Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Open redirect in karma CVE-2021-23495, GHSA-rc3x-jf5g-xvc5 | Medium | 0.9% | 25 Feb, 2022 | npm karma |
jQuery-Upload-File XSS in fileNameStr CVE-2021-37504, GHSA-43x9-7hfv-mxrf | Medium | 0.9% | 25 Feb, 2022 | npm jquery-file-upload |
Logic error in dolibarr/dolibarr BIT-dolibarr-2022-0746, CVE-2022-0746, GHSA-8vq6-5f66-hp3r | Medium | 0.9% | 25 Feb, 2022 | Packagist dolibarr/dolibarr |
Apache Airflow Cross-site Scripting Vulnerability BIT-airflow-2021-45229, CVE-2021-45229, GHSA-65xw-pcqw-hjrh, PYSEC-2022-29 | Medium | 2.6% | 25 Feb, 2022 | PyPI apache-airflow |
HashiCorp Consul Ingress Gateway Panic Can Shutdown Servers BIT-consul-2022-24687, CVE-2022-24687, GHSA-hj93-5fg3-3chr, GO-2022-0953 | Medium | 1.5% | 25 Feb, 2022 | Go github.com/hashicorp/consul |
EC-CUBE improperly handles HTTP Host header values CVE-2022-25355, GHSA-pw97-6v74-9w3p | Medium | 1.2% | 24 Feb, 2022 | Packagist ec-cube/ec-cube |
Cross site scripting in francoisjacquet/rosariosis CVE-2021-44566, GHSA-3756-hwhv-qw58 | Medium | 0.7% | 24 Feb, 2022 | Packagist francoisjacquet/rosariosis |
Cross site scripting in francoisjacquet/rosariosis CVE-2021-44565, GHSA-44cg-qcpr-fwjh | Medium | 0.7% | 24 Feb, 2022 | Packagist francoisjacquet/rosariosis |
Missing server signature validation in OctoberCMS CVE-2022-23655, GHSA-53m6-44rc-h2q5 | Medium | 0.6% | 24 Feb, 2022 | Packagist october/system |
b2-sdk-python TOCTOU application key disclosure CVE-2022-23651, GHSA-p867-fxfr-ph2w, PYSEC-2022-33 | Medium | 0.2% | 23 Feb, 2022 | PyPI b2sdk |
B2 Command Line Tool TOCTOU application key disclosure CVE-2022-23653, GHSA-8wr4-2wm6-w3pr, PYSEC-2022-32 | Medium | 0.2% | 23 Feb, 2022 | PyPI b2 |
Improper Authorization in dolibarr/dolibarr BIT-dolibarr-2022-0731, CVE-2022-0731, GHSA-4xc7-x2jr-cr74 | Medium | 1.0% | 23 Feb, 2022 | Packagist dolibarr/dolibarr |
Path traversal in pimcore CVE-2022-0665, GHSA-gjq4-69wj-p6pr | Medium | 1.5% | 22 Feb, 2022 | Packagist pimcore/pimcore |
Open Redirect in AllTube CVE-2022-0692, GHSA-jmhf-9fj8-88gh | Medium | 3.4% | 21 Feb, 2022 | Packagist rudloff/alltube |
Business Logic Errors in microweber CVE-2022-0688, GHSA-c5gj-w4hx-gvmx | Medium | 0.9% | 20 Feb, 2022 | Packagist microweber/microweber |
Business Logic Errors in microweber CVE-2022-0689, GHSA-3p9j-442x-hjp7 | Medium | 1.0% | 19 Feb, 2022 | Packagist microweber/microweber |
Cross-site Scripting in microweber CVE-2022-0678, GHSA-38m9-3vg4-rwvp | Medium | 2.3% | 19 Feb, 2022 | Packagist microweber/microweber |
Exposure of Resource to Wrong Sphere in ezsystems/ezplatform-kernel CVE-2022-25336, GHSA-x8xx-x82q-42q3 | Medium | 0.7% | 18 Feb, 2022 | Packagist ezsystems/ezplatform-kernel |
url-parse Incorrectly parses URLs that include an '@' CVE-2022-0639, GHSA-8v38-pw62-9cw2 | Medium | 1.5% | 17 Feb, 2022 | npm url-parse |
Cross-Site Request Forgery microweber CVE-2022-0638, GHSA-ghww-cv4v-hmxx | Medium | 0.4% | 17 Feb, 2022 | Packagist microweber/microweber |
Crypt_GPG does not prevent additional options in GPG calls CVE-2022-24953, GHSA-59x4-67mh-px54 | Medium | 0.9% | 17 Feb, 2022 | Packagist pear/crypt_gpg |
Generation of Error Message Containing Sensitive Information in Snipe-IT CVE-2022-0622, GHSA-pwwm-pwx2-2hw7 | Medium | 1.0% | 17 Feb, 2022 | Packagist snipe/snipe-it |
open redirect in pollbot CVE-2022-0637, GHSA-vg27-hr3v-3cqv, PYSEC-2026-738 | Medium | 0.4% | 16 Feb, 2022 | PyPI pollbot |
Incorrect authorization in Drupal core BIT-drupal-2022-25270, CVE-2022-25270, DRUPAL-CORE-2022-004, GHSA-73q4-j324-2qcc | Medium | 0.8% | 16 Feb, 2022 | Packagist drupal/core |
Authorization Bypass Through User-Controlled Key in urijs CVE-2022-0613, GHSA-gcv8-gh4r-25x6 | Medium | 1.5% | 16 Feb, 2022 | npm urijs |
Cross-site Scripting in livehelperchat BIT-livehelperchat-2022-0612, CVE-2022-0612, GHSA-h2fj-77wh-fh5w | Medium | 0.6% | 16 Feb, 2022 | Packagist remdex/livehelperchat |
