Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Buffer over-flow in Pillow BIT-pillow-2022-30595, CVE-2022-30595, GHSA-hr8g-f6r6-mr22, PYSEC-2022-43145 | Critical | 2.3% | 25 May, 2022 | PyPI Pillow PyPI pillow |
** DISPUTED ** Improper parsing of HTTP requests in Pallets Werkzeug v2.1.0 and below allows attackers to perform HTTP Request Smuggling using a crafted HTTP request with multiple requests included inside the body. NOTE: the vendor's position is that this behavior can only occur in unsupported confi CVE-2022-29361, PYSEC-2022-203 | Critical | 8.1% | 25 May, 2022 | PyPI werkzeug |
Incorrect Calculation in moodle BIT-moodle-2022-30600, CVE-2022-30600, GHSA-w37f-pvvx-wcwm | Critical | 5.1% | 18 May, 2022 | Packagist moodle/moodle |
SQL injection in moodle BIT-moodle-2022-30599, CVE-2022-30599, GHSA-69c3-5xxf-58q2 | Critical | 1.4% | 18 May, 2022 | Packagist moodle/moodle |
Formidable arbitrary file upload CVE-2022-29622, GHSA-8cp3-66vr-3r4c | Critical | 3.4% | 16 May, 2022 | npm formidable |
Withdrawn: Code execution via SVG file upload in tiddlywiki CVE-2022-29351, GHSA-cr9c-rhq6-vh53 | Critical | 2.7% | 16 May, 2022 | npm tiddlywiki |
SQL injection in calibreweb CVE-2022-30765, GHSA-8ppf-x4gr-2x7g, PYSEC-2026-305 | Critical | 1.2% | 16 May, 2022 | PyPI calibreweb |
Laravel Framework Deserialization Vulnerability CVE-2019-9081, GHSA-pfg4-p438-p874 | Critical | Not scored | 14 May, 2022 | Packagist laravel/framework |
Command injection in workspace-tools CVE-2022-25865, GHSA-5875-m6jq-vf78, SNYK-JS-WORKSPACETOOLS-2421201 | Critical | 6.7% | 13 May, 2022 | npm workspace-tools |
Prototype Pollution in convict CVE-2022-21190, GHSA-jjf5-wx3j-3fv7, SNYK-JS-CONVICT-2774757 | Critical | 4.0% | 13 May, 2022 | npm convict |
Account takeover in facturascripts CVE-2022-1715, GHSA-vjq3-x3f2-fvxq | Critical | 1.4% | 13 May, 2022 | Packagist facturascripts/facturascripts |
SolarView Compact Command Injection Vulnerability CVE-2022-29303 | CriticalExploited | 98.0% | 12 May, 2022 | |
Zyxel Multiple Firewalls OS Command Injection Vulnerability CVE-2022-30525 | CriticalExploited | 99.9% | 12 May, 2022 | |
Exposure of Sensitive Information in eventsource CVE-2022-1650, GHSA-6h5x-7c5m-7cr7 | Critical | 1.9% | 12 May, 2022 | npm eventsource |
Code-execution backdoor in marcador CVE-2022-28470, GHSA-57qv-h9m7-jxfg, PYSEC-2022-185 | Critical | 2.3% | 08 May, 2022 | PyPI marcador |
Deserialization of Untrusted Data in topthink/framework CVE-2021-23592, GHSA-3fpv-54ff-wqfj, SNYK-PHP-TOPTHINKFRAMEWORK-2385695 | Critical | 1.7% | 06 May, 2022 | Packagist topthink/framework |
F5 BIG-IP Missing Authentication Vulnerability CVE-2022-1388 | CriticalExploited | 100.0% | 05 May, 2022 | |
Tenant and Verifier might not use the same registrar data CVE-2022-1053, GHSA-jf66-3q76-h5p5, GHSA-jf66-3q76-h5p5,, PYSEC-2022-184 | Critical | 1.5% | 05 May, 2022 | PyPI keylime |
Argument injection in python-libnmap CVE-2022-30284, GHSA-qwqv-j7jr-4hp6, PYSEC-2022-42999 | Critical | 5.5% | 04 May, 2022 | PyPI python-libnmap |
RCE in SiteServer CMS CVE-2022-28118, GHSA-q469-j32f-h7vm | Critical | 2.8% | 03 May, 2022 | npm siteserver |
Incorrect Permission Assignment for Critical Resource in ShopXO CVE-2022-28056, GHSA-jfph-3hpg-2f65 | Critical | 1.4% | 02 May, 2022 | Packagist shopxo/shopxo |
Prototype Pollution in jsgui-lang-essentials CVE-2022-25301, GHSA-p3pg-64pv-v7jg | Critical | 1.2% | 01 May, 2022 | npm jsgui-lang-essentials |
OS Command Injection in git-pull-or-clone CVE-2022-24437, GHSA-3x62-x456-q2vm, SNYK-JS-GITPULLORCLONE-2434307 | Critical | 3.7% | 01 May, 2022 | npm git-pull-or-clone |
