Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Improper Access Control in Onionshare CVE-2022-21695, GHSA-99p8-9p2c-49j4, PYSEC-2022-46 | Medium | 0.9% | 18 Jan, 2022 | PyPI onionshare-cli |
Username spoofing in OnionShare CVE-2022-21696, GHSA-68vr-8f46-vc9f, PYSEC-2022-47 | Medium | 0.7% | 18 Jan, 2022 | PyPI onionshare-cli |
Comment reply notifications sent to incorrect users CVE-2022-21683, GHSA-xqxm-2rpm-3889, PYSEC-2022-13 | Medium | 1.0% | 18 Jan, 2022 | PyPI wagtail |
Cross-site Scripting in pimcore CVE-2022-0262, GHSA-4f5x-q4jc-xfcf | Medium | 1.5% | 18 Jan, 2022 | Packagist pimcore/pimcore |
Business Logic Errors in pimcore CVE-2021-4146, GHSA-54hw-mhgh-x4vc | Medium | 0.8% | 18 Jan, 2022 | Packagist pimcore/pimcore |
Cross-site Scripting in pimcore CVE-2022-0260, GHSA-455w-gv5p-wgg3 | Medium | 0.7% | 18 Jan, 2022 | Packagist pimcore/pimcore |
Cross-site Scripting in Ericsson CodeChecker CVE-2021-44217, GHSA-fxmx-pfm2-85m2, PYSEC-2022-43181, PYSEC-2026-625 | Medium | 1.6% | 18 Jan, 2022 | PyPI codechecker |
Cross-Site Request Forgery (CSRF) in livehelperchat/livehelperchat CVE-2022-0245, GHSA-vxh4-x6gv-mphf | Medium | 0.4% | 18 Jan, 2022 | Packagist livehelperchat/livehelperchat |
Cross-site Scripting in epubjs CVE-2021-33040, GHSA-c6rp-xvqv-mwmf | Medium | 0.9% | 17 Jan, 2022 | npm epubjs |
pimcore is vulnerable to Cross-site Scripting CVE-2022-0257, GHSA-v567-q267-phpg | Medium | 1.5% | 17 Jan, 2022 | Packagist pimcore/pimcore |
pimcore is vulnerable to Cross-site Scripting CVE-2022-0256, GHSA-57hg-26h7-9qgv | Medium | 0.6% | 17 Jan, 2022 | Packagist pimcore/pimcore |
livehelperchat is vulnerable to Cross-site Scripting CVE-2022-0253, GHSA-5r9v-8w62-r26j | Medium | 0.8% | 17 Jan, 2022 | Packagist remdex/livehelperchat |
icecoder is vulnerable to Cross-site Scripting CVE-2021-3862, GHSA-73q9-7pwj-gm46 | Medium | 0.7% | 17 Jan, 2022 | Packagist icecoder/icecoder |
calibre-web is vulnerable to Cross-site Scripting CVE-2021-4170, GHSA-wrp6-9w7f-3wxg, PYSEC-2026-620 | Medium | 0.8% | 16 Jan, 2022 | PyPI calibreweb |
Improper Privilege Management in shelljs GHSA-64g7-mvw6-v9qj | Medium | Not scored | 14 Jan, 2022 | npm shelljs |
Exposure of Sensitive Information to an Unauthorized Actor in nanoid CVE-2021-23566, GHSA-qrpm-p2h7-hrv2 | Medium | 0.4% | 14 Jan, 2022 | npm nanoid |
Cross-Site Request Forgery (CSRF) in livehelperchat BIT-livehelperchat-2022-0226, CVE-2022-0226, GHSA-6jmh-9gqm-5xrx | Medium | 0.4% | 14 Jan, 2022 | Packagist remdex/livehelperchat |
Cross-Site Request Forgery (CSRF) in livehelperchat BIT-livehelperchat-2022-0231, CVE-2022-0231, GHSA-8m28-w6xg-35hw | Medium | 0.5% | 14 Jan, 2022 | Packagist remdex/livehelperchat |
Improper Access Control in snipe-it CVE-2022-0178, GHSA-xc47-3rch-cv57 | Medium | 0.6% | 13 Jan, 2022 | Packagist snipe/snipe-it |
Zabbix Frontend Improper Access Control Vulnerability CVE-2022-23134 | MediumExploited | 95.3% | 13 Jan, 2022 | |
GovernorCompatibilityBravo incorrect ABI encoding may lead to unexpected behavior GHSA-m6w8-fq7v-ph4m | Medium | Not scored | 13 Jan, 2022 | npm @openzeppelin/contracts npm @openzeppelin/contracts-upgradeable |
XSS vulnerability in translations GHSA-rrgw-3hg3-9x8c | Medium | Not scored | 12 Jan, 2022 | Packagist oro/platform |
Cross-site Scripting in django-cms CVE-2021-44649, GHSA-hx7c-qpfq-xcrp, PYSEC-2022-7 | Medium | 0.6% | 12 Jan, 2022 | PyPI django-cms |
Incorrect Default Permissions and Improper Access Control in snipe-it CVE-2022-0179, GHSA-w3v3-cxq5-9vr4 | Medium | 0.7% | 12 Jan, 2022 | Packagist snipe/snipe-it |
Potential exposure of tokens to an Unauthorized Actor CVE-2022-21671, GHSA-7w54-gp8x-f33m | Medium | 1.0% | 11 Jan, 2022 | npm @replit/crosis |
Uncontrolled Resource Consumption in markdown-it CVE-2022-21670, GHSA-6vfc-qv3f-vr6c | Medium | 2.4% | 10 Jan, 2022 | npm markdown-it |
