Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Jupyter Notebook XSS via untrusted notebooks CVE-2018-19351, GHSA-49qr-xh3w-h436, PYSEC-2018-17 | Medium | 1.5% | 18 Nov, 2018 | PyPI notebook |
Jupyter Notebook XSS via directory name CVE-2018-19352, GHSA-3p4q-x8f3-p7vq, PYSEC-2018-18 | Medium | 1.3% | 18 Nov, 2018 | PyPI notebook |
Centreon XSS Vulnerability CVE-2018-19311, GHSA-8vh5-j6xj-5953 | Medium | 1.2% | 16 Nov, 2018 | Packagist centreon/centreon |
Valine HTML Injection CVE-2018-19289, GHSA-hhrp-qm88-xjr3 | Medium | 1.2% | 15 Nov, 2018 | npm valine |
Centreon XSS Vulnerability CVE-2018-19280, GHSA-7g3c-hrc6-5v4j | Medium | 0.9% | 14 Nov, 2018 | Packagist centreon/centreon |
Ckeditor XSS Vulnerability CVE-2018-17960, GHSA-g68x-vvqq-pvw3 | Medium | 1.9% | 14 Nov, 2018 | Packagist typo3/cms Packagist typo3/cms-core npm ckeditor |
Rack vulnerable to Cross-site Scripting CVE-2018-16471, GHSA-5r2p-j47h-mhpg | Medium | 1.9% | 13 Nov, 2018 | RubyGems rack |
Flarum Core Leaks PII CVE-2018-19133, GHSA-p6m5-x83r-hqmr | Medium | 1.2% | 09 Nov, 2018 | Packagist flarum/framework |
SimpleMDE XSS Vulnerability CVE-2018-19057, GHSA-wg85-p6j7-gp3w | Medium | 0.8% | 07 Nov, 2018 | npm simplemde |
Pandao editor.md vulnerable to DOM XSS CVE-2018-19056, GHSA-x3g3-334f-q6h4 | Medium | 0.8% | 07 Nov, 2018 | npm editor.md |
Stored Cross-Site Scripting in tianma-static CVE-2018-16474, GHSA-jhgp-hvj6-x2p2 | Medium | 0.8% | 06 Nov, 2018 | npm tianma-static |
Path Traversal in takeapeek CVE-2018-16473, GHSA-23xp-j737-282v | Medium | 1.4% | 06 Nov, 2018 | npm takeapeek |
XSS in baserCMS before 4.1.4 CVE-2018-18943, GHSA-fx2m-5m9v-jhgp | Medium | 0.7% | 05 Nov, 2018 | Packagist baserproject/basercms |
Loofah Cross-site Scripting vulnerability CVE-2018-16468, GHSA-g4xq-jx4w-4cjv | Medium | 0.9% | 30 Oct, 2018 | RubyGems loofah |
MantisBT allows XSS via Edit Filter page CVE-2018-17783, GHSA-gcqw-45xq-xc63 | Medium | 0.7% | 30 Oct, 2018 | Packagist mantisbt/mantisbt |
MantisBT allows XSS via the Manage Filter page CVE-2018-17782, GHSA-ggjm-7m5f-7xjv | Medium | 0.7% | 30 Oct, 2018 | Packagist mantisbt/mantisbt |
SaltStack Salt Directory Traversal vulnerability in salt-api CVE-2018-15750, GHSA-jx34-pppm-gjvr, PYSEC-2018-29 | Medium | 4.4% | 24 Oct, 2018 | PyPI salt |
Ajenti Cross-site Scripting Via Filename CVE-2018-18548, GHSA-5pcv-m8w2-62m9, PYSEC-2018-107 | Medium | 3.6% | 24 Oct, 2018 | PyPI ajenti |
LibreNMS XSS Vulnerability CVE-2018-18478, GHSA-9m82-f3wx-p625 | Medium | 1.6% | 18 Oct, 2018 | Packagist librenms/librenms |
Withdrawn Advisory: AlchemyCMS is vulnerable to stored XSS via the /admin/pictures image field CVE-2018-18307, GHSA-7mj4-2984-955f | Medium | 1.7% | 16 Oct, 2018 | RubyGems alchemy_cms |
Camaleon CMS vulnerable to Stored Cross-site Scripting CVE-2018-18260, GHSA-7f84-9cqf-g4j9 | Medium | 1.0% | 15 Oct, 2018 | RubyGems camaleon_cms |
Moderate severity vulnerability that affects moin CVE-2017-5934, GHSA-42fp-4hm3-j8r7, PYSEC-2018-47 | Medium | 1.9% | 15 Oct, 2018 | PyPI moin |
Next.js has cross site scripting (XSS) vulnerability via the 404 or 500 /_error page CVE-2018-18282, GHSA-qw96-mm2g-c8m7 | Medium | 1.0% | 12 Oct, 2018 | npm next |
Gitea Exposes Private Email Addresses CVE-2018-1000803, GHSA-f5fj-7265-jxhj, GO-2022-0823 | Medium | 1.4% | 08 Oct, 2018 | Go github.com/go-gitea/gitea |
Mediawiki tarball is missing .htaccess files CVE-2018-13258, GHSA-2c28-7gwv-cpgf | Medium | 2.3% | 04 Oct, 2018 | Packagist mediawiki/core |
Mediawiki BotPassword can bypass CentralAuth's account lock CVE-2018-0505, GHSA-5c6w-f4w2-2grp | Medium | 2.0% | 04 Oct, 2018 | Packagist mediawiki/core |
