Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
HashiCorp Nomad vulnerable to non-sensitive metadata exposure CVE-2022-3866, GHSA-7wg4-8m5p-hrfg, GO-2022-1105 | Medium | 0.6% | 10 Nov, 2022 | Go github.com/hashicorp/nomad |
Lin CMS vulnerable to Improper Authentication CVE-2022-44244, GHSA-4vrc-q7m6-vq7w, PYSEC-2026-839 | Medium | 1.1% | 09 Nov, 2022 | Maven io.github.talelin:lin-cms-core PyPI Lin-CMS PyPI lin-cms |
Microsoft Windows Mark of the Web (MOTW) Security Feature Bypass Vulnerability CVE-2022-41091 | MediumExploited | 1.9% | 09 Nov, 2022 | |
Microsoft Windows Mark of the Web (MOTW) Security Feature Bypass Vulnerability CVE-2022-41049 | MediumExploited | 2.6% | 09 Nov, 2022 | |
Subrion CMS is vulnerable to Cross-Site Scripting (XSS) CVE-2022-43121, GHSA-jrvr-gmqv-hgrh | Medium | 0.6% | 09 Nov, 2022 | Packagist intelliants/subrion |
Subrion CMS is vulnerable to Cross-Site Scripting (XSS) CVE-2022-43120, GHSA-3wmg-28v9-8hf6 | Medium | 0.5% | 09 Nov, 2022 | Packagist intelliants/subrion |
FeehiCMS is vulnerable to Cross-Site Scripting (XSS) CVE-2022-43320, GHSA-3ppm-fwhm-qqg6 | Medium | 0.4% | 09 Nov, 2022 | Packagist feehi/cms |
OpenFGA Authorization Bypass CVE-2022-39352, GHSA-3gfj-fxx4-f22w, GO-2022-1099 | Medium | 0.5% | 08 Nov, 2022 | Go github.com/openfga/openfga |
Exfiltration of hashed SMB credentials on Windows via file:// redirect CVE-2022-36077, GHSA-p2jh-44qj-pf2v | Medium | 0.7% | 08 Nov, 2022 | npm electron |
Froxlor vulnerable to code injection CVE-2022-3869, GHSA-6rjv-xxgr-v57x | Medium | 1.8% | 05 Nov, 2022 | Packagist froxlor/froxlor |
diplib Double Free CVE-2021-39432, GHSA-xf2w-5673-h6ww, PYSEC-2022-43131 | Medium | 0.9% | 04 Nov, 2022 | PyPI diplib |
Froxlor vulnerable to Code Injection CVE-2022-3721, GHSA-h95w-p3x6-wwj6 | Medium | 1.1% | 04 Nov, 2022 | Packagist froxlor/froxlor |
deep-parse-json vulnerable to Prototype Pollution CVE-2022-42743, GHSA-ff9j-pwxg-q5p2 | Medium | 0.7% | 03 Nov, 2022 | npm deep-parse-json |
fastest-json-copy vulnerable to Prototype Pollution CVE-2022-41714, GHSA-p5g9-rjcf-95vj | Medium | 0.7% | 03 Nov, 2022 | npm fastest-json-copy |
deep-object-diff vulnerable to Prototype Pollution CVE-2022-41713, GHSA-653v-rqx9-j85p | Medium | 0.8% | 03 Nov, 2022 | npm deep-object-diff |
Markdownify has Files or Directories Accessible to External Parties CVE-2022-41710, GHSA-qqhf-xfhw-7884 | Medium | 0.4% | 03 Nov, 2022 | npm electron-markdownify |
TYPO3 Extension femanager vulnerable to Broken Access Control CVE-2022-44543, GHSA-59m9-p6cm-94q5 | Medium | 0.6% | 03 Nov, 2022 | Packagist in2code/femanager |
OpenCart SQL injection vulnerability CVE-2021-37823, GHSA-236j-rfx5-wq38 | Medium | 0.9% | 03 Nov, 2022 | Packagist opencart/opencart |
Tribal Systems Zenario CMS vulnerable to Cross-site Scripting CVE-2020-36608, GHSA-f92p-f8r2-c87q | Medium | 0.5% | 02 Nov, 2022 | Packagist tribalsystems/zenario |
