Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Microsoft Windows Client Server Runtime Subsystem (CSRSS) Privilege Escalation Vulnerability CVE-2022-22047 | HighExploited | 18.8% | 12 Jul, 2022 | |
Argo CD certificate verification is skipped for connections to OIDC providers CVE-2022-31105, GHSA-7943-82jg-wmw5, GO-2022-0518 | High | 0.8% | 12 Jul, 2022 | Go github.com/argoproj/argo-cd Go github.com/argoproj/argo-cd/v2 |
October CMS upload process vulnerable to RCE via Race Condition CVE-2022-24800, GHSA-8v7h-cpc2-r8jp | High | 1.5% | 12 Jul, 2022 | Packagist october/system |
mat2 before 0.13.0 allows directory traversal during the ZIP archive cleaning process. CVE-2022-35410, GHSA-f33p-9287-h552, PYSEC-2022-223 | High | 2.3% | 08 Jul, 2022 | PyPI mat2 |
Hyperledger Fabric vulnerable to Improper Input Validation in orderer/common/cluster consensus request BIT-hyperledger-fabric-orderer-2022-31121, BIT-hyperledger-fabric-peer-2022-31121, BIT-hyperledger-fabric-tools-2022-31121, CVE-2022-31121, GHSA-72x4-cq6r-jp4p | High | 2.1% | 08 Jul, 2022 | Go github.com/hyperledger/fabric |
Known vulnerable to account takeover via host header injection attack in v1.3.1 CVE-2022-33011, GHSA-p757-4v3p-j74f | High | 1.5% | 08 Jul, 2022 | Packagist idno/known |
Moment.js vulnerable to Inefficient Regular Expression Complexity CVE-2022-31129, GHSA-wc69-rhjr-hc9g | High | 5.6% | 06 Jul, 2022 | NuGet Moment.js npm moment |
Improper handling of email input CVE-2022-31127, GHSA-pgjx-7f9g-9463 | High | 1.1% | 06 Jul, 2022 | npm next-auth |
Insufficient Session Expiration in Nakama CVE-2022-2306, GHSA-xv59-gc3r-rf92 | High | 0.9% | 06 Jul, 2022 | Go github.com/heroiclabs/nakama |
jquery-validation Regular Expression Denial of Service due to arbitrary input to url2 method CVE-2022-31147, GHSA-ffmh-x56j-9rc3 | High | 2.2% | 05 Jul, 2022 | npm jquery-validation |
opensearch-ruby 2.x before 2.0.2 vulnerable to unsafe YAML deserialization CVE-2022-31115, GHSA-977c-63xq-cgw3 | High | 1.6% | 05 Jul, 2022 | RubyGems opensearch-ruby |
Incorrect handling of invalid surrogate pair characters CVE-2022-31116, GHSA-wpqr-jcpx-745r, PYSEC-2026-1057 | High | 2.5% | 05 Jul, 2022 | PyPI ujson |
In OpenCTI through 5.2.4, a broken access control vulnerability has been identified in the profile endpoint. An attacker can abuse the identified vulnerability in order to arbitrarily change their registered e-mail address as well as their API key, even though such action is not possible through the CVE-2022-30290, PYSEC-2022-43186 | High | 1.0% | 05 Jul, 2022 | PyPI pycti |
lxml NULL Pointer Dereference allows attackers to cause a denial of service CVE-2022-2309, GHSA-wrxv-2j5q-m38w, PYSEC-2022-230 | High | 2.4% | 05 Jul, 2022 | PyPI lxml |
Regular expression denial of service in scss-tokenizer CVE-2022-25758, GHSA-7mwh-4pqv-wmr8 | High | 2.1% | 01 Jul, 2022 | npm scss-tokenizer |
Denial of service in Open Policy Agent CVE-2022-33082, GHSA-2m4x-4q9j-w97g, GO-2022-0574 | High | 1.7% | 01 Jul, 2022 | Go github.com/open-policy-agent/opa |
Protected fields exposed via LiveQuery BIT-parse-2022-31112, CVE-2022-31112, GHSA-crrq-vr9j-fxxh | High | 1.3% | 30 Jun, 2022 | npm parse-server |
Code injection in grav CVE-2022-2073, GHSA-cxgw-r5jg-7xwq | High | 10.9% | 29 Jun, 2022 | Packagist getgrav/grav |
URL previews of unusual or maliciously-crafted pages can crash Synapse media repositories or Synapse monoliths CVE-2022-31052, GHSA-22p3-qrh9-cx32, PYSEC-2022-224 | High | 1.7% | 28 Jun, 2022 | PyPI matrix-synapse |
Authorization Bypass in parse-path CVE-2022-0624, GHSA-3j8f-xvm3-ffx4 | High | 0.9% | 28 Jun, 2022 | npm parse-path |
SystemDS CPU exhaustion vulnerability CVE-2022-26477, GHSA-m43h-hfrq-x8wx, PYSEC-2022-222 | High | 2.3% | 27 Jun, 2022 | Maven org.apache.systemds:systemds PyPI systemds |
Hostname confusion in parse-url CVE-2022-0722, GHSA-4p35-cfcx-8653 | High | 1.2% | 27 Jun, 2022 | npm parse-url |
Path traversal mitigation bypass in OctoRPKI GHSA-3jhm-87m6-x959, GO-2022-0496 | High | Not scored | 25 Jun, 2022 | Go github.com/cloudflare/cfrpki |
