Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
thorsten/phpmyfaq vulnerable to improper access control CVE-2023-1883, GHSA-2wjp-w7g7-h63q | Medium | 0.5% | 05 Apr, 2023 | Packagist thorsten/phpmyfaq |
thorsten/phpmyfaq vulnerable to stored cross-site scripting (XSS) via updatecategory parameter CVE-2023-1879, GHSA-m9qm-m5w5-9pgj | Medium | 0.5% | 05 Apr, 2023 | Packagist thorsten/phpmyfaq |
thorsten/phpmyfaq vulnerable to stored cross-site scripting (XSS) via HTML export CVE-2023-1756, GHSA-8p48-ghv5-7qq7 | Medium | 0.5% | 05 Apr, 2023 | Packagist thorsten/phpmyfaq |
Uvdesk vulnerable to stored cross-site scripting (XSS) CVE-2023-0325, GHSA-fwhv-9phj-wrj5 | Medium | 0.7% | 04 Apr, 2023 | Packagist uvdesk/community-skeleton |
Docker Swarm encrypted overlay network traffic may be unencrypted CVE-2023-28841, GHSA-33pg-m6jh-5237, GO-2023-1700 | Medium | 0.7% | 04 Apr, 2023 | Go github.com/docker/docker |
Docker Swarm encrypted overlay network with a single endpoint is unauthenticated CVE-2023-28842, GHSA-6wrf-mxfj-pf5p, GO-2023-1701 | Medium | 1.4% | 04 Apr, 2023 | Go github.com/docker/docker |
Phachon mm-wiki vulnerable to stored cross-site scripting (XSS) CVE-2020-19277, GHSA-f7rp-xx67-4pj9 | Medium | 0.5% | 04 Apr, 2023 | Go github.com/phachon/mm-wiki |
Directus API vulnerable to denial of service CVE-2020-19850, GHSA-3gvp-54v2-2jrp | Medium | 1.1% | 04 Apr, 2023 | npm directus |
Pandao Editor.md vulnerable to cross-site scripting (XSS) in editor parameter CVE-2020-19698, GHSA-5p84-mmh9-pxgr | Medium | 0.7% | 04 Apr, 2023 | npm editor.md |
Pandao Editor.md vulnerable to cross-site scripting (XSS) in iframe src parameter CVE-2020-19697, GHSA-w974-rq9x-mh3v | Medium | 0.7% | 04 Apr, 2023 | npm editor.md |
Silverstripe Form Capture vulnerable to stored cross-site-scripting CVE-2023-28851, GHSA-38h6-gmr2-j4wx | Medium | 0.4% | 03 Apr, 2023 | Packagist andrewhaine/silverstripe-form-capture Packagist bigfork/silverstripe-form-capture |
Pimcore Perspective Editor vulnerable to stored cross-site scripting (XSS) in perspective name CVE-2023-28850, GHSA-fq8q-55v3-2986 | Medium | 0.6% | 03 Apr, 2023 | Packagist pimcore/perspective-editor |
Wagtail vulnerable to denial-of-service via memory exhaustion when uploading large files CVE-2023-28837, GHSA-33pv-vcgh-jfg9, PYSEC-2023-56 | Medium | 1.1% | 03 Apr, 2023 | PyPI wagtail |
configobj ReDoS exploitable by developer using values in a server-side configuration file CVE-2023-26112, GHSA-c33w-24p9-8m24, PYSEC-2026-1270 | Medium | 1.3% | 03 Apr, 2023 | PyPI configobj |
request-baskets vulnerable to Server-Side Request Forgery CVE-2023-27163, GHSA-58g2-vgpg-335q | Medium | 6.5% | 31 Mar, 2023 | Go github.com/darklynx/request-baskets |
Mattermost fails to properly authentication inviter's permissions to private channel BIT-mattermost-2023-1774, CVE-2023-1774, GHSA-9hj7-v56g-rhf6 | Medium | 0.3% | 31 Mar, 2023 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 |
