Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Uncontrolled Resource Consumption in Mattermost server BIT-mattermost-2022-1982, CVE-2022-1982, GHSA-gwpf-95jc-63rv | Medium | 0.9% | 03 Jun, 2022 | Go github.com/mattermost/mattermost-server |
Open redirect in caddy CVE-2022-29718, GHSA-2927-hv3p-f3vp | Medium | 1.1% | 03 Jun, 2022 | Go github.com/caddyserver/caddy Go github.com/caddyserver/caddy/v2 |
Neos CMS vulnerable to XSS in various backend modules BIT-neos-2022-30429, CVE-2022-30429, GHSA-7m9h-v68w-pfw3 | Medium | 0.6% | 02 Jun, 2022 | Packagist neos/neos |
Cross site scripting in librenms CVE-2022-29711, GHSA-2gqg-2rg7-gh33 | Medium | 0.7% | 02 Jun, 2022 | Packagist librenms/librenms |
Stored Cross-site Scripting in gitea BIT-gitea-2022-1928, CVE-2022-1928, GHSA-ph3w-2843-72mx, GO-2022-0612 | Medium | 0.8% | 30 May, 2022 | Go code.gitea.io/gitea |
Apple macOS Out-of-Bounds Read Vulnerability CVE-2022-22674 | MediumExploited | 1.1% | 26 May, 2022 | |
Cisco IOS XR Open Port Vulnerability CVE-2022-20821 | MediumExploited | 11.5% | 26 May, 2022 | |
Angular vulnerable to Cross-site Scripting CVE-2021-4231, GHSA-c75v-2vq8-878f | Medium | 1.2% | 26 May, 2022 | npm @angular/core |
Denial-of-service vulnerability processing large chat messages containing many newlines CVE-2022-51011, GHSA-gj94-v4p9-w672 | Medium | 0.5% | 25 May, 2022 | Packagist pocketmine/pocketmine-mp |
sharp vulnerable to Command Injection in post-installation over build environment CVE-2022-29256, GHSA-gp95-ppv5-3jc5 | Medium | 0.4% | 25 May, 2022 | npm sharp |
XSS in various backend modules due to (un)escaping in JS notification module GHSA-jfxf-4frr-9j3q | Medium | Not scored | 25 May, 2022 | Packagist neos/neos |
Ignition config accessible to unprivileged software on VMware CVE-2022-1706, GHSA-hj57-j5cw-2mwp, GO-2022-0451 | Medium | 1.3% | 25 May, 2022 | Go github.com/coreos/ignition Go github.com/coreos/ignition/v2 |
`CHECK` failure in depthwise ops via overflows GHSA-mw6j-hh29-h379 | Medium | Not scored | 25 May, 2022 | PyPI tensorflow PyPI tensorflow-cpu PyPI tensorflow-gpu |
Pion/DLTS Accepts Client Certificates Without CertificateVerify CVE-2022-29222, GHSA-w45j-f832-hxvh, GO-2022-0462 | Medium | 0.8% | 25 May, 2022 | Go github.com/pion/dtls Go github.com/pion/dtls/v2 |
Camaleon CMS Stored Cross-site Scripting vulnerability CVE-2021-25969, GHSA-x78v-4fvj-rg9j | Medium | 0.8% | 24 May, 2022 | RubyGems camaleon_cms |
Cross site scripting in publify BIT-publify-2021-25974, CVE-2021-25974, GHSA-wmh9-x28j-c6gr | Medium | 0.6% | 24 May, 2022 | RubyGems publify_core |
Cross site scripting in publify BIT-publify-2021-25975, CVE-2021-25975, GHSA-3h7v-wqw7-ff28 | Medium | 0.6% | 24 May, 2022 | RubyGems publify_core |
Pion/DTLS contains buffer for inbound DTLS fragments with no limit CVE-2022-29189, GHSA-cx94-mrg9-rq4j, GO-2022-0461 | Medium | 2.1% | 24 May, 2022 | Go github.com/pion/dtls Go github.com/pion/dtls/v2 |
Smokescreen SSRF via deny list bypass (square brackets) CVE-2022-29188, GHSA-qwrf-gfpj-qvj6, GO-2022-0459 | Medium | 0.9% | 24 May, 2022 | Go github.com/stripe/smokescreen |
