete5/concrete5 |
Stored cross site scripting on tags CVE-2023-28476, GHSA-2ggc-552c-rmqr | Medium | 0.5% | 28 Apr, 2023 | Packagist concrete5/concrete5 |
Reflected cross site scripting CVE-2023-28475, GHSA-vcpr-hm2m-gjjj | Medium | 0.6% | 28 Apr, 2023 | Packagist concrete5/concrete5 |
Stored cross site scripting on saved presets CVE-2023-28474, GHSA-2j26-j953-2rph | Medium | 0.6% | 28 Apr, 2023 | Packagist concrete5/concrete5 |
Concrete CMS missing secure cookie parameters CVE-2023-28472, GHSA-f55r-8rcv-mqcf | Medium | 0.6% | 28 Apr, 2023 | Packagist concrete5/concrete5 |
Stored cross site scripting via container name CVE-2023-28471, GHSA-9h33-5fxw-r2xv | Medium | 0.5% | 28 Apr, 2023 | Packagist concrete5/concrete5 |
Cross-site Scripting (XSS) in pimcore CVE-2023-2361, GHSA-9xg6-75mh-7x3f | Medium | 0.5% | 28 Apr, 2023 | Packagist pimcore/pimcore |
Cross-site Scripting (XSS) in Conditions tab of Pricing Rules CVE-2023-2332, GHSA-r7mm-jx6h-hv7m | Medium | 0.4% | 27 Apr, 2023 | Packagist pimcore/pimcore |
Arbitrary File Read in Admin JS CSS files CVE-2023-30852, GHSA-j5c3-r84f-9596 | Medium | 1.0% | 27 Apr, 2023 | Packagist pimcore/pimcore |
Cross-site Scripting (XSS) in DataObject Classification Store CVE-2023-2343, GHSA-9q7q-r54q-3f3g | Medium | 0.4% | 27 Apr, 2023 | Packagist pimcore/pimcore |
Cross-site Scripting (XSS) in Website Settings name field CVE-2023-2342, GHSA-2c67-p4xh-m34w | Medium | 0.4% | 27 Apr, 2023 | Packagist pimcore/pimcore |
Cross-site Scripting (XSS) in Admin Login too many attempts notice CVE-2023-2341, GHSA-fq95-rx4q-qgg2 | Medium | 1.1% | 27 Apr, 2023 | Packagist pimcore/pimcore |
Cross-site Scripting (XSS) in DataObject columns grid CVE-2023-2340, GHSA-g93x-fm2w-5pxw | Medium | 0.5% | 27 Apr, 2023 | Packagist pimcore/pimcore |
Cross-site Scripting (XSS) in DataObject Any Getter grid operator CVE-2023-2339, GHSA-6fvf-x8c6-2f6j | Medium | 0.5% | 27 Apr, 2023 | Packagist pimcore/pimcore |
Path Traversal in Asset "import from server" option CVE-2023-2336, GHSA-hg77-vx9v-f49x | Medium | 0.7% | 27 Apr, 2023 | Packagist pimcore/pimcore |