BlockWishList SQL Injection vulnerability CVE-2022-31101, GHSA-2jx3-5j9v-prpp | High | 23.5% | 25 Jun, 2022 | Packagist prestashop/blockwishlist |
Query predicate bypass in Zalando Skipper CVE-2022-34296, GHSA-qx2j-85q5-ffp8, GO-2022-0494 | High | 1.1% | 24 Jun, 2022 | Go github.com/zalando/skipper |
Improper handling of CSS at-rules in lettersanitizer CVE-2022-31103, GHSA-7r3r-gq8p-v9jj | High | 1.5% | 23 Jun, 2022 | npm lettersanitizer |
Salt's PAM auth fails to reject locked accounts CVE-2022-22967, GHSA-fpxm-fprw-6hxj, PYSEC-2022-210 | High | 2.1% | 23 Jun, 2022 | PyPI salt |
Denial of Service (DoS) vulnerability in RSSHub CVE-2022-31110, GHSA-jvxx-v45p-v5vf | High | 1.6% | 23 Jun, 2022 | npm rsshub |
Improper quoting of columns when using setOrderBy() or setGroupBy() on listing classes in Pimcore CVE-2022-31092, GHSA-gvmf-wcx6-p974 | High | 1.4% | 22 Jun, 2022 | Packagist pimcore/pimcore |
Change in port should be considered a change in origin CVE-2022-31091, GHSA-q559-8m2m-g699 | High | 1.6% | 21 Jun, 2022 | Packagist guzzlehttp/guzzle |
Improper Handling of `callbackUrl` parameter in next-auth CVE-2022-31093, GHSA-g5fm-jp9v-2432 | High | 1.7% | 21 Jun, 2022 | npm next-auth |
Insecure entropy in Argo CD's PKCE/Oauth2/OIDC params CVE-2022-31034, GHSA-2m7h-86qq-fp4v, GO-2022-0497 | High | 1.0% | 21 Jun, 2022 | Go github.com/argoproj/argo-cd Go github.com/argoproj/argo-cd/v2 |
CURLOPT_HTTPAUTH option not cleared on change of origin CVE-2022-31090, GHSA-25mq-v84q-4j7r | High | 1.9% | 21 Jun, 2022 | Packagist guzzlehttp/guzzle |
Invalid file request can crash server BIT-parse-2022-31089, CVE-2022-31089, GHSA-xw6g-jjvf-wwf9 | High | 1.2% | 20 Jun, 2022 | npm parse-server |
Code injection in Elefant CMS CVE-2017-20064, GHSA-gx6v-67qv-rhx5 | High | 1.1% | 20 Jun, 2022 | Packagist elefant/cms |
Unrestricted Upload of File with Dangerous Type in Elefant CMS CVE-2017-20063, GHSA-mwh6-g9wx-xcx3 | High | 0.9% | 20 Jun, 2022 | Packagist elefant/cms |
Cross-Site Request Forgery in Elefant CMS CVE-2017-20062, GHSA-pq7f-cq6q-94xh | High | 0.4% | 20 Jun, 2022 | Packagist elefant/cms |
XSS Vulnerability in Markdown Editor GHSA-85q9-7467-r53q | High | Not scored | 17 Jun, 2022 | PyPI inventree |
Prototype Pollution in querymen CVE-2022-25871, GHSA-p23c-p8w2-ww5v | High | 1.2% | 17 Jun, 2022 | npm querymen |
pg-native and libpq vulnerable to uncontrolled resource consumption CVE-2022-25852, GHSA-j32j-2hxv-rqf7 | High | 1.4% | 17 Jun, 2022 | npm libpq npm pg-native |
Uncontrolled Resource Consumption in @discordjs/opus CVE-2022-25345, GHSA-rvgf-69j7-xh78 | High | 1.4% | 17 Jun, 2022 | npm @discordjs/opus |
Uncontrolled Resource Consumption in fast-string-search CVE-2022-22138, GHSA-4263-q746-94mw | High | 1.2% | 17 Jun, 2022 | npm fast-string-search |
Prototype Pollution in mout CVE-2022-21213, GHSA-vvv8-xw5f-3f88 | High | 2.1% | 17 Jun, 2022 | npm mout |
Authentication bypass vulnerability in Apple Game Center auth adapter BIT-parse-2022-31083, CVE-2022-31083, GHSA-rh9j-f5f8-rvgc | High | 0.9% | 17 Jun, 2022 | npm parse-server |
CSV Injection in inventree CVE-2022-2112, GHSA-9hx5-jmxv-x44q, PYSEC-2026-824 | High | 1.3% | 17 Jun, 2022 | PyPI inventree |
Unrestricted Attachment Upload CVE-2022-2111, GHSA-fr2w-mp56-g4xp, PYSEC-2026-825 | High | 1.3% | 17 Jun, 2022 | PyPI inventree |
Insufficient HTML Sanitization GHSA-rm89-9g65-4ffr | High | Not scored | 17 Jun, 2022 | PyPI inventree |
Insecure path traversal in Git Trigger Source can lead to arbitrary file read CVE-2022-25856, GHSA-qpgx-64h2-gc3c, GO-2022-0492, SNYK-GOLANG-GITHUBCOMARGOPROJARGOEVENTSSENSORSARTIFACTS-2864522 | High | 1.9% | 17 Jun, 2022 | Go github.com/argoproj/argo-events |
Uses of deprecated API can be used to cause DoS in user-facing endpoints CVE-2022-31054, GHSA-5q86-62xr-3r57, GO-2022-0490 | High | 1.6% | 17 Jun, 2022 | Go github.com/argoproj/argo-events |
ProxyAgent vulnerable to MITM CVE-2022-32210, GHSA-pgw7-wx7w-2w33 | High | 0.5% | 17 Jun, 2022 | npm undici |