Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Command injection in vagrant.js CVE-2022-25962, GHSA-54jw-jqr9-6cj9 | Critical | 1.0% | 26 Jan, 2023 | npm vagrant.js |
Command Injection in create-choo-electron CVE-2022-25908, GHSA-j8wr-fwf2-vvr9 | Critical | 1.5% | 26 Jan, 2023 | npm create-choo-electron |
Remote code execution in simple-git CVE-2022-25860, GHSA-9w5j-4mwv-2wj8 | Critical | 2.7% | 26 Jan, 2023 | npm simple-git |
phpmyadmin contains SQL Injection vulnerability BIT-phpmyadmin-2020-22452, CVE-2020-22452, GHSA-prcg-mc23-hgjh | Critical | 1.7% | 26 Jan, 2023 | Packagist phpmyadmin/phpmyadmin |
Excessive Attack Surface in pyload-ng CVE-2023-0435, GHSA-6jmx-pv77-wm5w, PYSEC-2026-494 | Critical | 0.7% | 22 Jan, 2023 | PyPI pyload-ng |
Command Injection in Apache Airflow and Apache Airflow MySQL Provider BIT-airflow-2023-22884, CVE-2023-22884, GHSA-c732-xvv8-g94c, PYSEC-2026-268, PYSEC-2026-279 | Critical | 11.1% | 21 Jan, 2023 | PyPI apache-airflow PyPI apache-airflow-providers-mysql |
electerm allows unauthorized users to execute arbitrary commands CVE-2020-23256, GHSA-x73w-g8hx-v7rp | Critical | 0.9% | 20 Jan, 2023 | npm electerm |
XpressEngine vulnerable to Unrestricted Upload of File with Dangerous Type CVE-2021-26642, GHSA-8r5j-22j5-w4cm | Critical | 1.2% | 20 Jan, 2023 | Packagist xpressengine/xpressengine |
Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability CVE-2022-47966 | CriticalExploited | 99.8% | 18 Jan, 2023 | |
Shopware has Insufficient Session Expiration in Administration CVE-2023-22732, GHSA-59qg-93jg-236f | Critical | 0.8% | 17 Jan, 2023 | Packagist shopware/core Packagist shopware/platform |
Shopware vulnerable to Improper Control of Generation of Code in Twig rendered views CVE-2023-22731, GHSA-93cw-f5jj-x85w | Critical | 1.4% | 17 Jan, 2023 | Packagist shopware/core Packagist shopware/platform |
CakePHP Database\\Query::offset() and limit() methods are vulnerable to SQL injection CVE-2023-22727, GHSA-6g8q-qfpv-57wp | Critical | 0.9% | 17 Jan, 2023 | Packagist cakephp/cakephp Packagist cakephp/database |
SQL Injection in liftkit/database CVE-2016-15020, GHSA-8hcf-2m4v-f2rq | Critical | 0.7% | 16 Jan, 2023 | Packagist liftkit/database |
phpMyFAQ Improper Authentication vulnerability CVE-2023-0311, GHSA-g92r-9rxw-cmgx | Critical | 1.0% | 15 Jan, 2023 | Packagist thorsten/phpmyfaq |
phpMyFAQ has Weak Password Requirements CVE-2023-0307, GHSA-4p88-cfhq-f3vg | Critical | 0.7% | 15 Jan, 2023 | Packagist thorsten/phpmyfaq |
Code Injection in pyload-ng CVE-2023-0297, GHSA-pf38-5p22-x6h6, PYSEC-2026-498 | Critical | 95.9% | 14 Jan, 2023 | PyPI pyload-ng |
global-modules-path Command Injection vulnerability CVE-2022-21191, GHSA-vvj3-85vf-fgmw | Critical | 1.5% | 13 Jan, 2023 | npm global-modules-path |
wifey vulnerable to Command Injection due to improper input sanitization CVE-2022-25890, GHSA-xj9v-6q2f-vqhx | Critical | 1.3% | 09 Jan, 2023 | npm wifey |
WebPA SQL Injection vulnerability CVE-2021-4308, GHSA-mjgw-f2c4-f8qj | Critical | 0.7% | 08 Jan, 2023 | Packagist webpa/webpa |
PaginationServiceProvider SQL Injection vulnerability CVE-2014-125029, GHSA-ww43-mcvh-35p4 | Critical | 0.9% | 07 Jan, 2023 | Packagist ttskch/pagination-service-provider |
Baobab vulnerable to Prototype Pollution CVE-2021-4307, GHSA-wvr2-q86m-6whp | Critical | 1.3% | 07 Jan, 2023 | npm baobab |
kelvinmo simplexrd vulnerable to Improper Restriction of XML External Entity Reference CVE-2015-10029, GHSA-rh3m-pr36-xh2f | Critical | 0.8% | 07 Jan, 2023 | Packagist kelvinmo/simplexrd |
himiklab yii2-jqgrid-widget vulnerable to SQL Injection CVE-2014-125051, GHSA-7mg5-rw39-q67f | Critical | 0.7% | 06 Jan, 2023 | Packagist himiklab/yii2-jqgrid-widget |
DBRisinajumi d2files SQL Injection vulnerability CVE-2015-10018, GHSA-68hv-8926-j34c | Critical | 0.7% | 06 Jan, 2023 | Packagist dbrisinajumi/d2files |
