Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
October/System authenticated file write leads to remote code execution CVE-2021-32649, GHSA-wv23-pfj7-2mjj | High | 1.4% | 14 Jan, 2022 | Packagist october/system |
Unchecked validity of Facing values in PlayerActionPacket CVE-2022-51015, GHSA-xh99-hw7h-wf63 | High | 0.7% | 13 Jan, 2022 | Packagist pocketmine/pocketmine-mp |
Lookup operations do not take into account wildcards in SpiceDB CVE-2022-21646, GHSA-7p8f-8hjm-wm92, GO-2022-0295 | High | 1.3% | 13 Jan, 2022 | Go github.com/authzed/spicedb |
Unbounded memory usage on exposed HTTP/2 (non-gRPC) endpoints GHSA-m7vp-hqwv-7m5x | High | Not scored | 12 Jan, 2022 | Go github.com/spiffe/spire |
Uncaught Exception in engine.io CVE-2022-21676, GHSA-273r-mgr4-v34f | High | 2.9% | 12 Jan, 2022 | npm engine.io |
crater is vulnerable to Unrestricted Upload of File with Dangerous Type CVE-2021-4080, GHSA-wppj-3pjr-9w79 | High | 1.5% | 12 Jan, 2022 | Packagist bytefury/crater |
Reflected cross-site scripting (XSS) vulnerability CVE-2022-0087, GHSA-hrgx-7j6v-xj82 | High | 2.8% | 12 Jan, 2022 | npm @keystone-6/auth npm @keystone-next/auth |
Microsoft Windows User Profile Service Privilege Escalation Vulnerability CVE-2022-21919 | HighExploited | 2.6% | 11 Jan, 2022 | |
Microsoft Win32k Privilege Escalation Vulnerability CVE-2022-21882 | HighExploited | 59.2% | 11 Jan, 2022 | |
Improper Privilege Management in shelljs CVE-2022-0144, GHSA-4rq4-32rv-6wp6 | High | 0.5% | 11 Jan, 2022 | npm shelljs |
Pipenv's requirements.txt parsing allows malicious index url in comments CVE-2022-21668, GHSA-qc9x-gjcv-465w, PYSEC-2022-6 | High | 3.9% | 10 Jan, 2022 | PyPI pipenv |
Exposure of sensitive information in follow-redirects CVE-2022-0155, GHSA-74fj-2j2h-c42q | High | 2.6% | 10 Jan, 2022 | npm follow-redirects |
Sandbox Escape by math function in smarty CVE-2021-29454, GHSA-29gp-2c3m-3j6m | High | 1.9% | 10 Jan, 2022 | Packagist smarty/smarty |
Access to restricted PHP code by dynamic static class access in smarty CVE-2021-21408, GHSA-4h9c-v5vg-5m6m | High | 2.1% | 10 Jan, 2022 | Packagist smarty/smarty |
Infinite loop causing Denial of Service in colors GHSA-5rqg-jm4f-cqx7 | High | Not scored | 10 Jan, 2022 | npm Colors npm colors |
Samsung Mobile Devices Use-After-Free Vulnerability CVE-2022-22265 | HighExploited | 0.4% | 10 Jan, 2022 | |
dnslib has DNS reply verification issue CVE-2022-22846, GHSA-r478-c2pc-m7gx, PYSEC-2022-4 | High | 0.9% | 10 Jan, 2022 | PyPI dnslib |
Denial of Service in soketi CVE-2022-21667, GHSA-86ch-6w7v-v6xf | High | 1.7% | 08 Jan, 2022 | npm @soketi/soketi |
A potential Denial of Service issue in protobuf-java CVE-2021-22569, GHSA-wrvw-hg22-4m67 | High | 1.8% | 07 Jan, 2022 | Maven com.google.protobuf:protobuf-java Maven com.google.protobuf:protobuf-kotlin RubyGems google-protobuf |
Uncapped length of skin data fields submitted by players CVE-2022-51017, GHSA-c6fg-99pr-25m9 | High | 0.6% | 06 Jan, 2022 | Packagist pocketmine/pocketmine-mp |
Book page text, count, and author/title length is not limited in PocketMine-MP CVE-2022-51018, GHSA-p62j-hrxm-xcxf | High | 0.4% | 06 Jan, 2022 | Packagist pocketmine/pocketmine-mp |
An authenticated user can execute arbitrary command in Gerapy CVE-2021-32849, GHSA-756h-r2c9-qp5j, PYSEC-2022-17 | High | 7.6% | 06 Jan, 2022 | PyPI gerapy |
Insufficient Session Expiration in shopware CVE-2022-21652, GHSA-p523-jrph-qjc6 | High | 0.8% | 05 Jan, 2022 | Packagist shopware/shopware |
Missing Authorization in DayByDay CRM CVE-2022-22111, GHSA-w6rp-4vj7-v2m8 | High | 1.0% | 05 Jan, 2022 | Packagist bottelet/flarepoint |
Weak Password Requirements in Daybyday CRM CVE-2022-22110, GHSA-96v6-hrwg-p378 | High | 1.2% | 05 Jan, 2022 | Packagist bottelet/flarepoint |
Denial-of-service in Django BIT-django-2021-45115, CVE-2021-45115, GHSA-53qw-q765-4fww, PYSEC-2022-1 | High | 2.6% | 05 Jan, 2022 | PyPI Django PyPI django |
