Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
WebOb's location header normalization during redirect leads to open redirect CVE-2024-42353, GHSA-mg3v-6m49-jhp3, PYSEC-2024-188 | Medium | 0.6% | 14 Aug, 2024 | PyPI webob |
Magento Improper Access Control Leads to Privilege escalation CVE-2024-39419, GHSA-74w7-cr4v-wf2v | Medium | 0.4% | 14 Aug, 2024 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento Improper Authorization vulnerability CVE-2024-39418, GHSA-gvgf-pvh5-vjh4 | Medium | 0.4% | 14 Aug, 2024 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento Improper Authorization leads to Security feature bypass CVE-2024-39417, GHSA-4xmj-f664-hv98 | Medium | 0.4% | 14 Aug, 2024 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento Improper Authorization leads to Security feature bypass CVE-2024-39416, GHSA-4xgg-rw35-7mv5 | Medium | 0.4% | 14 Aug, 2024 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento Improper Authorization Leading to Security feature bypass CVE-2024-39415, GHSA-gj93-84g5-mcjq | Medium | 0.4% | 14 Aug, 2024 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento Improper Access Control Leads to Privilege escalation CVE-2024-39414, GHSA-x6f9-hv9r-fgq4 | Medium | 0.4% | 14 Aug, 2024 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento Improper Authorization vulnerability CVE-2024-39413, GHSA-8w5f-8992-g86j | Medium | 0.4% | 14 Aug, 2024 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento Open Source Improper Authorization vulnerability CVE-2024-39412, GHSA-7472-vw39-g2j3 | Medium | 0.4% | 14 Aug, 2024 | Packagist magento/community-edition |
Magento Improper Authorization leads to security feature bypass CVE-2024-39411, GHSA-qm77-mqf3-fmhq | Medium | 0.4% | 14 Aug, 2024 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento Open Source Cross-Site Request Forgery (CSRF) vulnerability CVE-2024-39410, GHSA-4323-f82v-f6jr | Medium | 0.5% | 14 Aug, 2024 | Packagist magento/community-edition |
Magento Open Source Cross-Site Request Forgery (CSRF) vulnerability CVE-2024-39409, GHSA-rf4q-m23c-7q8r | Medium | 0.5% | 14 Aug, 2024 | Packagist magento/community-edition |
Magento Open Source Cross-Site Request Forgery vulnerability CVE-2024-39408, GHSA-4cj6-f32v-6hgx | Medium | 0.5% | 14 Aug, 2024 | Packagist magento/community-edition |
Magento Improper Authorization vulnerability CVE-2024-39407, GHSA-cjm6-8mw8-2f8c | Medium | 0.4% | 14 Aug, 2024 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento Open Source Path Traversal vulnerability CVE-2024-39406, GHSA-6pxh-2557-5cj5 | Medium | 0.9% | 14 Aug, 2024 | Packagist magento/community-edition |
Magento Improper Authorization vulnerability CVE-2024-39405, GHSA-5g9f-7gqc-8hj4 | Medium | 0.4% | 14 Aug, 2024 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento Improper Authorization vulnerability CVE-2024-39404, GHSA-qrh3-vxjg-h9h6 | Medium | 0.5% | 14 Aug, 2024 | Packagist magento/community-edition Packagist magento/project-community-edition |
Microsoft Windows SmartScreen Security Feature Bypass Vulnerability CVE-2024-38213 | MediumExploited | 13.6% | 13 Aug, 2024 | |
Path traveral in Streamlit on windows CVE-2024-42474, GHSA-rxff-vr5r-8cj5, PYSEC-2024-153 | Medium | 0.6% | 12 Aug, 2024 | PyPI streamlit |
Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability CVE-2024-27443 | MediumExploited | 24.6% | 12 Aug, 2024 | |
Concrete CMS vulnerable to Stored Cross-site Scripting CVE-2024-7512, GHSA-c47w-9mcf-w972 | Medium | 0.4% | 12 Aug, 2024 | Packagist concrete5/concrete5 |
Concrete CMS Stored Cross-site Scripting vulnerability CVE-2024-4350, GHSA-q5wx-m95r-4cgc | Medium | 0.5% | 12 Aug, 2024 | Packagist concrete5/concrete5 |
In aiohttp, compressed files as symlinks are not protected from path traversal CVE-2024-42367, GHSA-jwhx-xcg6-8xhj, PYSEC-2026-1108 | Medium | 0.7% | 09 Aug, 2024 | PyPI aiohttp |
Concrete CMS Stored XSS in getAttributeSetName CVE-2024-7394, GHSA-w6j6-w6jx-vf2r | Medium | 0.4% | 08 Aug, 2024 | Packagist concrete5/concrete5 |
Shopware vulnerable to Improper Access Control with ManyToMany associations in store-api CVE-2024-42354, GHSA-hhcq-ph6w-494g | Medium | 0.4% | 08 Aug, 2024 | Packagist shopware/core Packagist shopware/platform |
Open WebUI Stored Cross-Site Scripting Vulnerability CVE-2024-6706, GHSA-5jp3-wp5v-5363, PYSEC-2026-1722 | Medium | 0.7% | 07 Aug, 2024 | PyPI open-webui |
The Opigno group manager project is related to Opigno LMS distribution. It allows to build the contents of learning paths, by combining together modules, courses, and other activities, ordering them, and defining conditional rules for the transitions from one step to the next one.
