Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
`SparseFillEmptyRows` heap OOB BIT-tensorflow-2021-41224, CVE-2021-41224, GHSA-rg3m-hqc5-344v, PYSEC-2021-416, PYSEC-2021-633, PYSEC-2021-831 | High | 0.2% | 05 Nov, 2021 | PyPI tensorflow PyPI tensorflow-cpu PyPI tensorflow-gpu |
Heap OOB in `SparseBinCount` BIT-tensorflow-2021-41226, CVE-2021-41226, GHSA-374m-jm66-3vj8, PYSEC-2021-418, PYSEC-2021-635, PYSEC-2021-833 | High | 0.2% | 05 Nov, 2021 | PyPI tensorflow PyPI tensorflow-cpu PyPI tensorflow-gpu |
Unitialized access in `EinsumHelper::ParseEquation` BIT-tensorflow-2021-41201, CVE-2021-41201, GHSA-j86v-p27c-73fm, PYSEC-2021-394, PYSEC-2021-611, PYSEC-2021-809 | High | 0.2% | 05 Nov, 2021 | PyPI tensorflow PyPI tensorflow-cpu PyPI tensorflow-gpu |
Heap OOB read in `tf.raw_ops.SparseCountSparseOutput` BIT-tensorflow-2021-41210, CVE-2021-41210, GHSA-m342-ff57-4jcc, PYSEC-2021-402, PYSEC-2021-619, PYSEC-2021-817 | High | 0.2% | 05 Nov, 2021 | PyPI tensorflow PyPI tensorflow-cpu PyPI tensorflow-gpu |
Path traversal in grav CVE-2021-3924, GHSA-8c5p-4362-9333 | High | 4.4% | 05 Nov, 2021 | Packagist getgrav/grav |
Obsidian Dataview vulnerable to code injection due to unsafe eval CVE-2021-42057, GHSA-xfg5-vrmc-24wc | High | 1.2% | 04 Nov, 2021 | npm obsidian-dataview |
GraphiQL introspection schema template injection attack CVE-2021-41248, GHSA-x4r7-m2q9-69c8 | High | 1.3% | 04 Nov, 2021 | npm graphiql |
XSS vulnerability in GraphQL Playground from untrusted schemas CVE-2021-41249, GHSA-59r9-6jp6-jcm7 | High | 1.2% | 04 Nov, 2021 | npm graphql-playground-react |
incomplete JupyterHub logout with simultaneous JupyterLab sessions BIT-jupyterhub-2021-41247, CVE-2021-41247, GHSA-cw7p-q79f-m2v7, PYSEC-2021-386 | High | 0.8% | 04 Nov, 2021 | PyPI jupyterhub |
Antilles Dependency Confusion Vulnerability CVE-2021-3840, GHSA-hgc3-hp6x-wpgx, PYSEC-2021-840 | High | 2.0% | 03 Nov, 2021 | PyPI antilles-tools |
Inefficient Regular Expression Complexity in validator.js CVE-2021-3765, GHSA-qgmg-gppg-76g5 | High | 1.8% | 02 Nov, 2021 | npm validator |
ReDoS vulnerability in parser_apache2 BIT-fluentd-2021-41186, CVE-2021-41186, GHSA-hwhf-64mh-r662 | High | 2.2% | 29 Oct, 2021 | RubyGems fluentd |
Cross-Site Request Forgery in firefly-iii CVE-2021-3901, GHSA-rqgp-ccph-5w65 | High | 0.6% | 27 Oct, 2021 | Packagist grumpydictator/firefly-iii |
Embedded malware in ua-parser-js CVE-2021-4229, GHSA-pjwm-rvh2-c87w | High | 1.5% | 22 Oct, 2021 | npm ua-parser-js |
Duplicate Advisory: ReDoS via crafted JSON input in GJSON CVE-2021-42248, CVE-2021-42836, GHSA-c9gm-7rfj-8w5h, GHSA-ppj4-34rq-v8j9, GO-2021-0265 | High | 2.4% | 22 Oct, 2021 | Go github.com/tidwall/gjson |
Authentication Bypass Using an Alternate Path or Channel and Authentication Bypass by Primary Weakness in rucio-webui GHSA-v988-828w-xvf2 | High | Not scored | 22 Oct, 2021 | PyPI rucio-webui |
Maliciously Crafted Model Archive Can Lead To Arbitrary File Write CVE-2021-41127, GHSA-4365-fhm5-qcrx, PYSEC-2021-381 | High | 0.8% | 21 Oct, 2021 | PyPI rasa |
Arbitrary command execution on Windows via qutebrowserurl: URL handler CVE-2021-41146, GHSA-vw27-fwjf-5qxm, PYSEC-2021-382 | High | 1.5% | 21 Oct, 2021 | PyPI qutebrowser |
Directory Traversal in Babel CVE-2021-42771, GHSA-h4m5-qpfp-3mpv, PYSEC-2021-421 | High | 0.8% | 20 Oct, 2021 | PyPI babel |
modern-async's `forEachSeries` and `forEachLimit` functions do not limit the number of requests CVE-2021-41167, GHSA-3pcq-34w5-p4g2 | High | 1.7% | 20 Oct, 2021 | npm modern-async |
Camaleon CMS Insufficient Session Expiration vulnerability CVE-2021-25970, GHSA-438x-2p9v-g8h9 | High | 1.3% | 20 Oct, 2021 | RubyGems camaleon_cms |
Client metadata path-traversal CVE-2021-41131, GHSA-wjw6-2cqr-j4qr, PYSEC-2021-376 | High | 1.5% | 19 Oct, 2021 | PyPI tuf |
