Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
ForkCMS XSS via `publish_on_time` parameter CVE-2022-35589, GHSA-q4qv-3x58-rxmh | Medium | 0.8% | 12 Aug, 2022 | Packagist forkcms/forkcms |
ForkCMS XSS via `publish_on_date` parameter CVE-2022-35587, GHSA-65wf-qm95-6mhm | Medium | 0.8% | 12 Aug, 2022 | Packagist forkcms/forkcms |
ForkCMS stored XSS via `start_date` parameter CVE-2022-35585, GHSA-9hmc-87h4-w869 | Medium | 0.8% | 12 Aug, 2022 | Packagist forkcms/forkcms |
update_by_case before 0.1.3 can be vulnerable to sql injection CVE-2022-35956, GHSA-33wh-w4m7-c6r8 | Medium | 0.6% | 11 Aug, 2022 | RubyGems update_by_case |
mofh Vulnerable to Improper Restriction of XML External Entity Reference GHSA-7r9x-qrpr-3cxw | Medium | Not scored | 11 Aug, 2022 | PyPI mofh |
Microweber's title parameter in the body of POST request vulnerable to stored XSS CVE-2022-2777, GHSA-cf6r-q678-f2p7 | Medium | 0.5% | 11 Aug, 2022 | Packagist microweber/microweber |
nbconvert vulnerable to cross-site scripting (XSS) via multiple exploit paths CVE-2021-32862, GHSA-9jmq-rx5f-8jwq, GHSA-h274-fcvj-h2wm, PYSEC-2022-249 | Medium | 1.5% | 10 Aug, 2022 | PyPI nbconvert |
Go Ethereum allows attackers to use manipulation of time-difference values to achieve replacement of main-chain blocks CVE-2022-37450, GHSA-rqmg-hrg4-fm69 | Medium | 1.3% | 06 Aug, 2022 | Go github.com/ethereum/go-ethereum |
Moodle XSS Vulnerability BIT-moodle-2020-1691, CVE-2020-1691, GHSA-cwhp-rqfr-8462 | Medium | 0.6% | 05 Aug, 2022 | Packagist moodle/moodle |
administrate vulnerable to Cross-Site Request Forgery CVE-2016-3098, GHSA-cc8c-26rj-v2vx | Medium | 0.4% | 05 Aug, 2022 | RubyGems administrate |
Raneto vulnerable to Cross-site Scripting CVE-2022-35144, GHSA-vc68-6x72-w22f | Medium | 0.9% | 04 Aug, 2022 | npm raneto |
CKEditor5 cross-site scripting vulnerability caused by the editor instance destroying process CVE-2022-31175, GHSA-42wq-rch8-6f6j | Medium | 0.9% | 03 Aug, 2022 | npm @ckeditor/ckeditor5-html-embed npm @ckeditor/ckeditor5-html-support npm @ckeditor/ckeditor5-markdown-gfm |
Flask-Security vulnerable to Open Redirect CVE-2021-23385, GHSA-cg8c-gc2j-2wf7, PYSEC-2026-809 | Medium | 1.2% | 02 Aug, 2022 | PyPI Flask-Security PyPI flask-security |
Byobu user preference to prevent private discussions being started are not respected CVE-2022-35921, GHSA-6gjm-6wj6-4px5 | Medium | 0.5% | 01 Aug, 2022 | Packagist fof/byobu |
Solana Pay Vulnerable to Weakness in Transfer Validation Logic CVE-2022-35917, GHSA-j47c-j42c-mwqq | Medium | 0.9% | 01 Aug, 2022 | npm @solana/pay |
Streamlit directory traversal vulnerability CVE-2022-35918, GHSA-v4hr-4jpx-56gc, PYSEC-2022-248 | Medium | 1.8% | 01 Aug, 2022 | PyPI streamlit |