openark/orchestrator cross-site scripting vulnerability CVE-2021-27940, GHSA-752c-vfpf-cp2w | Medium | 1.2% | 24 May, 2022 | Go github.com/openark/orchestrator |
DoS via malicious p2p message in Go Ethereum CVE-2022-29177, GHSA-wjxw-gh3m-7pm5, GO-2022-0456 | Medium | 1.2% | 24 May, 2022 | Go github.com/ethereum/go-ethereum |
Cross-site Scripting in Gogs CVE-2022-1464, GHSA-ff28-f46g-r9g8, GO-2022-0597 | Medium | 0.7% | 24 May, 2022 | Go gogs.io/gogs |
Camaleon CMS vulnerable to Uncaught Exception CVE-2021-25971, GHSA-r2w2-h6r8-3r53 | Medium | 1.0% | 24 May, 2022 | RubyGems camaleon_cms |
Camaleon CMS vulnerable to Server-Side Request Forgery CVE-2021-25972, GHSA-vx6p-q4gj-x6xx | Medium | 1.0% | 24 May, 2022 | RubyGems camaleon_cms |
apollo_upload_server has Denial of Service vulnerability BIT-gitlab-2021-39880, CVE-2021-39880, GHSA-w6pv-c757-6rgr | Medium | 2.1% | 24 May, 2022 | RubyGems apollo_upload_server |
Smashing Cross-site Scripting vulnerability CVE-2021-35440, GHSA-254j-mmc5-qhpx | Medium | 1.0% | 24 May, 2022 | RubyGems smashing |
golang.org/x/net/http/httpguts vulnerable to Uncontrolled Recursion BIT-golang-2021-31525, CVE-2021-31525, GHSA-h86h-8ppg-mxmh, GO-2022-0236 | Medium | 3.7% | 24 May, 2022 | Go golang.org/x/net Go stdlib |
Nokogiri Implements libxml2 version vulnerable to null pointer dereferencing CVE-2021-3537, GHSA-286v-pcf5-25rc | Medium | 3.6% | 24 May, 2022 | RubyGems nokogiri |
HashiCorp Consul Cross-site Scripting vulnerability BIT-consul-2020-25864, CVE-2020-25864, GHSA-8xmx-h8rq-h94j, GO-2023-1851 | Medium | 6.1% | 24 May, 2022 | Go github.com/hashicorp/consul |
MongoDB Tools Improper Certificate Validation vulnerability CVE-2020-7924, GHSA-6cwm-wm82-hgrw, GO-2024-2550 | Medium | 0.7% | 24 May, 2022 | Go github.com/mongodb/mongo-tools |
Rancher Cross-site Scripting Vulnerability CVE-2021-25313, GHSA-6m8r-jh89-rq7h | Medium | 1.5% | 24 May, 2022 | Go github.com/rancher/rancher |
Default inheritable capabilities for linux container should be empty CVE-2022-29162, GHSA-f3fp-gc8g-vw66, GO-2022-0452 | Medium | 0.4% | 24 May, 2022 | Go github.com/opencontainers/runc |
Grafana XSS via a query alias for the ElasticSearch datasource BIT-grafana-2020-24303, CVE-2020-24303, GHSA-mvpr-q6rh-8vrp, GO-2024-2520 | Medium | 2.1% | 24 May, 2022 | Go github.com/grafana/grafana |
Gophish vulnerable to Server-Side Request Forgery CVE-2020-24710, GHSA-9c9w-9pq7-f35h, GO-2023-1982 | Medium | 1.3% | 24 May, 2022 | Go github.com/gophish/gophish |
ingress-nginx component for Kubernetes allows file overwrite CVE-2020-8553, GHSA-hhpm-74pm-hf35 | Medium | 0.9% | 24 May, 2022 | Go k8s.io/ingress-nginx |
Podman has Files or Directories Accessible to External Parties CVE-2020-1726, GHSA-vmhj-p9hw-vgrf, GO-2023-1544 | Medium | 1.8% | 24 May, 2022 | Go github.com/containers/libpod Go github.com/containers/libpod/v2 Go github.com/containers/podman Go github.com/containers/podman/v2 |
Improper user session handling in filegator CVE-2022-1849, GHSA-47vg-483w-hp3m | Medium | 0.8% | 24 May, 2022 | Packagist filegator/filegator |
