Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Cross-site Scripting (XSS) in wallabag/wallabag CVE-2023-0736, GHSA-3x2c-87cq-qx49 | Medium | 0.4% | 07 Feb, 2023 | Packagist wallabag/wallabag |
Cross-Site Request Forgery (CSRF) in wallabag/wallabag CVE-2023-0735, GHSA-2qxp-xmx6-cq4f | Medium | 0.3% | 07 Feb, 2023 | Packagist wallabag/wallabag |
Mayan EDMS DMS XSS vulnerability CVE-2022-47419, GHSA-5m6v-2xgf-qhrw, PYSEC-2023-276 | Medium | 0.5% | 07 Feb, 2023 | PyPI mayan-edms |
Cipher.update_into can corrupt memory if passed an immutable python object as the outbuf CVE-2023-23931, GHSA-w7pp-m8wf-vj6r, PYSEC-2023-11 | Medium | 1.3% | 07 Feb, 2023 | PyPI cryptography |
Panic during unmarshal of Hello Verify Request in github.com/pion/dtls/v2 GHSA-4xgv-j62q-h3rj, GO-2023-1534 | Medium | Not scored | 07 Feb, 2023 | Go github.com/pion/dtls Go github.com/pion/dtls/v2 |
Panic during unmarshal of Hello Verify Request in github.com/pion/dtls/v2 GHSA-hxp2-xqf3-v83h, GO-2023-1535 | Medium | Not scored | 07 Feb, 2023 | Go github.com/pion/dtls Go github.com/pion/dtls/v2 |
Open Redirect in Caddy CVE-2022-28923, GHSA-qpm3-vr34-h8w8, GO-2023-1567 | Medium | 1.4% | 07 Feb, 2023 | Go github.com/caddyserver/caddy/v2 |
Exposure of Sensitive Information in EVE-SRP CVE-2020-36660, GHSA-fxqx-xgqq-gf42, PYSEC-2023-208 | Medium | 0.7% | 06 Feb, 2023 | PyPI EVE-SRP PyPI eve-srp |
Cross-site Scripting in DaSchTour matomo-mediawiki-extension CVE-2017-20175, GHSA-hc67-v29c-7g78 | Medium | 0.6% | 05 Feb, 2023 | Packagist mediawiki/matomo |
Cross-site Scripting in MobileDetect CVE-2018-25080, GHSA-r77c-qv68-j3pp | Medium | 2.7% | 04 Feb, 2023 | Packagist mobiledetect/mobiledetectlib |
Cross site scripting in automad/automad CVE-2021-37502, GHSA-q3c8-65q7-9v78 | Medium | 0.5% | 03 Feb, 2023 | Packagist automad/automad |
Jellyfin Web Cross-Site Scripting (XSS) via Playlist Name CVE-2023-23636, GHSA-2h5r-cqfc-45v6 | Medium | 0.6% | 03 Feb, 2023 | npm jellyfin-web |
Jellyfin Web Cross-Site Scripting (XSS) via Collection Name CVE-2023-23635, GHSA-749c-pc87-4qcw | Medium | 0.6% | 03 Feb, 2023 | npm jellyfin-web |
Pimcore contains Unrestricted Upload of File with Dangerous Type CVE-2023-23937, GHSA-8xv4-jj4h-qww6 | Medium | 0.5% | 02 Feb, 2023 | Packagist pimcore/pimcore |
OpenZeppelin Contracts contains Improper Verification of Cryptographic Signature CVE-2023-23940, GHSA-626q-v9j4-mcp4, PYSEC-2023-39 | Medium | 0.2% | 02 Feb, 2023 | PyPI openzeppelin-cairo-contracts |
Clockwork Web contains a Cross-Site Request Forgery Vulnerability with Rails < 5.2 CVE-2023-25015, GHSA-p4xx-w6fr-c4w9 | Medium | 0.4% | 02 Feb, 2023 | RubyGems clockwork_web |
wallabag subject to Improper Authorization via annotations CVE-2023-0610, GHSA-mrqx-mjc4-vfh3 | Medium | 0.4% | 01 Feb, 2023 | Packagist wallabag/wallabag |
wallabag contains Improper Authorization via export feature CVE-2023-0609, GHSA-qwx8-mxxx-mg96 | Medium | 0.6% | 01 Feb, 2023 | Packagist wallabag/wallabag |
Microweber contains Cross-site Scripting CVE-2023-0608, GHSA-pj97-r83v-vj7f | Medium | 0.5% | 01 Feb, 2023 | Packagist microweber/microweber |
Joplin Desktop App vulnerable to Cross-site Scripting CVE-2022-45598, GHSA-h6c2-879r-jffh | Medium | 0.5% | 31 Jan, 2023 | npm joplin |
Path traversal in ubi-reader CVE-2023-0591, GHSA-vp2x-3mc3-3cj4, PYSEC-2023-51 | Medium | 0.4% | 31 Jan, 2023 | PyPI ubi-reader |
jSuites subect to Cross-site Scripting CVE-2022-25979, GHSA-r4hg-4cpq-q57c | Medium | 0.6% | 31 Jan, 2023 | npm jsuites |
Froxlor contains Unchecked Error Condition CVE-2023-0572, GHSA-3chw-8jq2-w769 | Medium | 0.7% | 29 Jan, 2023 | Packagist froxlor/froxlor |
Froxlor contains Static Code Injection CVE-2023-0566, GHSA-w7w4-qjgg-372x | Medium | 0.4% | 29 Jan, 2023 | Packagist froxlor/froxlor |
Froxlor contains Business Logic Errors CVE-2023-0565, GHSA-vqqm-c9gx-773q | Medium | 0.6% | 29 Jan, 2023 | Packagist froxlor/froxlor |
