Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Appwrite Vulnerable to Cross-site Scripting CVE-2022-2925, GHSA-5ffj-mph5-c5hv | Medium | 0.8% | 09 Sep, 2022 | Packagist appwrite/server-ce |
JOSE vulnerable to resource exhaustion via specifically crafted JWE CVE-2022-36083, GHSA-jv3g-j58f-9mq9 | Medium | 1.6% | 07 Sep, 2022 | npm jose npm jose-browser-runtime npm jose-node-cjs-runtime npm jose-node-esm-runtime |
mangadex-downloader vulnerable to unauthorized file reading CVE-2022-36082, GHSA-r9x7-2xmr-v8fw, PYSEC-2022-264 | Medium | 0.7% | 07 Sep, 2022 | PyPI mangadex-downloader |
ReactPHP's HTTP server parses encoded cookie names so malicious `__Host-` and `__Secure-` cookies can be sent CVE-2022-36032, GHSA-w3w9-vrf5-8mx8 | Medium | 1.2% | 06 Sep, 2022 | Packagist react/http |
Unauthenticated Sensitive Information Disclosure vulnerability CVE-2022-34867, GHSA-29qv-hhg4-6x96 | Medium | 0.8% | 06 Sep, 2022 | Packagist libreform/libreform |
Apache Airflow exposes arbitrary file content BIT-airflow-2022-38170, CVE-2022-38170, GHSA-q8h9-pqcx-59hw, PYSEC-2022-261 | Medium | 0.6% | 02 Sep, 2022 | PyPI apache-airflow |
Pinniped Supervisor Insufficient Session Expiration vulnerability BIT-pinniped-2022-31677, CVE-2022-31677, GHSA-rp4v-hhm6-rcv9, GO-2022-0981 | Medium | 0.5% | 01 Sep, 2022 | Go go.pinniped.dev |
sosreport Exposure of Sensitive Information vulnerability CVE-2022-2806, GHSA-7pf9-7cff-f854, PYSEC-2026-925 | Medium | 0.3% | 01 Sep, 2022 | PyPI sosreport |
openstack-barbican Denial of Service vulnerability CVE-2022-23452, GHSA-6p2h-rjj7-2j63, PYSEC-2026-785 | Medium | 1.3% | 01 Sep, 2022 | PyPI barbican |
francoisjacquet/rosariosis vulnerable to Cross-Site Scripting (XSS) CVE-2022-3072, GHSA-2mh7-qxcw-q39g | Medium | 0.9% | 01 Sep, 2022 | Packagist francoisjacquet/rosariosis |
PrestaShop Product Comments Cross-site Scripting vulnerability CVE-2022-35933, GHSA-prrh-qvhf-x788 | Medium | 0.6% | 31 Aug, 2022 | Packagist prestashop/productcomments |
LibreNMS vulnerable to Cross-Site Scripting (XSS) CVE-2022-36746, GHSA-325v-g5vx-whxc | Medium | 0.5% | 30 Aug, 2022 | Packagist librenms/librenms |
LibreNMS vulnerable to Cross-Site Scripting (XSS) CVE-2022-36745, GHSA-5229-94p3-7wwq | Medium | 0.5% | 30 Aug, 2022 | Packagist librenms/librenms |
Captcha Bypass in strapi-plugin-ezforms GHSA-8mgq-6r2q-82w9 | Medium | Not scored | 30 Aug, 2022 | npm strapi-plugin-ezforms |
Helm Vulnerable to denial of service through string value parsing BIT-helm-2022-36055, CVE-2022-36055, GHSA-7hfp-qfw3-5jxh, GO-2022-0962 | Medium | 1.1% | 30 Aug, 2022 | Go helm.sh/helm/v3 |
Unexpected server crash in Next.js CVE-2022-36046, GHSA-wff4-fpwg-qqv3, PYSEC-2022-43188 | Medium | 1.2% | 30 Aug, 2022 | PyPI nextjs npm next |
