Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious HTML+XHR Artifact Privilege Escalation in Argo Workflows BIT-argo-workflows-2022-29164, CVE-2022-29164, GHSA-cmv8-6362-r5w9 | High | 0.9% | 23 May, 2022 | Go github.com/argoproj/argo-workflows/v3 |
Code injection in `saved_model_cli` in TensorFlow BIT-tensorflow-2022-29216, CVE-2022-29216, GHSA-75c9-jrh4-79mc, PYSEC-2026-3125, PYSEC-2026-3289, PYSEC-2026-963 | High | 0.5% | 21 May, 2022 | PyPI tensorflow PyPI tensorflow-cpu PyPI tensorflow-gpu |
Segfault and OOB write due to incomplete validation in `EditDistance` in TensorFlow BIT-tensorflow-2022-29208, CVE-2022-29208, GHSA-2r2f-g8mw-9gvr, PYSEC-2026-3088, PYSEC-2026-3266, PYSEC-2026-943 | High | 0.4% | 20 May, 2022 | PyPI tensorflow PyPI tensorflow-cpu PyPI tensorflow-gpu |
Crash in HeaderParser in dicer CVE-2022-24434, GHSA-wm7h-9275-46v2 | High | 3.4% | 20 May, 2022 | Maven org.webjars.npm:dicer npm dicer |
Regular expression denial of service in url_regex CVE-2022-21195, GHSA-hg3w-7hj9-m3f7 | High | 1.4% | 20 May, 2022 | PyPI url-regex PyPI url_regex |
Buffer overflow in wasm3 CVE-2022-28990, GHSA-77fq-4xf5-hph4, PYSEC-2022-43154 | High | 0.4% | 20 May, 2022 | PyPI pywasm3 |
Improper path handling in Kustomization files allows for denial of service BIT-flux-2022-24878, BIT-kustomize-2022-24878, CVE-2022-24878, GHSA-7pwf-jg34-hxwp, GO-2022-0448 | High | 1.0% | 20 May, 2022 | Go github.com/fluxcd/flux2 Go github.com/fluxcd/kustomize-controller |
Out of bounds memory access in github.com/open-policy-agent/opa CVE-2022-28946, GHSA-x7f3-62pm-9p38, GO-2022-0587 | High | 1.0% | 20 May, 2022 | Go github.com/open-policy-agent/opa |
gopkg.in/yaml.v3 Denial of Service CVE-2022-28948, GHSA-hp87-p4gw-j4gq, GO-2022-0603 | High | 4.0% | 20 May, 2022 | Go gopkg.in/yaml.v3 |
Improper Removal of Sensitive Information Before Storage or Transfer in Strapi CVE-2022-30618, GHSA-vgj7-895j-gpr6 | High | 1.0% | 19 May, 2022 | npm @strapi/strapi npm strapi |
Improper Removal of Sensitive Information Before Storage or Transfer in Strapi CVE-2022-30617, GHSA-f6fm-r26q-p747 | High | 1.5% | 19 May, 2022 | npm @strapi/strapi npm strapi |
Arbitrary file upload in ShopXO CVE-2021-41938, GHSA-86p5-97jr-r598 | High | 1.1% | 19 May, 2022 | Packagist shopxo/shopxo |
Missing Cryptographic Step in cassproject CVE-2022-29229, GHSA-7qcx-4p32-qcmx | High | 0.4% | 18 May, 2022 | npm cassproject |
Integer Overflow or Wraparound in libxml2 affects Nokogiri CVE-2022-50999, GHSA-cgx6-hpwq-fhv5 | High | Not scored | 18 May, 2022 | RubyGems nokogiri |
Cross-site Scripting in OctoPrint CVE-2022-1430, GHSA-x7r7-wmj8-vv5g, PYSEC-2022-200 | High | 1.4% | 18 May, 2022 | PyPI OctoPrint PyPI octoprint |
Cross-site Scripting in OctoPrint CVE-2022-1432, GHSA-h8pc-j334-jjhm, PYSEC-2022-201 | High | 1.2% | 18 May, 2022 | PyPI OctoPrint PyPI octoprint |
Insecure PRNG use in random_password_generator CVE-2019-25061, GHSA-ggfx-h9xj-5v9c | High | 1.9% | 18 May, 2022 | RubyGems random_password_generator |
Shell command injection in gitea BIT-gitea-2022-30781, CVE-2022-30781, GHSA-p5f9-c9j9-g8qx, GO-2022-0450 | High | 87.9% | 17 May, 2022 | Go code.gitea.io/gitea |
Connect-Multiparty allows arbitrary file upload CVE-2022-29623, GHSA-w2xw-44r3-4v9g | High | 1.4% | 16 May, 2022 | npm connect-multiparty |
Prototype Pollution in sds CVE-2022-25862, GHSA-ph28-wwfj-fv7f | High | 0.7% | 13 May, 2022 | npm sds |
Microsoft Active Directory Domain Services Privilege Escalation Vulnerability CVE-2022-26923 | HighExploited | 83.5% | 10 May, 2022 | |
Race Condition in Grunt CVE-2022-1537, GHSA-rm36-94g8-835r | High | 0.3% | 10 May, 2022 | npm grunt |
Privilege escalation in easyappointments CVE-2022-1397, GHSA-7f62-4887-cfv5 | High | 1.2% | 10 May, 2022 | Packagist alextselegidis/easyappointments |
Improper account password reset in Craft CMS CVE-2022-29933, GHSA-5cjr-78cq-3wrg | High | 4.6% | 09 May, 2022 | Packagist craftcms/cms |
Incorrect Authorization in microweber CVE-2022-1631, GHSA-73rp-q4rx-5grc | High | 8.8% | 09 May, 2022 | Packagist microweber/microweber |
