Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
NaN/INF in serverbound movement packets can crash clients and servers CVE-2021-48007, GHSA-fm35-jgg3-3grx | High | 0.5% | 18 Mar, 2022 | Packagist pocketmine/pocketmine-mp |
Improper Verification of Cryptographic Signature in node-forge CVE-2022-24772, GHSA-x4jg-mjrx-434g | High | 1.1% | 18 Mar, 2022 | npm node-forge |
Improper Verification of Cryptographic Signature in node-forge CVE-2022-24771, GHSA-cfm4-qjh2-4765 | High | 0.8% | 18 Mar, 2022 | npm node-forge |
Path traversal in github.com/valyala/fasthttp CVE-2022-21221, GHSA-fx95-883v-4q4h, GO-2022-0355, SNYK-GOLANG-GITHUBCOMVALYALAFASTHTTP-2407866 | High | 2.5% | 18 Mar, 2022 | Go github.com/valyala/fasthttp |
Race Condition in Paramiko CVE-2022-24302, GHSA-f8q4-jwww-x3wv, PYSEC-2022-166 | High | 2.1% | 17 Mar, 2022 | PyPI paramiko |
Veeam Backup & Replication Remote Code Execution Vulnerability CVE-2022-26500 | HighExploited | 5.8% | 17 Mar, 2022 | |
Allocation of Resources Without Limits or Throttling in nvflare CVE-2022-21822, GHSA-jx8f-cpx7-fv47, PYSEC-2026-695 | High | 1.1% | 17 Mar, 2022 | PyPI nvflare |
Improper Neutralization of Formula Elements in a CSV File in Gradio Flagging CVE-2022-24770, GHSA-f8xq-q7px-wg8c, PYSEC-2022-229 | High | 1.3% | 17 Mar, 2022 | PyPI gradio |
Failure to validate signature during handshake CVE-2022-24759, GHSA-j3ff-xp6c-6gcc | High | 0.5% | 17 Mar, 2022 | npm @chainsafe/libp2p-noise |
HTTP Request Smuggling in waitress CVE-2022-24761, GHSA-4f7p-27jc-3c36, PYSEC-2022-169 | High | 1.8% | 17 Mar, 2022 | PyPI waitress |
Prototype Pollution in bodymen CVE-2022-25296, GHSA-vhxc-fhm5-qcp9 | High | 1.0% | 17 Mar, 2022 | npm bodymen |
Command injection in guake CVE-2021-23556, GHSA-7x48-7466-3g33, PYSEC-2022-165, SNYK-PYTHON-GUAKE-2386334 | High | 1.1% | 17 Mar, 2022 | PyPI guake |
Denial of service in go-ethereum CVE-2021-42219, GHSA-vrcc-g6vj-mh5w | High | 1.2% | 17 Mar, 2022 | Go github.com/ethereum/go-ethereum |
Unhandled case in node-lmdb CVE-2022-21164, GHSA-32j9-6qqm-mq9g, SNYK-JS-NODELMDB-2400723 | High | 1.3% | 16 Mar, 2022 | npm node-lmdb |
Cross-site Scripting in CKEditor4 BIT-drupal-2022-24728, BIT-drupal-2022-24729, CVE-2022-24728, CVE-2022-24729, DRUPAL-CORE-2022-005, GHSA-4fc4-4p5g-6w89, GHSA-f6rf-9m92-x2hh | High | 2.5% | 16 Mar, 2022 | Packagist drupal/core npm ckeditor4 |
Google Pixel Out-of-Bounds Write Vulnerability CVE-2021-39793 | HighExploited | 0.7% | 16 Mar, 2022 | |
Server-Side Request Forgery in FUXA CVE-2021-45851, GHSA-9vp3-7qwq-83r9 | High | 1.5% | 16 Mar, 2022 | npm @frangoteam/fuxa |
Code Injection in CRI-O CVE-2022-0811, GHSA-6x2m-w449-qwx7, GO-2022-0354 | High | 19.0% | 15 Mar, 2022 | Go github.com/cri-o/cri-o |
Nicotine+ DoS on Null Character in Download Request CVE-2021-45848, GHSA-p4v2-r99v-wjc2, PYSEC-2026-687 | High | 1.6% | 15 Mar, 2022 | PyPI nicotine-plus |
Stored Cross-site Scripting in grav CVE-2022-0970, GHSA-r6hh-5g3q-wwgc | High | 1.8% | 15 Mar, 2022 | Packagist getgrav/grav |
Integer Overflow in microweber CVE-2022-0968, GHSA-5fxv-xx5p-g2fv | High | 3.7% | 15 Mar, 2022 | Packagist microweber/microweber |
Denial of service in microweber CVE-2022-0961, GHSA-hrf4-hcpc-3345 | High | 1.0% | 15 Mar, 2022 | Packagist microweber/microweber |
Sudden swap of user auth tokens in Volto CVE-2022-24740, GHSA-cfhh-xgwq-5r67 | High | 0.6% | 14 Mar, 2022 | npm @plone/volto |
Insufficient Session Expiration in Sylius CVE-2022-24743, GHSA-mf3v-f2qq-pf9g | High | 1.3% | 14 Mar, 2022 | Packagist sylius/sylius |
Cross-site Scripting in microweber CVE-2022-0930, GHSA-2cv6-6437-39p2 | High | 0.9% | 12 Mar, 2022 | Packagist microweber/microweber |
Moodle denial-of-service risk in the draft files area BIT-moodle-2021-32476, CVE-2021-32476, GHSA-4qxc-qxrp-33cw | High | 1.1% | 11 Mar, 2022 | Packagist moodle/moodle |
Moodle Blind SQL injection possible via MNet authentication BIT-moodle-2021-32474, CVE-2021-32474, GHSA-rvmc-8gmg-ggqr | High | 0.9% | 11 Mar, 2022 | Packagist moodle/moodle |
