Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Incorrect default cookie name and recommendation GHSA-jjmg-x456-w976 | Low | Not scored | 10 Oct, 2022 | npm csrf-csrf |
EC-CUBE Directory traversal vulnerability CVE-2022-40199, GHSA-wjpv-frf2-3r58 | Low | 1.2% | 27 Sep, 2022 | Packagist ec-cube/ec-cube |
parse-server auth adapter app ID validation can be circumvented BIT-parse-2022-39231, CVE-2022-39231, GHSA-r657-33vp-gp22 | Low | 0.5% | 21 Sep, 2022 | npm parse-server |
Python-TUF vulnerable to incorrect threshold signature computation for new root metadata GHSA-r7vq-6425-j94w | Low | Not scored | 15 Sep, 2022 | PyPI tuf |
Command Injection in moment-timezone GHSA-56x4-j7p9-fcf9 | Low | Not scored | 30 Aug, 2022 | npm moment-timezone |
OpenStack Nova Changing vnic_type breaks compute service restart CVE-2022-37394, GHSA-v725-c588-h936, PYSEC-2026-882 | Low | 0.3% | 03 Aug, 2022 | PyPI nova |
next-auth before v4.10.2 and v3.29.9 leaks excessive information into log CVE-2022-31186, GHSA-p6mm-27gq-9v3p | Low | 0.3% | 01 Aug, 2022 | npm next-auth |
Flask-AppBuilder before v4.1.3 allows inference of sensitive information through query strings CVE-2022-31177, GHSA-32ff-4g79-vgfc, PYSEC-2022-247 | Low | 0.8% | 29 Jul, 2022 | PyPI Flask-AppBuilder PyPI flask-appbuilder |
XSS Injection Vulnerability GHSA-wf98-vxv9-jqfv | Low | Not scored | 05 Apr, 2022 | Packagist craftcms/cms |
SaltStack Salt Improper Authentication via Man in the Middle Attack CVE-2022-22935, GHSA-cvcc-5x92-gmhc, PYSEC-2022-172 | Low | 1.6% | 29 Mar, 2022 | PyPI salt |
Discoverability of user password hash in Statamic CMS CVE-2022-24784, GHSA-qcgx-7p5f-hxvr | Low | 1.0% | 25 Mar, 2022 | Packagist statamic/cms |
node-ipc behavior change GHSA-3mpp-xfvh-qh37 | Low | Not scored | 16 Mar, 2022 | npm node-ipc |
Hidden functionality in node-ipc GHSA-8gr3-2gjw-jj7g | Low | Not scored | 16 Mar, 2022 | npm node-ipc |
Inconsistent storage layout for ERC2771ContextUpgradeable GHSA-7j52-6fjp-58gr | Low | Not scored | 14 Mar, 2022 | npm @openzeppelin/contracts-upgradeable |
Infinite loop in Pillow GHSA-4fx9-vc88-q2xc | Low | Not scored | 11 Mar, 2022 | PyPI Pillow PyPI pillow |
Shopware user session is not logged out if the password is reset via password recovery CVE-2022-24744, GHSA-w267-m9c4-8555 | Low | 0.5% | 09 Mar, 2022 | Packagist shopware/core Packagist shopware/platform |
Insufficient user authorization in Moodle BIT-moodle-2022-0333, CVE-2022-0333, GHSA-m434-m5pv-p35w | Low | 0.6% | 25 Jan, 2022 | Packagist moodle/moodle |
Prototype Pollution in node-forge debug API. GHSA-5rrq-pxf6-6jx5 | Low | Not scored | 08 Jan, 2022 | npm node-forge |
Prototype Pollution in node-forge util.setPath API GHSA-wxgw-qj99-44c2 | Low | Not scored | 08 Jan, 2022 | npm node-forge |
URL parsing in node-forge could lead to undesired behavior. GHSA-gf8q-jrpm-jvxq | Low | Not scored | 08 Jan, 2022 | npm node-forge |
ERC1155Supply vulnerability in OpenZeppelin Contracts GHSA-wmpv-c2jp-j2xg | Low | Not scored | 15 Nov, 2021 | npm @openzeppelin/contracts npm @openzeppelin/contracts-upgradeable |
Path traversal when using `preview-docs` when working dir contains files with question mark `?` in name GHSA-q324-q795-2q5p | Low | Not scored | 12 Oct, 2021 | npm @redocly/openapi-cli |
Magento Information Disclosure vulnerability BIT-magento-2021-28566, CVE-2021-28566, GHSA-w942-fw92-mqm2 | Low | 1.4% | 08 Sep, 2021 | Packagist magento/community-edition |
Improper authorisation of members discloses room membership to non-members CVE-2021-39164, GHSA-3x4c-pq33-4w3q, PYSEC-2021-425 | Low | 1.5% | 31 Aug, 2021 | PyPI matrix-synapse |
Adding a private/unlisted room to a community exposes room metadata in an unauthorised manner. CVE-2021-39163, GHSA-jj53-8fmw-f2w2, PYSEC-2021-424 | Low | 0.9% | 31 Aug, 2021 | PyPI matrix-synapse |
