Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
CakePHP SecurityComponent cross form submission issue GHSA-j9q2-f9q7-jhgq | Medium | Not scored | 20 Jan, 2023 | Packagist cakephp/cakephp |
CakePHP has incorrect Cross-Site Request Forgery validation GHSA-829q-v5g8-hhxc | Medium | Not scored | 20 Jan, 2023 | Packagist cakephp/cakephp |
scs-library-client may leak user credentials to third-party service via HTTP redirect CVE-2022-23538, GHSA-7p8m-22h4-9pj7, GO-2023-1497 | Medium | 0.7% | 20 Jan, 2023 | Go github.com/sylabs/scs-library-client |
@builder.io/qwik vulnerable to Cross-site Scripting CVE-2023-0410, GHSA-hm7f-rq7q-j9xp | Medium | 0.5% | 20 Jan, 2023 | npm @builder.io/qwik |
Cross-Site Request Forgery in modoboa CVE-2023-0406, GHSA-g298-59pg-93h7, PYSEC-2023-283 | Medium | 0.4% | 19 Jan, 2023 | PyPI modoboa |
Modoboa is vulnerable to Cross-Site Request Forgery CVE-2023-0398, GHSA-v9gj-5rgp-w33r, PYSEC-2023-282 | Medium | 0.4% | 19 Jan, 2023 | PyPI modoboa |
Velociraptor subject to Path Traversal CVE-2023-0290, GHSA-7jf5-fvgf-48c6, GO-2023-1502 | Medium | 0.8% | 19 Jan, 2023 | Go www.velocidex.com/golang/velociraptor |
Open Redirect Vulnerability in Action Pack CVE-2023-22797, GHSA-9445-4cr6-336r | Medium | 0.6% | 18 Jan, 2023 | RubyGems actionpack |
OpenStack Swift XML external entities (XXE) Injection CVE-2022-47950, GHSA-274c-rx2j-2v3x, PYSEC-2026-927 | Medium | 1.0% | 18 Jan, 2023 | PyPI swift |
Shopware's log module vulnerable to Improper Output Neutralization CVE-2023-22733, GHSA-7cp7-jfp6-jh4f | Medium | 0.7% | 17 Jan, 2023 | Packagist shopware/core Packagist shopware/platform |
Sisimai Inefficient Regular Expression Complexity vulnerability CVE-2022-4891, GHSA-vm74-j4wq-82xj | Medium | 1.4% | 17 Jan, 2023 | RubyGems sisimai |
pgAdmin 4 Open Redirect vulnerability CVE-2023-22298, GHSA-894c-rg7f-3c62, PYSEC-2026-894 | Medium | 1.0% | 17 Jan, 2023 | PyPI pgadmin4 |
simplesamlphp-module-openidprovider Cross Site Scripting vulnerability CVE-2010-10008, GHSA-chgc-rqjr-46gg | Medium | 0.6% | 17 Jan, 2023 | Packagist simplesamlphp/simplesamlphp-module-openidprovider |
pimcore is vulnerable to cross-site scripting via "title field " in data objects CVE-2023-0323, GHSA-6vf6-g3pr-j83h | Medium | 0.5% | 16 Jan, 2023 | Packagist pimcore/pimcore |
Apache Superset has Improper Access Control BIT-superset-2022-45438, CVE-2022-45438, GHSA-8f5j-mgx9-5hm5, PYSEC-2026-778 | Medium | 1.3% | 16 Jan, 2023 | PyPI apache-superset |
Apache Superset Open Redirect vulnerability BIT-superset-2022-43721, CVE-2022-43721, GHSA-fcg4-pm6h-9xx2, PYSEC-2026-781 | Medium | 1.0% | 16 Jan, 2023 | PyPI apache-superset |
