Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
rdiffweb does not have a rate limit on incorrect password attempts to prevent brute force attacks CVE-2022-3273, GHSA-9g3v-v24q-jj5p, PYSEC-2022-43156 | Critical | 0.6% | 06 Oct, 2022 | PyPI rdiffweb |
Moodle Minor SQL injection risk in admin user browsing BIT-moodle-2022-40315, CVE-2022-40315, GHSA-mqw9-3cjm-xwp3 | Critical | 1.1% | 30 Sep, 2022 | Packagist moodle/moodle |
Moodle remote code execution BIT-moodle-2022-40314, CVE-2022-40314, GHSA-2hmm-q272-xmhf | Critical | 2.1% | 30 Sep, 2022 | Packagist moodle/moodle |
isolated-vm has vulnerable CachedDataOptions in API CVE-2022-39266, GHSA-2jjq-x548-rhpv | Critical | 1.3% | 29 Sep, 2022 | npm isolated-vm |
Google Chromium Mojo Insufficient Data Validation Vulnerability CVE-2022-3075 | CriticalExploited | 5.8% | 26 Sep, 2022 | |
joblib vulnerable to arbitrary code execution CVE-2022-21797, GHSA-6hrg-qmvc-2xh8, PYSEC-2022-288 | Critical | 2.6% | 26 Sep, 2022 | PyPI joblib |
Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload Vulnerability CVE-2022-41352 | CriticalExploited | 95.5% | 26 Sep, 2022 | |
Sophos Firewall Code Injection Vulnerability CVE-2022-3236 | CriticalExploited | 98.9% | 23 Sep, 2022 | |
rdiffweb vulnerable to account access via session fixation CVE-2022-3269, GHSA-j3q4-gmj4-mj95, PYSEC-2022-290 | Critical | 0.9% | 23 Sep, 2022 | PyPI rdiffweb |
steal vulnerable to Prototype Pollution via alias variable CVE-2022-37265, GHSA-wc4x-qmr2-rj8h | Critical | 1.6% | 20 Sep, 2022 | npm steal |
Pagekit vulnerable to Unrestricted Upload of File with Dangerous Type CVE-2022-38916, GHSA-4v5m-vwvp-p7w8 | Critical | 18.3% | 20 Sep, 2022 | Packagist pagekit/pagekit |
Valine code injection vulnerability CVE-2022-38545, GHSA-mcvg-g9wx-v5vx | Critical | 34.1% | 19 Sep, 2022 | npm valine |
Teclib GLPI Remote Code Execution Vulnerability CVE-2022-35914 | CriticalExploited | 99.9% | 19 Sep, 2022 | |
steal vulnerable to Prototype Pollution CVE-2022-37258, GHSA-gvjw-8mmr-8f6g | Critical | 1.6% | 16 Sep, 2022 | npm steal |
TensorFlow vulnerable to OOB write in `scatter_nd` in TF Lite BIT-tensorflow-2022-35939, CVE-2022-35939, GHSA-ffjm-4qwc-7cmf, PYSEC-2026-3171, PYSEC-2026-3319, PYSEC-2026-989 | Critical | 0.6% | 16 Sep, 2022 | PyPI tensorflow PyPI tensorflow-cpu PyPI tensorflow-gpu |
TensorFlow vulnerable to OOB read in `Gather_nd` in TF Lite BIT-tensorflow-2022-35937, CVE-2022-35937, GHSA-pxrw-j2fv-hx3h, PYSEC-2026-1027, PYSEC-2026-3226, PYSEC-2026-3359 | Critical | 0.6% | 16 Sep, 2022 | PyPI tensorflow PyPI tensorflow-cpu PyPI tensorflow-gpu |
steal vulnerable to Prototype Pollution via optionName variable CVE-2022-37264, GHSA-8f8g-9j73-7p82 | Critical | 1.5% | 15 Sep, 2022 | npm steal |
steal vulnerable to Prototype Pollution via key variable in babel.js CVE-2022-37266, GHSA-vwhq-pm3r-fjm9 | Critical | 1.4% | 15 Sep, 2022 | npm steal |
steal vulnerable to Prototype Pollution via requestedVersion variable CVE-2022-37257, GHSA-93q5-3xpc-8vg3 | Critical | 1.4% | 15 Sep, 2022 | npm steal |
ThinkPHP deserialization vulnerability CVE-2022-38352, GHSA-qjjj-7g7h-54v3 | Critical | 21.0% | 15 Sep, 2022 | Packagist topthink/framework |
Server-Side Request Forgery (SSRF) in GitHub repository ionicabizau/parse-url CVE-2022-2900, GHSA-j9fq-vwqv-2fm2 | Critical | 1.2% | 14 Sep, 2022 | npm parse-url |
VNCAuthProxy authentication bypass vulnerability CVE-2022-36436, GHSA-237r-mx84-7x8c, PYSEC-2022-267 | Critical | 2.1% | 14 Sep, 2022 | PyPI vncauthproxy |
Casdoor v1.97.3 was discovered to contain an arbitrary file write vulnerability via the fullFilePath parameter at /api/upload-resource. CVE-2022-38638, GHSA-9vm3-r8gq-cr6x, GO-2022-1006, PYSEC-2022-43190 | Critical | 1.2% | 09 Sep, 2022 | PyPI casdoor |
Rank Math SEO plugin vulnerable to Server-Side Request Forgery CVE-2022-36376, GHSA-j95r-86hx-xwxg | Critical | 1.0% | 09 Sep, 2022 | Packagist rankmath/seo-by-rank-math |
cruddl vulnerable to ArangoDB Query Language (AQL) injection through flexSearch CVE-2022-36084, GHSA-qm4w-4995-vg7f | Critical | 1.5% | 08 Sep, 2022 | npm cruddl |
