Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
PHAR deserialization allowing remote code execution CVE-2023-28115, GHSA-gq6w-q6wh-jggc | Critical | 2.8% | 17 Mar, 2023 | Packagist knplabs/knp-snappy |
D-Link DIR-820 Router OS Command Injection Vulnerability CVE-2023-25280 | CriticalExploited | 97.9% | 16 Mar, 2023 | |
Array Networks AG and vxAG ArrayOS Missing Authentication for Critical Function Vulnerability CVE-2023-28461 | CriticalExploited | 68.1% | 15 Mar, 2023 | |
Microsoft Office Outlook Privilege Escalation Vulnerability CVE-2023-23397 | CriticalExploited | 97.2% | 14 Mar, 2023 | |
sqlite vulnerable to code execution due to Object coercion CVE-2022-43441, GHSA-jqv5-7xpx-qj74 | Critical | 2.4% | 13 Mar, 2023 | npm sqlite3 |
Cross-realm object access in Webpack 5 CVE-2023-28154, GHSA-hc6q-2mpp-qw7j | Critical | 1.4% | 13 Mar, 2023 | npm webpack |
stoqey/gnuplot is vulnerable to command injection CVE-2021-33360, GHSA-795w-7426-m94j | Critical | 1.1% | 10 Mar, 2023 | npm @stoqey/gnuplot |
Funadmin vulnerable to SQL injection CVE-2023-24774, GHSA-jx2x-fg9p-7gc7 | Critical | 0.9% | 10 Mar, 2023 | Packagist funadmin/funadmin |
Froxlor is vulnerable to authentication bypass CVE-2023-1307, GHSA-j83x-r9qq-9g4v | Critical | 1.1% | 10 Mar, 2023 | Packagist froxlor/froxlor |
node-bluetooth is vulnerable to Buffer Overflow via the findSerialPortChannel method due to improper user input length validation CVE-2023-26110, GHSA-cxx3-36qc-m6qm | Critical | 0.9% | 09 Mar, 2023 | npm node-bluetooth |
node-bluetooth-serial-port is vulnerable to Buffer Overflow via the findSerialPortChannel CVE-2023-26109, GHSA-9jh3-4pc9-hq29 | Critical | 0.7% | 09 Mar, 2023 | npm node-bluetooth-serial-port |
SQL Injection in Funadmin CVE-2023-24777, GHSA-pvp6-53r9-8vxh | Critical | 0.7% | 08 Mar, 2023 | Packagist funadmin/funadmin |
builderio/qwik is vulnerable to code injection CVE-2023-1283, GHSA-9wf9-qvvp-2929 | Critical | 1.1% | 08 Mar, 2023 | npm @builder.io/qwik |
SQL Injection in Funadmin CVE-2023-24782, GHSA-qhq8-2f3m-gxvp | Critical | 0.7% | 08 Mar, 2023 | Packagist funadmin/funadmin |
SQL Injection in Funadmin CVE-2023-24773, GHSA-m8wf-wmwh-jw2m | Critical | 0.7% | 08 Mar, 2023 | Packagist funadmin/funadmin |
Easy!Appointments uses hard-coded credentials CVE-2023-1269, GHSA-347f-rxg8-qgrv | Critical | 0.7% | 08 Mar, 2023 | Packagist alextselegidis/easyappointments |
SQL Injection in Funadmin CVE-2023-24780, GHSA-7pmh-8qjj-4q36 | Critical | 0.8% | 08 Mar, 2023 | Packagist funadmin/funadmin |
SQL Injection in Funadmin CVE-2023-24775, GHSA-v43v-pv95-jc55 | Critical | 19.8% | 07 Mar, 2023 | Packagist funadmin/funadmin |
SQL Injection in Funadmin CVE-2023-24781, GHSA-vhrv-9f9g-rfrx | Critical | 0.7% | 07 Mar, 2023 | Packagist funadmin/funadmin |
Moodle Session Fixation vulnerability BIT-moodle-2021-36394, CVE-2021-36394, GHSA-2563-fp9c-mgm8 | Critical | 7.0% | 06 Mar, 2023 | Packagist moodle/moodle |
Moodle SQL Injection vulnerability BIT-moodle-2021-36393, CVE-2021-36393, GHSA-f46j-r7q3-6cm2 | Critical | 52.3% | 06 Mar, 2023 | Packagist moodle/moodle |
Moodle SQL Injection vulnerability BIT-moodle-2021-36392, CVE-2021-36392, GHSA-qc86-vgf2-6fq6 | Critical | 0.8% | 06 Mar, 2023 | Packagist moodle/moodle |
Remote code execution in Funadmin CVE-2023-24776, GHSA-7g53-jj25-jhgr | Critical | 1.4% | 06 Mar, 2023 | Packagist funadmin/funadmin |
json-logic-js Command Injection vulnerability CVE-2021-4329, GHSA-67j4-2mh6-8627 | Critical | 2.2% | 05 Mar, 2023 | npm json-logic-js |
Apache Airflow Hive Provider Improper Input Validation vulnerability CVE-2023-25696, GHSA-9mwf-mw74-9cv5, PYSEC-2026-272 | Critical | 2.0% | 24 Feb, 2023 | PyPI apache-airflow-providers-apache-hive |
