Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
frp_form_answers allows Cross-site Scripting CVE-2023-26091, GHSA-q3r2-23r8-wqr9 | Medium | 0.4% | 26 Feb, 2023 | Packagist frappant/frp-form-answers |
@braintree/sanitize-url Cross-site Scripting vulnerability CVE-2022-48345, GHSA-q8gg-vj6m-hgmj | Medium | 0.6% | 24 Feb, 2023 | npm @braintree/sanitize-url |
MantisBT may expose private issues' summaries to unauthorized users CVE-2023-22476, GHSA-hf4x-6h87-hm79 | Medium | 0.6% | 23 Feb, 2023 | Packagist mantisbt/mantisbt |
modoboa Cross-site Scripting vulnerability CVE-2023-0949, GHSA-mgmm-cmhj-2h5f, PYSEC-2023-33 | Medium | 0.5% | 22 Feb, 2023 | PyPI modoboa |
Answer vulnerable to Cross-site Scripting CVE-2023-0934, GHSA-6cvf-m58q-h9wf, GO-2023-1592 | Medium | 0.4% | 21 Feb, 2023 | Go github.com/answerdev/answer |
iziModal Cross-site Scripting vulnerability CVE-2021-32860, GHSA-h685-83w4-3ph3 | Medium | 0.6% | 21 Feb, 2023 | npm izimodal |
Baremetrics date range picker vulnerable to Cross-site Scripting CVE-2021-32859, GHSA-465f-mxxh-grc4 | Medium | 0.5% | 21 Feb, 2023 | npm baremetrics-calendar |
Microweber Cross-site Scripting vulnerability CVE-2021-32856, GHSA-mv37-xrmc-hf64 | Medium | 0.6% | 21 Feb, 2023 | Packagist microweber/microweber |
Vditor Cross-site Scripting vulnerability CVE-2021-32855, GHSA-vfmp-9999-6wqj | Medium | 0.6% | 21 Feb, 2023 | npm vditor |
textAngular Cross-site Scripting vulnerability CVE-2021-32854, GHSA-7h4w-6p98-r3wx | Medium | 0.5% | 21 Feb, 2023 | npm textangular |
Mind-elixir Cross-site Scripting vulnerability CVE-2021-32851, GHSA-m22q-97p5-79v2 | Medium | 0.7% | 20 Feb, 2023 | npm mind-elixir |
@claviska/jquery-minicolors vulnerable to Cross-site Scripting CVE-2021-32850, GHSA-crh5-vv2v-c82q | Medium | 0.8% | 20 Feb, 2023 | npm @claviska/jquery-minicolors |
generator-hottowel Cross-site Scripting vulnerability CVE-2016-15025, GHSA-f8hv-rx9p-f9r4 | Medium | 0.5% | 20 Feb, 2023 | npm generator-hottowel |
Pixelfed may allow unauthorized actor to view private posts CVE-2023-0914, GHSA-qh6w-pq52-qxxq | Medium | 0.6% | 19 Feb, 2023 | Packagist pixelfed/pixelfed |
Pixelfed allows user enumeration via reset password functionality CVE-2023-0901, GHSA-vjxx-jgcx-9fq2 | Medium | 0.6% | 18 Feb, 2023 | Packagist pixelfed/pixelfed |
Cross-site Scripting in jspreadsheet CVE-2022-48115, GHSA-q82h-q47j-f492 | Medium | 0.4% | 17 Feb, 2023 | npm jspreadsheet-ce |
Stored cross site scripting in changedetection.io CVE-2023-24769, GHSA-68wj-c2jw-5pp9, PYSEC-2023-10 | Medium | 0.6% | 17 Feb, 2023 | PyPI changedetection-io PyPI changedetection.io |