Batched HTTP requests may set incorrect `cache-control` response header GHSA-8r69-3cvp-wxc3 | Medium | Not scored | 02 Nov, 2022 | npm @apollo/server npm apollo-server-core |
Vulnerable OpenSSL included in cryptography wheels GHSA-39hc-v87j-747x | Medium | Not scored | 02 Nov, 2022 | PyPI cryptography |
Apache Airflow Cross-site Scripting vulnerability BIT-airflow-2022-43982, CVE-2022-43982, GHSA-h63r-9xxf-f2c7, PYSEC-2022-42970 | Medium | 1.8% | 02 Nov, 2022 | PyPI apache-airflow |
Apache Airflow Open Redirect vulnerability BIT-airflow-2022-43985, CVE-2022-43985, GHSA-f9fq-78ch-4wmj, PYSEC-2022-42971 | Medium | 1.8% | 02 Nov, 2022 | PyPI apache-airflow |
TablePress Plugin vulnerable to Cross-site Scripting CVE-2022-3788, GHSA-9mf2-hpj4-rw3r | Medium | Not scored | 01 Nov, 2022 | Packagist tobiasbg/tablepress |
Apache Spark vulnerable to Log Injection BIT-spark-2022-31777, CVE-2022-31777, GHSA-43xg-8wmj-cw8h, PYSEC-2022-42976 | Medium | 1.8% | 01 Nov, 2022 | Maven org.apache.spark:spark-core_2.10 Maven org.apache.spark:spark-core_2.11 Maven org.apache.spark:spark-core_2.12 Maven org.apache.spark:spark-core_2.13 +2 more |
node-red-dashboard vulnerable to Cross-site Scripting CVE-2022-3783, GHSA-vrv9-3x3w-ffxw | Medium | 0.8% | 31 Oct, 2022 | npm node-red-dashboard |
OctoRPKI crashes when max iterations is reached CVE-2022-3616, GHSA-pmw9-567p-68pc, GO-2022-1089 | Medium | 0.5% | 31 Oct, 2022 | Go github.com/cloudflare/cfrpki |
ProcessWire vulnerable to Cross-Site Request Forgery CVE-2022-40488, GHSA-vpwh-qmwc-2phg | Medium | 0.3% | 31 Oct, 2022 | Packagist processwire/processwire |
ProcessWire vulnerable to Cross-site Scripting CVE-2022-40487, GHSA-8g35-prrr-gxxf | Medium | 0.5% | 31 Oct, 2022 | Packagist processwire/processwire |
phpMyFAQ vulnerable to reflected Cross-site Scripting CVE-2022-3766, GHSA-mg5h-rhjq-6v84 | Medium | 8.3% | 31 Oct, 2022 | Packagist thorsten/phpmyfaq |
phpMyFAQ vulnerable to stored Cross-site Scripting CVE-2022-3765, GHSA-wr74-2v66-57pp | Medium | 0.7% | 31 Oct, 2022 | Packagist thorsten/phpmyfaq |
OpenStack Sushy-Tools and VirtualBMC Improper Preservation of Permissions CVE-2022-44020, GHSA-5pj3-6fqm-8m7m, PYSEC-2026-1059, PYSEC-2026-3079 | Medium | 0.2% | 30 Oct, 2022 | PyPI sushy-tools PyPI virtualbmc |
Hashicorp Boundary vulnerable to clickjacking CVE-2022-36182, GHSA-xqv2-3vvq-qg6r | Medium | 0.7% | 27 Oct, 2022 | Go github.com/hashicorp/boundary |
Twisted vulnerable to NameVirtualHost Host header injection CVE-2022-39348, GHSA-vg46-2rrj-3647, PYSEC-2026-1055 | Medium | 1.6% | 26 Oct, 2022 | PyPI twisted |
HyperDown vulnerable to Cross-site Scripting CVE-2022-25849, GHSA-4r9g-w48q-8jwm | Medium | 0.6% | 26 Oct, 2022 | Packagist joyqi/hyper-down |