Use of a Broken or Risky Cryptographic Algorithm CVE-2021-27913, GHSA-x7g2-wrrp-r6h3 | Low | 0.5% | 30 Aug, 2021 | Packagist mautic/core |
Incorrect TCR calculation in batchLiquidateTroves() during Recovery Mode GHSA-xh2p-7p87-fhgh | Low | Not scored | 05 Aug, 2021 | npm @liquity/contracts |
Improper Neutralization of Special Elements used in a Command ('Command Injection') in @floffah/build GHSA-jcgr-9698-82jx | Low | Not scored | 28 May, 2021 | npm @floffah/build |
User enumeration in authentication mechanisms GHSA-g2qj-pmxm-9f8f | Low | Not scored | 17 May, 2021 | Packagist symfony/security-http Packagist symfony/symfony |
User enumeration in authentication mechanisms GHSA-2frx-j9hj-6c65 | Low | Not scored | 17 May, 2021 | Packagist lexik/jwt-authentication-bundle |
User (Encrypted) Password Field Being Serialised GHSA-7fjp-g4m7-fx23 | Low | Not scored | 13 Apr, 2021 | Packagist pwweb/laravel-core |
CSRF Vuln can expose user's QRcode GHSA-fxq4-r6mr-9x64 | Low | Not scored | 08 Apr, 2021 | PyPI Flask-Security-Too PyPI flask-security-too |
Potential sensitive information disclosed in error reports CVE-2021-21416, GHSA-58c7-px5v-82hh, PYSEC-2021-11 | Low | 0.4% | 01 Apr, 2021 | PyPI django-registration |
Generation of fake documents via public GET-call GHSA-jvg4-9rc2-wvcr | Low | Not scored | 10 Feb, 2021 | Packagist shopware/platform |
Key Caching behavior in the DynamoDB Encryption Client. GHSA-4ph2-8337-hm62 | Low | Not scored | 08 Feb, 2021 | PyPI dynamodb-encryption-sdk |
Regex denial of service vulnerability in codesample plugin GHSA-h96f-fc7c-9r55 | Low | Not scored | 06 Jan, 2021 | npm tinymce |
Authenticated Server Side Request Forgery GHSA-8pfh-mm2g-hmc3 | Low | Not scored | 21 Dec, 2020 | Packagist shopware/core Packagist shopware/platform |
Information exposure via query strings in URL GHSA-cq6h-w3mc-57f4 | Low | Not scored | 21 Dec, 2020 | Packagist shopware/core Packagist shopware/platform |
Authenticated Privilege Escalation GHSA-5q58-x5h2-v5rx | Low | Not scored | 21 Dec, 2020 | Packagist shopware/core Packagist shopware/platform |
OpenCart Cross-Site Request Forgery (CSRF) CVE-2020-28838, GHSA-3j6m-m5v5-9785 | Low | 0.4% | 11 Dec, 2020 | Packagist opencart/opencart |
UNEDITABLE_SCHEMAS and UNEDITABLE_TABLE_DESCRIPTION_MATCH_RULES not respected by frontend service backend GHSA-47qg-q58v-7vrp | Low | Not scored | 02 Dec, 2020 | PyPI amundsen-frontend |
datasette-graphql leaks details of the schema of private database files GHSA-74hv-qjjq-h7g5 | Low | Not scored | 24 Nov, 2020 | PyPI datasette-graphql |
XML External Entity in Dashboard Widget BIT-typo3-2020-26229, CVE-2020-26229, GHSA-q9cp-mc96-m4w2 | Low | 0.6% | 23 Nov, 2020 | Packagist typo3/cms Packagist typo3/cms-core |
Persistent XSS in newsletter module in Shopware GHSA-hrfh-fp4x-crrq | Low | Not scored | 13 Nov, 2020 | Packagist shopware/shopware |
Persistent XSS in shopping worlds GHSA-28fw-88hq-6jmm | Low | Not scored | 13 Nov, 2020 | Packagist shopware/shopware |
Persistent XSS in customer module in Shopware GHSA-6gv9-7q4g-pmvm | Low | Not scored | 13 Nov, 2020 | Packagist shopware/shopware |
Magento information disclosure vulnerability BIT-magento-2020-24406, CVE-2020-24406, GHSA-mr8q-7f5j-wc79 | Low | 2.1% | 09 Nov, 2020 | Packagist magento/community-edition |
Magento 2 Community Edition vulnerable to Improper Authorization BIT-magento-2020-24404, CVE-2020-24404, GHSA-rwf7-652f-76mv | Low | 1.9% | 09 Nov, 2020 | Packagist magento/community-edition |
Magento incorrect user permissions vulnerability within the Inventory component BIT-magento-2020-24403, CVE-2020-24403, GHSA-39rw-4m66-82gf | Low | 1.6% | 09 Nov, 2020 | Packagist magento/community-edition Packagist magento/project-community-edition |
CLI does not correctly implement strict mode GHSA-2xwp-m7mq-7q3r | Low | Not scored | 28 Oct, 2020 | PyPI aws-encryption-sdk-cli |