Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Denial of service in `tf.ragged.constant` due to lack of validation BIT-tensorflow-2022-29202, CVE-2022-29202, GHSA-cwpm-f78v-7m5c, PYSEC-2026-3163, PYSEC-2026-3312, PYSEC-2026-983 | Medium | 0.3% | 20 May, 2022 | PyPI tensorflow PyPI tensorflow-cpu PyPI tensorflow-gpu |
Missing validation results in undefined behavior in `QuantizedConv2D` BIT-tensorflow-2022-29201, CVE-2022-29201, GHSA-pqhm-4wvf-2jg8, PYSEC-2026-1026, PYSEC-2026-3224, PYSEC-2026-3358 | Medium | 0.3% | 20 May, 2022 | PyPI tensorflow PyPI tensorflow-cpu PyPI tensorflow-gpu |
Undefined behavior when users supply invalid resource handles BIT-tensorflow-2022-29207, CVE-2022-29207, GHSA-5wpj-c6f7-24x8, PYSEC-2026-3112, PYSEC-2026-3280, PYSEC-2026-955 | Medium | 0.3% | 20 May, 2022 | PyPI tensorflow PyPI tensorflow-cpu PyPI tensorflow-gpu |
Missing validation causes denial of service via `LSTMBlockCell` BIT-tensorflow-2022-29200, CVE-2022-29200, GHSA-2vv3-56qg-g2cf, PYSEC-2026-3089, PYSEC-2026-3267, PYSEC-2026-944 | Medium | 0.3% | 20 May, 2022 | PyPI tensorflow PyPI tensorflow-cpu PyPI tensorflow-gpu |
Missing validation causes denial of service via `LoadAndRemapMatrix` BIT-tensorflow-2022-29199, CVE-2022-29199, GHSA-p9rc-rmr5-529j, PYSEC-2026-1025, PYSEC-2026-3221, PYSEC-2026-3357 | Medium | 0.3% | 20 May, 2022 | PyPI tensorflow PyPI tensorflow-cpu PyPI tensorflow-gpu |
Missing validation causes denial of service via `SparseTensorToCSRSparseMatrix` BIT-tensorflow-2022-29198, CVE-2022-29198, GHSA-mg66-qvc5-rm93, PYSEC-2026-1018, PYSEC-2026-3214, PYSEC-2026-3350 | Medium | 0.3% | 20 May, 2022 | PyPI tensorflow PyPI tensorflow-cpu PyPI tensorflow-gpu |
Missing validation causes denial of service via `UnsortedSegmentJoin` BIT-tensorflow-2022-29197, CVE-2022-29197, GHSA-hrg5-737c-2p56, PYSEC-2026-1009, PYSEC-2026-3202, PYSEC-2026-3341 | Medium | 0.3% | 20 May, 2022 | PyPI tensorflow PyPI tensorflow-cpu PyPI tensorflow-gpu |
Missing validation causes denial of service via `Conv3DBackpropFilterV2` BIT-tensorflow-2022-29196, CVE-2022-29196, GHSA-5v77-j66x-4c4g, PYSEC-2026-3110, PYSEC-2026-3278, PYSEC-2026-953 | Medium | 0.3% | 20 May, 2022 | PyPI tensorflow PyPI tensorflow-cpu PyPI tensorflow-gpu |
Missing validation causes denial of service via `StagePeek` BIT-tensorflow-2022-29195, CVE-2022-29195, GHSA-h48f-q7rw-hvr7, PYSEC-2026-1003, PYSEC-2026-3196, PYSEC-2026-3335 | Medium | 0.3% | 20 May, 2022 | PyPI tensorflow PyPI tensorflow-cpu PyPI tensorflow-gpu |
Missing validation causes `TensorSummaryV2` to crash BIT-tensorflow-2022-29193, CVE-2022-29193, GHSA-2p9q-h29j-3f5v, PYSEC-2026-3087, PYSEC-2026-3265, PYSEC-2026-942 | Medium | 0.3% | 20 May, 2022 | PyPI tensorflow PyPI tensorflow-cpu PyPI tensorflow-gpu |
Missing validation causes denial of service via `DeleteSessionTensor` BIT-tensorflow-2022-29194, CVE-2022-29194, GHSA-h5g4-ppwx-48q2, PYSEC-2026-1004, PYSEC-2026-3197, PYSEC-2026-3336 | Medium | 0.3% | 20 May, 2022 | PyPI tensorflow PyPI tensorflow-cpu PyPI tensorflow-gpu |