OpenZeppelin Contracts's Cross chain utilities for Arbitrum L2 see EOA calls as cross chain calls CVE-2022-35916, GHSA-9j3m-g383-29qr | Medium | 0.6% | 01 Aug, 2022 | npm @openzeppelin/contracts npm @openzeppelin/contracts-upgradeable |
OpenZeppelin Contracts ERC165Checker unbounded gas consumption CVE-2022-35915, GHSA-7grf-83vw-6f5x | Medium | 0.8% | 01 Aug, 2022 | npm @openzeppelin/contracts npm @openzeppelin/contracts-upgradeable npm openzeppelin-eth npm openzeppelin-solidity |
node-fetch Inefficient Regular Expression Complexity CVE-2022-2596, GHSA-vp56-6g26-6827 | Medium | 1.3% | 01 Aug, 2022 | npm node-fetch |
Fava vulnerable to reflected cross-site scripting CVE-2022-2589, GHSA-6hcj-qrw3-m66q, PYSEC-2022-246 | Medium | 0.8% | 01 Aug, 2022 | PyPI fava |
Scrapy before 2.6.2 and 1.8.3 vulnerable to one proxy sending credentials to another GHSA-9x8m-2xpf-crp3 | Medium | Not scored | 29 Jul, 2022 | PyPI scrapy |
Feehi CMS Cross-site Scripting CVE-2022-34140, GHSA-25q6-m425-9fqr | Medium | 4.8% | 28 Jul, 2022 | Packagist feehi/cms |
Shopware vulnerable to persistent cross site scripting (XSS) in customer module CVE-2022-31148, GHSA-5834-xv5q-cgfw | Medium | 0.7% | 27 Jul, 2022 | Packagist shopware/shopware |
Diactoros before 2.11.1 vulnerable to HTTP Host Header Attack CVE-2022-31109, GHSA-8274-h5jp-97vr | Medium | 0.8% | 27 Jul, 2022 | Packagist laminas/laminas-diactoros |
WASM3 segmentation fault CVE-2022-34529, GHSA-gq4p-4hxv-5rg9, PYSEC-2022-43057 | Medium | 0.3% | 27 Jul, 2022 | PyPI pywasm3 crates.io wasm3 |
Moodle LTI module reflected XSS risk BIT-moodle-2022-35653, CVE-2022-35653, GHSA-62wh-m4jr-233r | Medium | 4.8% | 25 Jul, 2022 | Packagist moodle/moodle |
Moodle Open redirect risk in mobile auto-login feature BIT-moodle-2022-35652, CVE-2022-35652, GHSA-243v-5pff-qqfj | Medium | 1.1% | 25 Jul, 2022 | Packagist moodle/moodle |
Moodle Stored XSS and blind SSRF possible via SCORM track details BIT-moodle-2022-35651, CVE-2022-35651, GHSA-wwv7-h477-wrv7 | Medium | 1.1% | 25 Jul, 2022 | Packagist moodle/moodle |
grapesjs before 0.19.5 vulnerable to Cross-site Scripting CVE-2022-21802, GHSA-589f-c66p-hxr4 | Medium | 0.8% | 25 Jul, 2022 | npm grapesjs |
snyk-broker Path Traversal before v4.73.0 CVE-2020-7649, GHSA-gq75-5gc3-rfwg | Medium | 1.6% | 25 Jul, 2022 | npm snyk-broker |
markdown-it-toc Cross-site Scripting due to title of generated toc and contents of header not being escaped CVE-2020-28455, GHSA-wfvx-fx73-3rfj | Medium | 0.6% | 25 Jul, 2022 | npm markdown-it-toc |
Fava time and filter parameters vulnerable to reflected Cross-site Scripting CVE-2022-2514, GHSA-xrf4-39fm-j5f2, PYSEC-2022-239, PYSEC-2022-43182 | Medium | 0.9% | 25 Jul, 2022 | PyPI fava |
Fava vulnerable to Reflected Cross-site Scripting CVE-2022-2523, GHSA-q8hg-3vqv-f8v3, PYSEC-2022-240 | Medium | 0.9% | 25 Jul, 2022 | PyPI fava |