Apache Superset vulnerable to Injection BIT-superset-2022-43720, CVE-2022-43720, GHSA-fpmr-qmgh-42x2, PYSEC-2026-782 | Medium | 1.3% | 16 Jan, 2023 | PyPI apache-superset |
Apache Superset is vulnerable to Cross-Site Scripting (XSS) BIT-superset-2022-43718, CVE-2022-43718, GHSA-79x5-cv79-49rj, PYSEC-2026-777 | Medium | 1.2% | 16 Jan, 2023 | PyPI apache-superset |
Apache Superset vulnerable to Cross-site Scripting BIT-superset-2022-43717, CVE-2022-43717, GHSA-9f88-wg5r-947j, PYSEC-2026-779 | Medium | 1.3% | 16 Jan, 2023 | PyPI apache-superset |
Apache Superset's SQL Alchemy connector vulnerable to SQL Injection BIT-superset-2022-41703, CVE-2022-41703, GHSA-cxvp-3frm-3876, PYSEC-2026-780 | Medium | 1.2% | 16 Jan, 2023 | PyPI apache-superset |
Froxlor is vulnerable to path traversal CVE-2023-0316, GHSA-xp3g-2729-rxm3 | Medium | 0.8% | 16 Jan, 2023 | Packagist froxlor/froxlor |
phpMyFAQ Reflected Cross-site Scripting vulnerability CVE-2023-0314, GHSA-m9xr-8cx7-53pj | Medium | 0.5% | 15 Jan, 2023 | Packagist thorsten/phpmyfaq |
phpMyFAQ Stored Cross-site Scripting vulnerability CVE-2023-0313, GHSA-x2h8-4mhh-5hwh | Medium | 0.4% | 15 Jan, 2023 | Packagist thorsten/phpmyfaq |
thorsten/phpmyfaq is vulnerable to cross-site scripting (XSS) CVE-2023-0312, GHSA-6449-vf6p-9hfp | Medium | 0.6% | 15 Jan, 2023 | Packagist thorsten/phpmyfaq |
phpMyFAQ Stored Cross-site Scripting vulnerability CVE-2023-0310, GHSA-9jff-8xmm-mw22 | Medium | 0.6% | 15 Jan, 2023 | Packagist thorsten/phpmyfaq |
phpMyFAQ Stored Cross-site Scripting vulnerability CVE-2023-0309, GHSA-25c3-7fvj-v45j | Medium | 0.5% | 15 Jan, 2023 | Packagist thorsten/phpmyfaq |
phpMyFAQ Stored Cross-site Scripting vulnerability CVE-2023-0308, GHSA-w475-749h-c77m | Medium | 0.5% | 15 Jan, 2023 | Packagist thorsten/phpmyfaq |
phpMyFAQ Stored Cross-site Scripting vulnerability CVE-2023-0306, GHSA-96x6-jf5w-84c5 | Medium | 0.6% | 15 Jan, 2023 | Packagist thorsten/phpmyfaq |
Publify Core does not strip metadata from images BIT-publify-2022-2815, CVE-2022-2815, GHSA-79wq-g4v9-gfj4 | Medium | 0.6% | 14 Jan, 2023 | RubyGems publify_core |
Improper Authorization in grumpydictator/firefly-iii CVE-2023-0298, GHSA-7mc4-jp4f-v2j2 | Medium | 0.6% | 14 Jan, 2023 | Packagist grumpydictator/firefly-iii |
a12nserver vulnerable to potential SQL Injections via Knex dependency GHSA-crhg-xgrg-vvcc | Medium | Not scored | 13 Jan, 2023 | npm @curveball/a12n-server |
Pyload Insufficient Session Expiration vulnerability CVE-2023-0227, GHSA-rv9x-wmw4-44qj, PYSEC-2026-906 | Medium | 0.7% | 12 Jan, 2023 | PyPI pyload-ng |
XML-RPC for PHP allows access to local files via malicious argument to the Client::send method GHSA-m95x-m25c-w9mp | Medium | Not scored | 11 Jan, 2023 | Packagist phpxmlrpc/phpxmlrpc |
