Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Microsoft Windows COM+ Event System Service Privilege Escalation Vulnerability CVE-2022-41033 | HighExploited | 1.9% | 11 Oct, 2022 | |
Microsoft Windows Print Spooler Privilege Escalation Vulnerability CVE-2022-38028 | HighExploited | 14.9% | 11 Oct, 2022 | |
loader-utils is vulnerable to Regular Expression Denial of Service (ReDoS) CVE-2022-37599, GHSA-hhq3-ff78-jv3g | High | 2.8% | 11 Oct, 2022 | npm loader-utils |
golang.org/x/text/language Denial of service via crafted Accept-Language header CVE-2022-32149, GHSA-69ch-w2m2-3vjp, GO-2022-1059 | High | 1.8% | 11 Oct, 2022 | Go golang.org/x/text |
melisplatform/melis-asset-manager vulnerable to Path Traversal CVE-2022-39296, GHSA-7fj2-rrq6-rphq | High | 1.9% | 11 Oct, 2022 | Packagist melisplatform/melis-asset-manager |
django-mfa2 vulnerable to MFA Replay attack CVE-2022-42731, GHSA-vw39-2wj9-4q86, PYSEC-2022-303 | High | 1.5% | 11 Oct, 2022 | PyPI django-mfa2 |
Traefik HTTP/2 connections management could cause a denial of service CVE-2022-39271, GHSA-c6hx-pjc3-7fqr | High | 1.4% | 10 Oct, 2022 | Go github.com/traefik/traefik/v2 |
fastify vulnerable to denial of service via malicious Content-Type CVE-2022-39288, GHSA-455w-c45v-86rg | High | 59.2% | 10 Oct, 2022 | npm fastify |
tiny-csrf has openly visible CSRF tokens CVE-2022-39287, GHSA-pj2c-h76w-vv6f | High | 0.5% | 07 Oct, 2022 | npm tiny-csrf |
Backdrop CMS Unrestricted File Upload vulnerability CVE-2022-42092, GHSA-33c9-rppf-m7fq | High | 2.1% | 07 Oct, 2022 | Packagist backdrop/backdrop |
Apache Airflow may allow authenticated users who have been deactivated to continue using the UI or API BIT-airflow-2022-41672, CVE-2022-41672, GHSA-3q8r-f3pj-3gc4, PYSEC-2022-42983 | High | 1.5% | 07 Oct, 2022 | PyPI apache-airflow |
generator-jhipster vulnerable to login check Regular Expression Denial of Service GHSA-8w7w-67mw-r5p7 | High | Not scored | 06 Oct, 2022 | npm generator-jhipster |
Moodle Cross-Site Request Forgery (CSRF) BIT-moodle-2022-2986, CVE-2022-2986, GHSA-xjr3-fwp9-9g96 | High | 0.5% | 06 Oct, 2022 | Packagist moodle/moodle |
rdiffweb Path Traversal vulnerability CVE-2022-3389, GHSA-hrrm-895h-xh34, PYSEC-2022-302 | High | 1.4% | 06 Oct, 2022 | PyPI rdiffweb |
FlyteAdmin's Default OAuth Authorization Server secret must be rotated CVE-2022-39273, GHSA-67x4-qr35-qvrm, GO-2022-1043 | High | 0.9% | 05 Oct, 2022 | Go github.com/flyteorg/flyteadmin |
Dapr Dashboard vulnerable to Incorrect Access Control CVE-2022-38817, GHSA-2w6m-q946-399r, GO-2022-1033 | High | 3.9% | 04 Oct, 2022 | Go github.com/dapr/dashboard |
Snyk CLI affected by Command Injection vulnerability CVE-2022-40764, GHSA-hpqj-7cj6-hfj8 | High | 0.6% | 03 Oct, 2022 | npm snyk npm snyk-go-plugin |
LIEF vulnerable to denial of service through segmentation fault CVE-2022-40922, GHSA-38hf-c37x-32hv, PYSEC-2022-43138 | High | 0.7% | 03 Oct, 2022 | PyPI lief |
Heartex - Label Studio Community Edition vulnerable to SSRF in the Data Import module CVE-2022-36551, GHSA-pc6f-259w-w3j6, PYSEC-2022-300 | High | 6.9% | 03 Oct, 2022 | PyPI label-studio |
Microsoft Exchange Server Remote Code Execution Vulnerability CVE-2022-41082 | HighExploited | 100.0% | 03 Oct, 2022 | |
Microsoft Exchange Server Server-Side Request Forgery Vulnerability CVE-2022-41040 | HighExploited | 100.0% | 03 Oct, 2022 | |
Cloudflare GoFlow vulnerable to a Denial of Service in the sflow packet handling package CVE-2022-2529, GHSA-9rpw-2h95-666c, GO-2022-1032 | High | 1.0% | 01 Oct, 2022 | Go github.com/cloudflare/goflow Go github.com/cloudflare/goflow/v3 |
Cisco SD-WAN Path Traversal Vulnerability CVE-2022-20775 | HighExploited | 12.0% | 30 Sep, 2022 | |
Moodle Stored Cross-site Scripting and page denial of service BIT-moodle-2022-40313, CVE-2022-40313, GHSA-jqgr-gh62-jf53 | High | 0.7% | 30 Sep, 2022 | Packagist moodle/moodle |
Joplin Remote Code Execution CVE-2022-40277, GHSA-mjr5-v9c9-mm7g | High | 0.5% | 30 Sep, 2022 | npm joplin |
rdiffweb's lack of token name length limit can result in DoS or memory corruption CVE-2022-3371, GHSA-3fhq-72hw-jqwv, PYSEC-2022-299 | High | 1.3% | 30 Sep, 2022 | PyPI rdiffweb |
