Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Server-Side Request Forgery in Directus CVE-2022-23080, GHSA-5h75-pvq4-82c9 | Medium | 0.8% | 22 Jun, 2022 | npm directus |
Cross-site Scripting in Microweber CVE-2022-2174, GHSA-3x96-m42v-hvh5 | Medium | 2.6% | 22 Jun, 2022 | Packagist microweber/microweber |
DoS through large manifest files in Argo CD CVE-2022-31016, GHSA-jhqp-vf4w-rpwq, GO-2022-0495 | Medium | 0.9% | 21 Jun, 2022 | Go github.com/argoproj/argo-cd Go github.com/argoproj/argo-cd/v2 |
Symlink following allows leaking out-of-bounds YAML files from Argo CD repo-server CVE-2022-31036, GHSA-q4w5-4gq2-98vm, GO-2022-0499 | Medium | 0.9% | 21 Jun, 2022 | Go github.com/argoproj/argo-cd Go github.com/argoproj/argo-cd/v2 |
Cross-site Scripting in NukeViet CMS CVE-2022-30874, GHSA-pm37-5j5m-6cvw | Medium | 0.8% | 21 Jun, 2022 | Packagist nukeviet/nukeviet |
Cross-site Scripting in krayin/laravel-crm CVE-2021-41924, GHSA-v829-j9rr-85v9 | Medium | 0.6% | 21 Jun, 2022 | Packagist krayin/laravel-crm |
Cross-site Scripting in Microweber CVE-2022-2130, GHSA-27g3-58v4-fg9w | Medium | 3.1% | 20 Jun, 2022 | Packagist microweber/microweber |
Cross site scripting in Elefant CMS CVE-2017-20061, GHSA-hgm9-pww2-93pc | Medium | 0.5% | 20 Jun, 2022 | Packagist elefant/cms |
Cross site scripting in Elefant CMS CVE-2017-20060, GHSA-4453-g295-24mh | Medium | 0.5% | 20 Jun, 2022 | Packagist elefant/cms |
Cross site scripting in Elefant CMS CVE-2017-20059, GHSA-7f7g-8q3x-jpx9 | Medium | 0.5% | 20 Jun, 2022 | Packagist elefant/cms |
Cross site scripting in Elefant CMS CVE-2017-20058, GHSA-5hfm-g799-wjw6 | Medium | 0.8% | 20 Jun, 2022 | Packagist elefant/cms |
Cross site scripting in Elefant CMS CVE-2017-20057, GHSA-xwj7-29j7-rw76 | Medium | 0.6% | 20 Jun, 2022 | Packagist elefant/cms |
Got allows a redirect to a UNIX socket CVE-2022-33987, GHSA-pfrx-2q88-qq97 | Medium | 2.4% | 18 Jun, 2022 | npm got |
brotkrueml/typo3-matomo-integration vulnerable to Cross-Site Scripting BIT-matomo-2022-33156, CVE-2022-33156, GHSA-gvxv-p9rv-gmcg | Medium | 0.6% | 17 Jun, 2022 | Packagist brotkrueml/typo3-matomo-integration |
brotkrueml/schema fails to properly encode user input for output in HTML context, leading to XSS CVE-2022-33154, GHSA-374w-gwqr-fmxg | Medium | 0.5% | 17 Jun, 2022 | Packagist brotkrueml/schema |
Out-of-bounds Read in fast-string-search CVE-2022-25872, GHSA-hmqg-p8f8-3qrw | Medium | 1.1% | 17 Jun, 2022 | npm fast-string-search |
Formula Injection in Exported Data GHSA-7rq4-qcpw-74gq | Medium | Not scored | 17 Jun, 2022 | PyPI inventree |
Ghost vulnerable to remote code execution in locale setting change GHSA-7v28-g2pq-ggg8 | Medium | Not scored | 17 Jun, 2022 | npm ghost |