Privilege Issues in jailed CVE-2022-23923, GHSA-77m7-9wvw-87fx | Critical | 1.3% | 01 May, 2022 | npm jailed |
Prototype Pollution in Dexie CVE-2022-21189, GHSA-3xgx-r9j4-qw9w | Critical | 1.7% | 01 May, 2022 | npm dexie |
Object state limitation has no effect GHSA-w8qp-hmh5-4v9v | Critical | Not scored | 29 Apr, 2022 | Packagist ezsystems/ezplatform-kernel |
Object state limitation has no effect GHSA-gvj8-4cj4-h776 | Critical | Not scored | 29 Apr, 2022 | Packagist ibexa/core |
Object state limitation has no effect CVE-2022-48367, GHSA-5x4f-7xgq-r42x, GHSA-h5v2-wrhp-5v35 | Critical | 0.7% | 29 Apr, 2022 | Packagist ezsystems/ezpublish-kernel |
Cross site scripting in FacturaScripts CVE-2022-1514, GHSA-p3w3-4ppm-c3f6 | Critical | 0.8% | 28 Apr, 2022 | Packagist facturascripts/facturascripts |
Improper Input Validation in httpx CVE-2021-41945, GHSA-h8pj-cxx2-jfg2, PYSEC-2022-183 | Critical | 2.1% | 28 Apr, 2022 | PyPI httpx |
Apache CouchDB Insecure Default Initialization of Resource Vulnerability CVE-2022-24706 | CriticalExploited | 92.5% | 26 Apr, 2022 | |
Mitel MiVoice Connect Data Validation Vulnerability CVE-2022-29499 | CriticalExploited | 55.2% | 26 Apr, 2022 | |
Command injection in czproject/git-php CVE-2022-25866, GHSA-3xpw-vhmv-cw7h, SNYK-PHP-CZPROJECTGITPHP-2421349 | Critical | 3.6% | 25 Apr, 2022 | Packagist czproject/git-php |
ejs template injection vulnerability CVE-2022-29078, GHSA-phwq-j96m-2c2q | Critical | 32.8% | 25 Apr, 2022 | npm ejs |
Cross site scripting in facturascripts CVE-2022-1457, GHSA-8wp2-vxpg-xcvp | Critical | 0.8% | 25 Apr, 2022 | Packagist neorazorx/facturascripts |
Command injection in git-interface CVE-2022-1440, GHSA-qffw-8wg7-h665 | Critical | 3.7% | 22 Apr, 2022 | npm git-interface |
Prototype Pollution in convict CVE-2022-22143, GHSA-x2w5-725j-gf2g, SNYK-JS-CONVICT-2340604 | Critical | 2.2% | 20 Apr, 2022 | npm convict |
Oracle ADF Faces Deserialization of Untrusted Data Vulnerability CVE-2022-21445 | CriticalExploited | 62.5% | 19 Apr, 2022 | |
WSO2 Multiple Products Unrestrictive Upload of File Vulnerability CVE-2022-29464 | CriticalExploited | 100.0% | 18 Apr, 2022 | |
Integer bounds error in Vyper CVE-2022-24845, GHSA-j2x6-9323-fp7h, PYSEC-2022-198 | Critical | 1.4% | 13 Apr, 2022 | PyPI vyper |
OSGeo GeoServer JAI-EXT Code Injection Vulnerability CVE-2022-24816 | CriticalExploited | 99.9% | 13 Apr, 2022 | |
Buffer Overflow in vyper CVE-2022-24788, GHSA-4mrx-6fxm-8jpg, PYSEC-2022-197 | Critical | 1.0% | 13 Apr, 2022 | PyPI vyper |
SQL injection in apache-superset BIT-superset-2022-27479, CVE-2022-27479, GHSA-wh73-hpcg-v32j, PYSEC-2022-188 | Critical | 2.9% | 13 Apr, 2022 | PyPI apache-superset |
Arbitrary file upload in Ghost BIT-ghost-2022-28397, CVE-2022-28397, GHSA-ffhq-g856-9f2p | Critical | 3.5% | 12 Apr, 2022 | npm ghost |
Unrestricted Upload of File with Dangerous Type in Payload CVE-2022-27952, GHSA-w8xh-93qh-35vw | Critical | 2.3% | 12 Apr, 2022 | npm payload |
Unrestricted Upload of File with Dangerous Type in Strapi CVE-2022-27263, GHSA-9qgm-w87q-hx89 | Critical | 3.2% | 12 Apr, 2022 | npm strapi |
Unrestricted Upload of File with Dangerous Type in ButterCMS CVE-2022-27260, GHSA-3v5x-qjrp-q2hq | Critical | 3.1% | 12 Apr, 2022 | npm buttercms |
Arbitrary file upload in Ghost BIT-ghost-2022-27139, CVE-2022-27139, GHSA-fvc6-qjp7-m4g4 | Critical | 4.0% | 12 Apr, 2022 | npm ghost |
Command injection in npm-dependency-versions CVE-2022-29080, GHSA-m7xq-8jp8-rj2c | Critical | 2.2% | 12 Apr, 2022 | npm npm-dependency-versions |
SQL Injection in Django BIT-django-2022-28346, CVE-2022-28346, GHSA-2gwj-7jmv-h26r, PYSEC-2022-190 | Critical | 18.7% | 12 Apr, 2022 | PyPI Django PyPI django |