OpenFGA Authorization Bypass via tupleset wildcard CVE-2022-39341, GHSA-vj4m-83m8-xpw5, GO-2022-1080 | Medium | 1.1% | 25 Oct, 2022 | Go github.com/openfga/openfga |
OpenFGA Authorization Bypass CVE-2022-39342, GHSA-f4mm-2r69-mg5f, GO-2022-1081 | Medium | 1.1% | 25 Oct, 2022 | Go github.com/openfga/openfga |
OpenFGA subject to Information Disclosure via streamed-list-objects endpoint CVE-2022-39340, GHSA-95x7-mh78-7w2r, GO-2022-1079 | Medium | 0.9% | 25 Oct, 2022 | Go github.com/openfga/openfga |
Plaintext storage of tokens in pulp_ansible CVE-2022-3644, GHSA-qv37-mfjf-42h8, PYSEC-2026-900 | Medium | 0.3% | 25 Oct, 2022 | PyPI pulp-ansible |
@dependencytrack/frontend vulnerable to Persistent Cross-Site-Scripting via Vulnerability Details CVE-2022-39350, GHSA-c33w-pm52-mqvf | Medium | 0.9% | 25 Oct, 2022 | npm @dependencytrack/frontend |
free5GC vulnerable to malformed NGAP message crashing the AMF and NGAP decoders CVE-2022-43677, GHSA-59hj-62f5-fgmc, GO-2022-1083 | Medium | 0.8% | 24 Oct, 2022 | Go github.com/free5gc/aper Go github.com/free5gc/free5gc |
Team scope authorization bypass when Post/Put request with :team_name in body, allows HTTP parameter pollution BIT-concourse-2022-31683, CVE-2022-31683, GHSA-5jp2-vwrj-99rf | Medium | 0.5% | 19 Oct, 2022 | Go github.com/concourse/concourse |
Improper use of metav1.Duration allows for Denial of Service BIT-flux-2022-39272, BIT-kustomize-2022-39272, CVE-2022-39272, GHSA-f4p5-x4vc-mh4v, GO-2022-1071 | Medium | 0.8% | 19 Oct, 2022 | Go github.com/fluxcd/flux2 Go github.com/fluxcd/helm-controller Go github.com/fluxcd/helm-controller/api Go github.com/fluxcd/image-automation-controller +9 more |
OctoPrint vulnerable to Special Element Injection CVE-2022-3607, GHSA-rj5f-vm79-5j84, PYSEC-2022-42975 | Medium | 0.4% | 19 Oct, 2022 | PyPI OctoPrint PyPI octoprint |
Kirby CMS vulnerable to user enumeration in the brute force protection CVE-2022-39315, GHSA-c27j-76xg-6x4f | Medium | 0.8% | 18 Oct, 2022 | Packagist getkirby/cms |
Kirby CMS vulnerable to user enumeration in the code-based login and password reset forms CVE-2022-39314, GHSA-43qq-qw4x-28f8 | Medium | 0.4% | 18 Oct, 2022 | Packagist getkirby/cms |
Update bundled libxml2 to v2.10.3 to resolve multiple CVEs CVE-2022-50998, GHSA-2qc6-mcvw-92cw | Medium | Not scored | 18 Oct, 2022 | RubyGems nokogiri |
OroCommerce Cross site scripting vulnerability during shipping rule editing for UPS integration CVE-2022-31037, GHSA-4vf4-955g-vxp2 | Medium | 0.5% | 18 Oct, 2022 | Packagist oro/commerce |
Magento Open Source allows Improper Access Control CVE-2022-35689, GHSA-5fxx-jwjm-x9hj | Medium | 1.4% | 14 Oct, 2022 | Packagist magento/community-edition Packagist magento/project-community-edition |
The graphql-upload library included in Apollo Server 2 is vulnerable to CSRF mutations GHSA-2p3c-p3qw-69r4 | Medium | Not scored | 12 Oct, 2022 | npm apollo-server |