Configuration API in EdgeXFoundry 2.1.0 and earlier exposes message bus credentials to local unauthenticated users CVE-2022-31066, GHSA-g63h-q855-vp3q, GO-2022-0491 | Medium | 0.3% | 17 Jun, 2022 | Go github.com/edgexfoundry/app-functions-sdk-go Go github.com/edgexfoundry/app-functions-sdk-go/v2 Go github.com/edgexfoundry/device-sdk-go Go github.com/edgexfoundry/device-sdk-go/v2 |
Path traversal for local publishers in TechDocs backend GHSA-4jqc-jvh2-pxg9 | Medium | Not scored | 17 Jun, 2022 | npm @backstage/plugin-techdocs-node npm @backstage/techdocs-common |
Joplin Cross Site Scripting Vulnerability via NOSCRIPT tags CVE-2021-33295, GHSA-phj8-2p6x-hq5r | Medium | 0.9% | 16 Jun, 2022 | npm joplin |
Cross-Site Scripting in TYPO3's Frontend Login Mailer BIT-typo3-2022-31049, CVE-2022-31049, GHSA-h4mx-xv96-2jgm | Medium | 0.8% | 14 Jun, 2022 | Packagist typo3/cms Packagist typo3/cms-core |
Cross-Site Scripting in TYPO3's Form Framework BIT-typo3-2022-31048, CVE-2022-31048, GHSA-3r95-23jp-mhvg | Medium | 0.8% | 14 Jun, 2022 | Packagist typo3/cms Packagist typo3/cms-core |
Insertion of Sensitive Information into Log File in typo3/cms-core BIT-typo3-2022-31047, CVE-2022-31047, GHSA-fh99-4pgr-8j99 | Medium | 1.1% | 14 Jun, 2022 | Packagist typo3/cms Packagist typo3/cms-core |
Information Disclosure via Export Module BIT-typo3-2022-31046, CVE-2022-31046, GHSA-8gmv-9hwg-w89g | Medium | 0.6% | 14 Jun, 2022 | Packagist typo3/cms Packagist typo3/cms-core |
Token bruteforcing. BIT-jupyter-base-notebook-2022-29238, BIT-jupyter-notebook-2022-29238, CVE-2022-29238, GHSA-v7vq-3x77-87vg, PYSEC-2022-212 | Medium | 1.2% | 14 Jun, 2022 | PyPI notebook |
Incorrect Authorization in thinkcmf CVE-2021-40616, GHSA-v25c-8349-v2q3 | Medium | 0.8% | 14 Jun, 2022 | Packagist thinkcmf/thinkcmf |
Cross-site Scripting in NocoDB CVE-2022-2079, GHSA-hv6q-5g4f-8897 | Medium | 0.7% | 14 Jun, 2022 | npm nocodb |
Cross site scripting in facturascripts CVE-2022-2066, GHSA-h6wm-mr85-4h9g | Medium | 1.0% | 13 Jun, 2022 | Packagist facturascripts/facturascripts |
Cross-site Scripting in FacturaScripts CVE-2022-2065, GHSA-fp76-f299-v3hj | Medium | 0.7% | 13 Jun, 2022 | Packagist facturascripts/facturascripts |
Cross site scripting in dolibarr BIT-dolibarr-2022-2060, CVE-2022-2060, GHSA-8fvr-7945-mg7w | Medium | 0.9% | 13 Jun, 2022 | Packagist dolibarr/dolibarr |
Cross-site Scripting in Strapi CVE-2022-29894, GHSA-mcqm-6ff4-53qx | Medium | 0.8% | 13 Jun, 2022 | npm strapi |
Cross-site Scripting in SEOmatic plugin CVE-2021-41750, GHSA-6hjc-m38h-7jhh | Medium | 1.1% | 12 Jun, 2022 | Packagist nystudio107/craft-seomatic |
