Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Cross-site Scripting (XSS) in DataObjects QuantityValue Unit Definition CVE-2023-2328, GHSA-2295-vh28-pphc | Medium | 0.4% | 27 Apr, 2023 | Packagist pimcore/pimcore |
Cross-site Scripting (XSS) in pimcore via DataObject Class date fields CVE-2023-2327, GHSA-x9xj-pqmv-8jf7 | Medium | 0.4% | 27 Apr, 2023 | Packagist pimcore/pimcore |
Cross-site Scripting (XSS) in Ecommerce Pricing Rules name field CVE-2023-2323, GHSA-cjv6-w5hf-5wr6 | Medium | 0.5% | 27 Apr, 2023 | Packagist pimcore/pimcore |
Cross-site Scripting (XSS) in Document Properties Parameter CVE-2023-2322, GHSA-476g-v7hf-cw5m | Medium | 0.6% | 27 Apr, 2023 | Packagist pimcore/pimcore |
Ironic and ironic-inspector may expose as ConfigMaps CVE-2023-30841, GHSA-9wh7-397j-722m | Medium | 0.2% | 26 Apr, 2023 | Go github.com/metal3-io/baremetal-operator |
@builder.io/qwik-city Cross-Site Request Forgery vulnerability CVE-2023-2307, GHSA-c54w-7j5f-xg98 | Medium | 0.3% | 26 Apr, 2023 | npm @builder.io/qwik-city |
Cross-site scripting vulnerabilities in old version of bundled TinyMCE GHSA-wqm8-jx8r-8rcq | Medium | Not scored | 26 Apr, 2023 | Packagist silverstripe/admin |
Open redirect vulnerability on CMSSecurity relogin screen CVE-2023-22729, GHSA-fw84-xgm8-9jmv | Medium | 0.4% | 26 Apr, 2023 | Packagist silverstripe/framework |
Missing permission check of canView in GridFieldPrintButton CVE-2023-22728, GHSA-jh3w-6jp2-vqqm | Medium | 0.5% | 26 Apr, 2023 | Packagist silverstripe/framework |
Cross Site Scripting in CraftCMS CVE-2023-30177, GHSA-wv7j-rc2q-9j67 | Medium | 0.4% | 25 Apr, 2023 | Packagist craftcms/cms |
kiwi TCMS has possibility for user to update email address to unverified one CVE-2023-30544, GHSA-7x6q-3v3m-cwjg, PYSEC-2026-1497 | Medium | 0.4% | 24 Apr, 2023 | PyPI kiwitcms |
Apache Superset vulnerable to Exposure of Sensitive Information BIT-superset-2023-30776, CVE-2023-30776, GHSA-cmjc-52fg-9f7j, PYSEC-2026-1171 | Medium | 2.1% | 24 Apr, 2023 | PyPI apache-superset |
Cross-site Scripting in Backdrop CMS CVE-2023-31045, GHSA-3862-c622-v4fp | Medium | 0.5% | 24 Apr, 2023 | Packagist backdrop/backdrop |
Cross-site Scripting in thorsten/phpmyfaq CVE-2023-1875, GHSA-ch5w-2994-6h82 | Medium | 0.5% | 22 Apr, 2023 | Packagist thorsten/phpmyfaq |
Information exposure in microweber CVE-2023-2239, GHSA-h83h-77x2-6w6g | Medium | 0.5% | 22 Apr, 2023 | Packagist microweber/microweber |
CSRF token fixation in fastify-passport CVE-2023-29020, GHSA-2ccf-ffrj-m4qw | Medium | 0.4% | 21 Apr, 2023 | npm @fastify/passport |
Improper Input Validation in nyholm/psr7 GHSA-wjfc-pgfp-pv9c | Medium | Not scored | 21 Apr, 2023 | Packagist nyholm/psr7 |
Improper header validation in httpsoft/http-message GHSA-9jxr-mwpp-w643 | Medium | Not scored | 21 Apr, 2023 | Packagist httpsoft/http-message |