Cleartext Transmission of Sensitive Information in moment-timezone GHSA-v78c-4p63-2j6c | Medium | Not scored | 30 Aug, 2022 | npm moment-timezone |
Network Policies & (Clusterwide) Cilium Network Policies with namespace label selectors may unexpectedly select pods with maliciously crafted labels GHSA-pfhr-pccp-hwmh, GO-2022-0959 | Medium | Not scored | 30 Aug, 2022 | Go github.com/cilium/cilium |
x-data-spreadsheet through 1.1.9 vulnerable to Cross-site Scripting CVE-2022-25646, GHSA-x5cw-843f-r366 | Medium | 0.9% | 30 Aug, 2022 | npm x-data-spreadsheet |
snipe-it vulnerable to cross-site scripting (XSS) CVE-2022-3035, GHSA-rff2-vqm3-jpv5 | Medium | 0.7% | 29 Aug, 2022 | Packagist snipe/snipe-it |
Cross-site scripting from dynamic options in the multiselect field CVE-2022-36037, GHSA-3f89-869f-5w76 | Medium | 0.9% | 29 Aug, 2022 | Packagist getkirby/cms |
python-oslo-utils has improper password parsing CVE-2022-0718, GHSA-wmqq-r32m-87c5, PYSEC-2022-258 | Medium | 1.9% | 29 Aug, 2022 | PyPI oslo-utils |
Subrion CMS 4.2.1 vulnerable to cross-site scripting in admin panel CVE-2022-37059, GHSA-rh4r-9689-6xw4 | Medium | 0.6% | 29 Aug, 2022 | Packagist intelliants/subrion |
Pagekit CMS cross-site scripting in Markdown text box where articles are edited CVE-2022-36573, GHSA-q6h8-qjjc-j8cg | Medium | 0.6% | 29 Aug, 2022 | Packagist pagekit/pagekit |
Froxlor vulnerable to Cross-Site Request Forgery (CSRF) CVE-2022-3017, GHSA-9xgp-3mxp-rv7x | Medium | 0.4% | 28 Aug, 2022 | Packagist froxlor/froxlor |
Deluge Web-UI vulnerable to XSS through a crafted torrent file CVE-2021-3427, GHSA-5c8p-qhch-qhx6, PYSEC-2022-256 | Medium | 1.0% | 26 Aug, 2022 | PyPI deluge |
Kirby CMS 2.5.12 Cross-site Scripting CVE-2018-14520, GHSA-h3w2-qg2r-c7mf | Medium | 0.7% | 24 Aug, 2022 | Packagist getkirby/cms |
Kirby CMS 2.5.12 Cross-site Request Forgery CVE-2018-14519, GHSA-c7x2-7h8r-jq4m | Medium | 0.5% | 24 Aug, 2022 | Packagist getkirby/cms |
exceedone/exment and exceedone/laravel-admin Cross-site Scripting vulnerability CVE-2022-38080, GHSA-8629-83m5-rj75 | Medium | 0.9% | 24 Aug, 2022 | Packagist exceedone/exment Packagist exceedone/laravel-admin |
ansible-runner has default temporary files written to world R/W locations CVE-2021-3701, GHSA-wwch-cmqr-hhrm, PYSEC-2022-43067 | Medium | 0.3% | 23 Aug, 2022 | PyPI ansible-runner |
ansible-runner vulnerable to Race Condition CVE-2021-3702, GHSA-772j-xvf9-qpf5, PYSEC-2022-43068 | Medium | 0.2% | 23 Aug, 2022 | PyPI ansible-runner |
Pimcore Cross-site Scripting (XSS) CVE-2022-2796, GHSA-pr4f-4pcx-2r3h | Medium | 1.7% | 23 Aug, 2022 | Packagist pimcore/pimcore |
gomatrixserverlib and Dendrite vulnerable to incorrect parsing of the event default power level in event auth CVE-2022-36009, GHSA-grvv-h2f9-7v9c, GO-2022-0952 | Medium | 0.9% | 22 Aug, 2022 | Go github.com/matrix-org/dendrite Go github.com/matrix-org/gomatrixserverlib |
