Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Stored cross site scripting in getgrav/grav CVE-2022-1173, GHSA-3p5m-j98p-c698 | Medium | 1.5% | 26 Apr, 2022 | Packagist getgrav/grav |
Potential Captcha Validate Bypass in flask-session-captcha CVE-2022-24880, GHSA-7r87-cj48-wj45, PYSEC-2022-193 | Medium | 1.2% | 25 Apr, 2022 | PyPI flask-session-captcha |
element-plus vulnerable to cross-site scripting (XSS) via el-table-column CVE-2022-27103, GHSA-rjvg-8v36-xv9r | Medium | 0.9% | 25 Apr, 2022 | npm element-plus |
Stored cross-site scripting in Snipe-IT CVE-2022-1445, GHSA-hpx4-xjp7-m4vr | Medium | 0.8% | 24 Apr, 2022 | Packagist snipe/snipe-it |
Incorrect Default Permissions in CRI-O CVE-2022-27652, GHSA-4hj2-r2pm-3hc6, GO-2022-0426 | Medium | 0.2% | 22 Apr, 2022 | Go github.com/cri-o/cri-o |
SVG with embedded scripts can lead to cross-site scripting attacks in xml2rfc GHSA-cf4q-4cqr-7g7w | Medium | Not scored | 22 Apr, 2022 | PyPI xml2rfc |
Cross-site Scripting in Microweber CVE-2022-1439, GHSA-9w7h-3wwh-6m5q | Medium | 3.3% | 22 Apr, 2022 | Packagist microweber/microweber |
Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability CVE-2022-27926 | MediumExploited | 17.6% | 21 Apr, 2022 | |
Access bypass in Drupal core BIT-drupal-2022-25274, CVE-2022-25274, DRUPAL-CORE-2022-009, GHSA-7jr4-hgqx-vwgq | Medium | 0.4% | 20 Apr, 2022 | Packagist drupal/core |
Improper Control of a Resource Through its Lifetime in Mattermost BIT-mattermost-2022-1385, CVE-2022-1385, GHSA-fxwj-v664-wv5g, GO-2022-0599 | Medium | 0.8% | 20 Apr, 2022 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 |
NextAuth.js default redirect callback vulnerable to open redirects CVE-2022-24858, GHSA-f9wg-5f46-cjmw | Medium | 0.8% | 19 Apr, 2022 | npm next-auth |
Manipulated inline images can cause Infinite Loop in PyPDF2 CVE-2022-24859, GHSA-xcjx-m2pj-8g79, PYSEC-2022-194 | Medium | 1.3% | 18 Apr, 2022 | PyPI PyPDF2 PyPI pypdf2 |
Cross site scripting in safe-svg CVE-2022-1091, GHSA-5h7w-hmxc-99g5 | Medium | 1.2% | 18 Apr, 2022 | Packagist darylldoyle/safe-svg |
Zoho ManageEngine ADSelfService Plus Remote Code Execution Vulnerability CVE-2022-28810 | MediumExploited | 71.0% | 18 Apr, 2022 | |
Cross-site Scripting in snipe-it CVE-2022-1380, GHSA-p885-prv3-m4xv | Medium | 0.8% | 16 Apr, 2022 | Packagist snipe/snipe-it |
Withdrawn Advisory: Incorrect Authorization in cross-fetch CVE-2022-1365, GHSA-7gc6-qh9x-w6h8 | Medium | 1.2% | 15 Apr, 2022 | npm cross-fetch |
Cross-site Scripting in Pimcore CVE-2022-1351, GHSA-xcr3-4qvr-54rh | Medium | 0.8% | 14 Apr, 2022 | Packagist pimcore/pimcore |
Improper Privilege Management in Mattermost BIT-mattermost-2022-1332, CVE-2022-1332, GHSA-qggc-pj29-j27m, GO-2022-0616 | Medium | 0.7% | 14 Apr, 2022 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 |
Resource exhaustion in Mattermost BIT-mattermost-2022-1337, CVE-2022-1337, GHSA-f37q-q7p2-ccfc, GO-2022-0595 | Medium | 0.9% | 14 Apr, 2022 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 |
MantisBT vulnerable to XSS due to improper escape in manage_plugin_page.php and manage_plugin_uninstall.php CVE-2022-26144, GHSA-rqgj-rqfr-5j6f | Medium | 0.8% | 13 Apr, 2022 | Packagist mantisbt/mantisbt |
HTML Injection in Froxlor CVE-2020-29653, GHSA-j739-gw6q-f4c7 | Medium | 1.4% | 13 Apr, 2022 | Packagist froxlor/froxlor |
Cross-site Scripting in fullpage.js CVE-2022-1330, GHSA-h3cq-j957-vhxg | Medium | 0.8% | 12 Apr, 2022 | npm fullpage.js |
Path Traversal in Grunt CVE-2022-0436, GHSA-j383-35pm-c5h4 | Medium | 0.6% | 12 Apr, 2022 | npm grunt |
XML Injection in Xerces Java affects Nokogiri GHSA-xxx9-3xcr-gjj3 | Medium | Not scored | 11 Apr, 2022 | RubyGems nokogiri |
Cross-site Scripting in tableexport.jquery.plugin CVE-2022-1291, GHSA-j636-crp3-m584 | Medium | 0.7% | 10 Apr, 2022 | npm tableexport.jquery.plugin |