XML-RPC for PHP's `Wrapper::buildClientWrapperCode` method allows code injection via malicious `$client` argument GHSA-7vcx-v65q-9wpg | Medium | Not scored | 11 Jan, 2023 | Packagist phpxmlrpc/phpxmlrpc |
XML-RPC for PHP's debugger vulnerable to possible XSS attack GHSA-pxqj-xrv5-qvjf | Medium | Not scored | 11 Jan, 2023 | Packagist phpxmlrpc/phpxmlrpc |
dompurify vulnerable to Cross-site Scripting GHSA-h6p3-p4vx-wr8q | Medium | Not scored | 11 Jan, 2023 | PyPI dompurify |
dompurify vulnerable to Cross-site Scripting GHSA-pgjv-jrg2-gq3v | Medium | Not scored | 11 Jan, 2023 | PyPI dompurify |
Zitadel RefreshToken invalidation vulnerability CVE-2023-22492, GHSA-6rrr-78xp-5jp8 | Medium | 0.6% | 11 Jan, 2023 | Go github.com/zitadel/zitadel |
Reflected XSS in Gotify's /docs via import of outdated Swagger UI GHSA-3244-8mff-w398, GO-2023-1471 | Medium | Not scored | 10 Jan, 2023 | Go github.com/gotify/server Go github.com/gotify/server/v2 |
Flarum notifications can leak restricted content CVE-2023-22488, GHSA-8gcg-vwmw-rxj4 | Medium | 0.4% | 10 Jan, 2023 | Packagist flarum/core |
phoenix_html allows Cross-site Scripting in HEEx class attributes CVE-2021-46871, GHSA-5g2h-9x5v-5h3x, GHSA-j3gg-r6gp-95q2 | Medium | 0.4% | 10 Jan, 2023 | Hex phoenix_html npm phoenix_html |
PocketMine-MP vulnerable to denial-of-service by sending large modal form responses CVE-2023-54395, GHSA-7m9r-rq9j-wmmh | Medium | 0.5% | 10 Jan, 2023 | Packagist pocketmine/pocketmine-mp |
@okta/oidc-middlewareOpen Redirect vulnerability CVE-2022-3145, GHSA-58h4-9m7m-j9m4 | Medium | 0.4% | 09 Jan, 2023 | npm @okta/oidc-middleware |
Information Cards Module vulnerable to Cross-site Scripting CVE-2010-10004, GHSA-2phw-rgr7-5pvh | Medium | 0.5% | 09 Jan, 2023 | Packagist simplesamlphp/simplesamlphp-module-infocard |
Barzahlen Payment Module PHP SDK vulnerable to Observable Timing Discrepancy CVE-2016-15015, GHSA-vg5x-6q66-rvgx | Medium | 0.7% | 08 Jan, 2023 | Packagist barzahlen/barzahlen-php |
SUKOHI Surpass Path Traversal vulnerability CVE-2015-10030, GHSA-c9pw-f4wp-22jr | Medium | 0.8% | 08 Jan, 2023 | Packagist sukohi/surpass |
Symbiote Seed Open Redirect vulnerability CVE-2017-20164, GHSA-wm32-3r4m-jvcc | Medium | 0.5% | 07 Jan, 2023 | Packagist symbiote/silverstripe-seed |
Inline SVG vulnerable to Cross-site Scripting CVE-2020-36644, GHSA-p33q-4h4m-j994 | Medium | 0.7% | 07 Jan, 2023 | RubyGems inline_svg |
easy-scrypt Observable Timing Discrepancy vulnerability CVE-2014-125055, GHSA-r894-5r7v-7rx3, GO-2023-1294 | Medium | 0.7% | 07 Jan, 2023 | Go github.com/agnivade/easy-scrypt |
usememos/memos vulnerable to stored Cross-site Scripting CVE-2023-0106, GHSA-8686-4cr3-76wj | Medium | 0.7% | 07 Jan, 2023 | Go github.com/usememos/memos |