Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Local File Inclusion vulnerability in zmarkdown GHSA-mq6v-w35g-3c97 | Low | Not scored | 03 Feb, 2024 | npm zmarkdown |
vantage6 vulnerable to username timing attack CVE-2024-21671, GHSA-45gq-q4xh-cp53, PYSEC-2024-31, PYSEC-2026-2008 | Low | 0.4% | 30 Jan, 2024 | PyPI vantage6 PyPI vantage6-server |
changedetection.io API endpoint is not secured with API token CVE-2024-23329, GHSA-hcvp-2cc7-jrwr, PYSEC-2024-15 | Low | 0.6% | 19 Jan, 2024 | PyPI changedetection-io PyPI changedetection.io |
cdo-local-uuid vulnerable to insertion of artifact derived from developer's Present Working Directory into demonstration code CVE-2024-22194, GHSA-rgrf-6mf5-m882, PYSEC-2024-5, PYSEC-2024-6 | Low | 0.4% | 11 Jan, 2024 | PyPI case-utils PyPI cdo-local-uuid |
Gila CMS SQL Injection vulnerability CVE-2020-26625, GHSA-3pfj-g4wr-qj3j | Low | 0.7% | 02 Jan, 2024 | Packagist gilacms/gila |
Gila CMS SQL Injection vulnerability CVE-2020-26624, GHSA-4vf6-2rmx-fgqx | Low | 0.7% | 02 Jan, 2024 | Packagist gilacms/gila |
Withdrawn Advisory: Stored Cross-site scripting affecting automad/automad CVE-2023-7035, GHSA-7j9h-ch38-474r | Low | 0.6% | 21 Dec, 2023 | Packagist automad/automad |
dbt-core's secret env vars written to package-lock.json in plaintext GHSA-j4g3-3q8x-jxqp | Low | Not scored | 08 Dec, 2023 | PyPI dbt-core |
google-translate-api-browser Server-Side Request Forgery (SSRF) Vulnerability CVE-2023-48711, GHSA-4233-7q5q-m7p6 | Low | 0.5% | 24 Nov, 2023 | npm google-translate-api-browser |
Moodle Exposure of Sensitive Information to an Unauthorized Actor vulnerability BIT-moodle-2023-5551, CVE-2023-5551, GHSA-jr83-8x65-xcr5 | Low | 0.3% | 09 Nov, 2023 | Packagist moodle/moodle |
Ibexa ezplatform-kernel download route allows filename change GHSA-gv2c-5g79-h73c | Low | Not scored | 03 Nov, 2023 | Packagist ezsystems/ezplatform-kernel |
Ibexa DXP Download route allows filename change GHSA-g95c-xc83-8353 | Low | Not scored | 03 Nov, 2023 | Packagist ibexa/core |
Download route allows filename change in eZpublish kernel GHSA-946c-f9w6-2c25 | Low | Not scored | 03 Nov, 2023 | Packagist ezsystems/ezpublish-kernel |
Wagtail vulnerable to disclosure of user names via admin bulk action views CVE-2023-45809, GHSA-fc75-58r8-rm3h, PYSEC-2023-219 | Low | 0.6% | 19 Oct, 2023 | PyPI wagtail |
Undici's cookie header not cleared on cross-origin redirect in fetch CVE-2023-45143, GHSA-wqq4-5wpv-mx2g | Low | 1.4% | 12 Oct, 2023 | npm undici |
Economizzer Insecure Direct Object Reference vulnerability CVE-2023-38872, GHSA-896v-ph5w-379h | Low | 0.7% | 28 Sep, 2023 | Packagist gugoan/economizzer |
matrix-synapse vulnerable to temporary storage of plaintext passwords during password changes CVE-2023-41335, GHSA-4f74-84v3-j9q5, PYSEC-2023-185 | Low | 0.4% | 26 Sep, 2023 | PyPI matrix-synapse |
plone.restapi vulnerable to Stored Cross Site Scripting with SVG image in user portrait GHSA-hc5c-r8m5-2gfh | Low | Not scored | 21 Sep, 2023 | PyPI plone-restapi PyPI plone.restapi |
Vulnerable OpenSSL included in cryptography wheels GHSA-v8gr-m533-ghj9 | Low | Not scored | 21 Sep, 2023 | PyPI cryptography |
Prevent logging invalid header values GHSA-j5g3-5c8r-7qfx | Low | Not scored | 30 Aug, 2023 | npm @apollo/server npm apollo-server-core |
Minimal `basti` IAM Policy Allows Shell Access GHSA-q4pp-j36h-3gqg | Low | Not scored | 24 Aug, 2023 | npm basti-cdk |
Froxlor vulnerable to business logic errors CVE-2023-4304, GHSA-9rmf-6qgj-g3wj | Low | 0.6% | 11 Aug, 2023 | Packagist froxlor/froxlor |
matrix-appservice-irc events can be crafted to leak parts of targeted messages from other bridged rooms CVE-2023-38700, GHSA-c7hh-3v6c-fj4q | Low | 0.6% | 04 Aug, 2023 | npm matrix-appservice-irc |
pyca/cryptography's wheels include vulnerable OpenSSL GHSA-jm77-qphf-c4w8 | Low | Not scored | 01 Aug, 2023 | PyPI cryptography |
Silverstripe Framework: Members with no password can be created and bypass custom login forms CVE-2023-32302, GHSA-36xx-7vf6-7mv3 | Low | Not scored | 31 Jul, 2023 | Packagist silverstripe/framework |
