Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Insufficient Session Expiration in TYPO3's Admin Tool BIT-typo3-2022-31050, CVE-2022-31050, GHSA-wwjw-r3gj-39fq | High | 1.3% | 14 Jun, 2022 | Packagist typo3/cms Packagist typo3/cms-core |
Jupyter server Token bruteforcing CVE-2022-29241, GHSA-q874-g24w-4q9g, PYSEC-2022-211 | High | 1.0% | 14 Jun, 2022 | PyPI jupyter-server |
Qualcomm Multiple Chipsets Use-After-Free Vulnerability CVE-2022-22071 | HighExploited | 0.4% | 14 Jun, 2022 | |
AutoUpdater module fails to validate certain nested components of the bundle CVE-2022-29257, GHSA-77xc-hjv8-ww97 | High | 0.9% | 13 Jun, 2022 | npm electron |
Insufficient Session Expiration in NocoDB CVE-2022-2064, GHSA-6293-2vg2-pmp5 | High | 1.2% | 13 Jun, 2022 | npm nocodb |
Improper Privilege Management in NocoDB CVE-2022-2063, GHSA-fq4h-m3c8-8m2v | High | 1.4% | 13 Jun, 2022 | npm nocodb |
NocoDB information disclosure vulnerability CVE-2022-2062, GHSA-mx8q-jqwm-85mv | High | 1.5% | 13 Jun, 2022 | npm nocodb |
Command Injection in Nuitka CVE-2022-2054, GHSA-4v3r-hqr9-69jf, PYSEC-2022-209 | High | 0.5% | 12 Jun, 2022 | PyPI Nuitka PyPI nuitka |
Infinite loop in jpeg-js CVE-2022-25851, GHSA-xvf7-4v9q-58w6 | High | 1.9% | 10 Jun, 2022 | npm jpeg-js |
Code injection via SVG file in convert-svg-core CVE-2022-24429, GHSA-54px-mhwv-5v8x, SNYK-JS-CONVERTSVGCORE-2859212 | High | 0.9% | 10 Jun, 2022 | npm convert-svg-core |
Unhandled crash in npm posix CVE-2022-21211, GHSA-27mx-gchc-6xjp | High | 1.1% | 10 Jun, 2022 | npm posix |
Cross Site Scripting vulnerability in django-jsonform's admin form. GHSA-x9jp-4w8m-4f3c | High | Not scored | 10 Jun, 2022 | PyPI django-jsonform |
Failure to strip the Cookie header on change in host or HTTP downgrade BIT-drupal-2022-31042, BIT-drupal-2022-31043, CVE-2022-31042, CVE-2022-31043, DRUPAL-CORE-2022-011, GHSA-f2wf-25xc-69c9, GHSA-w248-ffj2-4v5q | High | 2.0% | 09 Jun, 2022 | Packagist drupal/core Packagist guzzlehttp/guzzle |
Exposure of Sensitive Information to an Unauthorized Actor in semantic-release CVE-2022-31051, GHSA-x2pg-mjhr-2m5x | High | 1.8% | 09 Jun, 2022 | npm semantic-release |
Path Traversal in Git HTTP endpoints in Gogs CVE-2022-1993, GHSA-6vcc-v9vw-g2x5, GO-2022-0562 | High | 36.7% | 08 Jun, 2022 | Go gogs.io/gogs |
Improperly checked IDs on itemstacks received from the client leading to server crash in PocketMine-MP CVE-2022-51010, GHSA-fqx3-r75h-vc89 | High | 0.5% | 07 Jun, 2022 | Packagist pocketmine/pocketmine-mp |
Node DOS by way of memory exhaustion through ExecSync request in CRI-O CVE-2022-1708, GHSA-fcm2-6c3h-pg6j, GO-2022-0480 | High | 3.2% | 06 Jun, 2022 | Go github.com/cri-o/cri-o |
Multiple evaluation of contract address in call in vyper CVE-2022-29255, GHSA-4v9q-cgpw-cf38, PYSEC-2022-43053 | High | 1.3% | 06 Jun, 2022 | PyPI vyper |
TiDB authentication bypass vulnerability CVE-2022-31011, GHSA-4whx-7p29-mq22 | High | 0.3% | 06 Jun, 2022 | Go github.com/pingcap/tidb |
Packing does not respect root-level ignore files in workspaces CVE-2022-29244, GHSA-hj9c-8jmm-8c52 | High | 4.0% | 02 Jun, 2022 | npm npm |
Phoenix-ws source code and data in extensions folder is publicly available GHSA-c8f7-x2g7-7fxj | High | Not scored | 02 Jun, 2022 | PyPI phoenix-ws |
Regular expression denial of service in devcert CVE-2022-1929, GHSA-fp36-299x-pwmw | High | 0.6% | 02 Jun, 2022 | npm devcert |
Regular expression denial of service in markdown-link-extractor CVE-2021-43308, GHSA-mmh6-m7v9-5956 | High | 1.1% | 02 Jun, 2022 | npm markdown-link-extractor |
Regular expression denial of service in semver-regex CVE-2021-43307, GHSA-4x5v-gmq8-25ch | High | 1.6% | 02 Jun, 2022 | npm semver-regex |
Regular expression denial of service in jquery-validation CVE-2021-43306, GHSA-j9m2-h2pv-wvph | High | 1.5% | 02 Jun, 2022 | npm jquery-validation |
Command injection in google-it CVE-2021-34083, GHSA-7xhv-mpjw-422f | High | 2.1% | 02 Jun, 2022 | npm google-it |
