Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
bounter Null pointer reference CVE-2021-41497, GHSA-74xw-gwfm-7pv7, PYSEC-2021-880 | High | 1.1% | 17 Dec, 2021 | PyPI bounter |
Pyo Buffer Overflow Vulnerability CVE-2021-41498, GHSA-qj27-32wp-ghrg, PYSEC-2021-890 | High | 1.2% | 17 Dec, 2021 | PyPI pyo |
Incorrect Comparison in cvxopt CVE-2021-41500, GHSA-8rh6-h94m-vj54, PYSEC-2021-870 | High | 1.2% | 17 Dec, 2021 | PyPI cvxopt |
Unrestricted Upload of File with Dangerous Type in unisharp/laravel-filemanager CVE-2021-23814, GHSA-f8x6-m9f5-ffp8, SNYK-PHP-UNISHARPLARAVELFILEMANAGER-1567199 | High | 1.8% | 17 Dec, 2021 | Packagist unisharp/laravel-filemanager |
NumPy NULL Pointer Dereference CVE-2021-41495, GHSA-5545-2q6w-2gh6, PYSEC-2021-856 | High | 1.2% | 17 Dec, 2021 | PyPI numpy |
Regular Expression Denial of Service (ReDoS) in jsx-slack CVE-2021-43838, GHSA-55xv-f85c-248q | High | 1.4% | 17 Dec, 2021 | npm jsx-slack |
Omnissa Workspace ONE Server-Side Request Forgery CVE-2021-22054 | HighExploited | 99.7% | 17 Dec, 2021 | |
PHP file inclusion in the Sulu admin panel CVE-2021-43836, GHSA-vx6j-pjrh-vgjh | High | 2.0% | 15 Dec, 2021 | Packagist sulu/sulu |
Privilege escalation in the Sulu Admin panel CVE-2021-43835, GHSA-84px-q68r-2fc9 | High | 1.2% | 15 Dec, 2021 | Packagist sulu/sulu |
Android Kernel Use-After-Free Vulnerability CVE-2021-1048 | HighExploited | 1.1% | 15 Dec, 2021 | |
Microsoft Windows AppX Installer Spoofing Vulnerability CVE-2021-43890 | HighExploited | 11.3% | 15 Dec, 2021 | |
Microsoft Windows Privilege Escalation Vulnerability CVE-2021-43226 | HighExploited | 3.3% | 15 Dec, 2021 | |
YetiForceCRM is vulnerable to Business Logic Errors because product amount can be a negative number CVE-2021-4111, GHSA-7v7w-f7c6-f829 | High | 0.6% | 15 Dec, 2021 | Packagist yetiforce/yetiforce-crm |
Improper Initialization in OpenZeppelin CVE-2021-46320, CVE-2022-39384, GHSA-88g8-f5mf-f5rj, GHSA-9c22-pwxw-p6hx | High | 1.2% | 14 Dec, 2021 | npm @openzeppelin/contracts npm @openzeppelin/contracts-upgradeable |
Unsafe inline XSS in pasting DOM element into chat CVE-2021-39183, GHSA-2hfj-cxw7-g45p, GO-2022-0291 | High | 0.8% | 14 Dec, 2021 | Go github.com/owncast/owncast |
SQL injection in jackalope/jackalope-doctrine-dbal CVE-2021-43822, GHSA-ph98-v78f-jqrm | High | 1.0% | 13 Dec, 2021 | Packagist jackalope/jackalope-doctrine-dbal |
Uncaught Exception in mercurius CVE-2021-43801, GHSA-273r-rm8g-7f3x | High | 1.6% | 13 Dec, 2021 | npm mercurius |
lxml's HTML Cleaner allows crafted and SVG embedded scripts to pass through CVE-2021-43818, GHSA-55x5-fj6c-h6m8, PYSEC-2021-852 | High | 2.6% | 13 Dec, 2021 | PyPI lxml |
GitLab Community and Enterprise Editions Server-Side Request Forgery (SSRF) Vulnerability CVE-2021-39935 | HighExploited | 36.1% | 13 Dec, 2021 | |
Improper Authentication in Flask-AppBuilder CVE-2021-41265, GHSA-m3rf-7m4w-r66q, PYSEC-2021-851 | High | 1.3% | 09 Dec, 2021 | PyPI Flask-AppBuilder PyPI flask-appbuilder |
Session fixation in express-openid-connect CVE-2021-41246, GHSA-7rg2-qxmf-hhx9 | High | 0.9% | 09 Dec, 2021 | npm express-openid-connect |
Code injection via unsafe YAML loading CVE-2021-43811, GHSA-ggmr-44cv-24pm, PYSEC-2021-848 | High | 2.5% | 08 Dec, 2021 | PyPI sockeye |
APM Java Agent Local Privilege Escalation CVE-2021-37941, GHSA-r562-m862-63w3, PYSEC-2026-634 | High | 0.2% | 08 Dec, 2021 | PyPI elastic-apm |
Local Code Execution through Argument Injection via dash leading git url parameter in Gemfile. CVE-2021-43809, GHSA-fj7f-vq84-fh43 | High | 2.9% | 08 Dec, 2021 | RubyGems bundler |
Instance config inline secret exposure in Grafana CVE-2021-41090, GHSA-9c4x-5hgq-q3wh, GO-2022-0305 | High | 0.8% | 08 Dec, 2021 | Go github.com/grafana/agent |
FatPipe WARP, IPVPN, and MPVPN Configuration Upload exploit CVE-2021-27860 | HighExploited | 39.7% | 08 Dec, 2021 | |