Information disclosure in Django BIT-django-2021-45116, CVE-2021-45116, GHSA-8c5j-9r9f-c6w8, PYSEC-2022-2 | High | 2.0% | 05 Jan, 2022 | PyPI Django PyPI django |
Sandbox bypass in Latte templates CVE-2022-21648, GHSA-36m2-8rhx-f36j | High | 0.8% | 04 Jan, 2022 | Packagist latte/latte |
Client-Side JavaScript Prototype Pollution in oro/platform CVE-2021-43852, GHSA-jx5q-g37m-h5hj | High | 1.1% | 04 Jan, 2022 | Packagist oro/platform |
NLTK Vulnerable to REDoS CVE-2021-3842, GHSA-rqjh-jp2r-59cj, PYSEC-2022-5 | High | 1.6% | 04 Jan, 2022 | PyPI nltk |
Fortinet FortiOS Arbitrary File Download CVE-2021-44168 | HighExploited | 0.9% | 04 Jan, 2022 | |
Injection in UserFrosting CVE-2021-25994, GHSA-cv25-3gmg-c6m8 | High | 1.6% | 03 Jan, 2022 | Packagist userfrosting/userfrosting |
Cookie Prefix Spoofing in CGI::Cookie.parse BIT-ruby-2021-41819, BIT-ruby-min-2021-41819, CVE-2021-41819, GHSA-4vf4-qmvg-mh7h | High | 3.2% | 01 Jan, 2022 | RubyGems cgi |
golang.org/x/net/http2 allows uncontrolled memory consumption BIT-golang-2021-44716, CVE-2021-44716, GHSA-vc3p-29h2-gpcp, GO-2022-0288 | High | 4.3% | 01 Jan, 2022 | Go golang.org/x/net Go golang.org/x/net/http2 Go stdlib |
Incorrect sanitisation function leads to `XSS` in mermaid CVE-2021-43861, GHSA-p3rp-vmj9-gv6v | High | 0.9% | 30 Dec, 2021 | npm mermaid |
OS Command Injection in celery CVE-2021-23727, GHSA-q4xr-rc97-m4xx, PYSEC-2021-858, SNYK-PYTHON-CELERY-2314953 | High | 3.6% | 29 Dec, 2021 | PyPI celery |
Use of a Broken or Risky Cryptographic Algorithm in Max Mazurov Maddy CVE-2021-42583, GHSA-5r5w-h76p-m726, GO-2022-0306 | High | 0.7% | 28 Dec, 2021 | Go github.com/foxcpp/maddy |
showdoc is vulnerable to Cross-Site Request Forgery (CSRF) CVE-2021-4168, GHSA-7vxc-chqj-h83g | High | 0.6% | 26 Dec, 2021 | Packagist showdoc/showdoc |
An issue was discovered in split_region in uc.c in Unicorn Engine before 2.0.0-rc5. It allows local attackers to escape the sandbox. An attacker must first obtain the ability to execute crafted code in the target sandbox in order to exploit this vulnerability. The specific flaw exists within the vir CVE-2021-44078, PYSEC-2021-868 | High | 0.5% | 26 Dec, 2021 | PyPI unicorn |
Uncontrolled Resource Consumption in parse-link-header CVE-2021-23490, GHSA-q674-xm3x-2926 | High | 1.9% | 24 Dec, 2021 | npm parse-link-header |
Link Following in Iris CVE-2021-23772, GHSA-jcxc-rh6w-wf49, GO-2022-0272 | High | 1.9% | 24 Dec, 2021 | Go github.com/kataras/iris Go github.com/kataras/iris/v12 |
pytorch-lightning is vulnerable to Deserialization of Untrusted Data CVE-2021-4118, GHSA-2vj5-px25-gjrp, PYSEC-2021-874, PYSEC-2026-3968 | High | 1.0% | 23 Dec, 2021 | PyPI lightning PyPI pytorch-lightning |
Inefficient Regular Expression Complexity in nltk (word_tokenize, sent_tokenize) CVE-2021-43854, GHSA-f8m6-h2c7-8h9x, PYSEC-2021-859 | High | 2.8% | 23 Dec, 2021 | PyPI nltk |
Acclaim Systems USAHERDS Use of Hard-Coded Credentials Vulnerability CVE-2021-44207 | HighExploited | 17.4% | 21 Dec, 2021 | |
Drainage of FeeCollector's Block Transaction Fees in cronos CVE-2021-43839, GHSA-f854-hpxv-cw9r | High | 1.4% | 21 Dec, 2021 | Go github.com/crypto-org-chain/cronos Go github.com/tharsis/ethermint Go github.com/tharsis/evmos |
jsx-slack insufficient patch for CVE-2021-43838 ReDoS CVE-2021-43843, GHSA-hp68-xhvj-x6j6 | High | 2.0% | 20 Dec, 2021 | npm jsx-slack |
OS Command Injection in Laravel Framework CVE-2020-19316, GHSA-w2pm-r78h-4m7v | High | 2.5% | 20 Dec, 2021 | Packagist laravel/framework |
livehelperchat is vulnerable to Cross-Site Request Forgery (CSRF) BIT-livehelperchat-2021-4131, CVE-2021-4131, GHSA-hx77-5p88-f92r | High | 0.6% | 18 Dec, 2021 | Packagist remdex/livehelperchat |
snipe-it is vulnerable to Cross-Site Request Forgery (CSRF) CVE-2021-4130, GHSA-4w23-c97g-fq5v | High | 0.5% | 18 Dec, 2021 | Packagist snipe/snipe-it |
Classic Buffer Overflow in pyo CVE-2021-41499, GHSA-5f5c-687x-g5qm, PYSEC-2026-743 | High | 1.4% | 17 Dec, 2021 | PyPI pyo |