Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Cross-site Scripting in Backdrop CMS CVE-2022-42097, GHSA-g9cp-9fw3-56cf | Medium | 0.9% | 22 Nov, 2022 | Packagist backdrop/backdrop |
Cross-site Scripting in Backdrop CMS CVE-2022-42094, GHSA-vcvg-g8p2-3hqr | Medium | 2.8% | 22 Nov, 2022 | Packagist backdrop/backdrop |
OS Command Injection in Apache Airflow BIT-airflow-2022-40954, CVE-2022-40954, GHSA-45r6-j3cc-6mxx, PYSEC-2026-770 | Medium | 1.4% | 22 Nov, 2022 | PyPI apache-airflow |
ToolJet is vulnerable to Denial of Service (DoS) CVE-2022-4111, GHSA-hgp8-w8fj-r4cm | Medium | 0.8% | 22 Nov, 2022 | npm tooljet |
Mitel MiVoice Connect Code Injection Vulnerability CVE-2022-41223 | MediumExploited | 10.7% | 22 Nov, 2022 | |
Mitel MiVoice Connect Command Injection Vulnerability CVE-2022-40765 | MediumExploited | 10.6% | 22 Nov, 2022 | |
Stored XSS in Compare Mode CVE-2022-38145, GHSA-66jf-xm2m-7m8r | Medium | 0.7% | 22 Nov, 2022 | Packagist silverstripe/versioned-admin |
Reflected XSS in querystring parameters CVE-2022-38462, GHSA-vvxf-r4vm-2vm6 | Medium | 0.5% | 21 Nov, 2022 | Packagist silverstripe/framework |
Stored XSS using HTMLEditor CVE-2022-37429, GHSA-wc6r-4ggc-79w5 | Medium | 0.5% | 21 Nov, 2022 | Packagist silverstripe/framework |
Stored XSS using uppercase characters in HTMLEditor CVE-2022-37430, GHSA-qw4w-vq8v-2wcv | Medium | 0.6% | 21 Nov, 2022 | Packagist silverstripe/framework |
Silverstipe CMS Stored XSS in custom meta tags BIT-silverstripe-2022-37421, CVE-2022-37421, GHSA-pp74-g2q5-j4jf | Medium | 0.6% | 21 Nov, 2022 | Packagist silverstripe/cms |
Silverstripe XSS in shortcodes CVE-2022-38724, GHSA-9cx2-hj6m-fv58 | Medium | 0.7% | 21 Nov, 2022 | Packagist silverstripe/assets Packagist silverstripe/framework |
XSS via uploaded gpx file CVE-2022-38147, GHSA-vv3r-fxqp-vr3f | Medium | 0.6% | 21 Nov, 2022 | Packagist silverstripe/assets |
Uncaught exception in engine.io CVE-2022-41940, GHSA-r7qp-cfhv-p84w | Medium | 2.1% | 21 Nov, 2022 | npm engine.io |
Cross-site Scripting in Backdrop CMS CVE-2022-42096, GHSA-g8jw-8vpv-pv5q | Medium | 2.2% | 21 Nov, 2022 | Packagist backdrop/backdrop |
Lack of proper validation of server UUID can be used by the server to trick the client to accept invalid proofs CVE-2022-39199, GHSA-6cqj-6969-p57x, GO-2022-1118 | Medium | 0.3% | 21 Nov, 2022 | Go github.com/codenotary/immudb |
Insufficient Verification of Proofs generated by the immudb server in client SDK. CVE-2022-36111, GHSA-672p-m5jq-mrh8, GO-2022-1117 | Medium | 0.4% | 21 Nov, 2022 | Go github.com/codenotary/immudb |
Cross-site Scripting in kiwitcms CVE-2022-4105, GHSA-hf94-8mx5-2vvj, PYSEC-2026-837 | Medium | 0.5% | 21 Nov, 2022 | PyPI kiwitcms |
URL XSS vulnerability due to outdated jquery in CMS CVE-2022-38146, GHSA-44xv-v98g-v79f | Medium | 0.6% | 21 Nov, 2022 | Packagist silverstripe/admin |
Cross-site Scripting in librenms/librenms CVE-2022-4069, GHSA-p55m-g4m3-qmrp | Medium | 93.3% | 20 Nov, 2022 | Packagist librenms/librenms |
Cross-site Scripting in librenms/librenms CVE-2022-4067, GHSA-qch4-jmf8-xvp7 | Medium | 93.7% | 20 Nov, 2022 | Packagist librenms/librenms |
Cross-site Scripting in librenms/librenms CVE-2022-3562, GHSA-5h77-4245-pg5p | Medium | 94.2% | 20 Nov, 2022 | Packagist librenms/librenms |
Cross-site Scripting in librenms/librenms CVE-2022-3561, GHSA-264w-gw9g-fhgj | Medium | 0.6% | 20 Nov, 2022 | Packagist librenms/librenms |
Cross-site Scripting in librenms/librenms CVE-2022-3516, GHSA-r4gq-hv2r-mrf5 | Medium | 0.5% | 20 Nov, 2022 | Packagist librenms/librenms |
KubeVela VelaUX APIserver has SSRF vulnerability CVE-2022-39383, GHSA-m5xf-x7q6-3rm7, GO-2022-1113 | Medium | 0.4% | 18 Nov, 2022 | Go github.com/oam-dev/kubevela |
