Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Microsoft: CBC Padding Oracle in Azure Blob Storage Encryption Library CVE-2022-30187, GHSA-64x4-9hc6-r2h6, PYSEC-2026-2388, PYSEC-2026-784 | Medium | 0.5% | 12 Jul, 2022 | Maven com.azure:azure-storage-blob NuGet Azure.Storage.Blobs NuGet Azure.Storage.Queues PyPI azure-storage-blob +1 more |
Cross site scripting in ameos_tarteaucitron CVE-2022-33155, GHSA-4vr9-33fv-mg6r | Medium | 0.5% | 12 Jul, 2022 | Packagist ameos/ameos_tarteaucitron |
Svelte vulnerable to XSS when using objects during server-side rendering CVE-2022-25875, GHSA-wv8q-r932-8hc7, SNYK-JS-SVELTE-2931080 | Medium | 1.4% | 12 Jul, 2022 | npm svelte |
Whoogle Search Cross-site Scripting via string parameter CVE-2022-25303, GHSA-mxvc-fwgx-j778, PYSEC-2022-226, SNYK-PYTHON-WHOOGLESEARCH-2803306 | Medium | 1.0% | 12 Jul, 2022 | PyPI whoogle-search |
DoS in KubeEdge's Websocket Client in package Viaduct CVE-2022-31080, GHSA-6wvc-6pww-qr4r, GO-2022-0512 | Medium | 0.7% | 11 Jul, 2022 | Go github.com/kubeedge/kubeedge |
KubeEdge Cloud Stream and Edge Stream DoS from large stream message CVE-2022-31079, GHSA-wrcr-x4qj-j543, GO-2022-0511 | Medium | 0.7% | 11 Jul, 2022 | Go github.com/kubeedge/kubeedge |
KubeEdge CloudCore Router memory exhaustion vulnerability CVE-2022-31078, GHSA-qpx3-9565-5xwm, GO-2022-0510 | Medium | 0.7% | 11 Jul, 2022 | Go github.com/kubeedge/kubeedge |
KubeEdge DoS when signing the CSR from EdgeCore CVE-2022-31075, GHSA-x3px-2p95-f6jr, GO-2022-0509 | Medium | 1.0% | 11 Jul, 2022 | Go github.com/kubeedge/kubeedge |
KubeEdge Cloud AdmissionController component DoS CVE-2022-31074, GHSA-w52j-3457-q9wr, GO-2022-0508 | Medium | 0.8% | 11 Jul, 2022 | Go github.com/kubeedge/kubeedge |
KubeEdge Edge ServiceBus module DoS CVE-2022-31073, GHSA-vwm6-qc77-v2rh, GO-2022-0507 | Medium | 1.7% | 11 Jul, 2022 | Go github.com/kubeedge/kubeedge |
Microweber before v1.2.20 vulnerable to cross-site scripting CVE-2022-2353, GHSA-gmh3-x5w7-jg5m | Medium | 0.5% | 09 Jul, 2022 | Packagist microweber/microweber |
Known vulnerable to code execution via SVG file in v1.3.1 CVE-2022-32115, GHSA-5jgj-h9wp-53fr | Medium | 1.4% | 08 Jul, 2022 | Packagist idno/known |
Known v1.3.1 Cross-site Scripting CVE-2022-31290, GHSA-g688-7j3c-h9f3 | Medium | 0.9% | 08 Jul, 2022 | Packagist idno/known |
Known v1.3.1 contains Insecure Direct Object Reference CVE-2022-30852, GHSA-4v4p-87m3-5423 | Medium | 1.0% | 08 Jul, 2022 | Packagist idno/known |
Snipe-IT 6.0.2 vulnerable to Cross-site Scripting CVE-2022-32061, GHSA-xwqx-x38c-cw95 | Medium | 0.7% | 07 Jul, 2022 | Packagist snipe/snipe-it |
Snipe-IT 6.0.2 vulnerable to Cross-site Scripting via arbitrary file upload in Update Branding Settings CVE-2022-32060, GHSA-w82x-xjjr-cjr5 | Medium | 1.2% | 07 Jul, 2022 | Packagist snipe/snipe-it |
