Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Moodle vulnerable to Cross-site Scripting when algebra filter enabled but not functional BIT-moodle-2023-28332, CVE-2023-28332, GHSA-9f45-9qrw-pp4v | Medium | 0.6% | 23 Mar, 2023 | Packagist moodle/moodle |
Moodle vulnerable to Cross-site Scripting BIT-moodle-2023-28331, CVE-2023-28331, GHSA-77jm-f3vj-xvx2 | Medium | 0.7% | 23 Mar, 2023 | Packagist moodle/moodle |
Moodle arbitrary file read vulnerability BIT-moodle-2023-28330, CVE-2023-28330, GHSA-56r9-72vx-q989 | Medium | 1.2% | 23 Mar, 2023 | Packagist moodle/moodle |
Moodle may display roles to users who don't have access to them BIT-moodle-2023-1402, CVE-2023-1402, GHSA-vj5p-fp42-774p | Medium | 0.7% | 23 Mar, 2023 | Packagist moodle/moodle |
tripleo-ansible may disclose important configuration details from an OpenStack deployment CVE-2022-3146, GHSA-w4x6-6w3r-9h2m, PYSEC-2026-1052 | Medium | 0.2% | 23 Mar, 2023 | PyPI tripleo-ansible |
tripleo-ansible may disclose important configuration details from an OpenStack deployment CVE-2022-3101, GHSA-7x96-2w32-w3gw, PYSEC-2026-1051 | Medium | 0.2% | 23 Mar, 2023 | PyPI tripleo-ansible |
Grafana Stored Cross-site Scripting in Graphite FunctionDescription tooltip BIT-grafana-2023-1410, CVE-2023-1410, GHSA-qrrg-gw7w-vp76 | Medium | 1.0% | 23 Mar, 2023 | Go github.com/grafana/grafana |
Non-interactive Tailscale SSH sessions on FreeBSD may use the effective group ID of the tailscaled process CVE-2023-28436, GHSA-vfgq-g5x8-g595, GO-2023-1671 | Medium | 0.5% | 23 Mar, 2023 | Go tailscale.com |
Argo CD authenticated but unauthorized users may enumerate Application names via the API CVE-2022-41354, GHSA-2q5c-qw9c-fmvq, GO-2023-1670 | Medium | 0.6% | 23 Mar, 2023 | Go github.com/argoproj/argo-cd Go github.com/argoproj/argo-cd/v2 |
directus vulnerable to Insertion of Sensitive Information into Log File CVE-2023-28443, GHSA-8vg2-wf3q-mwv7 | Medium | 0.3% | 23 Mar, 2023 | npm directus |
Gophish vulnerable to Cross-site Scripting via crafted landing page CVE-2022-45004, GHSA-55m9-hm92-xm8j | Medium | 0.6% | 22 Mar, 2023 | Go github.com/gophish/gophish |
`cilium-cli` disables etcd authorization for clustermesh clusters CVE-2023-28114, GHSA-6f27-3p6c-p5jc, GO-2023-1653 | Medium | 0.2% | 21 Mar, 2023 | Go github.com/cilium/cilium-cli |
Answer vulnerable to Stored Cross-site Scripting CVE-2023-1535, GHSA-83qr-c7m9-wmgw, GO-2023-1656 | Medium | 0.5% | 21 Mar, 2023 | Go github.com/answerdev/answer |
Answer vulnerable to Stored Cross-site Scripting CVE-2023-1536, GHSA-xvfj-84vc-hrmf, GO-2023-1662 | Medium | 0.5% | 21 Mar, 2023 | Go github.com/answerdev/answer |
Answer has Observable Timing Discrepancy CVE-2023-1538, GHSA-rvjp-8qj4-8p29, GO-2023-1661 | Medium | 0.6% | 21 Mar, 2023 | Go github.com/answerdev/answer |
Answer has Guessable CAPTCHA CVE-2023-1539, GHSA-g44v-6qfm-f6ch, GO-2023-1657 | Medium | 0.6% | 21 Mar, 2023 | Go github.com/answerdev/answer |
Answer has Observable Response Discrepancy CVE-2023-1540, GHSA-6x5v-cxpp-pc5x, GO-2023-1654 | Medium | 0.6% | 21 Mar, 2023 | Go github.com/answerdev/answer |