Cross-site Scripting in Zenario CVE-2022-44073, GHSA-gmf5-q34v-vwvp | Medium | 0.5% | 16 Nov, 2022 | Packagist tribalsystems/zenario |
Cross-site Scripting in Zenario CVE-2022-44071, GHSA-j43m-4pxc-hmqj | Medium | 0.5% | 16 Nov, 2022 | Packagist tribalsystems/zenario |
Cross-site Scripting in Zenario CVE-2022-44070, GHSA-f454-jm6x-56q6 | Medium | 0.5% | 16 Nov, 2022 | Packagist tribalsystems/zenario |
Cross-site Scripting in Zenario CVE-2022-44069, GHSA-r9xx-4cmv-856x | Medium | 0.5% | 16 Nov, 2022 | Packagist tribalsystems/zenario |
Rdiffweb vulnerable to Missing Authentication for Critical Function CVE-2022-4018, GHSA-4wph-9vrm-6v3w, PYSEC-2022-43001 | Medium | 0.9% | 16 Nov, 2022 | PyPI rdiffweb |
Cross-Site Request Forgery in feehi/feehicms CVE-2022-4014, GHSA-cjp8-vv38-p3g2 | Medium | 0.2% | 16 Nov, 2022 | Packagist feehi/feehicms |
PHPServerMon PRNG has Insufficient Entropy CVE-2021-4241, GHSA-hc4j-7mqg-cxjj | Medium | 0.9% | 15 Nov, 2022 | Packagist phpservermon/phpservermon |
Insufficient Entropy in PHPServerMon PRNG CVE-2021-4240, GHSA-97w9-gcc7-vr8g | Medium | 0.9% | 15 Nov, 2022 | Packagist phpservermon/phpservermon |
Apache Airflow Contains Open Redirect BIT-airflow-2022-45402, CVE-2022-45402, GHSA-rg94-84xj-7gq3, PYSEC-2022-42984 | Medium | 81.8% | 15 Nov, 2022 | PyPI apache-airflow |
Concrete CMS Cross-site Scripting vulnerability CVE-2022-43695, GHSA-8699-h45g-7hm8 | Medium | 0.7% | 14 Nov, 2022 | Packagist concrete5/concrete5 |
Concrete CMS vulnerable to Cleartext Transmission of Sensitive Information CVE-2022-43691, GHSA-q3hq-hm5h-qrx3 | Medium | 0.5% | 14 Nov, 2022 | Packagist concrete5/concrete5 |
Concrete CMS vulnerable to Improper Authentication CVE-2022-43690, GHSA-q56r-mw39-944g | Medium | 0.7% | 14 Nov, 2022 | Packagist concrete5/concrete5 |
Concrete CMS vulnerable to XML External Entity CVE-2022-43689, GHSA-q48r-xg9h-78m8 | Medium | 0.7% | 14 Nov, 2022 | Packagist concrete5/concrete5 |
Concrete CMS vulnerable to Cross-site Scripting CVE-2022-43688, GHSA-9jc5-9wh5-mc36 | Medium | 0.6% | 14 Nov, 2022 | Packagist concrete5/concrete5 |
Concrete CMS vulnerable to Session Fixation CVE-2022-43687, GHSA-m53v-5x5x-5m2p | Medium | 0.8% | 14 Nov, 2022 | Packagist concrete5/concrete5 |
Concrete CMS vulnerable to Reflected Cross-Site Scripting via dashboard icons CVE-2022-43968, GHSA-8782-xgh5-r7mv | Medium | 0.7% | 14 Nov, 2022 | Packagist concrete5/concrete5 |
Concrete CMS vulnerable to Cross-site Scripting via multilingual report CVE-2022-43967, GHSA-vq39-q549-g786 | Medium | 0.7% | 14 Nov, 2022 | Packagist concrete5/concrete5 |
Concrete CMS vulnerable to Uncontrolled Resource Consumption leading to DoS CVE-2022-43686, GHSA-3cxx-3f53-m92c | Medium | 1.1% | 14 Nov, 2022 | Packagist concrete5/concrete5 |
Concrete CMS vulnerable to Reflected Cross-site Scripting via image manipulation library CVE-2022-43694, GHSA-jfmc-3975-fv5f | Medium | 0.7% | 14 Nov, 2022 | Packagist concrete5/concrete5 |
Concrete CMS vulnerable to Reflected Cross-site Scripting CVE-2022-43692, GHSA-rg6w-c352-p8pg | Medium | 0.7% | 14 Nov, 2022 | Packagist concrete5/concrete5 |
NodeBB vulnerable to Cross-Site Request Forgery CVE-2022-3978, GHSA-5gwx-wf9g-r5mx | Medium | 0.4% | 13 Nov, 2022 | npm nodebb |
NukeView CMS vulnerable to Cross-site Scripting CVE-2022-3975, GHSA-x45f-j34v-75xm | Medium | 0.6% | 13 Nov, 2022 | Packagist nukeviet/nukeviet |
Matrix-appservice-irc vulnerable to sql injection via roomIds argument CVE-2022-3971, GHSA-ffwf-47x2-jpr8 | Medium | 0.6% | 13 Nov, 2022 | npm matrix-appservice-irc |
mm-wiki is vulnerable to Cross-Site Scripting (XSS) CVE-2021-40289, GHSA-99g5-5643-xphp | Medium | 0.5% | 10 Nov, 2022 | Go github.com/phachon/mm-wiki |
Read the Docs vulnerable to Cross-Site Scripting (XSS) GHSA-98pf-gfh3-x3mp | Medium | Not scored | 10 Nov, 2022 | npm readthedocs |