A potential risk in clusternet which can be leveraged to make a cluster-level privilege escalation CVE-2023-30622, GHSA-833c-xh79-p429, GO-2023-1735 | Medium | 0.2% | 21 Apr, 2023 | Go github.com/clusternet/clusternet |
IO FinNet tss-lib vulnerable to replay attacks involving proofs CVE-2022-47930, GHSA-c58h-qv6g-fw74, GO-2023-1867 | Medium | 0.5% | 21 Apr, 2023 | Go github.com/binance-chain/tss-lib Go github.com/bnb-chain/tss-lib |
Shopware vulnerable to cross-site scripting (XSS) CVE-2022-48150, GHSA-mj9r-fpv3-rgfx | Medium | 0.6% | 21 Apr, 2023 | Packagist shopware/shopware |
RosarioSIS improper access control vulnerability CVE-2023-2202, GHSA-g66v-3v62-g375 | Medium | 0.5% | 21 Apr, 2023 | Packagist francoisjacquet/rosariosis |
Nunjucks autoescape bypass leads to cross site scripting CVE-2023-2142, GHSA-x77j-w7wf-fjmw | Medium | 0.4% | 20 Apr, 2023 | npm nunjucks |
pretalx allows path traversal in HTML export CVE-2023-28458, GHSA-23fx-92m6-4f2g, PYSEC-2023-40 | Medium | 3.5% | 20 Apr, 2023 | PyPI pretalx |
Bypass of CSRF protection in the presence of predictable userInfo CVE-2023-27495, GHSA-qrgf-9gpc-vrxw | Medium | 0.3% | 20 Apr, 2023 | npm @fastify/csrf-protection |
eslint-detailed-reporter vulnerable to cross-site scripting CVE-2022-4942, GHSA-4xr4-89m5-46c7 | Medium | 0.5% | 20 Apr, 2023 | npm eslint-detailed-reporter |
AzuraCast/AzuraCast vulnerable to cross-site scripting CVE-2023-2191, GHSA-q55c-hmpf-6h2g | Medium | 0.5% | 20 Apr, 2023 | Packagist azuracast/azuracast |
`chainId` may be outdated if user changes chains as part of connection in @web3-react CVE-2023-30543, GHSA-8pf3-6fgr-3g3g | Medium | 0.4% | 17 Apr, 2023 | npm @web3-react/coinbase-wallet npm @web3-react/eip1193 npm @web3-react/metamask npm @web3-react/walletconnect |
Insecure header validation in slim/psr7 CVE-2023-30536, GHSA-q2qj-628g-vhfw | Medium | 0.7% | 17 Apr, 2023 | Packagist slim/psr7 |
Path traversal vulnerability in gatsby-plugin-sharp CVE-2023-30548, GHSA-h2pm-378c-pcxx | Medium | 0.9% | 17 Apr, 2023 | npm gatsby-plugin-sharp |
Apache Superset vulnerable to Improper Authorization BIT-superset-2023-27525, CVE-2023-27525, GHSA-7jhg-8m74-6f6g, PYSEC-2026-1163 | Medium | 0.8% | 17 Apr, 2023 | PyPI apache-superset |
Apache Superset Server-Side Request Forgery vulnerability BIT-superset-2023-25504, CVE-2023-25504, GHSA-fxjg-28fm-pfxh, PYSEC-2026-1179 | Medium | 1.0% | 17 Apr, 2023 | PyPI apache-superset |
OpenZeppelin Contracts TransparentUpgradeableProxy clashing selector calls may not be delegated CVE-2023-30541, GHSA-mx2q-35m2-x2rh | Medium | 0.8% | 17 Apr, 2023 | npm @openzeppelin/contracts npm @openzeppelin/contracts-upgradeable |
alextselegidis/easyappointments Improper Access Control vulnerability CVE-2023-2104, GHSA-fc4g-f42p-7rhp | Medium | 0.4% | 15 Apr, 2023 | Packagist alextselegidis/easyappointments |