Answer vulnerable to Business Logic Errors CVE-2023-1542, GHSA-r95w-7cpx-h5mx, GO-2023-1660 | Medium | 0.8% | 21 Mar, 2023 | Go github.com/answerdev/answer |
Pimcore has Cross site Scripting vulnerability in Schedule tab of Documents CVE-2023-1517, GHSA-42x8-2v53-pqmj | Medium | 0.4% | 20 Mar, 2023 | Packagist pimcore/pimcore |
Pimcore has Cross-site Scripting vulnerability in DataObject tooltip field CVE-2023-28429, GHSA-rcg9-hrhx-6q69 | Medium | 0.5% | 20 Mar, 2023 | Packagist pimcore/pimcore |
Pimcore vulnerable to Cross-site Scripting (XSS) in Redirects CVE-2023-1515, GHSA-66cm-c7ch-5j8q | Medium | 0.3% | 20 Mar, 2023 | Packagist pimcore/pimcore |
imgproxy Cross-site Scripting vulnerability CVE-2023-1496, GHSA-ch9g-x9j7-rcgp, GO-2023-1651 | Medium | 1.6% | 19 Mar, 2023 | Go github.com/imgproxy/imgproxy Go github.com/imgproxy/imgproxy/v2 Go github.com/imgproxy/imgproxy/v3 |
Cilium eBPF filters may be temporarily removed during agent restart BIT-cilium-2023-27595, BIT-cilium-operator-2023-27595, BIT-cilium-proxy-2023-27595, BIT-hubble-2023-27595, BIT-hubble-relay-2023-27595, BIT-hubble-ui-2023-27595, BIT-hubble-ui-backend-2023-27595, CVE-2023-27595, GHSA-r5x6-w42p-jhpp, GO-2023-1644 | Medium | 0.7% | 17 Mar, 2023 | Go github.com/cilium/cilium |
Potential network policy bypass when routing IPv6 traffic BIT-cilium-2023-27594, BIT-cilium-operator-2023-27594, BIT-cilium-proxy-2023-27594, BIT-hubble-2023-27594, BIT-hubble-relay-2023-27594, BIT-hubble-ui-2023-27594, BIT-hubble-ui-backend-2023-27594, CVE-2023-27594, GHSA-8fg8-jh2h-f2hc, GO-2023-1643 | Medium | 0.6% | 17 Mar, 2023 | Go github.com/cilium/cilium |
cilium-agent container can access the host via `hostPath` mount BIT-cilium-2023-27593, BIT-cilium-operator-2023-27593, BIT-cilium-proxy-2023-27593, BIT-hubble-2023-27593, BIT-hubble-relay-2023-27593, BIT-hubble-ui-2023-27593, BIT-hubble-ui-backend-2023-27593, CVE-2023-27593, GHSA-4hc4-pgfx-3mrx | Medium | 0.2% | 17 Mar, 2023 | Go github.com/cilium/cilium |
Authorization Bypass Through User-Controlled Key play-with-docker CVE-2023-28109, GHSA-vq59-5x26-h639 | Medium | 0.7% | 17 Mar, 2023 | Go github.com/play-with-docker/play-with-docker |
Improper Authorization in nilsteampassnet/teampass CVE-2023-1463, GHSA-86jq-pwgx-6vrq | Medium | 0.5% | 17 Mar, 2023 | Packagist nilsteampassnet/teampass |
Streamlit publishes previously-patched Cross-site Scripting vulnerability CVE-2023-27494, GHSA-9c6g-qpgj-rvxw, PYSEC-2023-50 | Medium | 0.4% | 16 Mar, 2023 | PyPI streamlit |
Reflective Cross-site Scripting Vulnerability in twitter-bootstrap-rails CVE-2014-4920, GHSA-vpqv-mqvc-pcx2 | Medium | Not scored | 16 Mar, 2023 | RubyGems twitter-bootstrap-rails |
Reflected XSS in Application Logger module GHSA-2xpm-cmvw-3jcc | Medium | Not scored | 16 Mar, 2023 | Packagist pimcore/pimcore |
Cross-site Scripting (XSS) - stored in Print Documents GHSA-rrwm-8wqm-gwgv | Medium | Not scored | 16 Mar, 2023 | Packagist pimcore/pimcore |
Cross-site Scripting (XSS) in UrlSlug Data type CVE-2023-28106, GHSA-x5j3-mq9g-8jc8 | Medium | 0.7% | 16 Mar, 2023 | Packagist pimcore/pimcore |