Missing validation crashes `QuantizeAndDequantizeV4Grad` BIT-tensorflow-2022-29192, CVE-2022-29192, GHSA-h2wq-prv9-2f56, PYSEC-2026-1002, PYSEC-2026-3195, PYSEC-2026-3334 | Medium | 0.3% | 20 May, 2022 | PyPI tensorflow PyPI tensorflow-cpu PyPI tensorflow-gpu |
Missing validation causes denial of service via `GetSessionTensor` BIT-tensorflow-2022-29191, CVE-2022-29191, GHSA-fv25-wrff-wf86, PYSEC-2026-3179, PYSEC-2026-3324, PYSEC-2026-993 | Medium | 0.4% | 20 May, 2022 | PyPI tensorflow PyPI tensorflow-cpu PyPI tensorflow-gpu |
Potential Cross-site Scripting vulnerability in Hydrogen CVE-2022-29230, GHSA-6j22-wv8g-894f | Medium | 0.8% | 18 May, 2022 | npm @shopify/hydrogen |
Exposure of Sensitive Information in moodle BIT-moodle-2022-30598, CVE-2022-30598, GHSA-fj6p-g234-rrv3 | Medium | 1.1% | 18 May, 2022 | Packagist moodle/moodle |
External Control of Assumed-Immutable Web Parameter in moodle BIT-moodle-2022-30597, CVE-2022-30597, GHSA-x6gm-qqwp-76gr | Medium | 1.3% | 18 May, 2022 | Packagist moodle/moodle |
Cross-site Scripting in moodle BIT-moodle-2022-30596, CVE-2022-30596, GHSA-wvh5-78h5-gmgr | Medium | 0.9% | 18 May, 2022 | Packagist moodle/moodle |
HashiCorp Vault improper configuration of multi factor authentication BIT-vault-2022-30689, CVE-2022-30689, GHSA-c5wc-v287-82pc, GO-2022-0590 | Medium | 1.2% | 18 May, 2022 | Go github.com/hashicorp/vault |
Cross-site Scripting in Jirafeau CVE-2022-30110, GHSA-j2xf-p274-g8cc | Medium | 0.6% | 17 May, 2022 | Packagist mojo42/jirafeau |
Publify exposes article metadata BIT-publify-2022-1553, CVE-2022-1553, GHSA-5jm7-g527-m694 | Medium | 1.2% | 17 May, 2022 | RubyGems publify_core |
Publify Incorrect Authorization BIT-publify-2022-0574, CVE-2022-0574, GHSA-79m3-q3wh-c3qm | Medium | 0.8% | 17 May, 2022 | RubyGems publify_core |
Publify vulnerable to code injection BIT-publify-2022-0578, CVE-2022-0578, GHSA-w78q-4w34-jrjx | Medium | 0.9% | 17 May, 2022 | RubyGems publify_core |
Cross-site Scripting in bootstrap-table CVE-2022-1726, GHSA-grw5-g9h2-wpg8 | Medium | 0.9% | 16 May, 2022 | npm bootstrap-table |
Cross-site Scripting in facturascripts CVE-2022-1682, GHSA-6465-r752-2h8v | Medium | 0.8% | 12 May, 2022 | Packagist facturascripts/facturascripts |
Cross site scripting in code-server CVE-2021-42648, GHSA-2gp3-6c9p-jp7w | Medium | 0.9% | 11 May, 2022 | npm code-server |
Microsoft Windows LSA Spoofing Vulnerability CVE-2022-26925 | MediumExploited | 10.5% | 10 May, 2022 | |
Improper Access Control in wp-graphql CVE-2019-25060, GHSA-w3xg-7q6m-3xwp | Medium | 1.8% | 09 May, 2022 | Packagist wp-graphql/wp-graphql |
Cross-site Scripting in Auth0 Lock CVE-2022-29172, GHSA-7ww6-75fj-jcj7 | Medium | 0.6% | 05 May, 2022 | npm auth0-lock |
Unrestricted Upload of File with Dangerous Type in yetiforce-crm CVE-2022-1411, GHSA-pqr6-3j58-9w58 | Medium | 0.8% | 05 May, 2022 | Packagist yetiforce/yetiforce-crm |
Cross-site Scripting in jquery.json-viewer CVE-2022-30241, GHSA-qp2q-6h9j-jg2r | Medium | 0.7% | 04 May, 2022 | npm jquery.json-viewer |
Cross-site Scripting in Microweber CVE-2022-1584, GHSA-f23x-4gf4-m9ff | Medium | 0.9% | 04 May, 2022 | Packagist microweber/microweber |