Moodle Cross-site Scripting vulnerability BIT-moodle-2023-23922, CVE-2023-23922, GHSA-grmj-gpwm-98ww | Medium | 0.9% | 17 Feb, 2023 | Packagist moodle/moodle |
Moodle Cross-site Scripting vulnerability BIT-moodle-2023-23921, CVE-2023-23921, GHSA-97qf-pq7x-964m | Medium | 0.8% | 17 Feb, 2023 | Packagist moodle/moodle |
Misinterpretation of Input in thorsten/phpmyfaq CVE-2023-0880, GHSA-f9c6-4j9h-6c5r | Medium | 0.6% | 17 Feb, 2023 | Packagist thorsten/phpmyfaq |
Uncontrolled Resource Consumption in Hashicorp Nomad CVE-2023-0821, GHSA-w479-w22g-cffh, GO-2023-1581 | Medium | 0.8% | 17 Feb, 2023 | Go github.com/hashicorp/nomad |
Uncontrolled Resource Consumption in golang.org/x/image CVE-2022-41727, GHSA-qgc7-mgm3-q253, GO-2023-1572 | Medium | 0.3% | 16 Feb, 2023 | Go golang.org/x/image |
Data Amplification in HashiCorp go-getter CVE-2023-0475, GHSA-jpxj-2jvg-6jv9, GO-2023-1578 | Medium | 0.5% | 16 Feb, 2023 | Go github.com/hashicorp/go-getter Go github.com/hashicorp/go-getter/v2 |
CRLF Injection in Nodejs ‘undici’ via host BIT-node-2023-23936, BIT-node-min-2023-23936, CVE-2023-23936, GHSA-5r9g-qh6m-jxff | Medium | 1.1% | 16 Feb, 2023 | npm undici |
Joomla! Improper Access Control Vulnerability CVE-2023-23752 | MediumExploited | 99.8% | 16 Feb, 2023 | |
OCI image importer memory exhaustion in github.com/containerd/containerd CVE-2023-25153, GHSA-259w-8hf6-59c2, GO-2023-1573 | Medium | 0.4% | 16 Feb, 2023 | Go github.com/containerd/containerd |
Supplementary groups are not set up properly in github.com/containerd/containerd CVE-2023-25173, GHSA-hmfx-3pcx-653p, GO-2023-1574 | Medium | 0.5% | 16 Feb, 2023 | Go github.com/containerd/containerd |
Cross Site Scripting (XSS) in Model\DataObject\Data\UrlSlug GHSA-76r7-h46w-463r | Medium | Not scored | 15 Feb, 2023 | Packagist pimcore/pimcore |
Cross Site Scripting in usememos/memos CVE-2022-25978, GHSA-9w8x-5hv5-r6gw, GO-2023-1566 | Medium | 0.5% | 15 Feb, 2023 | Go github.com/usememos/memos |
Cross site scripting Vulnerability in backstage Software Catalog CVE-2023-25571, GHSA-7hv8-3fr9-j2hv | Medium | 0.5% | 14 Feb, 2023 | npm @backstage/catalog-model npm @backstage/core-components npm @backstage/plugin-catalog-backend |
Cross-site Scripting in pimcore CVE-2023-0827, GHSA-3w96-p6vh-c298 | Medium | 3.0% | 14 Feb, 2023 | Packagist pimcore/pimcore |
Cross-Site-Scripting attack on `<RichTextField>` CVE-2023-25572, GHSA-5jcr-82fh-339v | Medium | 0.7% | 13 Feb, 2023 | npm ra-ui-materialui npm react-admin |
Cross-site Scripting in UDX Stateless Media Plugin CVE-2022-4905, GHSA-9j2p-8qqf-h55c | Medium | 0.7% | 13 Feb, 2023 | Packagist wpcloud/wp-stateless |
Cross-site scripting in CKEditor5 CVE-2022-48110, GHSA-6p89-3p7c-qrhv | Medium | 2.1% | 13 Feb, 2023 | npm ckeditor5 |