Nomad Spread Job Stanza May Trigger Panic in Servers CVE-2022-24684, GHSA-6jm6-cmcp-fqjq, GO-2022-0560 | Medium | 1.4% | 16 Feb, 2022 | Go github.com/hashicorp/nomad |
Open redirect in microweber CVE-2022-0597, GHSA-rw98-5846-pqhx | Medium | 2.6% | 15 Feb, 2022 | Packagist microweber/microweber |
Microweber vulnerable to Improper Validation of Specified Quantity in Input CVE-2022-0596, GHSA-vpq7-m4qm-p2gp | Medium | 0.6% | 15 Feb, 2022 | Packagist microweber/microweber |
Cross-site Scripting in librenms CVE-2022-0589, GHSA-gj26-g5qf-jrh7 | Medium | 0.8% | 15 Feb, 2022 | Packagist librenms/librenms |
Missing Authorization in librenms/librenms CVE-2022-0588, GHSA-254q-rqmw-vx45 | Medium | 1.1% | 15 Feb, 2022 | Packagist librenms/librenms |
Hashicorp Nomad Information Exposure Through Environmental Variables CVE-2019-14802, GHSA-6hv3-7c34-4hx8, GO-2022-0634 | Medium | 0.6% | 15 Feb, 2022 | Go github.com/hashicorp/nomad |
Authorization bypass in Istio CVE-2020-16844, GHSA-82mm-ffjr-h86c | Medium | 1.1% | 15 Feb, 2022 | Go istio.io/istio |
Improper Privilege Management and Execution with Unnecessary Privileges in Kata Containers CVE-2020-2023, GHSA-6978-vg2j-cc9q | Medium | 1.1% | 15 Feb, 2022 | Go github.com/kata-containers/agent Go github.com/kata-containers/runtime |
Path Traversal in HashiCorp Nomad CVE-2020-28348, GHSA-5x92-p4p5-33c4, GO-2022-0770 | Medium | 1.7% | 15 Feb, 2022 | Go github.com/hashicorp/nomad |
Allocation of Resources Without Limits or Throttling and Uncontrolled Memory Allocation in Kubernetes CVE-2020-8551, GHSA-qhm4-jxv7-j9pq, GO-2022-0867 | Medium | 1.2% | 15 Feb, 2022 | Go k8s.io/kubernetes |
Kubernetes API Server DoS Via API Requests CVE-2020-8552, GHSA-82hx-w2r5-c2wq | Medium | 2.8% | 15 Feb, 2022 | Go k8s.io/apiserver |
Server Side Request Forgery (SSRF) in Kubernetes CVE-2020-8555, GHSA-x6mj-w4jf-jmgw, GO-2022-0890 | Medium | 3.7% | 15 Feb, 2022 | Go k8s.io/kubernetes |
Directory traversal in Kubernetes Secrets Store CSI Driver CVE-2020-8568, GHSA-5cgx-vhfp-6cf9, GO-2022-0629 | Medium | 1.3% | 15 Feb, 2022 | Go sigs.k8s.io/secrets-store-csi-driver |
NULL Pointer Dereference in Kubernetes CSI snapshot-controller CVE-2020-8569, GHSA-hwrr-rhmm-vcvf | Medium | 2.2% | 15 Feb, 2022 | Go github.com/kubernetes-csi/external-snapshotter/v2 Go github.com/kubernetes-csi/external-snapshotter/v3 |
Denial of service in Grafana BIT-grafana-2021-27358, CVE-2021-27358, GHSA-h5rh-w6vm-9ghc | Medium | 83.0% | 15 Feb, 2022 | Go github.com/grafana/grafana |
On Windows, `git-sizer` might run a `git` executable within the repository being analyzed GHSA-57q7-rxqq-7vgp, GO-2022-0424 | Medium | Not scored | 15 Feb, 2022 | Go github.com/github/git-sizer |
Improper input validation in umoci CVE-2021-29136, GHSA-9m95-8hx6-7p9v, GO-2022-0815 | Medium | 0.3% | 15 Feb, 2022 | Go github.com/opencontainers/umoci |
HashiCorp Nomad Artifact Download Race Condition CVE-2022-24686, GHSA-gwmc-6795-qghj, GO-2022-0600 | Medium | 0.9% | 15 Feb, 2022 | Go github.com/hashicorp/nomad |
Cross-site Scripting in enshrined/svg-sanitize CVE-2022-23638, GHSA-fqx8-v33p-4qcc | Medium | 0.7% | 14 Feb, 2022 | Packagist enshrined/svg-sanitize |
Improper Privilege Management in Snipe-IT CVE-2022-0579, GHSA-v6vg-pxvv-g5cq | Medium | 1.1% | 14 Feb, 2022 | Packagist snipe/snipe-it |
Authorization bypass in url-parse CVE-2022-0512, GHSA-rqff-837h-mm52 | Medium | 1.8% | 14 Feb, 2022 | npm url-parse |
Cross-site Scripting in librenms CVE-2022-0576, GHSA-rp34-85x3-3764 | Medium | 1.0% | 14 Feb, 2022 | Packagist librenms/librenms |
Cross-site Scripting in librenms CVE-2022-0575, GHSA-hxmr-5gv9-6p8v | Medium | 0.8% | 14 Feb, 2022 | Packagist librenms/librenms |
Exposure of Sensitive Information in snipe/snipe-it CVE-2022-0569, GHSA-qpv2-jxc7-3638 | Medium | 1.0% | 14 Feb, 2022 | Packagist snipe/snipe-it |