RARLAB UnRAR Directory Traversal Vulnerability CVE-2022-30333 | HighExploited | 99.2% | 09 May, 2022 | |
Out-of-bounds read in admesh CVE-2018-25033, GHSA-5jrq-582v-9767, PYSEC-2022-182 | High | 1.1% | 08 May, 2022 | PyPI admesh |
Uncaught Exception in bignum CVE-2022-25324, GHSA-6429-3g3w-6mw5 | High | 1.5% | 06 May, 2022 | npm bignum |
Improper Input Validation in k8s.io/ingress-nginx CVE-2021-25745, GHSA-pvmg-xgmx-9mxh | High | 1.2% | 06 May, 2022 | Go k8s.io/ingress-nginx |
Cross site scripting via canonical tag in Contao CVE-2022-24899, GHSA-m8x6-6r63-qvj2 | High | 4.5% | 06 May, 2022 | Packagist contao/contao Packagist contao/core-bundle |
Uncontrolled Resource Consumption in Hawk CVE-2022-29167, GHSA-44pw-h2cw-w3vq | High | 1.1% | 05 May, 2022 | npm hawk |
Improper handling of multiline messages in node-irc affects matrix-appservice-irc CVE-2022-29166, GHSA-37hr-348p-rmf4 | High | 1.0% | 05 May, 2022 | npm matrix-appservice-irc |
Improper handling of multiline messages in node-irc GHSA-52rh-5rpj-c3w6 | High | Not scored | 05 May, 2022 | npm matrix-org-irc |
Server-Side Request Forgery in scout-browser CVE-2022-1592, GHSA-g53g-q539-93cv, PYSEC-2026-750 | High | 1.3% | 05 May, 2022 | PyPI scout-browser |
Authentication bypass and denial of service (DoS) vulnerabilities in Apple Game Center auth adapter BIT-parse-2022-24901, CVE-2022-24901, GHSA-qf8x-vqjv-92gr | High | 0.7% | 04 May, 2022 | npm parse-server |
Arbitrary file deletion in gitea BIT-gitea-2022-27313, CVE-2022-27313, GHSA-g7p7-x6w7-w6qg, GO-2022-0442 | High | 1.0% | 04 May, 2022 | Go code.gitea.io/gitea |
Insecure password handling vulnerability in Strapi CVE-2021-46440, GHSA-85vg-grr5-pw42 | High | 2.9% | 03 May, 2022 | npm @strapi/strapi npm strapi |
Path Traversal in scout-browser CVE-2022-1554, GHSA-694v-63fq-fmr4, PYSEC-2026-749 | High | 1.4% | 03 May, 2022 | PyPI scout-browser |
ProxyScotch is vulnerable to a server-side Request Forgery (SSRF) CVE-2022-25850, GHSA-5hjh-c26m-xw8w, SNYK-GOLANG-GITHUBCOMHOPPSCOTCHPROXYSCOTCH-2435228 | High | 1.4% | 03 May, 2022 | Go github.com/hoppscotch/proxyscotch |
sinatra does not validate expanded path matches CVE-2022-29970, GHSA-qp49-3pvw-x4m5 | High | 2.1% | 03 May, 2022 | RubyGems sinatra |
snipe-IT vulnerable to host header injection CVE-2022-23064, GHSA-9vh6-qfv6-vcqp | High | 1.3% | 02 May, 2022 | Packagist snipe/snipe-it |
Write access to the catalog for any user when restricted-admin role is enabled in Rancher CVE-2021-4200, GHSA-hx8w-ghh8-r4xf | High | 0.6% | 02 May, 2022 | Go github.com/rancher/rancher |
Privilege escalation for users with create/update permissions in Global Roles in Rancher CVE-2021-36784, GHSA-jwvr-vv7p-gpwq | High | 0.9% | 02 May, 2022 | Go github.com/rancher/rancher |
Exposure of repository credentials to external third-party sources in Rancher CVE-2021-36778, GHSA-4fc7-hc63-7fjg | High | 0.8% | 02 May, 2022 | Go github.com/rancher/rancher |
angular vulnerable to regular expression denial of service (ReDoS) CVE-2022-25844, GHSA-m2h2-264f-f486 | High | 4.9% | 01 May, 2022 | npm angular |
Prototype Pollution in dset CVE-2022-25645, GHSA-23wx-cgxq-vpwx | High | 1.8% | 01 May, 2022 | Maven org.webjars.npm:dset npm dset |
Denial of service vulnerability exists in libxmljs CVE-2022-21144, GHSA-773h-w45w-f2f9, SNYK-JS-LIBXMLJS-2348756 | High | 1.9% | 01 May, 2022 | npm libxmljs |
Improper neutralization of formula elements in yii-helpers CVE-2022-1544, GHSA-f9p3-h6cg-2cjr | High | 2.4% | 01 May, 2022 | Packagist luyadev/yii-helpers |
Podman publishes a malicious image to public registries CVE-2022-1227, GHSA-66vw-v2x9-hw75, GO-2022-0558 | High | 4.2% | 29 Apr, 2022 | Go github.com/containers/podman/v3 Go github.com/containers/psgo |
URL Rewrite vulnerability in multiple zendframework components GHSA-f6p5-76fp-m248 | High | Not scored | 28 Apr, 2022 | Packagist zendframework/zend-diactoros Packagist zendframework/zend-feed Packagist zendframework/zend-http |