Potential bypass of an upstream access control based on URL paths in Django BIT-django-2021-44420, CVE-2021-44420, GHSA-v6rh-hp5x-86rv, PYSEC-2021-439 | High | 2.4% | 08 Dec, 2021 | PyPI Django PyPI django |
Improper Privilege Management in devise_masquerade CVE-2021-28680, GHSA-25f5-gc4h-hc22 | High | 1.3% | 07 Dec, 2021 | RubyGems devise_masquerade |
Unexpected server crash in Next.js. CVE-2021-43803, GHSA-25mp-g6fv-mqxx | High | 47.3% | 07 Dec, 2021 | npm next |
Grafana path traversal BIT-grafana-2021-43798, CVE-2021-43798, GHSA-8pjx-jj86-j47p | HighExploited | 88.5% | 07 Dec, 2021 | Go github.com/grafana/grafana |
ReDos vulnerability on guest checkout email validation CVE-2021-43805, GHSA-qxmr-qxh6-2cc9 | High | 1.4% | 07 Dec, 2021 | RubyGems solidus_core |
Server-Side Request Forgery in snipe/snipe-it CVE-2021-4075, GHSA-553q-hpvp-q8pc | High | 0.9% | 06 Dec, 2021 | Packagist snipe/snipe-it |
Improper Authentication in HashiCorp Nomad CVE-2021-43415, GHSA-2jhh-5xm2-j4gf, GO-2022-0573 | High | 1.2% | 03 Dec, 2021 | Go github.com/hashicorp/nomad |
Code injection in plupload CVE-2021-23562, GHSA-rp2c-jrgp-cvr8 | High | 1.0% | 03 Dec, 2021 | npm plupload |
Information exposure in elgg CVE-2021-3980, GHSA-hx6g-q9v2-xh7v | High | 1.6% | 03 Dec, 2021 | Packagist elgg/elgg |
Cross Site Request Forgery in mailman CVE-2021-44227, GHSA-xq58-69h2-765m, PYSEC-2026-660 | High | 0.8% | 02 Dec, 2021 | PyPI mailman |
RCE vulnerability affecting v1beta3 templates in @backstage/plugin-scaffolder-backend GHSA-2g8g-63j4-9w3r | High | Not scored | 01 Dec, 2021 | npm @backstage/plugin-scaffolder-backend |
showdoc is vulnerable to Cross-Site Request Forgery (CSRF) CVE-2021-4017, GHSA-f77h-m9w2-vvg2 | High | 0.6% | 01 Dec, 2021 | Packagist showdoc/showdoc |
Path Traversal in @backstage/plugin-scaffolder-backend CVE-2021-43783, GHSA-mg3m-f475-28hv | High | 1.2% | 29 Nov, 2021 | npm @backstage/plugin-scaffolder-backend |
Cross-Site Scripting Vulnerability in @joeattardi/emoji-button CVE-2021-43785, GHSA-f34m-x9pj-62vq | High | 1.0% | 26 Nov, 2021 | npm @joeattardi/emoji-button |
Cross-Site Scripting vulnerability in @backstage/plugin-auth-backend CVE-2021-43776, GHSA-w7fj-336r-vw49 | High | 0.7% | 26 Nov, 2021 | npm @backstage/plugin-auth-backend |
Potential Zip Slip Vulnerability in baserCMS CVE-2021-41279, GHSA-4x2f-54wr-4hjg | High | 1.6% | 26 Nov, 2021 | Packagist baserproject/basercms |
Cookie persistence after password changes in symfony/security-bundle BIT-symfony-2021-41268, CVE-2021-41268, GHSA-qw36-p97w-vcqr | High | 1.3% | 24 Nov, 2021 | Packagist symfony/security-bundle Packagist symfony/symfony |
Google Chromium V8 Memory Corruption Vulnerability CVE-2021-38003 | HighExploited | 38.6% | 23 Nov, 2021 | |
Path traversal in Matrix Synapse CVE-2021-41281, GHSA-3hfw-x7gx-437c, PYSEC-2021-436 | High | 1.6% | 23 Nov, 2021 | PyPI matrix-synapse |
Improper certificate management in AWS IoT Device SDK v2 CVE-2021-40828, GHSA-94jq-q5v2-76wj, PYSEC-2021-861 | High | 0.4% | 23 Nov, 2021 | Maven software.amazon.awssdk.iotdevicesdk:aws-iot-device-sdk PyPI awsiotsdk npm aws-iot-device-sdk-v2 |
Improper certificate management in AWS IoT Device SDK v2 CVE-2021-40829, GHSA-743r-5g92-5vgf, PYSEC-2021-862 | High | 0.4% | 23 Nov, 2021 | Maven software.amazon.awssdk.iotdevicesdk:aws-iot-device-sdk PyPI awsiotsdk npm aws-iot-device-sdk-v2 |
Improper certificate management in AWS IoT Device SDK v2 CVE-2021-40830, GHSA-c4rh-4376-gff4, PYSEC-2021-863 | High | 0.4% | 23 Nov, 2021 | Maven software.amazon.awssdk.iotdevicesdk:aws-iot-device-sdk PyPI awsiotsdk npm aws-iot-device-sdk-v2 |
Improper certificate management in AWS IoT Device SDK v2 CVE-2021-40831, GHSA-j3f7-7rmc-6wqj, PYSEC-2021-864 | High | 0.6% | 23 Nov, 2021 | Maven software.amazon.awssdk.iotdevicesdk:aws-iot-device-sdk PyPI awsiotsdk npm aws-iot-device-sdk-v2 |
Server-Side Request Forgery in ssrf-agent CVE-2021-23718, GHSA-6gww-qpm6-mc2g | High | 1.6% | 22 Nov, 2021 | npm ssrf-agent |