An administration CVE-2024-13263, DRUPAL-CONTRIB-2024-027 | Medium | 0.3% | 07 Aug, 2024 | Packagist:https://packages.drupal.org/8 drupal/opigno_group_manager |
Qwik has a potential mXSS vulnerability due to improper HTML escaping CVE-2024-41677, GHSA-2rwj-7xq8-4gx4 | Medium | 0.5% | 06 Aug, 2024 | npm @builder.io/qwik |
Microweber Reflected Cross-site scripting (XSS) vulnerability CVE-2024-40101, GHSA-m99v-mmg2-66vf | Medium | 0.9% | 06 Aug, 2024 | Packagist microweber/microweber |
Matrix SDK for React's URL preview setting for a room is controllable by the homeserver CVE-2024-42347, GHSA-f83w-wqhc-cfp4 | Medium | 0.4% | 06 Aug, 2024 | npm matrix-react-sdk |
nuxt vulnerable to Cross-site Scripting in navigateTo if used after SSR CVE-2024-34343, GHSA-vf6r-87q4-2vjf | Medium | 0.4% | 05 Aug, 2024 | npm nuxt |
Microweber Cross Site Scripting (XSS) vulnerability CVE-2024-41381, GHSA-h4xf-wx99-jmv4 | Medium | 0.3% | 05 Aug, 2024 | Packagist microweber/microweber |
Microweber Cross Site Scripting (XSS) vulnerability CVE-2024-41380, GHSA-hf66-xfgj-42g8 | Medium | 0.3% | 05 Aug, 2024 | Packagist microweber/microweber |
openstack-heat may disclose sensitive information CVE-2024-7319, GHSA-2fqr-cx7q-3ph8, PYSEC-2026-1750 | Medium | 0.4% | 02 Aug, 2024 | PyPI openstack-heat |
Elliptic's ECDSA missing check for whether leading bit of r and s is zero CVE-2024-42460, GHSA-977x-g7h5-7qgw | Medium | 0.5% | 02 Aug, 2024 | npm elliptic |
Elliptic's EDDSA missing signature length check CVE-2024-42459, GHSA-f7q4-pwc6-w24p | Medium | 0.3% | 02 Aug, 2024 | npm elliptic |
Concrete CMS vulnerable to Stored Cross-site Scripting CVE-2024-4353, GHSA-3cpf-jmmc-8jm3 | Medium | 0.3% | 01 Aug, 2024 | Packagist concrete5/concrete5 |
Bostr Improper Authorization vulnerability CVE-2024-41962, GHSA-5cf7-cxrf-mq73 | Medium | 0.3% | 01 Aug, 2024 | npm bostr |
MobSF vulnerable to Open Redirect in Login Redirect CVE-2024-41955, GHSA-8m9j-2f32-2vx4, PYSEC-2026-1669 | Medium | 1.0% | 31 Jul, 2024 | PyPI mobsf |
PheonixAppAPI has visible Encoding Maps CVE-2024-41951, GHSA-258h-f687-4226, PYSEC-2026-1779 | Medium | 0.2% | 31 Jul, 2024 | PyPI PheonixAppAPI PyPI pheonixappapi |
eZ Platform Admin UI vulnerable to DOM-based Cross-site Scripting in file upload widget GHSA-gc5h-6jx9-q2qh | Medium | Not scored | 31 Jul, 2024 | Packagist ezsystems/ezplatform-admin-ui |
The View Password module enables you to add a help icon button next to the password input field to toggle the password visibility. The administrative user is allowed to add classes to this icon for styling purposes.
The module doesn't validate the content of classes. A malicious user with access to CVE-2024-13262, DRUPAL-CONTRIB-2024-026 | Medium | 0.3% | 31 Jul, 2024 | Packagist:https://packages.drupal.org/8 drupal/view_password |
Ibexa Admin UI vulnerable to DOM-based Cross-site Scripting in file upload widget CVE-2024-39318, GHSA-qm44-wjm2-pr59 | Medium | 0.4% | 31 Jul, 2024 | Packagist ibexa/admin-ui |
Bolt CMS Cross-site Scripting vulnerability CVE-2024-7300, GHSA-xhqw-4hcq-fcvr | Medium | 0.4% | 31 Jul, 2024 | Packagist bolt/bolt |
Pimcore vulnerable to disclosure of system and database information behind /admin firewall CVE-2024-41109, GHSA-fx6j-9pp6-ph36 | Medium | 0.5% | 30 Jul, 2024 | Packagist pimcore/admin-ui-classic-bundle |
Aim Stored Cross-site Scripting Vulnerability CVE-2024-6578, GHSA-p9f2-jg9w-cx69, PYSEC-2026-1092 | Medium | 0.3% | 29 Jul, 2024 | PyPI aim |
Twisted vulnerable to HTML injection in HTTP redirect body CVE-2024-41810, GHSA-cf56-g6w6-pqq2, PYSEC-2024-75 | Medium | 1.2% | 29 Jul, 2024 | PyPI twisted |
Magento LTS vulnerable to stored Cross-site Scripting (XSS) in admin system configs CVE-2024-41676, GHSA-5vrp-638w-p8m2 | Medium | 0.4% | 29 Jul, 2024 | Packagist openmage/magento-lts |
ICEcoder Path Traversal vulnerability CVE-2024-41373, GHSA-x38c-v778-w56m | Medium | 0.4% | 26 Jul, 2024 | Packagist icecoder/icecoder |
Reflected Cross Site-Scripting (XSS) in Oveleon Cookiebar CVE-2024-47069, GHSA-296q-rj83-g9rq | Medium | 0.4% | 26 Jul, 2024 | Packagist oveleon/contao-cookiebar |