Mediawiki information disclosure vulnerability CVE-2018-0504, GHSA-hr8v-f4g2-p66f | Medium | 2.9% | 04 Oct, 2018 | Packagist mediawiki/core |
Mediawiki Improper Privilege Management CVE-2018-0503, GHSA-mhfv-9h99-jwg7 | Medium | 1.6% | 04 Oct, 2018 | Packagist mediawiki/core |
Coaster CMS Stored Cross-site Scripting vulnerability CVE-2018-17876, GHSA-77cq-wgpf-g449 | Medium | 1.0% | 04 Oct, 2018 | Packagist web-feet/coastercms |
Subrion CMS Stored Cross-site Scripting (XSS) CVE-2018-15563, GHSA-6wc4-v4v5-3m82 | Medium | 0.7% | 02 Oct, 2018 | Packagist intelliants/subrion |
Django allows unprivileged users to read the password hashes of arbitrary accounts CVE-2018-16984, GHSA-6mx3-3vqg-hpp2, PYSEC-2018-3 | Medium | 2.1% | 02 Oct, 2018 | PyPI django |
Cross-site Scripting in yapi-vendor CVE-2018-17574, GHSA-5xgh-643p-cp2g | Medium | 0.7% | 28 Sep, 2018 | npm yapi-vendor |
Wallabag cross-site scripting (XSS) vulnerability CVE-2018-11352, GHSA-gvcw-x64m-pfcj | Medium | 0.7% | 21 Sep, 2018 | Packagist wallabag/wallabag |
In marshmallow library the schema "only" option treats an empty list as implying no "only" option CVE-2018-17175, GHSA-9q2p-fj49-vpxj, PYSEC-2018-67 | Medium | 1.9% | 18 Sep, 2018 | PyPI marshmallow |
Moodle Cross-site Scripting CVE-2018-14631, GHSA-gqrp-qhv8-phrv | Medium | 2.1% | 17 Sep, 2018 | Packagist moodle/moodle |
Gogs XSS Vulnerability CVE-2018-17031, GHSA-px5r-fqj6-r2f8, GO-2023-1972 | Medium | 0.9% | 14 Sep, 2018 | Go gogs.io/gogs |
Open Chinese Convert subject to Denial of Service via Out-of-bounds Read CVE-2018-16982, GHSA-9qh2-6fxg-9m4g | Medium | 1.1% | 13 Sep, 2018 | npm opencc |
Smarty Path Traversal Vulnerability CVE-2018-16831, GHSA-65j5-vpm7-6xp4 | Medium | 2.7% | 11 Sep, 2018 | Packagist smarty/smarty |
Openstack Neutron vulnerable to eavesdropping on private traffic CVE-2018-14636, GHSA-8q95-jj7p-x93x, PYSEC-2018-94 | Medium | 1.2% | 10 Sep, 2018 | PyPI neutron |
Gleez CMS Vulnerability Allows Forced Browsing to Profile Page of Other Users CVE-2018-16704, GHSA-hh92-wg7v-8vfr | Medium | 0.8% | 07 Sep, 2018 | Packagist gleez/cms |
Cross-Site Scripting in exceljs CVE-2018-16459, GHSA-2j2j-8rrv-264g | Medium | 0.8% | 06 Sep, 2018 | npm exceljs |
Stored XSS in LavaLite 5.5 CVE-2018-16551, GHSA-pxxp-283v-xpq5 | Medium | 0.7% | 05 Sep, 2018 | Packagist lavalite/cms |
ReDoS via long string of semicolons in tough-cookie CVE-2016-1000232, GHSA-qhv9-728r-6jqg | Medium | 2.4% | 05 Sep, 2018 | npm tough-cookie |
Flask-Admin Cross-site Scripting vulnerability CVE-2018-16516, GHSA-894g-6j7q-2hx6, PYSEC-2018-54 | Medium | 1.2% | 05 Sep, 2018 | PyPI flask-admin |
mayan-edms Cross-site Scripting vulnerability CVE-2018-16405, GHSA-fpcv-j2q9-vqhw, PYSEC-2018-106, PYSEC-2018-16 | Medium | 1.3% | 03 Sep, 2018 | PyPI mayan-edms PyPI mayan-edms-ng |
Moderate severity vulnerability that affects mayan-edms CVE-2018-16406, GHSA-5r76-cjf4-c9qx, PYSEC-2018-14 | Medium | 1.3% | 03 Sep, 2018 | PyPI mayan-edms |
Moderate severity vulnerability that affects mayan-edms CVE-2018-16407, GHSA-5h6m-9mvx-m6c5, PYSEC-2018-15 | Medium | 1.2% | 03 Sep, 2018 | PyPI mayan-edms |
Gleez CMS Vulnerable to Cross-site Scripting in media/imagecache/resize CVE-2018-16347, GHSA-5qqx-32hw-5vx4 | Medium | 0.8% | 02 Sep, 2018 | Packagist gleez/cms |
Showdoc XSS Vulnerability CVE-2018-16342, GHSA-2263-jwgm-wv97 | Medium | 0.6% | 02 Sep, 2018 | Packagist showdoc/showdoc |
Pandao editor.md vulnerable to XSS in IMG attributes CVE-2018-16330, GHSA-vjcj-5g2r-vxqc | Medium | 0.9% | 02 Sep, 2018 | npm editor.md |