Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Multiple vulnerabilities in extension "Newsletter subscriber management" (fp_newsletter) CVE-2022-47408, GHSA-f683-35w9-28g5 | Critical | 0.7% | 14 Dec, 2022 | Packagist fixpunkt/fp-newsletter |
TYPO3 vulnerable to Insufficient Session Expiration CVE-2022-47406, GHSA-53mm-hx32-6475 | Critical | 0.5% | 14 Dec, 2022 | Packagist derhansen/fe_change_pwd Packagist typo3/cms |
cycle-import-check vulnerable to Command Injection CVE-2022-24377, GHSA-995x-33wq-8gc9 | Critical | 2.4% | 14 Dec, 2022 | npm cycle-import-check |
Citrix Application Delivery Controller (ADC) and Gateway Authentication Bypass Vulnerability CVE-2022-27518 | CriticalExploited | 6.9% | 13 Dec, 2022 | |
Improper Privilege Management in rdiffweb CVE-2022-4314, GHSA-g594-55mp-f6q8, PYSEC-2022-43002 | Critical | 0.9% | 12 Dec, 2022 | PyPI rdiffweb |
PaddlePaddle vulnerable to Code Injection CVE-2022-46742, GHSA-gcjf-29m9-888q, PYSEC-2022-43063 | Critical | 1.2% | 07 Dec, 2022 | PyPI paddlepaddle |
PaddlePaddle Out-of-bounds Read vulnerability CVE-2022-46741, GHSA-2hvc-hwg3-hpvw, PYSEC-2026-441 | Critical | 0.7% | 07 Dec, 2022 | PyPI paddlepaddle |
py7zr directory traversal vulnerability CVE-2022-44900, GHSA-m8xw-9x5x-6vh3, PYSEC-2022-42998 | Critical | 2.5% | 06 Dec, 2022 | PyPI py7zr |
simple-git vulnerable to Remote Code Execution when enabling the ext transport protocol CVE-2022-25912, GHSA-9p95-fxvg-qgq2 | Critical | 3.1% | 06 Dec, 2022 | npm simple-git |
GitPython vulnerable to Remote Code Execution due to improper user input validation CVE-2022-24439, GHSA-hcpj-qp55-gfph, PYSEC-2022-42992 | Critical | 6.1% | 06 Dec, 2022 | PyPI GitPython PyPI gitpython |
Cacti Command Injection Vulnerability CVE-2022-46169 | CriticalExploited | 99.8% | 05 Dec, 2022 | |
NodeBB vulnerable to account takeover via prototype vulnerability CVE-2022-46164, GHSA-rf3g-v8p5-p675 | Critical | 47.4% | 05 Dec, 2022 | npm nodebb |
nadesiko3 vulnerable to OS Command Injection CVE-2022-42496, GHSA-7249-8x22-4rg4 | Critical | 2.1% | 05 Dec, 2022 | npm nadesiko3 |
Nadesiko3 OS Command Injection vulnerability CVE-2022-41642, GHSA-m8r5-7wf4-63mw | Critical | 2.1% | 05 Dec, 2022 | npm nadesiko3 |
Zenario CMS is vulnerable to Remote Code Execution (RCE). CVE-2022-44136, GHSA-4p38-rc98-cr39 | Critical | 1.2% | 30 Nov, 2022 | Packagist tribalsystems/zenario |
PaddlePaddle vulnerable to code injection via winstr CVE-2022-45908, GHSA-83g7-8fch-p37m, PYSEC-2026-443 | Critical | 1.4% | 26 Nov, 2022 | PyPI paddlepaddle |
PyTorch vulnerable to arbitrary code execution BIT-pytorch-2022-45907, CVE-2022-45907, GHSA-47fc-vmwq-366v, PYSEC-2022-43015 | Critical | 1.3% | 26 Nov, 2022 | PyPI torch |
