Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Incorrect Comparison in Vyper CVE-2022-24787, GHSA-7vrm-3jc8-5wwm, PYSEC-2022-196 | High | 1.0% | 04 Apr, 2022 | PyPI vyper |
Path Traversal: 'dir/../../filename' in moment.locale CVE-2022-24785, GHSA-8hfj-j24r-96c4 | High | 13.8% | 04 Apr, 2022 | NuGet Moment.js npm moment |
Rancher's Steve API Component Improper authorization check allows privilege escalation CVE-2021-36776, GHSA-gvh9-xgrq-r8hw, GO-2024-2771 | High | 1.1% | 04 Apr, 2022 | Go github.com/rancher/rancher |
Rancher's Failure to delete orphaned role bindings does not revoke project level access from group based authentication CVE-2021-36775, GHSA-28g7-896h-695v, GO-2024-2760 | High | 1.0% | 04 Apr, 2022 | Go github.com/rancher/rancher |
Cross-Site Request Forgery in YOURLS CVE-2022-0088, GHSA-gx7g-wjxg-jwwj | High | 2.0% | 03 Apr, 2022 | Packagist yourls/yourls |
Command injection in cocoapods-downloader CVE-2022-21223, GHSA-g397-v4w5-4m79, SNYK-RUBY-COCOAPODSDOWNLOADER-2414280 | High | 1.7% | 02 Apr, 2022 | RubyGems cocoapods-downloader |
Command injection in cocoapods-downloader CVE-2022-24440, GHSA-7627-mp87-jf6q, SNYK-RUBY-COCOAPODSDOWNLOADER-2414278 | High | 2.6% | 02 Apr, 2022 | RubyGems cocoapods-downloader |
Podman's default inheritable capabilities for linux container not empty CVE-2022-27649, GHSA-qvf8-p83w-v58j, GO-2022-0416 | High | 1.4% | 01 Apr, 2022 | Go github.com/containers/podman Go github.com/containers/podman/v2 Go github.com/containers/podman/v3 Go github.com/containers/podman/v4 |
Automatic named constructor discovery in Valinor GHSA-xhr8-mpwq-2rr2 | High | Not scored | 01 Apr, 2022 | Packagist cuyz/valinor |
Sensitive Auth & Cookie data stored in Jupyter server logs BIT-jupyter-base-notebook-2022-24758, BIT-jupyter-notebook-2022-24758, CVE-2022-24758, GHSA-m87f-39q9-6f55, PYSEC-2022-180 | High | 1.1% | 31 Mar, 2022 | PyPI notebook |
Improper Removal of Sensitive Information Before Storage or Transfer in irrd CVE-2022-24798, GHSA-cqxx-66wh-8pjw, PYSEC-2022-178 | High | 1.4% | 31 Mar, 2022 | PyPI irrd |
URL Redirection to Untrusted Site ('Open Redirect') in express-openid-connect CVE-2022-24794, GHSA-7p99-3798-f85c | High | 0.7% | 31 Mar, 2022 | npm express-openid-connect |
Access Control vulnerability in Dolibarr BIT-dolibarr-2021-37517, CVE-2021-37517, GHSA-xw7v-qrhc-jjg2 | High | 1.0% | 31 Mar, 2022 | Packagist dolibarr/dolibarr |
SQL Injection in Dolibarr BIT-dolibarr-2021-36625, CVE-2021-36625, GHSA-vrgp-3ph6-2wwq | High | 0.9% | 31 Mar, 2022 | Packagist dolibarr/dolibarr |
Unrestricted Upload of File with Dangerous Type in WPanel 4 CVE-2021-34257, GHSA-vhgr-gfx3-fg37 | High | 1.8% | 31 Mar, 2022 | Packagist wpanel/wpanel4-cms |
Type Confusion in LiveHelperChat BIT-livehelperchat-2022-1176, CVE-2022-1176, GHSA-5cmw-fhq9-8fhh | High | 1.3% | 31 Mar, 2022 | Packagist remdex/livehelperchat |
Path Traversal within joomla/archive tar class BIT-joomla-2022-23793, CVE-2022-23793, GHSA-jm67-jh3g-cg3f | High | 2.1% | 30 Mar, 2022 | Packagist joomla/archive |
Old sessions not blocked by login enable function in Snipe-IT CVE-2022-1155, GHSA-636j-7x7r-gvw2 | High | 1.0% | 30 Mar, 2022 | Packagist snipe/snipe-it |
Uncontrolled Resource Consumption in Apache DolphinScheduler CVE-2022-25598, GHSA-qg5x-66hp-cw5p, PYSEC-2022-176 | High | 2.0% | 30 Mar, 2022 | Maven org.apache.dolphinscheduler:dolphinscheduler PyPI apache-dolphinscheduler |
SaltStack Improper Verification of Cryptographic Signature CVE-2022-22934, GHSA-2q4g-wfm6-5fpm, PYSEC-2022-171 | High | 0.9% | 29 Mar, 2022 | PyPI salt |
SaltStack Salt Authentication Bypass by Capture-replay CVE-2022-22936, GHSA-5r3f-3m3j-wcj2, PYSEC-2022-173 | High | 0.8% | 29 Mar, 2022 | PyPI salt |
SaltStack Salt Permissions Bypass CVE-2022-22941, GHSA-qcr3-hr2f-6557, PYSEC-2022-174 | High | 1.3% | 29 Mar, 2022 | PyPI salt |
Incorrect Authorization in imgcrypt CVE-2022-24778, GHSA-8v99-48m9-c8pm, GO-2021-0412 | High | 2.7% | 28 Mar, 2022 | Go github.com/containerd/imgcrypt |