Vendure Cross Site Request Forgery vulnerability impacting all API requests GHSA-h9wq-xcqx-mqxm | Low | Not scored | 11 Jul, 2023 | npm @vendure/core |
sweetalert2 contains potentially undesirable behavior GHSA-mrr8-v49w-3333 | Low | Not scored | 10 Jul, 2023 | npm sweetalert2 |
SafeURL-Python's hostname blocklist does not block FQDNs GHSA-373w-rj84-pv6x | Low | Not scored | 29 Jun, 2023 | PyPI SafeURL-Python PyPI safeurl-python |
Admidio Improper Access Control vulnerability CVE-2023-3303, GHSA-vmxg-wx6c-4f3r | Low | 0.4% | 23 Jun, 2023 | Packagist admidio/admidio |
@apollo/server vulnerable to unsafe application of Content Security Policy via reused nonces GHSA-68jh-rf6x-836f | Low | Not scored | 16 Jun, 2023 | npm @apollo/server |
Magento Open Source affected by Improper Input Validation CVE-2023-29293, GHSA-66c9-xrwj-9xv6 | Low | 1.0% | 15 Jun, 2023 | Packagist magento/community-edition Packagist magento/project-community-edition |
fast-xml-parser regex vulnerability patch could be improved from a safety perspective GHSA-gpv5-7x3g-ghjv | Low | Not scored | 15 Jun, 2023 | npm fast-xml-parser |
VMware Tools Authentication Bypass Vulnerability CVE-2023-20867 | LowExploited | 13.6% | 13 Jun, 2023 | |
@keystone-6/core's bundled cuid package known to be insecure GHSA-5fp6-4xw3-xqq3 | Low | Not scored | 12 Jun, 2023 | npm @keystone-6/core |
Vulnerable OpenSSL included in cryptography wheels GHSA-5cpq-8wj7-hf2v | Low | Not scored | 02 Jun, 2023 | PyPI cryptography |
Possible prototype pollution in metadata record, when using meta decorator CVE-2023-30857, GHSA-wwxh-74fx-33c6 | Low | 0.5% | 28 Apr, 2023 | npm @aedart/support |
Arm Mali GPU Kernel Driver Information Disclosure Vulnerability CVE-2023-26083 | LowExploited | 1.2% | 06 Apr, 2023 | |
Timing attack in eZ Platform Ibexa CVE-2022-48366, GHSA-66m4-gc8h-hpjx | Low | 0.5% | 12 Mar, 2023 | Packagist ezsystems/ezplatform-kernel Packagist ezsystems/ezpublish-kernel |
OpenStack Glance Inclusion of Functionality from Untrusted Control Sphere vulnerability CVE-2022-4134, GHSA-5gp5-vxj6-4257, PYSEC-2023-270 | Low | 0.3% | 06 Mar, 2023 | PyPI glance |
Incorrect parsing of nameless cookies leads to __Host- cookies bypass CVE-2023-23934, GHSA-px8h-6qxv-m22q, PYSEC-2023-57 | Low | 0.5% | 14 Feb, 2023 | PyPI Werkzeug PyPI werkzeug |
Any Flarum user including unactivated can reply in public discussions whose first post was permanently deleted CVE-2023-22489, GHSA-hph3-hv3c-7725 | Low | 0.6% | 10 Jan, 2023 | Packagist flarum/core |
Package discontinued because Bitly lowered the free quota GHSA-ggrh-grj3-vfvw | Low | Not scored | 28 Nov, 2022 | PyPI bitlyshortener |
Temporary File Information Disclosure vulnerability in MPXJ CVE-2022-41954, GHSA-jf2p-4gqj-849g, PYSEC-2022-42996 | Low | 0.2% | 25 Nov, 2022 | Maven net.sf.mpxj:mpxj NuGet net.sf.mpxj NuGet net.sf.mpxj-for-csharp NuGet net.sf.mpxj-for-vb +1 more |
sweetalert2 v8.19.1 and above contains hidden functionality GHSA-8jh9-wqpf-q52c | Low | Not scored | 23 Nov, 2022 | npm sweetalert2 |
sweetalert2 v9.17.4 and above contains hidden functionality GHSA-pg98-6v7f-2xfv | Low | Not scored | 23 Nov, 2022 | npm sweetalert2 |
sweetalert2 v10.16.10 and above contains hidden functionality GHSA-457r-cqc8-9vj9 | Low | Not scored | 23 Nov, 2022 | npm sweetalert2 |
sweetalert2 v11.4.9 and above contains hidden functionality GHSA-qq6h-5g6j-q3cm | Low | Not scored | 23 Nov, 2022 | npm sweetalert2 |
`CHECK` failure in `SobolSample` via missing validation GHSA-cqvq-fvhr-v6hc | Low | Not scored | 21 Nov, 2022 | PyPI tensorflow PyPI tensorflow-cpu PyPI tensorflow-gpu |
`CHECK` fail in `TensorListScatter` and `TensorListScatterV2` in eager mode GHSA-xf83-q765-xm6m | Low | Not scored | 21 Nov, 2022 | PyPI tensorflow PyPI tensorflow-cpu PyPI tensorflow-gpu |
Hardening of TypedArrays with non-canonical numeric property names in SES GHSA-whpx-q3rq-w8jc | Low | Not scored | 20 Oct, 2022 | npm ses |