Integer Overflow or Wraparound in Microweber CVE-2022-0913, GHSA-c383-q5vf-hx55 | High | 1.4% | 11 Mar, 2022 | Packagist microweber/microweber |
Exposure of Sensitive Information to an Unauthorized Actor in FreeTAKServer-UI CVE-2022-25512, GHSA-9988-f88m-mr42, PYSEC-2026-638 | High | 1.1% | 11 Mar, 2022 | PyPI FreeTAKServer-UI PyPI freetakserver-ui |
Improper Authentication in FreeTAKServer CVE-2022-25508, GHSA-hggv-mcp4-vxc5, PYSEC-2022-43054 | High | 1.1% | 11 Mar, 2022 | PyPI FreeTAKServer PyPI freetakserver |
Hard coded credentials in FreeTAKServer CVE-2022-25510, GHSA-f897-875p-23x7, PYSEC-2022-43135 | High | 1.1% | 11 Mar, 2022 | PyPI FreeTAKServer PyPI freetakserver |
Arbitrary file write in nats-server BIT-nats-2022-26652, CVE-2022-26652, GHSA-6h3m-36w8-hv68, GO-2022-0351 | High | 2.3% | 10 Mar, 2022 | Go github.com/nats-io/nats-server Go github.com/nats-io/nats-server/v2 Go github.com/nats-io/nats-streaming-server |
Code injection in Stripe CLI on windows CVE-2022-24753, GHSA-4cx6-fj7j-pjx9, GO-2022-0350 | High | 0.4% | 10 Mar, 2022 | Go github.com/stripe/stripe-cli |
Unrestricted Upload of File with Dangerous Type in Croogo CVE-2021-44673, GHSA-4pww-fqgh-36hj | High | 9.0% | 10 Mar, 2022 | Packagist croogo/croogo |
XML Entity Expansion in trytond and proteus CVE-2022-26662, GHSA-pm3h-mm62-pwm8, PYSEC-2022-43171, PYSEC-2026-3392, PYSEC-2026-741 | High | 2.0% | 10 Mar, 2022 | PyPI proteus PyPI tryton PyPI trytond |
Linux Kernel Privilege Escalation Vulnerability CVE-2022-0847 | HighExploited | 92.8% | 10 Mar, 2022 | |
Exposure of Sensitive Information to an Unauthorized Actor in PhpMyAdmin BIT-phpmyadmin-2022-0813, CVE-2022-0813, GHSA-vx8q-j7h9-vf6q | High | 1.3% | 10 Mar, 2022 | Packagist phpmyadmin/phpmyadmin |
Gitea Missing Authorization vulnerability BIT-gitea-2022-0905, CVE-2022-0905, GHSA-jr9c-h74f-2v28, GO-2022-0609 | High | 0.8% | 10 Mar, 2022 | Go code.gitea.io/gitea |
Authentication Bypass by Capture-replay in Apache Spark BIT-spark-2021-38296, CVE-2021-38296, GHSA-9rr6-jpg7-9jg6, PYSEC-2022-186 | High | 1.8% | 10 Mar, 2022 | Maven org.apache.spark:spark-core PyPI pyspark |
Incorrect Authentication in shopware CVE-2022-24748, GHSA-83vp-6jqg-6cmr | High | 0.8% | 09 Mar, 2022 | Packagist shopware/core |
Improper Neutralization of Special Elements Used in a Template Engine in microweber CVE-2022-0896, GHSA-q9qc-pp5x-mc8c | High | 1.4% | 09 Mar, 2022 | Packagist microweber/microweber |
Server-Side Request Forgery and Open Redirect in AllTube Download CVE-2022-24739, GHSA-75p7-527p-w8wp | High | 0.9% | 08 Mar, 2022 | Packagist rudloff/alltube |
Account compromise in Evmos CVE-2022-24738, GHSA-5jgq-x857-p8xw, GO-2022-0348 | High | 1.1% | 07 Mar, 2022 | Go github.com/tharsis/evmos Go github.com/tharsis/evmos/v2 |
Denial of Service in Go-Ethereum CVE-2022-23327, GHSA-pvx3-gm3c-gmpr | High | 1.4% | 05 Mar, 2022 | Go github.com/ethereum/go-ethereum |
Denial of Service in Go-Ethereum CVE-2022-23328, GHSA-vmf7-hmh6-vv57 | High | 1.4% | 05 Mar, 2022 | Go github.com/ethereum/go-ethereum |
Duplicate Advisory: Command injection in Weblate BIT-weblate-2022-23915, CVE-2022-23915, CVE-2022-24727, GHSA-3872-f48p-pxqj, GHSA-h2g5-2rhx-ffgj, PYSEC-2022-162, PYSEC-2022-31, SNYK-PYTHON-WEBLATE-2414088 | High | 3.1% | 04 Mar, 2022 | PyPI Weblate PyPI weblate |
Cross Site Request Forgery in intelliants/subrion CVE-2020-18326, GHSA-9cc3-5w85-pxvx | High | 2.2% | 04 Mar, 2022 | Packagist intelliants/subrion |
Integer overflow in cmark-gfm table parsing extension leads to heap memory corruption CVE-2024-22051, GHSA-fmx4-26r3-wxpf | High | 1.5% | 03 Mar, 2022 | RubyGems commonmarker |
Linux Kernel Improper Authentication Vulnerability CVE-2022-0492 | HighExploited | 5.5% | 03 Mar, 2022 | |
Execution with Unnecessary Privileges in arc-electron GHSA-v3wr-67px-44xg | High | Not scored | 03 Mar, 2022 | npm @advanced-rest-client/base |