Smokescreen SSRF via deny list bypass CVE-2022-24825, GHSA-gcj7-j438-hjj2, GO-2022-0429 | Medium | 0.9% | 07 Apr, 2022 | Go github.com/stripe/smokescreen |
Improper one time password handling in devise-two-factor CVE-2021-43177, GHSA-jm35-h8q2-73mp | Medium | 0.9% | 07 Apr, 2022 | RubyGems devise-two-factor |
Open redirect in wwbn/avideo CVE-2022-27463, GHSA-34hv-f45p-4qfq | Medium | 0.6% | 05 Apr, 2022 | Packagist wwbn/avideo |
Cross site scripting in valine CVE-2020-28847, GHSA-6xvq-2gj8-4276 | Medium | 0.5% | 05 Apr, 2022 | npm valine |
Buffer Overflow in yajl-ruby CVE-2022-24795, GHSA-jj47-x69x-mxrm | Medium | 3.4% | 05 Apr, 2022 | RubyGems yajl-ruby |
Opened exploitable ports in default docker-compose.yaml in go-ipfs GHSA-fx5p-f64h-93xc, GO-2022-0418 | Medium | Not scored | 04 Apr, 2022 | Go github.com/ipfs/go-ipfs |
URL Confusion When Scheme Not Supplied in medialize/uri.js CVE-2022-1233, GHSA-g694-m8vq-gv9h | Medium | 0.8% | 04 Apr, 2022 | npm urijs |
Cross-site Scripting in craftcms/cms CVE-2022-28378, GHSA-7xj5-fwqr-5378 | Medium | 0.6% | 03 Apr, 2022 | Packagist craftcms/cms |
Cross-site Scripting in @rocket.chat/livechat CVE-2022-21830, GHSA-hf55-c445-2w97 | Medium | 0.8% | 01 Apr, 2022 | npm @rocket.chat/livechat |
Uncontrolled Resource Consumption in Matrix Synapse CVE-2022-41952, GHSA-4822-jvwx-w47h, PYSEC-2026-663 | Medium | 0.9% | 01 Apr, 2022 | PyPI matrix-synapse |
Non-empty default inheritable capabilities for linux container in Buildah CVE-2022-27651, GHSA-c3g4-w6cv-6v7h, GO-2022-0417 | Medium | 1.3% | 01 Apr, 2022 | Go github.com/containers/buildah |
Improper Certificate Validation in node-sass affects eZ Platform GHSA-6v6p-g8cg-2hgg | Medium | Not scored | 01 Apr, 2022 | Packagist ezsystems/ezplatform-admin-ui |
Cross-site Scripting in vditor CVE-2022-0350, GHSA-689x-x68p-fph3 | Medium | 0.5% | 31 Mar, 2022 | npm vditor |
Cross-site Scripting (XSS) within joomla/filter class BIT-joomla-2022-23800, CVE-2022-23800, GHSA-qcv6-h33g-hvrc | Medium | 0.7% | 30 Mar, 2022 | Packagist joomla/filter |
Path Disclosure within joomla/filesystem class BIT-joomla-2022-23794, CVE-2022-23794, GHSA-rc8q-45v8-x6xc | Medium | 0.9% | 30 Mar, 2022 | Packagist joomla/filesystem |
VMware vCenter Server Incorrect Default File Permissions Vulnerability CVE-2022-22948 | MediumExploited | 13.3% | 29 Mar, 2022 | |
Cross-site Scripting in teampass CVE-2022-26980, GHSA-m2wv-m5pf-284r | Medium | 1.1% | 28 Mar, 2022 | Packagist nilsteampassnet/teampass |
Incorrect Access Control in ImpressCMS CVE-2021-26598, GHSA-48p3-xfvw-g59c | Medium | 10.5% | 28 Mar, 2022 | Packagist impresscms/impresscms |
Gitea Open Redirect BIT-gitea-2022-1058, CVE-2022-1058, GHSA-4rqq-rxvc-v2rc, GO-2024-2752 | Medium | 53.2% | 25 Mar, 2022 | Go code.gitea.io/gitea |
Cross-Site Request Forgery in Anchor CMS CVE-2022-25576, GHSA-322v-p3jc-7hrg | Medium | 0.4% | 24 Mar, 2022 | Packagist anchorcms/anchor-cms |
Open Redirect in Flask-AppBuilder CVE-2022-24776, GHSA-2ccw-7px8-vmpf, PYSEC-2026-635 | Medium | 1.0% | 24 Mar, 2022 | PyPI Flask-AppBuilder PyPI flask-appbuilder |
Cross-site Scripting in Pimcore Datahub BIT-pimcore-2022-0955, CVE-2022-0955, GHSA-vc5r-xfc4-4x22 | Medium | 0.6% | 24 Mar, 2022 | Packagist pimcore/data-hub |
Cross-site Scripting in Fork CMS CVE-2022-0145, GHSA-qf2g-q4mc-w7rr | Medium | 0.7% | 24 Mar, 2022 | Packagist forkcms/forkcms |
Path traversal allows leaking out-of-bound files from Argo CD repo-server CVE-2022-24731, GHSA-h6h5-6fmq-rh28, GO-2022-0358 | Medium | 1.0% | 24 Mar, 2022 | Go github.com/argoproj/argo-cd Go github.com/argoproj/argo-cd/v2 |
Exposure of Sensitive Information to an Unauthorized Actor in OpenStack tripleo-heat-templates CVE-2021-4180, GHSA-hm3x-jwwf-jpr9, PYSEC-2026-753 | Medium | 0.8% | 23 Mar, 2022 | PyPI tripleo-heat-templates |