Moodle blind Server-Side Request Forgery (SSRF) vulnerability in LTI provider library BIT-moodle-2022-45152, CVE-2022-45152, GHSA-xqcf-vgqc-pcmg | Critical | 1.5% | 25 Nov, 2022 | Packagist moodle/moodle |
Badaso vulnerable to Remote Code Execution (RCE) CVE-2022-41705, GHSA-g389-rf5p-fg56 | Critical | 2.0% | 25 Nov, 2022 | Packagist badaso/core |
PyroCMS vulnerable to stored Cross Site Scripting CVE-2022-37721, GHSA-cm7f-hf2g-ghrp | Critical | 0.8% | 25 Nov, 2022 | Packagist pyrocms/pyrocms |
Heap buffer overflow in GPU CVE-2022-4135, GHSA-995f-9x5r-2rcj | CriticalExploited | 31.9% | 25 Nov, 2022 | npm electron |
wger vulnerable to brute force attempts CVE-2022-2650, GHSA-gr58-76rp-mmg4, PYSEC-2026-573 | Critical | 0.7% | 24 Nov, 2022 | PyPI wger |
OS Command Injection in Apache Airflow BIT-airflow-2022-40189, CVE-2022-40189, GHSA-rmf2-pwfq-h75j, PYSEC-2026-270 | Critical | 4.2% | 22 Nov, 2022 | PyPI apache-airflow |
OS Command Injection in Apache Airflow BIT-airflow-2022-38649, CVE-2022-38649, GHSA-7wqf-h36w-47mc, PYSEC-2026-267 | Critical | 3.4% | 22 Nov, 2022 | PyPI apache-airflow |
Prevent RCE when deserializing untrusted user input CVE-2022-41922, GHSA-442f-wcwq-fpcf | Critical | 1.2% | 21 Nov, 2022 | Packagist yiisoft/yii |
Heap overflow in `QuantizeAndDequantizeV2` BIT-tensorflow-2022-41910, CVE-2022-41910, GHSA-frqp-wp83-qggv, PYSEC-2026-3178, PYSEC-2026-3323, PYSEC-2026-992 | Critical | 0.4% | 21 Nov, 2022 | PyPI tensorflow PyPI tensorflow-cpu PyPI tensorflow-gpu |
Out of bounds write in grappler in Tensorflow BIT-tensorflow-2022-41902, CVE-2022-41902, GHSA-cg88-rpvp-cjv5, PYSEC-2026-3161, PYSEC-2026-3310, PYSEC-2026-981 | Critical | 0.5% | 21 Nov, 2022 | PyPI tensorflow PyPI tensorflow-cpu PyPI tensorflow-gpu |
SQL injection in Dolibarr BIT-dolibarr-2022-4093, CVE-2022-4093, GHSA-gjg7-qfvp-9hm4 | Critical | 4.3% | 21 Nov, 2022 | Packagist dolibarr/dolibarr |
Insufficient Session Expiration in librenms/librenms CVE-2022-4070, GHSA-x93j-3hh3-6x23 | Critical | 0.7% | 20 Nov, 2022 | Packagist librenms/librenms |
Cross site scripting vulnerability with discussion titles CVE-2022-41938, GHSA-7x4w-j98p-854x | Critical | 0.8% | 19 Nov, 2022 | Packagist flarum/core |
FractionalMaxPool and FractionalAVGPool heap out-of-bounds acess BIT-tensorflow-2022-41900, CVE-2022-41900, GHSA-xvwp-h6jv-7472, PYSEC-2026-1049, PYSEC-2026-3261, PYSEC-2026-3383 | Critical | 0.7% | 18 Nov, 2022 | PyPI tensorflow PyPI tensorflow-cpu PyPI tensorflow-gpu |
Tensorflow vulnerable to Out-of-Bounds Read BIT-tensorflow-2022-41880, CVE-2022-41880, GHSA-8w5g-3wcv-9g2j, PYSEC-2026-3140, PYSEC-2026-3298, PYSEC-2026-971 | Critical | 0.4% | 18 Nov, 2022 | PyPI tensorflow PyPI tensorflow-cpu PyPI tensorflow-gpu |
Dolibarr vulnerable to privilege escalation BIT-dolibarr-2022-43138, CVE-2022-43138, GHSA-gh7m-j673-wm97 | Critical | 1.3% | 17 Nov, 2022 | Packagist dolibarr/dolibarr |