Mattermost vulnerable to information disclosure BIT-mattermost-2023-1775, CVE-2023-1775, GHSA-8jhh-3jf2-pfwr | Medium | 0.5% | 31 Mar, 2023 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 |
Mattermost vulnerable to cross-site scripting (XSS) BIT-mattermost-2023-1776, CVE-2023-1776, GHSA-63f2-6959-2pxj | Medium | 0.4% | 31 Mar, 2023 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 |
Mattermost vulnerable to information disclosure BIT-mattermost-2023-1777, CVE-2023-1777, GHSA-3wq5-3f56-v5xc | Medium | 0.5% | 31 Mar, 2023 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v6 |
phpMyFAQ Code Injection vulnerability CVE-2023-1761, GHSA-6cpg-gqgq-2rrr | Medium | 0.5% | 31 Mar, 2023 | Packagist thorsten/phpmyfaq |
phpMyFAQ Stored Cross-site Scripting vulnerability CVE-2023-1760, GHSA-7q9c-f2v8-j8gw | Medium | 0.5% | 31 Mar, 2023 | Packagist thorsten/phpmyfaq |
phpMyFAQ Stored Cross-site Scripting vulnerability CVE-2023-1759, GHSA-4wfc-ghv5-2v7j | Medium | 0.5% | 31 Mar, 2023 | Packagist thorsten/phpmyfaq |
phpMyFAQ Cross-site Scripting vulnerability CVE-2023-1755, GHSA-hp8m-g55r-9cfq | Medium | 0.6% | 31 Mar, 2023 | Packagist thorsten/phpmyfaq |
phpMyFAQ vulnerable to improper input validation CVE-2023-1754, GHSA-gvg8-r8w2-9gfj | Medium | 0.6% | 31 Mar, 2023 | Packagist thorsten/phpmyfaq |
unpoly-rails Denial of Service vulnerability CVE-2023-28846, GHSA-m875-3xf6-mf78 | Medium | 1.0% | 30 Mar, 2023 | RubyGems unpoly-rails |
runc AppArmor bypass with symlinked /proc CVE-2023-28642, GHSA-g2j6-57v7-gm8c, GO-2023-1683 | Medium | 0.3% | 30 Mar, 2023 | Go github.com/opencontainers/runc |
angular vulnerable to regular expression denial of service via the <input type="url"> element CVE-2023-26118, GHSA-qwqh-hm9m-p5hr | Medium | 1.7% | 30 Mar, 2023 | npm angular |
angular vulnerable to regular expression denial of service via the $resource service CVE-2023-26117, GHSA-2qqx-w9hr-q5gx | Medium | 1.7% | 30 Mar, 2023 | npm angular |
angular vulnerable to regular expression denial of service via the angular.copy() utility CVE-2023-26116, GHSA-2vrf-hf26-jrp5 | Medium | 1.7% | 30 Mar, 2023 | npm angular |
HashiCorp Vault’s Microsoft SQL Database Storage Backend Vulnerable to SQL Injection Via Configuration File BIT-vault-2023-0620, CVE-2023-0620, GHSA-v3hp-mcj5-pg39, GO-2023-1685 | Medium | 0.4% | 30 Mar, 2023 | Go github.com/hashicorp/vault |
HashiCorp Vault's PKI mount vulnerable to denial of service BIT-vault-2023-0665, CVE-2023-0665, GHSA-hwc3-3qh6-r4gg, GO-2023-1708 | Medium | 0.3% | 30 Mar, 2023 | Go github.com/hashicorp/vault |
HashiCorp Vault's implementation of Shamir's secret sharing vulnerable to cache-timing attacks BIT-vault-2023-25000, CVE-2023-25000, GHSA-vq4h-9ghm-qmrr, GO-2023-1709 | Medium | 0.2% | 30 Mar, 2023 | Go github.com/hashicorp/vault |
pimcore is vulnerable to cross-site scripting in translate module CVE-2023-1704, GHSA-hfmg-g39c-5444 | Medium | 0.4% | 29 Mar, 2023 | Packagist pimcore/pimcore |