Cross site scripting in mobiledoc-kit CVE-2022-2932, GHSA-hw2p-xqhq-3mjf | Medium | 0.9% | 22 Aug, 2022 | npm mobiledoc-kit |
Cross site scripting in yetiforce/yetiforce-crm CVE-2022-2890, GHSA-jhxh-68jj-68c7 | Medium | 0.9% | 22 Aug, 2022 | Packagist yetiforce/yetiforce-crm |
Cross site scripting in yetiforce/yetiforce-crm CVE-2022-1340, GHSA-w83m-rghh-frxj | Medium | 0.5% | 22 Aug, 2022 | Packagist yetiforce/yetiforce-crm |
Cross site scripting in yetiforce/yetiforce-crm CVE-2022-2885, GHSA-rjvc-mf7r-ch7r | Medium | 0.5% | 21 Aug, 2022 | Packagist yetiforce/yetiforce-crm |
Magento Open Source has Improper Access Control vulnerability CVE-2022-35692, GHSA-gm4m-9rm8-7rxj | Medium | 0.9% | 19 Aug, 2022 | Packagist magento/community-edition Packagist magento/project-community-edition |
Directus vulnerable to unhandled exception on illegal filename_disk value CVE-2022-36031, GHSA-77qm-wvqq-fg79 | Medium | 1.0% | 19 Aug, 2022 | npm directus |
apollo-server-core vulnerable to URL-based XSS attack affecting IE11 on default landing page GHSA-2fvv-qxrq-7jq6 | Medium | Not scored | 18 Aug, 2022 | npm apollo-server-core |
Cross site scripting in getkirby/starterkit CVE-2022-35174, GHSA-4m2g-668v-jwjx | Medium | 0.7% | 18 Aug, 2022 | Packagist getkirby/starterkit |
NotrinosERP Cross-site Scripting vulnerability CVE-2022-2871, GHSA-hrx5-cv4v-4c44 | Medium | 0.7% | 17 Aug, 2022 | Packagist notrinos/notrinos-erp |
Magento Improper Access Control vulnerability BIT-magento-2022-34259, CVE-2022-34259, GHSA-9wjf-94h3-r4rh | Medium | 1.7% | 16 Aug, 2022 | Packagist magento/community-edition |
Magento stored Cross-Site Scripting (XSS) vulnerability BIT-magento-2022-34258, CVE-2022-34258, GHSA-5m55-g8pv-x8ww | Medium | 69.9% | 16 Aug, 2022 | Packagist magento/community-edition |
Magento stored Cross-Site Scripting (XSS) vulnerability BIT-magento-2022-34257, CVE-2022-34257, GHSA-rg7p-wmgj-f374 | Medium | 1.0% | 16 Aug, 2022 | Packagist magento/community-edition |
Moodle reflected XSS Vulnerability BIT-moodle-2020-14320, CVE-2020-14320, GHSA-fcpw-vqh5-6qwj | Medium | 0.7% | 16 Aug, 2022 | Packagist moodle/moodle |
@actions/core has Delimiter Injection Vulnerability in exportVariable CVE-2022-35954, GHSA-7r3h-m5j6-3q42 | Medium | 0.7% | 15 Aug, 2022 | npm @actions/core |
Nodejs ‘undici’ vulnerable to CRLF Injection via Content-Type CVE-2022-35948, GHSA-f772-66g8-q5h3 | Medium | 1.4% | 15 Aug, 2022 | npm undici |
Gitea allowed assignment of private issues BIT-gitea-2022-38183, CVE-2022-38183, GHSA-fhv8-m4j4-cww2, GO-2024-2769 | Medium | 0.9% | 13 Aug, 2022 | Go code.gitea.io/gitea |
ForkCMS XSS via `end_date` parameter CVE-2022-35590, GHSA-pw4j-r69m-rrr5 | Medium | 0.8% | 12 Aug, 2022 | Packagist forkcms/forkcms |