MantisBT vulnerable to XSS via unescaped output in browser_search_plugin.php CVE-2022-28508, GHSA-wfg2-2wmw-6894 | Medium | 5.2% | 04 May, 2022 | Packagist mantisbt/mantisbt |
Cross-site Scripting in FacturaScripts CVE-2022-1571, GHSA-m8gv-gvhf-7rhp | Medium | 0.9% | 04 May, 2022 | Packagist facturascripts/facturascripts |
Microweber vulnerable to cross-site scripting (XSS) CVE-2022-1555, GHSA-6346-5r4h-ff5x | Medium | 1.3% | 04 May, 2022 | Packagist microweber/microweber |
tkvideo has a memory issue in playing videos CVE-2022-24902, GHSA-jmhj-vh4q-hhmq, PYSEC-2022-187 | Medium | 0.5% | 03 May, 2022 | PyPI tkvideoplayer |
Privilege escalation for users with create/update permissions in Global Roles in Rancher CVE-2021-36784, GHSA-jwvr-vv7p-gpwq | Medium | 0.9% | 02 May, 2022 | Go github.com/rancher/rancher |
materialize-css vulnerable to cross-site Scripting (XSS) due to improper escape of user input CVE-2022-25349, GHSA-7jvx-f994-rfw2 | Medium | 1.0% | 01 May, 2022 | npm materialize-css |
SCart is vulnerable to cross-site scripting (XSS) CVE-2022-21149, GHSA-7pfc-cx3m-v22x | Medium | 0.6% | 01 May, 2022 | Packagist s-cart/core Packagist s-cart/s-cart |
Woodpecker allows cross-site scripting (XSS) via build logs CVE-2022-29947, GHSA-vmp5-c5hp-6c65, GO-2022-0440 | Medium | 0.7% | 30 Apr, 2022 | Go github.com/woodpecker-ci/woodpecker |
tagify can pass a malicious placeholder to initiate the cross-site scripting (XSS) payload CVE-2022-25854, GHSA-pxpf-v376-7xx5, SNYK-JS-YAIREOTAGIFY-2404358 | Medium | 1.0% | 29 Apr, 2022 | npm @yaireo/tagify |
Missing authorization in Moodle BIT-moodle-2022-0984, CVE-2022-0984, GHSA-c5hf-mc85-2hx4 | Medium | 0.6% | 29 Apr, 2022 | Packagist moodle/moodle |
Improper Authentication in moodle BIT-moodle-2022-0985, CVE-2022-0985, GHSA-6q9g-3vfq-q2qj | Medium | 0.6% | 29 Apr, 2022 | Packagist moodle/moodle |
Subrion CMS Cross-site Scripting (XSS) vulnerability in the `contact us` plugin CVE-2021-41948, GHSA-jv64-2m3x-6v4q | Medium | 0.5% | 29 Apr, 2022 | Packagist intelliants/subrion |
An attacker can execute malicious javascript in Live Helper Chat BIT-livehelperchat-2022-1530, CVE-2022-1530, GHSA-9hgc-wpc5-v8p9 | Medium | 0.7% | 29 Apr, 2022 | Packagist remdex/livehelperchat |
Improper Access Control in snipe/snipe-it CVE-2022-1511, GHSA-p2vw-f87c-q597 | Medium | 1.1% | 28 Apr, 2022 | Packagist snipe/snipe-it |
Reflected Cross-site Scripting in Shopware storefront CVE-2022-24873, GHSA-4g29-fccr-p59w | Medium | 0.8% | 28 Apr, 2022 | Packagist shopware/shopware |
Insertion of Sensitive Information into Log File in Hashicorp go-getter CVE-2022-29810, GHSA-27rq-4943-qcwp, GO-2022-0438 | Medium | 0.4% | 28 Apr, 2022 | Go github.com/hashicorp/go-getter |
XSS Vulnerability in Action View tag helpers CVE-2022-27777, GHSA-ch3h-j2vf-95pv | Medium | 1.7% | 27 Apr, 2022 | RubyGems actionview |
Cross-site Scripting Vulnerability in Action Pack CVE-2022-22577, GHSA-mm33-5vfq-3mm3 | Medium | 1.8% | 27 Apr, 2022 | RubyGems actionpack |
Cross-site Scripting in microweber CVE-2022-1504, GHSA-6xj3-fhrf-rjgc | Medium | 1.0% | 27 Apr, 2022 | Packagist microweber/microweber |