Cross-site Scripting vulnerability in drag-and-drop upload of phpMyAdmin BIT-phpmyadmin-2023-25727, CVE-2023-25727, GHSA-6hr3-44gx-g6wh | Medium | 1.2% | 13 Feb, 2023 | Packagist phpmyadmin/phpmyadmin |
Path traversal vulnerability in glance CVE-2022-25937, GHSA-3hjh-5hgx-f5wh | Medium | 1.1% | 13 Feb, 2023 | npm glance |
Cross-site Scripting in thorsten/phpmyfaq CVE-2023-0794, GHSA-gf34-hh5r-f74h | Medium | 0.6% | 12 Feb, 2023 | Packagist thorsten/phpmyfaq |
Code Injection in thorsten/phpmyfaq CVE-2023-0792, GHSA-wjrj-jc3w-ppfw | Medium | 0.6% | 12 Feb, 2023 | Packagist thorsten/phpmyfaq |
Cross-site Scripting in thorsten/phpmyfaq CVE-2023-0791, GHSA-c38p-vw6j-qjpr | Medium | 0.6% | 12 Feb, 2023 | Packagist thorsten/phpmyfaq |
Cross-site Scripting in thorsten/phpmyfaq CVE-2023-0787, GHSA-gxxj-x426-xj2w | Medium | 0.5% | 12 Feb, 2023 | Packagist thorsten/phpmyfaq |
Cross-site Scripting in thorsten/phpmyfaq CVE-2023-0786, GHSA-jfpg-jggf-rpph | Medium | 0.6% | 12 Feb, 2023 | Packagist thorsten/phpmyfaq |
Improper Restriction of Rendered UI Layers or Frames in cockpit-hq/cockpit CVE-2023-0780, GHSA-gm7m-rqf8-jx4m | Medium | 0.4% | 11 Feb, 2023 | Packagist cockpit-hq/cockpit |
Denial of service via HAMT Decoding Panics CVE-2023-23625, GHSA-q264-w97q-q778, GO-2023-1557 | Medium | 0.7% | 10 Feb, 2023 | Go github.com/ipfs/go-unixfs |
IPFS go-bitfield vulnerable to DoS via malformed size arguments CVE-2023-23626, GHSA-2h6c-j3gf-xp9r, GO-2023-1558 | Medium | 0.9% | 10 Feb, 2023 | Go github.com/ipfs/go-bitfield |
Formwork Cross-site Scripting (XSS) from Page title field CVE-2023-24230, GHSA-fvrh-wrpf-6q7h | Medium | 0.5% | 10 Feb, 2023 | Packagist getformwork/formwork |
Argo CD leaks repository credentials in user-facing error messages and in logs BIT-argo-cd-2023-25163, CVE-2023-25163, GHSA-mv6w-j4xc-qpfw, GO-2023-1548 | Medium | 0.8% | 08 Feb, 2023 | Go github.com/argoproj/argo-cd/v2 |
Helm vulnerable to information disclosure via getHostByName Function BIT-helm-2023-25165, CVE-2023-25165, GHSA-pwcw-6f5g-gxf8, GO-2023-1547 | Medium | 0.8% | 08 Feb, 2023 | Go helm.sh/helm/v3 |
Credential disclosure in syft when SYFT_ATTEST_PASSWORD environment variable set CVE-2023-24827, GHSA-jp7v-3587-2956, GO-2023-1533 | Medium | 0.8% | 08 Feb, 2023 | Go github.com/anchore/syft |
@sideway/formula contains Regular Expression Denial of Service (ReDoS) Vulnerability CVE-2023-25166, GHSA-c2jc-4fpr-4vhg | Medium | 0.6% | 08 Feb, 2023 | npm @sideway/formula |
Answer vulnerable to Race Condition CVE-2023-0739, GHSA-qx34-47fc-vv79, GO-2023-1553 | Medium | 0.7% | 08 Feb, 2023 | Go github.com/answerdev/answer |