Apache Airflow Sqoop Provider Improper Input Validation vulnerability CVE-2023-25693, GHSA-j69x-v4wc-3fpf, PYSEC-2023-314, PYSEC-2026-275 | Critical | 1.9% | 24 Feb, 2023 | PyPI apache-airflow PyPI apache-airflow-providers-apache-sqoop |
Apache Airflow Google Provider Improper Input Validation vulnerability CVE-2023-25691, GHSA-8g23-2q5p-8866, PYSEC-2026-277 | Critical | 1.6% | 24 Feb, 2023 | PyPI apache-airflow-providers-google |
Update share links to use FRP instead of SSH tunneling CVE-2023-25823, GHSA-3x5j-9vwr-8rr5, PYSEC-2023-16 | Critical | 0.6% | 23 Feb, 2023 | PyPI gradio |
Sequelize vulnerable to SQL Injection via replacements CVE-2023-25813, GHSA-wrh9-cjv3-2hpw | Critical | 1.4% | 22 Feb, 2023 | npm sequelize |
Nautobot vulnerable to remote code execution via Jinja2 template rendering CVE-2023-25657, GHSA-8mfq-f5wj-vw5m, PYSEC-2023-37 | Critical | 1.5% | 21 Feb, 2023 | PyPI nautobot |
Erxes vulnerable to Cross-site Scripting CVE-2021-32853, GHSA-g9ph-r9hc-34r8 | Critical | 3.1% | 20 Feb, 2023 | npm erxes |
Versionn Command Injection Vulnerability CVE-2023-25805, GHSA-fj78-2vc5-f6cm | Critical | 1.6% | 20 Feb, 2023 | npm versionn |
Buffer Overflow vulnerability in Saltstack v.3003 and before allows attacker to execute arbitrary code via the func variable in salt/salt/modules/status.py file. CVE-2021-33226, PYSEC-2023-47 | Critical | 1.6% | 17 Feb, 2023 | PyPI salt |
IBM Aspera Faspex Code Execution Vulnerability CVE-2022-47986 | CriticalExploited | 100.0% | 17 Feb, 2023 | |
Unsafe fall-through in getWhereConditions CVE-2023-22579, GHSA-vqfx-gj96-3w95 | Critical | 0.8% | 16 Feb, 2023 | npm @sequelize/core npm sequelize |
Sequelize - Default support for “raw attributes” when using parentheses CVE-2023-22578, GHSA-f598-mfpv-gmfx | Critical | 0.8% | 16 Feb, 2023 | npm @sequelize/core npm sequelize |
Cross-site Scripting in kimai/kimai CVE-2020-19825, GHSA-r58m-v5pr-jhhq | Critical | 0.7% | 15 Feb, 2023 | Packagist kimai/kimai |
No protection against brute-force attacks on login page CVE-2023-25156, GHSA-7968-h4m4-ghm9, PYSEC-2026-835 | Critical | 0.9% | 15 Feb, 2023 | PyPI kiwitcms |
Multiple Ruckus Wireless Products CSRF and RCE Vulnerability CVE-2023-25717 | CriticalExploited | 98.1% | 13 Feb, 2023 | |
Command Injection in thorsten/phpmyfaq CVE-2023-0789, GHSA-6vp5-vv9p-7q62 | Critical | 1.7% | 12 Feb, 2023 | Packagist thorsten/phpmyfaq |
Code Injection in thorsten/phpmyfaq CVE-2023-0788, GHSA-r6cw-356h-mvwg | Critical | 0.9% | 12 Feb, 2023 | Packagist thorsten/phpmyfaq |
Authentication Bypass in modoboa CVE-2023-0777, GHSA-rfhw-fm4m-52j6, PYSEC-2023-32 | Critical | 15.2% | 10 Feb, 2023 | PyPI modoboa |
SQL injection in webbuilders-group silverstripe-kapost-bridge CVE-2015-10077, GHSA-32gr-x76g-267w | Critical | 0.7% | 10 Feb, 2023 | Packagist webbuilders-group/silverstripe-kapost-bridge |
Deserialization of Untrusted Data in thinkphp CVE-2022-45982, GHSA-j2h2-g882-x9j2 | Critical | 1.2% | 08 Feb, 2023 | Packagist topthink/think |
URI validation failure on SVG parsing. Bypass of CVE-2023-23924 CVE-2023-24813, GHSA-56gj-mvh6-rp75 | Critical | 2.5% | 07 Feb, 2023 | Packagist dompdf/dompdf |
tinymighty WikiSEO is vulnerable to cross-site scripting via modifyHTML function CVE-2015-10073, GHSA-84mm-prjg-49xm | Critical | 0.9% | 06 Feb, 2023 | Packagist tinymighty/wiki-seo |
Header injection in TurboGears CVE-2019-25101, GHSA-8q38-w56m-qq2c, PYSEC-2026-556 | Critical | 0.9% | 04 Feb, 2023 | PyPI TurboGears PyPI turbogears |
AVideo contains Command injection when embedding a video link CVE-2023-25313, GHSA-pgvh-p3g4-86jw | Critical | 1.3% | 02 Feb, 2023 | Packagist wwbn/avideo |
Dompdf vulnerable to URI validation failure on SVG parsing CVE-2023-23924, GHSA-3cw5-7cxw-v5qg | Critical | 3.6% | 01 Feb, 2023 | Packagist dompdf/dompdf |
nemo-appium vulnerable to OS Command Injection CVE-2022-21129, GHSA-c6rx-gxqv-vr5j | Critical | 2.8% | 31 Jan, 2023 | npm nemo-appium |