OS Command Injection in gitsome CVE-2021-34081, GHSA-9v73-x562-wv5x | High | 3.4% | 02 Jun, 2022 | npm gitsome |
OS Command Injection in lifion-verify-deps CVE-2021-34078, GHSA-rphm-c8gw-3r38 | High | 2.4% | 02 Jun, 2022 | npm lifion-verify-deps |
Flower OAuth authentication bypass CVE-2022-30034, GHSA-q4qm-xhf9-4p8f, PYSEC-2022-42973 | High | 1.1% | 02 Jun, 2022 | PyPI flower |
Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability CVE-2022-30190 | HighExploited | 99.2% | 01 Jun, 2022 | |
Server-Side Request Forgery in gogs webhook CVE-2022-1285, GHSA-w689-557m-2cvq, GO-2022-0583 | High | 1.1% | 01 Jun, 2022 | Go gogs.io/gogs |
Uncaught Exception (due to a data race) leads to process termination in Waitress CVE-2022-31015, GHSA-f5x9-8jwc-25rw, PYSEC-2022-205 | High | 1.5% | 31 May, 2022 | PyPI waitress |
Prototype Pollution in protobufjs CVE-2022-25878, GHSA-g954-5hwp-pp24 | High | 2.3% | 27 May, 2022 | npm protobufjs |
Denial of Service Vulnerability in Rack Multipart Parsing CVE-2022-30122, GHSA-hxqx-xwvh-44m2 | High | 2.2% | 27 May, 2022 | RubyGems rack |
Arbitrary command execution in Minidoc CVE-2022-29637, GHSA-f7ff-xf87-f22q | High | 0.9% | 27 May, 2022 | Go github.com/mindoc-org/mindoc |
Apple macOS Out-of-Bounds Write Vulnerability CVE-2022-22675 | HighExploited | 12.5% | 26 May, 2022 | |
Path traversal in ginadmin CVE-2022-30427, GHSA-9pg5-3pjc-f8wm | High | 1.5% | 26 May, 2022 | Go github.com/gphper/ginadmin |
Arbitrary file read in ginadmin CVE-2022-30428, GHSA-5824-6jfv-xr3r | High | 1.1% | 26 May, 2022 | Go github.com/gphper/ginadmin |
Possible cross-site scripting attack via unsanitized SVG files in FoF Upload CVE-2022-30999, GHSA-fm53-mpmp-7qw2 | High | 1.3% | 25 May, 2022 | Packagist fof/upload |
Cross-domain cookie leakage in Guzzle BIT-drupal-2022-29248, CVE-2022-29248, DRUPAL-CORE-2022-010, GHSA-cwmx-hcrq-mhc3 | High | 1.4% | 25 May, 2022 | Packagist drupal/core Packagist guzzlehttp/guzzle |
Pion DTLS Header reconstruction method can be thrown into an infinite loop CVE-2022-29190, GHSA-cm8f-h6j3-p25c, GO-2022-0460 | High | 1.7% | 24 May, 2022 | Go github.com/pion/dtls Go github.com/pion/dtls/v2 |
Improper Privilege Management in Cilium BIT-cilium-2022-29179, BIT-cilium-operator-2022-29179, BIT-cilium-proxy-2022-29179, BIT-hubble-2022-29179, BIT-hubble-relay-2022-29179, BIT-hubble-ui-2022-29179, BIT-hubble-ui-backend-2022-29179, CVE-2022-29179, GHSA-fmrf-gvjp-5j5g, GO-2022-0458 | High | 0.4% | 24 May, 2022 | Go github.com/cilium/cilium |
Access to Unix domain socket can lead to privileges escalation in Cilium BIT-cilium-2022-29178, BIT-cilium-operator-2022-29178, BIT-cilium-proxy-2022-29178, BIT-hubble-2022-29178, BIT-hubble-relay-2022-29178, BIT-hubble-ui-2022-29178, BIT-hubble-ui-backend-2022-29178, CVE-2022-29178, GHSA-6p8v-8cq8-v2r3, GO-2022-0457 | High | 0.3% | 24 May, 2022 | Go github.com/cilium/cilium |
Improper Validation of Integrity Check Value in go-tuf CVE-2022-29173, GHSA-66x3-6cw3-v5gj, GO-2022-0444 | High | 0.6% | 24 May, 2022 | Go github.com/theupdateframework/go-tuf |
PHP Code Injection by malicious block or filename in Smarty CVE-2022-29221, GHSA-634x-pc3q-cf4c | High | 4.9% | 24 May, 2022 | Packagist smarty/smarty |
AttesterSlashing number overflow CVE-2022-29219, GHSA-cvj7-5f3c-9vg9 | High | 1.3% | 24 May, 2022 | npm @chainsafe/lodestar |
Path Traversal in FileGator CVE-2022-1850, GHSA-rrhw-54r8-545q | High | 1.0% | 24 May, 2022 | Packagist filegator/filegator |
Key confusion through non-blocklisted public key formats CVE-2022-29217, GHSA-ffqj-6fqr-9h24, PYSEC-2022-202 | High | 1.4% | 24 May, 2022 | PyPI pyjwt |
SQL injection in helloxz/imgurl CVE-2022-29305, GHSA-rrjv-34p5-4c7r | High | 0.9% | 24 May, 2022 | Packagist helloxz/imgurl |
Nokogiri Improperly Handles Unexpected Data Type CVE-2022-29181, GHSA-xh29-r2w5-wx8m | High | 3.2% | 23 May, 2022 | RubyGems nokogiri |