pimcore is vulnerable to cross-site scripting in Composite indices key field CVE-2023-1703, GHSA-4f25-2x2c-vg6v | Medium | 0.5% | 29 Mar, 2023 | Packagist pimcore/pimcore |
Pimcore Cross-site Scripting in Predefined Asset Metadata module in Settings CVE-2023-1702, GHSA-6qjm-39vh-729w | Medium | 0.4% | 29 Mar, 2023 | Packagist pimcore/pimcore |
Pimcore vulnerable to Reflected XSS in Predefined Properties module in Settings CVE-2023-1701, GHSA-7r35-chv4-xr3r | Medium | 0.4% | 29 Mar, 2023 | Packagist pimcore/pimcore |
Fluid Components TYPO3 extension vulnerable to Cross-Site Scripting CVE-2023-28604, GHSA-8648-h559-8h42 | Medium | 0.5% | 27 Mar, 2023 | Packagist sitegeist/fluid-components |
Podman Time-of-check Time-of-use (TOCTOU) Race Condition CVE-2023-0778, GHSA-qwqv-rqgf-8qh8, GO-2023-1681 | Medium | 0.5% | 27 Mar, 2023 | Go github.com/containers/podman/v4 |
Magento Open Source allows Incorrect Authorization CVE-2023-22251, GHSA-2wm7-mmgc-qxr3 | Medium | 0.6% | 27 Mar, 2023 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento Open Source allows Improper Access Control CVE-2023-22250, GHSA-4h7p-4vq8-g2gh | Medium | 1.0% | 27 Mar, 2023 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento Open Source allows Cross-Site Scripting (XSS) CVE-2023-22249, GHSA-fxcr-gvcw-hmqm | Medium | 58.5% | 27 Mar, 2023 | Packagist magento/community-edition |
pgAdmin 4 vulnerable to directory traversal CVE-2023-0241, GHSA-9crj-hpxh-f6qg, PYSEC-2026-1771 | Medium | 8.8% | 27 Mar, 2023 | PyPI pgadmin4 |
TensorFlow Denial of Service vulnerability BIT-tensorflow-2023-25661, CVE-2023-25661, GHSA-fxgc-95xx-grvq, PYSEC-2026-1952, PYSEC-2026-3182 | Medium | 0.4% | 27 Mar, 2023 | PyPI tensorflow PyPI tensorflow-cpu |
Complianz WordPress plugin vulnerable to cross-site scripting CVE-2023-1069, GHSA-7j4m-f87g-5r9r | Medium | 0.6% | 27 Mar, 2023 | Packagist really-simple-plugins/complianz-gdpr |
redis-py Race Condition vulnerability CVE-2023-28858, GHSA-24wv-mv5m-xv4h, PYSEC-2023-45 | Medium | 1.0% | 26 Mar, 2023 | PyPI redis |
OpenShift Assisted Installer leaks image pull secrets as plaintext in installation logs CVE-2021-3684, GHSA-g8xm-p2h4-v6jp | Medium | 0.2% | 24 Mar, 2023 | Go github.com/openshift/assisted-installer |
Moodle may allow students to bypass sequential navigation during a quiz attempt BIT-moodle-2022-40208, CVE-2022-40208, GHSA-948f-j464-rfj2 | Medium | 0.6% | 24 Mar, 2023 | Packagist moodle/moodle |
Remote file existence check vulnerability in `mlflow server` and `mlflow ui` CLIs BIT-mlflow-2023-1176, CVE-2023-1176, GHSA-wp72-7hj9-5265, PYSEC-2023-28 | Medium | 0.6% | 24 Mar, 2023 | PyPI mlflow |
Moodle may allow teachers to access the names of users they could not otherwise access BIT-moodle-2023-28336, CVE-2023-28336, GHSA-prjm-2fj2-787f | Medium | 0.7% | 23 Mar, 2023 | Packagist moodle/moodle |
Moodle may allow authenticated users to enumerate other user's names via learning plans page BIT-moodle-2023-28334, CVE-2023-28334, GHSA-hh52-g5c4-wprh | Medium | 0.6% | 23 Mar, 2023 | Packagist moodle/moodle |