Logic error in dolibarr BIT-dolibarr-2022-0174, CVE-2022-0174, GHSA-8qvx-f5gf-g43v | Medium | 1.0% | 10 Jan, 2022 | Packagist dolibarr/dolibarr |
Path Traversal in nemo-toolkit CVE-2022-22821, GHSA-9hg3-hmmf-c3gr, GHSA-rpx7-33j2-xx9x, PYSEC-2026-685 | Medium | 0.3% | 10 Jan, 2022 | PyPI nemo-toolkit |
Improper Initialization in Pillow BIT-pillow-2022-22815, CVE-2022-22815, GHSA-pw3c-h7wp-cvhx, PYSEC-2022-8 | Medium | 2.8% | 10 Jan, 2022 | PyPI Pillow PyPI pillow |
Out-of-bounds Read in Pillow BIT-pillow-2022-22816, CVE-2022-22816, GHSA-xrcv-f9gm-v42c, PYSEC-2022-9 | Medium | 2.1% | 10 Jan, 2022 | PyPI Pillow PyPI pillow |
SolarWinds Serv-U Improper Input Validation Vulnerability CVE-2021-35247 | MediumExploited | 3.6% | 10 Jan, 2022 | |
Exposure of Sensitive Information to an Unauthorized Actor and Origin Validation Error in podman CVE-2021-4024, GHSA-3cf2-x423-x582, GO-2022-0281 | Medium | 1.1% | 06 Jan, 2022 | Go github.com/containers/podman Go github.com/containers/podman/v2 Go github.com/containers/podman/v3 |
CSRF forgery protection bypass in solidus_frontend CVE-2021-43846, GHSA-h3fg-h5v3-vf8m | Medium | 0.6% | 06 Jan, 2022 | RubyGems solidus_frontend |
bookstack is vulnerable to Improper Access Control CVE-2021-4194, GHSA-ghhm-xrwp-75m9 | Medium | 0.7% | 06 Jan, 2022 | Packagist ssddanbrown/bookstack |
Open Redirect in node-forge CVE-2022-0122, GHSA-8fr3-hfg3-gpgp | Medium | 0.9% | 06 Jan, 2022 | npm node-forge |
Cross-site Scripting in Scratch-Svg-Renderer CVE-2020-27428, GHSA-h3vq-wv8j-36gw | Medium | 0.7% | 06 Jan, 2022 | npm scratch-svg-renderer |
Open redirect in shopware CVE-2022-21651, GHSA-c53v-qmrx-93hg | Medium | 0.8% | 05 Jan, 2022 | Packagist shopware/shopware |
Cross-site Scripting in DayByDay CRM CVE-2022-22109, GHSA-jr37-66pj-36v7 | Medium | 0.5% | 05 Jan, 2022 | Packagist bottelet/flarepoint |
Missing Authorization in DayByDay CRM CVE-2022-22108, GHSA-frxp-xxx8-hrg6 | Medium | 0.7% | 05 Jan, 2022 | Packagist bottelet/flarepoint |
Missing Authorization in DayByDay CRM CVE-2022-22107, GHSA-44gv-fgcj-w546 | Medium | 0.7% | 05 Jan, 2022 | Packagist bottelet/flarepoint |
Directory-traversal in Django BIT-django-2021-45452, CVE-2021-45452, GHSA-jrh2-hc4r-7jwx, PYSEC-2022-3 | Medium | 2.6% | 05 Jan, 2022 | PyPI Django PyPI django |
XSS vulnerability on email template preview page CVE-2021-41236, GHSA-qv7g-j98v-8pp7 | Medium | 0.7% | 04 Jan, 2022 | Packagist oro/platform |
User enumeration in livehelperchat BIT-livehelperchat-2022-0083, CVE-2022-0083, GHSA-4xww-6h7v-29jg | Medium | 0.9% | 04 Jan, 2022 | Packagist remdex/livehelperchat |
showdoc is vulnerable to Generation of Error Message Containing Sensitive Information CVE-2022-0079, GHSA-5mj6-3cmq-fh34 | Medium | 1.0% | 03 Jan, 2022 | Packagist showdoc/showdoc |
Cross site scripting in dolibarr BIT-dolibarr-2022-22293, CVE-2022-22293, GHSA-g5jm-xhwm-9xp9 | Medium | 0.8% | 02 Jan, 2022 | Packagist dolibarr/dolibarr |
GDAL 3.3.0 through 3.4.0 has a heap-based buffer overflow in PCIDSK::CPCIDSKFile::ReadFromFile (called from PCIDSK::CPCIDSKSegment::ReadFromFile and PCIDSK::CPCIDSKBinarySegment::CPCIDSKBinarySegment). BIT-gdal-2021-45943, CVE-2021-45943, PYSEC-2022-43065 | Medium | 1.5% | 01 Jan, 2022 | PyPI gdal |
UltraJSON vulnerable to Out-of-bounds Write CVE-2021-45958, GHSA-fh56-85cw-5pq6, PYSEC-2022-25 | Medium | 1.7% | 01 Jan, 2022 | PyPI ujson |
jquery.terminal self XSS on user input CVE-2021-43862, GHSA-x9r5-jxvq-4387 | Medium | 1.1% | 30 Dec, 2021 | npm jquery.terminal |
Cross-site Scripting in Netgen Tags Bundle CVE-2021-45895, GHSA-xvvv-wj7j-r9jm | Medium | 0.7% | 27 Dec, 2021 | Packagist netgen/tagsbundle |
archivy is vulnerable to Cross-Site Request Forgery (CSRF) CVE-2021-4162, GHSA-9236-8w7q-rmrv, PYSEC-2021-869 | Medium | 0.4% | 25 Dec, 2021 | PyPI archivy |