nodebatis SQL Injection vulnerability CVE-2018-25066, GHSA-8ph8-9q2j-c3rq | Critical | 0.7% | 06 Jan, 2023 | npm nodebatis |
exec-local-bin vulnerable to Command Injection CVE-2022-25923, GHSA-f259-h6m8-hm8m | Critical | 2.6% | 06 Jan, 2023 | npm exec-local-bin |
CWP Control Web Panel OS Command Injection Vulnerability CVE-2022-44877 | CriticalExploited | 100.0% | 05 Jan, 2023 | |
Improper validation of script alert plugin parameters in Apache DolphinScheduler to avoid remote command execution vulnerability. This issue affects Apache DolphinScheduler version 3.0.1 and prior versions; version 3.1.0 and prior versions. CVE-2022-45875, GHSA-3xh5-8hvq-rc8x, PYSEC-2023-4 | Critical | 2.7% | 04 Jan, 2023 | PyPI apache-dolphinscheduler |
nterchange Code Injection vulnerability CVE-2015-10009, GHSA-cp2p-6xh4-jmcp | Critical | 0.9% | 02 Jan, 2023 | Packagist nonfiction/nterchange |
Fortinet FortiOS Heap-Based Buffer Overflow Vulnerability CVE-2022-42475 | CriticalExploited | 99.5% | 02 Jan, 2023 | |
express-param vulnerable to Improper Handling of Extra Parameters CVE-2017-20160, GHSA-fr54-72wr-cqvq | Critical | 0.9% | 31 Dec, 2022 | npm express-param |
Ariadne Component Library vulnerable to Server-Side Request Forgery CVE-2017-20157, GHSA-qr97-v87p-x965 | Critical | 0.7% | 31 Dec, 2022 | Packagist arc/web |
rdiffweb vulnerable to Business Logic Errors CVE-2022-4719, GHSA-2wpw-cm9w-v4xm, PYSEC-2022-43005 | Critical | 1.0% | 27 Dec, 2022 | PyPI rdiffweb |
rdiffweb Improper Access Control vulnerability CVE-2022-4724, GHSA-m8r9-qxx8-mrxp, PYSEC-2022-43010 | Critical | 0.9% | 27 Dec, 2022 | PyPI rdiffweb |
json-pointer vulnerable to Prototype Pollution CVE-2022-4742, GHSA-6xrf-q977-5vgc | Critical | 1.1% | 26 Dec, 2022 | npm json-pointer |
Starcounter-Jack JSON-Patch Prototype Pollution vulnerability CVE-2021-4279, GHSA-8gh8-hqwg-xf34 | Critical | 1.2% | 25 Dec, 2022 | npm fast-json-patch |
flat vulnerable to Prototype Pollution CVE-2020-36632, GHSA-2j2x-2gpw-g8fm | Critical | 1.2% | 25 Dec, 2022 | npm flat |
ThinkPHP Framework vulnerable to remote code execution CVE-2022-47945, GHSA-p4qr-vq2g-22wp | Critical | 30.2% | 23 Dec, 2022 | Packagist topthink/framework |
Mozilla Firefox Use-After-Free Vulnerability CVE-2022-26486 | CriticalExploited | 2.4% | 22 Dec, 2022 | |
CodeIgniter4 Potential Session Handlers Vulnerability BIT-codeigniter-2022-46170, CVE-2022-46170, GHSA-6cq5-8cj7-g558 | Critical | 0.9% | 22 Dec, 2022 | Packagist codeigniter4/framework |
vm2 vulnerable to Arbitrary Code Execution CVE-2022-25893, GHSA-4w2j-2rg4-5mjw | Critical | 1.5% | 21 Dec, 2022 | npm vm2 |
abacus-ext-cmdline vulnerable to Command Injection CVE-2022-24431, GHSA-m5v8-wpw4-rj3x | Critical | 1.3% | 21 Dec, 2022 | npm abacus-ext-cmdline |
Apache Airflow Hive Provider vulnerable to Command Injection CVE-2022-46421, GHSA-rc58-qr9j-cpgw, PYSEC-2026-274 | Critical | 3.3% | 20 Dec, 2022 | PyPI apache-airflow-providers-apache-hive |
safe-eval vulnerable to Prototype Pollution CVE-2022-25904, GHSA-33vh-7x8q-mg35 | Critical | 0.9% | 20 Dec, 2022 | npm safe-eval |
p4 vulnerable to Command Injection due to improper input sanitization CVE-2022-25171, GHSA-jfm8-hwhg-r6gg | Critical | 2.5% | 20 Dec, 2022 | npm p4 |
Patchelf out-of-bounds read CVE-2022-44940, GHSA-5pcj-3m26-w633, PYSEC-2022-43144, PYSEC-2022-43151 | Critical | 1.1% | 19 Dec, 2022 | PyPI patchelf PyPI pypatchelf |
laravel-jqgrid vulnerable to SQL Injection CVE-2021-4262, GHSA-3fhj-wpvj-x5w8 | Critical | 0.7% | 19 Dec, 2022 | Packagist mgallegos/laravel-jqgrid |
FurqanSoftware/node-whois vulnerable to Prototype Pollution CVE-2020-36618, GHSA-97jv-c342-5xhc | Critical | 1.0% | 19 Dec, 2022 | npm whois |
npm package rfc6902 vulnerable to Prototype Pollution CVE-2021-4245, GHSA-p495-jxh2-wrfg | Critical | 1.4% | 15 Dec, 2022 | npm rfc6902 |
replicator vulnerable to Deserialization of Untrusted Data CVE-2021-33420, GHSA-hw46-vg6w-88fj | Critical | 1.7% | 15 Dec, 2022 | npm replicator |