rdiffweb vulnerable to Insufficient Session Expiration CVE-2022-3362, GHSA-94qm-99qc-qwqj, PYSEC-2022-43000 | Critical | 1.0% | 14 Nov, 2022 | PyPI rdiffweb |
Arches vulnerable to execution of arbitrary SQL CVE-2022-41892, GHSA-gmpq-xrxj-xh8m, PYSEC-2022-42985 | Critical | 0.6% | 11 Nov, 2022 | PyPI arches |
eZ Platform users with the Company admin role can assign any role to any user GHSA-99r3-xmmq-7q7g | Critical | Not scored | 10 Nov, 2022 | Packagist ezsystems/ezpublish-kernel |
eZ Platform users with the Company admin role can assign any role to any user GHSA-8h83-chh2-fchp | Critical | Not scored | 10 Nov, 2022 | Packagist ezsystems/ezplatform-kernel |
eZ Platform users with the Company admin role can assign any role to any user GHSA-446q-xxg5-3vhh | Critical | Not scored | 10 Nov, 2022 | Packagist ezsystems/repository-forms |
eZ Platform users with the Company admin role can assign any role to any user GHSA-pcpm-vc4v-cmvx | Critical | Not scored | 10 Nov, 2022 | Packagist ezsystems/ezplatform-admin-ui |
Ibexa DXP users with the Company admin role can assign any role to any user GHSA-g6jc-xrc3-4wwq | Critical | Not scored | 10 Nov, 2022 | Packagist ibexa/admin-ui |
Ibexa DXP users with the Company admin role can assign any role to any user GHSA-394j-x37r-2q27 | Critical | Not scored | 10 Nov, 2022 | Packagist ibexa/core |
ibexa/admin-ui vulnerable to Cross-site Scripting in content type name/shortname GHSA-7644-cxp8-h23r | Critical | Not scored | 10 Nov, 2022 | Packagist ibexa/admin-ui |
ezplatform-admin-ui vulnerable to Cross-Site Scripting (XSS) GHSA-58h5-h554-429q | Critical | Not scored | 10 Nov, 2022 | Packagist ezsystems/ezplatform-admin-ui |
GraphQL queries can expose password hashes GHSA-3p7g-wrgg-wq45 | Critical | Not scored | 10 Nov, 2022 | Packagist ibexa/graphql |
Parse Server is vulnerable to Prototype Pollution via Cloud Code Webhooks BIT-parse-2022-41879, CVE-2022-41879, GHSA-93vw-8fm5-p2jf | Critical | 0.9% | 10 Nov, 2022 | npm parse-server |
Parse Server vulnerable to Prototype Pollution via Cloud Code Webhooks or Cloud Code Triggers BIT-parse-2022-41878, CVE-2022-41878, GHSA-xprv-wvh7-qqqx | Critical | 1.0% | 09 Nov, 2022 | npm parse-server |
Remote code execution via MongoDB BSON parser through prototype pollution BIT-parse-2022-39396, CVE-2022-39396, GHSA-prm5-8g2m-24gg | Critical | 38.7% | 08 Nov, 2022 | npm parse-server |
Netwrix Auditor Insecure Object Deserialization Vulnerability CVE-2022-31199 | CriticalExploited | 36.0% | 08 Nov, 2022 | |
@keystone-6/core's NODE_ENV defaults to development with esbuild CVE-2022-39382, GHSA-25mx-2mxm-6343 | Critical | 2.1% | 03 Nov, 2022 | npm @keystone-6/core |
Centreon vulnerable to SQL Injection CVE-2022-3827, GHSA-j5wx-jvw3-j363 | Critical | 1.0% | 02 Nov, 2022 | Packagist centreon/centreon |