Cross site scripting in intelliants/subrion CVE-2021-41502, GHSA-jvq4-cgfw-jgf4 | Medium | 0.6% | 11 Jun, 2022 | Packagist intelliants/subrion |
Ill-formed headers may lead to unexpected behavior in Istio CVE-2022-31045, GHSA-xwx5-5c9g-x68x | Medium | 1.2% | 10 Jun, 2022 | Go istio.io/istio |
Mechanize before v2.8.5 vulnerable to authorization header leak on port redirect CVE-2022-31033, GHSA-64qm-hrgp-pgr9 | Medium | 1.5% | 09 Jun, 2022 | RubyGems mechanize |
Cross site scripting in francoisjacquet/rosariosis CVE-2022-2036, GHSA-4hpr-hh77-6q9p | Medium | 0.9% | 09 Jun, 2022 | Packagist francoisjacquet/rosariosis |
Cross-site Scripting in FacturaScripts CVE-2022-2016, GHSA-j8c7-3jpq-8985 | Medium | 0.7% | 09 Jun, 2022 | Packagist facturascripts/facturascripts |
Cross-site Scripting vulnerability in repository issue list in Gogs CVE-2022-31038, GHSA-xq4v-vrp9-vcf2, GO-2022-0483 | Medium | 0.7% | 08 Jun, 2022 | Go gogs.io/gogs |
Cross-site Scripting in Dolibarr BIT-dolibarr-2022-30875, CVE-2022-30875, GHSA-f2g5-426f-353q | Medium | 0.7% | 08 Jun, 2022 | Packagist dolibarr/dolibarr |
Cross-site Scripting in RosarioSIS CVE-2022-1997, GHSA-wjh9-344g-vc49 | Medium | 0.7% | 08 Jun, 2022 | Packagist francoisjacquet/rosariosis |
Cross-Site Request Forgery in easyii CMS CVE-2020-36534, GHSA-3x3w-vcjx-7796 | Medium | 0.5% | 07 Jun, 2022 | Packagist noumo/easyii |
Calico vulnerable to pod route hijacking CVE-2022-28224, GHSA-9394-xfq9-6qrp | Medium | 0.6% | 07 Jun, 2022 | Go github.com/projectcalico/calico |
containerd CRI plugin: Host memory exhaustion through ExecSync CVE-2022-31030, GHSA-5ffw-gxpp-mxpf, GO-2022-0482 | Medium | 0.4% | 06 Jun, 2022 | Go github.com/containerd/containerd |
Failed payment recorded has completed in Silverstripe Omnipay CVE-2022-29254, GHSA-48f2-m7jg-866x | Medium | 0.7% | 06 Jun, 2022 | Packagist silverstripe/silverstripe-omnipay |
Use of Uninitialized Variable in trilogy CVE-2022-31026, GHSA-5g4r-2qhx-vqfm | Medium | 1.1% | 06 Jun, 2022 | RubyGems trilogy |
Authorization Bypass Through User-Controlled Key when using CILogonOAuthenticator oauthenticator CVE-2022-31027, GHSA-r7v4-jwx9-wx43, PYSEC-2022-206 | Medium | 0.5% | 06 Jun, 2022 | PyPI oauthenticator |
Missing Role Based Access Control for the REST handlers in bleve/http package CVE-2022-31022, GHSA-9w9f-6mg8-jp7w, GO-2022-0470 | Medium | 0.3% | 03 Jun, 2022 | Go github.com/blevesearch/bleve Go github.com/blevesearch/bleve/v2 |
Access control issue in AlekSIS-Core CVE-2022-29773, GHSA-76x2-h8h3-cwjg, PYSEC-2026-767 | Medium | 0.7% | 03 Jun, 2022 | PyPI aleksis-core |
Cross-site Scripting in FacturaScripts CVE-2022-1988, GHSA-r7jw-mg27-j839 | Medium | 0.8% | 03 Jun, 2022 | Packagist facturascripts/facturascripts |