Login screen allows message spoofing if SSO is enabled CVE-2022-24905, GHSA-xmg8-99r8-jc2j, GO-2022-0454 | Medium | 1.3% | 24 May, 2022 | Go github.com/argoproj/argo-cd Go github.com/argoproj/argo-cd/v2 |
Publify has Improper Access Controls BIT-publify-2022-1810, CVE-2022-1810, GHSA-c273-c6vg-4pv5 | Medium | 0.8% | 24 May, 2022 | RubyGems publify_core |
Symlink following allows leaking out-of-bound manifests and JSON files from Argo CD repo-server CVE-2022-24904, GHSA-6gcg-hp2x-q54h, GO-2022-0453 | Medium | 1.2% | 23 May, 2022 | Go github.com/argoproj/argo-cd Go github.com/argoproj/argo-cd/v2 |
URL Redirection to Untrusted Site ('Open Redirect') in next-auth CVE-2022-29214, GHSA-q2mx-j4x2-2h74 | Medium | 0.7% | 21 May, 2022 | npm next-auth |
Incomplete validation in signal ops leads to crashes in TensorFlow BIT-tensorflow-2022-29213, CVE-2022-29213, GHSA-5889-7v45-q28m, PYSEC-2026-3107, PYSEC-2026-3277, PYSEC-2026-952 | Medium | 0.3% | 21 May, 2022 | PyPI tensorflow PyPI tensorflow-cpu PyPI tensorflow-gpu |
Core dump when loading TFLite models with quantization in TensorFlow BIT-tensorflow-2022-29212, CVE-2022-29212, GHSA-8wwm-6264-x792, PYSEC-2026-3141, PYSEC-2026-3299, PYSEC-2026-972 | Medium | 0.3% | 21 May, 2022 | PyPI tensorflow PyPI tensorflow-cpu PyPI tensorflow-gpu |
Segfault if `tf.histogram_fixed_width` is called with NaN values in TensorFlow BIT-tensorflow-2022-29211, CVE-2022-29211, GHSA-xrp2-fhq4-4q3w, PYSEC-2026-1048, PYSEC-2026-3260, PYSEC-2026-3382 | Medium | 0.3% | 21 May, 2022 | PyPI tensorflow PyPI tensorflow-cpu PyPI tensorflow-gpu |
Heap buffer overflow due to incorrect hash function in TensorFlow BIT-tensorflow-2022-29210, CVE-2022-29210, GHSA-hc2f-7r5r-r2hg, PYSEC-2026-1007, PYSEC-2026-3200, PYSEC-2026-3339 | Medium | 0.2% | 21 May, 2022 | PyPI tensorflow PyPI tensorflow-cpu PyPI tensorflow-gpu |
Type confusion leading to `CHECK`-failure based denial of service in TensorFlow BIT-tensorflow-2022-29209, CVE-2022-29209, GHSA-f4rr-5m7v-wxcw, PYSEC-2026-3167, PYSEC-2026-3315, PYSEC-2026-986 | Medium | 0.4% | 21 May, 2022 | PyPI tensorflow PyPI tensorflow-cpu PyPI tensorflow-gpu |
Missing validation results in undefined behavior in `SparseTensorDenseAdd BIT-tensorflow-2022-29206, CVE-2022-29206, GHSA-rc9w-5c64-9vqq, PYSEC-2026-1032, PYSEC-2026-3235, PYSEC-2026-3365 | Medium | 0.4% | 20 May, 2022 | PyPI tensorflow PyPI tensorflow-cpu PyPI tensorflow-gpu |
Segfault due to missing support for quantized types BIT-tensorflow-2022-29205, CVE-2022-29205, GHSA-54ch-gjq5-4976, PYSEC-2026-3104, PYSEC-2026-3274, PYSEC-2026-950 | Medium | 0.3% | 20 May, 2022 | PyPI tensorflow PyPI tensorflow-cpu PyPI tensorflow-gpu |
Missing validation causes denial of service via `Conv3DBackpropFilterV2` BIT-tensorflow-2022-29204, CVE-2022-29204, GHSA-hx9q-2mx4-m4pg, PYSEC-2026-1010, PYSEC-2026-3203, PYSEC-2026-3342 | Medium | 0.4% | 20 May, 2022 | PyPI tensorflow PyPI tensorflow-cpu PyPI tensorflow-gpu |
Integer overflow in `SpaceToBatchND` BIT-tensorflow-2022-29203, CVE-2022-29203, GHSA-jjm6-4vf7-cjh4, PYSEC-2026-1012, PYSEC-2026-3207, PYSEC-2026-3344 | Medium | 0.3% | 20 May, 2022 | PyPI tensorflow PyPI tensorflow-cpu PyPI tensorflow-gpu |