Insecure cookies in Openshift Origin CVE-2015-3207, GHSA-rqph-25q9-9jhp, GO-2022-0505 | Medium | 0.8% | 07 Jul, 2022 | Go github.com/openshift/origin |
DOS and excessive memory usage when passing untrusted user input to to dag import GHSA-f2gr-7299-487h | Medium | Not scored | 06 Jul, 2022 | Go github.com/ipfs/go-ipfs |
Malformed CAR panics and excessive memory usage GHSA-9x4h-8wgm-8xfg, GO-2022-0503 | Medium | Not scored | 06 Jul, 2022 | Go github.com/ipld/go-car Go github.com/ipld/go-car/v2 |
Possible leak of key's raw field if declared length is incorrect CVE-2022-31124, GHSA-hm37-9xh2-q499, PYSEC-2022-233 | Medium | 1.3% | 06 Jul, 2022 | PyPI openssh-key-parser |
Apache Superset allows authenticated users to access metadata they have no permission to BIT-superset-2021-37839, CVE-2021-37839, GHSA-748r-5r8q-273m, PYSEC-2026-776 | Medium | 1.4% | 06 Jul, 2022 | PyPI apache-superset |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in pycares GHSA-c58j-88f5-h53f | Medium | Not scored | 05 Jul, 2022 | PyPI pycares |
Potential double free of buffer during string decoding CVE-2022-31117, GHSA-fm67-cv37-96ff, PYSEC-2026-1056 | Medium | 1.9% | 05 Jul, 2022 | PyPI ujson |
A stored Cross-site Scripting (XSS) vulnerability was identified in the Data Import functionality of OpenCTI through 5.2.4. An attacker can abuse the vulnerability to upload a malicious file that will then be executed by a victim when they open the file location. CVE-2022-30289, PYSEC-2022-43185 | Medium | 0.5% | 05 Jul, 2022 | PyPI pycti |
Cross-site Scripting in microweber CVE-2022-2300, GHSA-q6mp-562x-ggvv | Medium | 0.5% | 04 Jul, 2022 | Packagist microweber/microweber |
Passport vulnerable to session regeneration when a users logs in or out CVE-2022-25896, GHSA-v923-w3x8-wh69, SNYK-JS-PASSPORT-2840631 | Medium | 1.1% | 01 Jul, 2022 | npm passport |
Server-Side Request Forgery in link-preview-js CVE-2022-25876, GHSA-h9cw-7g8j-h66h | Medium | 0.4% | 01 Jul, 2022 | npm link-preview-js |
Cross-site Scripting in microweber CVE-2022-2280, GHSA-5pg2-qg87-vmj7 | Medium | 0.6% | 01 Jul, 2022 | Packagist microweber/microweber |
Ember.js Potential XSS Exploit When Binding `tagName` to User-Supplied Data CVE-2013-4170, GHSA-5m48-c37x-f792 | Medium | 0.9% | 30 Jun, 2022 | RubyGems ember-source |
Open Redirect in microweber CVE-2022-2252, GHSA-437j-5qc3-c589 | Medium | 0.9% | 29 Jun, 2022 | Packagist microweber/microweber |
Stored XSS in link tags added via XHR in SilverStripe Framework BIT-silverstripe-2022-28803, CVE-2022-28803, GHSA-rppc-655v-7j3c | Medium | 0.5% | 29 Jun, 2022 | Packagist silverstripe/framework |
Externally Controlled Reference to a Resource in Another Sphere in ruby-mysql CVE-2021-3779, GHSA-73pr-g6jj-5hc9 | Medium | 1.2% | 29 Jun, 2022 | RubyGems ruby-mysql |