rdiffweb vulnerable to Improper Restriction of Rendered UI Layers or Frames CVE-2022-3167, GHSA-m379-x4xc-38x9, PYSEC-2022-268 | Critical | 1.2% | 08 Sep, 2022 | PyPI rdiffweb |
QNAP Photo Station Externally Controlled Reference Vulnerability CVE-2022-27593 | CriticalExploited | 87.9% | 08 Sep, 2022 | |
vm2 vulnerable to Sandbox Escape resulting in Remote Code Execution on host CVE-2022-36067, GHSA-mrgp-mrhc-5jrq | Critical | 47.9% | 06 Sep, 2022 | npm vm2 |
FeehiCMS has an arbitrary file upload vulnerability CVE-2020-21516, GHSA-jj62-mc3m-j769 | Critical | 1.3% | 06 Sep, 2022 | Packagist feehi/cms |
RosarioSIS before 10.1 vulnerable to Improper Handling of Length Parameter Inconsistency CVE-2022-2714, GHSA-vh4m-mw8w-g4w8 | Critical | 0.9% | 06 Sep, 2022 | Packagist francoisjacquet/rosariosis |
Apache Airflow Session Fixation vulnerability BIT-airflow-2022-38054, CVE-2022-38054, GHSA-5ff8-7639-6v6g, PYSEC-2022-263 | Critical | 2.2% | 02 Sep, 2022 | PyPI apache-airflow |
python-jwt vulnerable to token forgery with new claims CVE-2022-39227, GHSA-5p8v-58qm-c7fp, PYSEC-2022-259 | Critical | 5.3% | 01 Sep, 2022 | PyPI python-jwt |
python-scciclient vulnerable to Man-in-the-middle (MITM) attacks CVE-2022-2996, GHSA-rf3f-3p37-2qh4, PYSEC-2022-43152 | Critical | 0.7% | 01 Sep, 2022 | PyPI python-scciclient |
Cryptographically weak PRNG in `utils.generateUUID` CVE-2022-36045, GHSA-p4cc-w597-6cpm | Critical | 1.3% | 30 Aug, 2022 | npm nodebb |
morgan-json vulnerable to Arbitrary Code Execution CVE-2022-25921, GHSA-fwv4-6mxc-x5h3 | Critical | 1.4% | 29 Aug, 2022 | npm morgan-json |
@pendo324/get-process-by-name are vulnerable to Arbitrary Code Execution CVE-2022-25644, GHSA-qhxv-296x-hjv7 | Critical | 1.6% | 29 Aug, 2022 | npm @pendo324/get-process-by-name |
Font-Converter Vulnerable to Arbitrary Command Injection CVE-2022-21165, GHSA-g2c3-vwff-m3xr | Critical | 3.1% | 29 Aug, 2022 | npm font-converter |
NVFLARE unsafe deserialization due to Pickle CVE-2022-34668, GHSA-6qv6-q77g-7qm6, PYSEC-2022-257 | Critical | 11.6% | 29 Aug, 2022 | PyPI nvflare |
D-Link Routers Buffer Overflow Vulnerability CVE-2022-37055 | CriticalExploited | 55.5% | 28 Aug, 2022 | |
exotel-py includes code execution backdoor inserted by a third party CVE-2022-38792, GHSA-cv6j-9835-p7fh, PYSEC-2022-43134 | Critical | 1.6% | 27 Aug, 2022 | PyPI exotel |
Mongoose Vulnerable to Prototype Pollution in Schema Object CVE-2022-24304, GHSA-h8hf-x3f4-xwgp | Critical | Not scored | 27 Aug, 2022 | npm mongoose |
Openstack Keystone Incorrect Authorization vulnerability CVE-2021-3563, GHSA-cc99-whm5-mmq3, PYSEC-2026-370 | Critical | 1.9% | 26 Aug, 2022 | PyPI keystone |
Missing password strength check in notrinos/notrinos-erp CVE-2022-2927, GHSA-qhm8-69qh-g76j | Critical | 0.9% | 22 Aug, 2022 | Packagist notrinos/notrinos-erp |
Magento Improper Authorization vulnerability BIT-magento-2022-34256, CVE-2022-34256, GHSA-r7mm-grf3-5fjv | Critical | 2.1% | 16 Aug, 2022 | Packagist magento/community-edition |
Magento XML Injection vulnerability in the Widgets Module BIT-magento-2022-34253, CVE-2022-34253, GHSA-cj7w-pm77-hvg6 | Critical | 5.0% | 16 Aug, 2022 | Packagist magento/community-edition |
React Editable Json Tree vulnerable to arbitrary code execution via function parsing CVE-2022-36010, GHSA-j3rv-w43q-f9x2 | Critical | 1.5% | 15 Aug, 2022 | npm react-editable-json-tree |
`undici.request` vulnerable to SSRF using absolute URL on `pathname` CVE-2022-35949, GHSA-8qr4-xgw6-wmr3 | Critical | 1.9% | 12 Aug, 2022 | npm undici |
Synacor Zimbra Collaboration Suite (ZCS) Authentication Bypass Vulnerability CVE-2022-37042 | CriticalExploited | 92.1% | 12 Aug, 2022 | |
loopback-connector-postgresql Vulnerable to Improper Sanitization of `contains` Filter CVE-2022-35942, GHSA-j259-6c58-9m58 | Critical | 0.7% | 11 Aug, 2022 | npm loopback-connector-postgresql |
ts-deepmerge before 2.0.2 vulnerable to Prototype Pollution CVE-2022-25907, GHSA-7qqq-gh2f-wq76 | Critical | 1.9% | 09 Aug, 2022 | npm ts-deepmerge |