Authelia allows open redirects on the logout endpoint CVE-2021-29456, GHSA-36f2-fcrx-fp4j | Medium | 0.5% | 16 Mar, 2023 | Go github.com/authelia/authelia/v4 |
Server-Side Request Forgery in Request CVE-2023-28155, GHSA-p8p7-x288-28g6 | Medium | 0.7% | 16 Mar, 2023 | npm @cypress/request npm request |
Cross-site Scripting (XSS) in Document Types CVE-2023-1429, GHSA-3223-w774-99fq | Medium | 0.4% | 16 Mar, 2023 | Packagist pimcore/pimcore |
Possible XSS Security Vulnerability in SafeBuffer#bytesplice CVE-2023-28120, GHSA-pj73-v5mw-pm9j | Medium | 0.9% | 15 Mar, 2023 | RubyGems activesupport |
Sensitive Information in Error Messages in Apache Airflow BIT-airflow-2023-25695, CVE-2023-25695, GHSA-h6g5-wqqr-3mw3, PYSEC-2023-2 | Medium | 1.4% | 15 Mar, 2023 | PyPI apache-airflow |
Microsoft Windows SmartScreen Security Feature Bypass Vulnerability CVE-2023-24880 | MediumExploited | 78.0% | 14 Mar, 2023 | |
fieldpath's Paved.SetValue allows growing arrays up to arbitrary sizes in crossplane-runtime CVE-2023-27483, GHSA-vfvj-3m3g-m532, GO-2023-1623 | Medium | 0.8% | 13 Mar, 2023 | Go github.com/crossplane/crossplane-runtime |
Password Shucking Vulnerability CVE-2023-27580, GHSA-c5vj-f36q-p9vg | Medium | 0.5% | 13 Mar, 2023 | Packagist codeigniter4/shield |
Crossplane-runtime contains Improper Input Validation via Compositions CVE-2023-27484, GHSA-v829-x6hh-cqfq | Medium | 0.7% | 10 Mar, 2023 | Go github.com/crossplane/crossplane |
Path Traversal Vulnerability in `LESS` Parser allows reading of sensitive server files CVE-2023-27577, GHSA-vhm8-wwrf-3gcw | Medium | 0.9% | 10 Mar, 2023 | Packagist flarum/core |
pimcore is vulnerable to cross-site scripting CVE-2023-1312, GHSA-gh4g-65f6-84g5 | Medium | 0.4% | 10 Mar, 2023 | Packagist pimcore/pimcore |
WebAssembly v1.0.29 was discovered to contain a segmentation fault via the component wabt::Decompiler::WrapChild. CVE-2023-27119, PYSEC-2023-318 | Medium | 0.3% | 10 Mar, 2023 | PyPI wabt |
WebAssembly v1.0.29 was discovered to contain a segmentation fault via the component wabt::cat_compute_size. CVE-2023-27115, PYSEC-2023-316 | Medium | 0.3% | 10 Mar, 2023 | PyPI wabt |
Cross-site Scripting in django-ajax-utilities CVE-2017-20182, GHSA-p4g9-c9qr-wmg5, PYSEC-2026-803 | Medium | 0.6% | 10 Mar, 2023 | PyPI django-ajax-utilities |
Consul Server Panic when Ingress and API Gateways Configured with Peering Connections BIT-consul-2023-0845, CVE-2023-0845, GHSA-wj6x-hcc2-f32j, GO-2023-1639 | Medium | 1.0% | 09 Mar, 2023 | Go github.com/hashicorp/consul |
Cross-site Scripting (XSS) in pimcore/pimcore CVE-2023-1286, GHSA-8jv7-vwrc-mv4g | Medium | 0.4% | 09 Mar, 2023 | Packagist pimcore/pimcore |
Buildkit credentials inlined to Git URLs could end up in provenance attestation CVE-2023-26054, GHSA-gc89-7gcr-jxqc | Medium | 1.0% | 07 Mar, 2023 | Go github.com/moby/buildkit |
Directus vulnerable to extraction of password hashes through export querying CVE-2023-27481, GHSA-m5q3-8wgf-x8xf | Medium | 0.6% | 07 Mar, 2023 | npm directus |