alextselegidis/easyappointments vulnerable to Stored Cross-site Scripting CVE-2023-2103, GHSA-7m8r-gmc3-3p4v | Medium | 0.5% | 15 Apr, 2023 | Packagist alextselegidis/easyappointments |
alextselegidis/easyappointments vulnerable to Stored Cross-site Scripting CVE-2023-2102, GHSA-j6qq-9939-9jv8 | Medium | 0.5% | 15 Apr, 2023 | Packagist alextselegidis/easyappointments |
matrix-js-sdk vulnerable to invisible eavesdropping in group calls CVE-2023-29529, GHSA-6g67-q39g-r79q | Medium | 0.5% | 14 Apr, 2023 | npm matrix-js-sdk |
nilsteampassnet/teampass vulnerable to stored cross-site scripting (XSS) CVE-2023-2021, GHSA-4h2q-84w7-4mhx | Medium | 0.4% | 13 Apr, 2023 | Packagist nilsteampassnet/teampass |
Microweber vulnerable to cross-site scripting (XSS) CVE-2023-2014, GHSA-f4g6-c47x-qhww | Medium | 0.5% | 13 Apr, 2023 | Packagist microweber/microweber |
CubeFS allows Kubernetes cluster-level privilege escalation CVE-2023-30512, GHSA-9337-8c6c-c2xg | Medium | 0.5% | 12 Apr, 2023 | Go github.com/cubefs/cubefs |
Commonmarker vulnerable to to several quadratic complexity bugs that may lead to denial of service GHSA-48wp-p9qv-4j64 | Medium | Not scored | 11 Apr, 2023 | RubyGems commonmarker |
Nokogiri updates packaged libxml2 to v2.10.4 to resolve multiple CVEs CVE-2023-54354, GHSA-pxvg-2qj5-37jq | Medium | Not scored | 11 Apr, 2023 | RubyGems nokogiri |
vitess allows users to create keyspaces that can deny access to already existing keyspaces CVE-2023-29194, GHSA-735r-hv67-g38f, GO-2023-1717 | Medium | 0.8% | 11 Apr, 2023 | Go vitess.io/vitess |
Answer vulnerable to Exposure of Sensitive Information Through Metadata CVE-2023-1974, GHSA-8jg3-rx43-3fv4, GO-2023-1718 | Medium | 0.6% | 11 Apr, 2023 | Go github.com/answerdev/answer |
Answer vulnerable to Insertion of Sensitive Information Into Sent Data CVE-2023-1975, GHSA-65v8-6pvw-jwvq, GO-2023-1716 | Medium | 0.6% | 11 Apr, 2023 | Go github.com/answerdev/answer |
yuan1994 tpAdmin vulnerable to Server-Side Request Forgery CVE-2023-1971, GHSA-qr7h-8pv2-xvx2 | Medium | 0.6% | 10 Apr, 2023 | Packagist yuan1994/tpadmin |
Allegro Tech BigFlow vulnerable to Missing SSL Certificate Validation CVE-2023-25392, GHSA-w6q2-48ch-fj26, PYSEC-2026-1220 | Medium | 0.4% | 10 Apr, 2023 | PyPI bigflow |
xml2js is vulnerable to prototype pollution CVE-2023-0842, GHSA-776f-qx25-q3cc | Medium | 1.4% | 05 Apr, 2023 | npm xml2js |
thorsten/phpmyfaq vulnerable to stored cross-site scripting (XSS) via category field name parameter CVE-2023-1885, GHSA-xxm6-ff3x-v4vm | Medium | 0.5% | 05 Apr, 2023 | Packagist thorsten/phpmyfaq |
thorsten/phpmyfaq vulnerable to cross-site scripting (XSS) via stopword parameter CVE-2023-1884, GHSA-gmjj-g2rm-xwm7 | Medium | 0.4% | 05 Apr, 2023 | Packagist thorsten/phpmyfaq |