Path Traversal in ImpressCMS CVE-2021-26601, GHSA-4q96-9f63-p7jj | High | 3.2% | 28 Mar, 2022 | Packagist impresscms/impresscms |
Arbitrary shell execution GHSA-3988-h75v-hwf6 | High | Not scored | 26 Mar, 2022 | Packagist squizlabs/php_codesniffer |
Arbitrary shell execution GHSA-mhfv-8rc9-w38c | High | Not scored | 26 Mar, 2022 | Packagist squizlabs/php_codesniffer |
Linux Kernel Out-of-Bounds Write Vulnerability CVE-2022-0995 | HighExploited | 8.9% | 25 Mar, 2022 | |
SQL Injection in Moodle BIT-moodle-2022-0983, CVE-2022-0983, GHSA-h2fw-93qx-vrcq | High | 0.9% | 25 Mar, 2022 | Packagist moodle/moodle |
Improper Certificate Validation in kubeclient CVE-2022-0759, GHSA-69p3-xp37-f692 | High | 0.9% | 25 Mar, 2022 | RubyGems kubeclient |
SQL Injection in Yeswiki CVE-2021-43091, GHSA-xgx2-332h-9x6q | High | 1.4% | 25 Mar, 2022 | Packagist yeswiki/yeswiki |
SQL Injection in Fork CMS CVE-2022-1064, GHSA-rr8m-29g8-8cgc | High | 1.2% | 25 Mar, 2022 | Packagist forkcms/forkcms |
Nokogiri affected by zlib's Out-of-bounds Write vulnerability CVE-2018-25032, GHSA-jc36-42cf-vqwj, PSF-2022-3 | High | 51.7% | 25 Mar, 2022 | RubyGems nokogiri |
SQL Injection in Fork CMS CVE-2022-0153, GHSA-q863-cchm-c6c6 | High | 1.1% | 24 Mar, 2022 | Packagist forkcms/forkcms |
MotionEye allows attackers to access sensitive information CVE-2022-25568, GHSA-2c7w-v459-cwgf, PYSEC-2022-43141 | High | 6.9% | 24 Mar, 2022 | PyPI motioneye |
Use of insecure temporary file in Horovod CVE-2022-0315, GHSA-47wv-vhj2-g66m, PYSEC-2022-175 | High | 1.0% | 24 Mar, 2022 | PyPI horovod |
Path traversal and improper access control allows leaking out-of-bound files from Argo CD repo-server CVE-2022-24730, GHSA-r9cr-hvjj-496v, GO-2022-0357 | High | 0.9% | 24 Mar, 2022 | Go github.com/argoproj/argo-cd Go github.com/argoproj/argo-cd/v2 |
Insertion of Sensitive Information into Log File in Jupyter notebook CVE-2022-24757, GHSA-p737-p57g-4cpr, PYSEC-2022-179 | High | 1.3% | 23 Mar, 2022 | PyPI jupyter-server |
Missing Authentication for Critical Function in Foreman Ansible CVE-2021-3589, GHSA-vvff-6wrr-4g7q | High | 1.0% | 23 Mar, 2022 | RubyGems foreman_ansible |
Removal of functional code in faker.js GHSA-5w9c-rv96-fr7g | High | Not scored | 22 Mar, 2022 | npm faker |
Integer Overflow or Wraparound in Microweber CVE-2022-1036, GHSA-3qr6-qrqm-8v86 | High | 1.2% | 22 Mar, 2022 | Packagist microweber/microweber |
Unrestricted Upload of File with Dangerous Type in ShowDoc CVE-2022-1034, GHSA-xp82-jmw8-mjxp | High | 1.5% | 22 Mar, 2022 | Packagist showdoc/showdoc |
Untrusted Search Path in PNPM CVE-2022-26183, GHSA-9m87-6fj3-c5xh | High | 1.6% | 21 Mar, 2022 | npm pnpm |
Improper Input Validation in guzzlehttp/psr7 BIT-drupal-2022-24775, CVE-2022-24775, DRUPAL-CORE-2022-006, GHSA-q7rv-6hp3-vh96 | High | 2.5% | 21 Mar, 2022 | Packagist drupal/core Packagist guzzlehttp/psr7 |
Command Injection in ungit CVE-2022-25766, GHSA-hf8c-xr89-vfm5, SNYK-JS-UNGIT-2414099 | High | 34.5% | 21 Mar, 2022 | npm ungit |
Unrestricted Upload of File with Dangerous Type in Gogs CVE-2022-0415, GHSA-5gjh-5j4f-cpwv, GO-2022-0554 | High | 65.9% | 21 Mar, 2022 | Go gogs.io/gogs |
Exposure of Resource to Wrong Sphere in ThinkPHP Framework CVE-2022-25481, GHSA-69wp-xwm7-69wm | High | 4.7% | 21 Mar, 2022 | Packagist topthink/framework |
Insufficient Session Expiration in Admidio CVE-2022-0991, GHSA-mf79-f657-47ww | High | 1.0% | 19 Mar, 2022 | Packagist admidio/admidio |
golang.org/x/crypto/ssh Denial of service via crafted Signer CVE-2022-27191, GHSA-8c26-wmh5-6g9v, GO-2021-0356 | High | 4.0% | 19 Mar, 2022 | Go golang.org/x/crypto |
Improperly checked metadata on tools/armour itemstacks received from the client CVE-2022-51013, GHSA-46c5-pfj8-fv65 | High | 0.5% | 18 Mar, 2022 | Packagist pocketmine/pocketmine-mp |
Apple iOS, iPadOS, and macOS Webkit Use-After-Free Vulnerability CVE-2022-22620 | HighExploited | 16.3% | 18 Mar, 2022 |