react-native-reanimated vulnerable to ReDoS CVE-2022-24373, GHSA-2j79-8pqc-r7x6 | High | 1.6% | 30 Sep, 2022 | npm react-native-reanimated |
css-what vulnerable to ReDoS due to use of insecure regular expression CVE-2022-21222, GHSA-p28h-cc7q-c4fg | High | 1.9% | 30 Sep, 2022 | npm css-what |
rdiffweb's unlimited length Fullname field can lead to DoS CVE-2022-3364, GHSA-fqfg-c577-2vc3, PYSEC-2022-298 | High | 1.2% | 29 Sep, 2022 | PyPI rdiffweb |
go-resolver's DNSSEC validation not performed correctly CVE-2022-3347, GHSA-jr65-gpj5-cw74, GO-2022-1026 | High | 0.3% | 29 Sep, 2022 | Go github.com/peterzen/goresolver |
go-resolver vulnerable to attacker-controlled domains due to unvalidated RRSIG RRs CVE-2022-3346, GHSA-87mm-qxm5-cp3f, GO-2022-0979 | High | 0.2% | 29 Sep, 2022 | Go github.com/peterzen/goresolver |
When matrix-nio receives forwarded room keys, the receiver doesn't check if it requested the key from the forwarder CVE-2022-39254, GHSA-w4pr-4vjg-hffh, PYSEC-2026-842 | High | 0.7% | 29 Sep, 2022 | PyPI matrix-nio |
d3-color vulnerable to ReDoS GHSA-36jr-mh4h-2g58 | High | Not scored | 29 Sep, 2022 | npm d3-color |
matrix-js-sdk subject to user impersonation due to key/device identifier confusion in SAS verification CVE-2022-39250, GHSA-5w8r-8pgj-5jmf | High | 1.2% | 29 Sep, 2022 | npm matrix-js-sdk |
Hertz contains path traversal via normalizePath function CVE-2022-40082, GHSA-c9qr-f6c8-rgxf, GO-2022-1027 | High | 1.1% | 29 Sep, 2022 | Go github.com/cloudwego/hertz |
Upstash Adapter missing token verification CVE-2022-39263, GHSA-4rxr-27mm-mxq9 | High | 0.7% | 28 Sep, 2022 | npm @next-auth/upstash-redis-adapter |
matrix-js-sdk subject to user spoofing via Olm/Megolm protocol confusion CVE-2022-39251, GHSA-r48r-j8fx-mq2c | High | 1.2% | 28 Sep, 2022 | npm matrix-js-sdk |
matrix-js-sdk subject to impersonated messages due to permissive key forwarding CVE-2022-39249, GHSA-6263-x97c-c4gg | High | 1.3% | 28 Sep, 2022 | npm matrix-js-sdk |
Twig may load a template outside a configured directory when using the filesystem loader BIT-drupal-2022-39261, CVE-2022-39261, DRUPAL-CORE-2022-016, GHSA-52m2-vc4m-jj33 | High | 3.2% | 28 Sep, 2022 | Packagist drupal/core Packagist twig/twig |
Strapi mishandles hidden attributes within admin API responses CVE-2022-31367, GHSA-4phg-hpqm-c3j4 | High | 1.7% | 27 Sep, 2022 | npm @strapi/strapi npm strapi |
Brokercap Bifrost subject to authentication bypass when using HTTP basic authentication CVE-2022-39219, GHSA-p6fh-xc6r-g5hw, GO-2022-1023 | High | 1.2% | 27 Sep, 2022 | Go github.com/brokercap/Bifrost |
ReDoS issue in dparse CVE-2022-39280, GHSA-8fg9-p83m-x5pq, PYSEC-2022-301 | High | 1.3% | 27 Sep, 2022 | PyPI dparse |
rdiffweb vulnerable to potential DoS via memory consumption CVE-2022-3298, GHSA-xhw9-4wqq-x67v, PYSEC-2022-294 | High | 1.2% | 26 Sep, 2022 | PyPI rdiffweb |
rdiffweb's unlimited username field length can lead to DoS CVE-2022-3290, GHSA-5v95-j4rr-6f3c, PYSEC-2022-292, PYSEC-2022-43184 | High | 0.9% | 26 Sep, 2022 | PyPI rdiffweb |
rdiffweb's unlimited length email field can lead to DoS CVE-2022-3272, GHSA-qrj3-hrgj-fm7r, PYSEC-2022-291 | High | 1.8% | 26 Sep, 2022 | PyPI rdiffweb |
Centreon SQL Injection vulnerability via esc_name parameter CVE-2022-40043, GHSA-25gv-wg6f-6frp | High | 1.4% | 26 Sep, 2022 | Packagist centreon/centreon |
Google Chromium Network Service Use-After-Free Vulnerability CVE-2022-3038 | HighExploited | 24.9% | 26 Sep, 2022 | |
rdiffweb allows unlimited length of root directory name, which could result in DoS CVE-2022-3295, GHSA-hrj7-f62f-j7x7, PYSEC-2022-293 | High | 1.2% | 26 Sep, 2022 | PyPI rdiffweb |
Dompdf allows remote file inclusion because URI validation failure does not halt font registration CVE-2022-41343, GHSA-6x28-7h8c-chx4 | High | 6.0% | 25 Sep, 2022 | Packagist dompdf/dompdf |
Hyperledger Fabric subject to Denial of Service via non-validated request CVE-2022-35253, GHSA-9w7j-q3xw-p9vh | High | Not scored | 25 Sep, 2022 | Go github.com/hyperledger/fabric |