CImage Cross-site Scripting vulnerability CVE-2016-15022, GHSA-6hv3-9fqx-8pg5 | Medium | 0.5% | 29 Jan, 2023 | Packagist mos/cimage |
Publify contains Weak Password Requirements BIT-publify-2023-0569, CVE-2023-0569, GHSA-g7gf-2rqw-5rwx | Medium | 0.7% | 29 Jan, 2023 | RubyGems publify_core |
Improper neutralization of `noscript` element content may allow XSS in Sanitize CVE-2023-23627, GHSA-fw3g-2h3j-qmm7 | Medium | 0.5% | 28 Jan, 2023 | RubyGems sanitize |
Grafana Spoofing originalUrl of snapshots BIT-grafana-2022-39324, CVE-2022-39324, GHSA-4724-7jwc-3fpw, GO-2024-2867 | Medium | 0.8% | 27 Jan, 2023 | Go github.com/grafana/grafana |
safeurl-python contains Server-Side Request Forgery CVE-2023-24622, GHSA-jgh8-vchw-q3g7, PYSEC-2023-298 | Medium | 0.6% | 27 Jan, 2023 | PyPI safeurl-python |
Initial debug-host handler implementation could leak information and facilitate denial of service GHSA-x477-fq37-q5wr, GO-2023-1524 | Medium | Not scored | 27 Jan, 2023 | Go fortio.org/proxy |
xaviershay-dm-rails Gem for Ruby exposes sensitive information via the process table CVE-2015-2179, GHSA-88p8-4vv5-82j7 | Medium | 0.4% | 26 Jan, 2023 | RubyGems xaviershay-dm-rails |
Cross-site Scripting in modoboa CVE-2023-0519, GHSA-jm3m-wr3p-hjrq, PYSEC-2023-31 | Medium | 0.5% | 26 Jan, 2023 | PyPI modoboa |
Cross-site Scripting in pyload-ng CVE-2023-0488, GHSA-wcm6-wv95-7jw6, PYSEC-2026-907 | Medium | 0.8% | 26 Jan, 2023 | PyPI pyload-ng |
OpenStack Cinder, glance, and Nova vulnerable to Path Traversal CVE-2022-47951, GHSA-7h75-hwxx-qpgc, PYSEC-2026-2411, PYSEC-2026-2490, PYSEC-2026-868 | Medium | 1.0% | 26 Jan, 2023 | PyPI cinder PyPI glance PyPI nova |
Cross-site Scripting in modoboa CVE-2023-0470, GHSA-c467-5c2g-jp86, PYSEC-2023-30 | Medium | 0.6% | 26 Jan, 2023 | PyPI modoboa |
github.com/openshift/apiserver-library-go Improper Input Validation vulnerability CVE-2023-0229, GHSA-5465-xc2j-6p84, GO-2023-1549 | Medium | 0.7% | 26 Jan, 2023 | Go github.com/openshift/apiserver-library-go |
LTI 1.3 Grade Pass Back Implementation has Missing Authorization Vulnerability CVE-2023-23611, GHSA-7j9p-67mm-5g87, PYSEC-2023-21 | Medium | 0.4% | 26 Jan, 2023 | PyPI lti-consumer-xblock |
Cross-site Scripting (XSS) in serve-lite CVE-2022-25847, GHSA-j8x7-qcw4-xx85 | Medium | 0.6% | 26 Jan, 2023 | npm serve-lite |
Cross-site Scripting in yapi-vendor CVE-2021-36686, GHSA-4jqw-vfmj-9rmh | Medium | 0.5% | 26 Jan, 2023 | npm yapi-vendor |
magento-lts Reset Password not protected against well-timed CSRF CVE-2021-21395, GHSA-r3c9-9j5q-pwv4 | Medium | 0.4% | 26 Jan, 2023 | Packagist openmage/magento-lts |
Denial of service (DoS) when processing Git credentials CVE-2022-43756, GHSA-8fcj-gf77-47mg, GO-2023-1515 | Medium | 0.7% | 25 Jan, 2023 | Go github.com/rancher/wrangler |
Command injection in Rancher Git package CVE-2022-43758, GHSA-34p5-jp77-fcrc | Medium | 1.0% | 25 Jan, 2023 | Go github.com/rancher/rancher |
Several quadratic complexity bugs may lead to denial of service in Commonmarker GHSA-636f-xm5j-pj9m | Medium | Not scored | 24 Jan, 2023 | RubyGems commonmarker |
Path traversal in spotipy CVE-2023-23608, GHSA-q764-g6fm-555v, PYSEC-2026-926 | Medium | 0.7% | 23 Jan, 2023 | PyPI spotipy |
Cross-Site Request Forgery in modoboa CVE-2023-0438, GHSA-9c64-x3cx-vgmm, PYSEC-2023-284 | Medium | 0.4% | 23 Jan, 2023 | PyPI modoboa |
Path Traversal in github.com/go-sonic/sonic CVE-2022-46959, GHSA-2x48-p6cq-5xcw, GO-2023-1509 | Medium | 0.8% | 23 Jan, 2023 | Go github.com/go-sonic/sonic |
CakePHP vulnerable to Cross-site Scripting in some development error pages GHSA-xwhj-pqcg-8rcr | Medium | Not scored | 20 Jan, 2023 | Packagist cakephp/cakephp |
CakePHP vulnerable to Remote File Inclusion through View template name manipulation GHSA-p76f-wr22-4rv6 | Medium | Not scored | 20 Jan, 2023 | Packagist cakephp/cakephp |
CakePHP allows direct access of prefixed controller actions GHSA-6hg4-vp5q-47mw | Medium | Not scored | 20 Jan, 2023 | Packagist cakephp/cakephp |