Django REST framework XSS Vulnerability CVE-2018-25045, GHSA-xqcf-hj92-967m, PYSEC-2026-804 | Medium | 0.8% | 23 Jul, 2022 | PyPI django-rest-framework |
Microweber before 1.2.21 vulnerable to reflected XSS CVE-2022-2470, GHSA-cfcg-2qgr-v243 | Medium | 1.0% | 22 Jul, 2022 | Packagist microweber/microweber |
Microweber Stored Cross-site Scripting before v1.2.20 CVE-2022-2495, GHSA-xg72-6c83-ghh4 | Medium | 0.7% | 22 Jul, 2022 | Packagist microweber/microweber |
undici before v5.8.0 vulnerable to uncleared cookies on cross-host / cross-origin redirect CVE-2022-31151, GHSA-q768-x9m6-m9qp | Medium | 0.7% | 21 Jul, 2022 | npm undici |
Lack of domain validation in Druple core BIT-drupal-2022-25276, CVE-2022-25276, DRUPAL-CORE-2022-015, GHSA-4wfq-jc9h-vpcx | Medium | 0.5% | 20 Jul, 2022 | Packagist drupal/core |
Access bypass in Drupal Core BIT-drupal-2022-25278, CVE-2022-25278, DRUPAL-CORE-2022-013, GHSA-cfh2-7f6h-3m85 | Medium | 0.6% | 20 Jul, 2022 | Packagist drupal/core |
undici before v5.8.0 vulnerable to CRLF injection in request headers CVE-2022-31150, GHSA-3cvr-822r-rqcc | Medium | 1.5% | 19 Jul, 2022 | npm undici |
markdown-it-decorate vulnerable to cross-site scripting (XSS) CVE-2020-28459, GHSA-rhf5-2378-3w3w | Medium | 0.6% | 19 Jul, 2022 | npm markdown-it-decorate |
jQuery UI vulnerable to XSS when refreshing a checkboxradio with an HTML-like initial text label CVE-2022-31160, GHSA-h6gj-6jjq-h8g9 | Medium | 2.7% | 18 Jul, 2022 | Maven org.webjars.npm:jquery-ui NuGet jQuery.UI.Combined RubyGems jquery-ui-rails npm jquery-ui |
Dompdf before v2.0.0 vulnerable to chroot check bypass CVE-2022-2400, GHSA-5qj8-6xxj-hp9h | Medium | 1.2% | 18 Jul, 2022 | Packagist dompdf/dompdf |
WooCommerce WordPress plugin before 6.6.0 vulnerable to stored HTML injection CVE-2022-2099, GHSA-jwvf-28fg-g4xg | Medium | 0.7% | 17 Jul, 2022 | Packagist woocommerce/woocommerce |
Gollum Cross-site Scripting vulnerability via filename parameter to New Page dialog CVE-2020-35305, GHSA-fj2w-qmjp-3rjm | Medium | 0.8% | 16 Jul, 2022 | RubyGems gollum |
Bypass of CMS Safe Mode Security Feature GHSA-q37h-jhf3-85cj | Medium | Not scored | 15 Jul, 2022 | Packagist wintercms/winter |
Angular (deprecated package) Cross-site Scripting CVE-2022-25869, GHSA-prc3-vjfx-vhm9 | Medium | 7.7% | 15 Jul, 2022 | npm angular |
OroCommerce vulnerable to XSS when adding class name to Selector Manager on pages that use GrapeJS editor GHSA-6f85-3f8q-qc94 | Medium | Not scored | 15 Jul, 2022 | Packagist oro/commerce |
OpenZeppelin Contracts for Cairo account cannot process transactions on Goerli CVE-2022-31153, GHSA-8mjr-jr5h-q2xr, PYSEC-2026-890 | Medium | 1.5% | 15 Jul, 2022 | PyPI openzeppelin-cairo-contracts |
FlyteAdmin Insufficient AccessToken Expiration Check CVE-2022-31145, GHSA-qwrj-9hmp-gpxh, GO-2022-0519 | Medium | 1.0% | 15 Jul, 2022 | Go github.com/flyteorg/flyteadmin |