Unpublished, protected files can be published via shortcode CVE-2022-29858, GHSA-v68g-62v9-39w5 | Medium | 1.2% | 28 Jun, 2022 | Packagist silverstripe/assets |
Stored XSS via HTML fields in SilverStripe Framework CVE-2022-25238, GHSA-jx34-gqqq-r6gm | Medium | 0.7% | 28 Jun, 2022 | Packagist silverstripe/framework |
Hybridsessions does not expire session id on logout BIT-silverstripe-2022-24444, CVE-2022-24444, GHSA-c7q8-m4xw-c674 | Medium | 0.9% | 28 Jun, 2022 | Packagist silverstripe/hybridsessions |
Quadratic blowup in Convert::xml2array() BIT-silverstripe-2021-41559, CVE-2021-41559, GHSA-9fmg-89fx-r33w | Medium | 1.1% | 28 Jun, 2022 | Packagist silverstripe/framework |
Possible inject arbitrary `CSS` into the generated graph affecting the container HTML CVE-2022-31108, GHSA-x3vm-38hw-55wf | Medium | 0.9% | 28 Jun, 2022 | npm mermaid |
Server-Side Request Forgery in dompdf/dompdf CVE-2022-0085, GHSA-pf6p-25r2-fx45 | Medium | 1.0% | 28 Jun, 2022 | Packagist dompdf/dompdf |
Cross-site Scripting in admidio CVE-2022-23896, GHSA-qr6m-f3gv-8678 | Medium | 0.6% | 28 Jun, 2022 | Packagist admidio/admidio |
Cross site scripting in parse-url CVE-2022-2218, GHSA-jpp7-7chh-cf67 | Medium | 0.9% | 27 Jun, 2022 | npm parse-url |
Cross site scripting in parse-url CVE-2022-2217, GHSA-q6wq-5p59-983w | Medium | 1.0% | 27 Jun, 2022 | npm parse-url |
Open redirect in web2py CVE-2022-33146, GHSA-cgrj-xjm7-9q27, PYSEC-2026-1060 | Medium | 1.9% | 27 Jun, 2022 | PyPI web2py |
CloudCore UDS Server: Malicious Message can crash CloudCore CVE-2022-31076, GHSA-8f4f-v9x5-cg6j, GO-2022-0500 | Medium | 0.6% | 25 Jun, 2022 | Go github.com/kubeedge/kubeedge |
CloudCore CSI Driver: Malicious response from KubeEdge can crash CSI Driver controller server CVE-2022-31077, GHSA-x938-fvfw-7jh5, GO-2022-0501 | Medium | 0.8% | 25 Jun, 2022 | Go github.com/kubeedge/kubeedge |
Rails::Html::Sanitizer vulnerable to Cross-site Scripting CVE-2022-32209, GHSA-pg8v-g4xq-hww9 | Medium | 26.5% | 25 Jun, 2022 | RubyGems rails-html-sanitizer |
MantisBT XSS through crafted SVG documents in file_download.php CVE-2022-33910, GHSA-qghg-v7xv-q98q | Medium | 0.9% | 24 Jun, 2022 | Packagist mantisbt/mantisbt |
Cross site scripting in Concrete CMS CVE-2022-30120, GHSA-m2ww-6wv6-vw3c | Medium | 1.0% | 24 Jun, 2022 | Packagist concrete5/core |
golang.org/x/sys/unix has Incorrect privilege reporting in syscall BIT-golang-2022-29526, CVE-2022-29526, GHSA-p782-xgp4-8hr8, GO-2022-0493 | Medium | 3.0% | 24 Jun, 2022 | Go golang.org/x/sys Go stdlib |
Withdrawn: Denial of Service in aiohttp CVE-2022-33124, GHSA-rwqr-c348-m5wr, PYSEC-2022-43059 | Medium | 0.7% | 23 Jun, 2022 | PyPI aiohttp |
Authenticated Stored Cross-site Scripting in Shopware CVE-2022-31057, GHSA-q754-vwc4-p6qj | Medium | 0.7% | 22 Jun, 2022 | Packagist shopware/shopware |