Apple Multiple Products Memory Corruption Vulnerability CVE-2021-30807 | HighExploited | 28.8% | 19 Oct, 2021 | |
Cross-Site Request Forgery in snipe-it CVE-2021-3858, GHSA-g92x-8m54-p89v | High | 0.5% | 19 Oct, 2021 | Packagist snipe/snipe-it |
Unrestricted File Upload vulnerability in Firefly III CVE-2021-3846, GHSA-5gq7-826w-8282 | High | 0.8% | 19 Oct, 2021 | Packagist grumpydictator/firefly-iii |
Apache Superset SQL Injection when template processing is enabled BIT-superset-2021-41971, CVE-2021-41971, GHSA-pg8m-4p8j-2p56, PYSEC-2021-378 | High | 1.8% | 18 Oct, 2021 | PyPI apache-superset |
Cross Site Request Forgery in kindeditor CVE-2021-42228, GHSA-3ww4-cp53-6g2x | High | 1.0% | 14 Oct, 2021 | npm kindeditor |
Draytek VigorConnect Path Traversal Vulnerability CVE-2021-20124 | HighExploited | 95.9% | 13 Oct, 2021 | |
Draytek VigorConnect Path Traversal Vulnerability CVE-2021-20123 | HighExploited | 90.3% | 13 Oct, 2021 | |
Microsoft Win32k Privilege Escalation Vulnerability CVE-2021-41357 | HighExploited | 1.5% | 13 Oct, 2021 | |
Microsoft Win32k Privilege Escalation Vulnerability CVE-2021-40450 | HighExploited | 1.5% | 13 Oct, 2021 | |
Microsoft Windows Win32k Privilege Escalation Vulnerability CVE-2021-40449 | HighExploited | 81.9% | 13 Oct, 2021 | |
Electron's sandboxed renderers can obtain thumbnails of arbitrary files through the nativeImage API CVE-2021-39184, GHSA-mpjm-v997-c4h4 | High | 1.1% | 12 Oct, 2021 | npm electron |
DOS and Open Redirect with user input CVE-2021-22964, GHSA-pgh6-m65r-2rhq | High | 1.0% | 12 Oct, 2021 | npm fastify-static |
Incorrect Privilege Assignment in HashiCorp Vault BIT-vault-2021-42135, CVE-2021-42135, GHSA-362v-wg5p-64w2, GO-2022-0578 | High | 0.8% | 11 Oct, 2021 | Go github.com/hashicorp/vault |
Google Chromium V8 Use-After-Free Vulnerability CVE-2021-37975 | HighExploited | 34.9% | 08 Oct, 2021 | |
Google Chromium V8 Out-of-Bounds Write Vulnerability CVE-2021-30632 | HighExploited | 63.2% | 08 Oct, 2021 | |
Directory traversal in mkdocs CVE-2021-40978, GHSA-qh9q-34h6-hcv9, PYSEC-2021-878 | High | 15.0% | 07 Oct, 2021 | PyPI mkdocs |
Samsung Mobile Devices Out-of-Bounds Read Vulnerability CVE-2021-25487 | HighExploited | 0.6% | 06 Oct, 2021 | |
Memory corruption when returning a literal struct with a private call inside of it CVE-2021-41121, GHSA-xv8x-pr4h-73jv, PYSEC-2021-365 | High | 1.1% | 06 Oct, 2021 | PyPI vyper |
golang.org/x/text/language Out-of-bounds Read vulnerability CVE-2021-38561, GHSA-ppp9-7jff-5vj2, GO-2021-0113 | High | 1.5% | 06 Oct, 2021 | Go golang.org/x/text |
S3 storage write is not aborted on errors leading to unbounded memory usage GHSA-m6m5-pp4g-fcc8, GO-2022-0374 | High | Not scored | 06 Oct, 2021 | Go github.com/foxcpp/maddy |
Deleted Admin Can Sign In to Admin Interface CVE-2021-41126, GHSA-6gjf-7w99-j7x7 | High | 1.1% | 06 Oct, 2021 | Packagist october/october Packagist october/system |
Sylius PayPal Plugin allows unauthorized access to Credit card form, exposing payer name and not requiring 3DS CVE-2021-41120, GHSA-25fx-mxc2-76g7 | High | 1.5% | 05 Oct, 2021 | Packagist sylius/paypal-plugin |
Splash authentication credentials potentially leaked to target websites CVE-2021-41124, GHSA-823f-cwm9-4g74, PYSEC-2021-364 | High | 1.1% | 05 Oct, 2021 | PyPI scrapy-splash |
Cross-Site-Request-Forgery in Backend BIT-typo3-2021-41113, CVE-2021-41113, GHSA-657m-v5vm-f6rw | High | 0.6% | 05 Oct, 2021 | Packagist typo3/cms Packagist typo3/cms-core |
Authentication bypass for viewing and deletions of snapshots BIT-grafana-2021-39226, CVE-2021-39226, GHSA-69j6-29vr-p3j9 | HighExploited | 99.9% | 05 Oct, 2021 | Go github.com/grafana/grafana |
Docker CLI leaks private registry credentials to registry-1.docker.io BIT-docker-cli-2021-41092, CVE-2021-41092, GHSA-99pg-grm5-qq3v, GO-2024-2912 | High | 1.7% | 04 Oct, 2021 | Go github.com/docker/cli |
Pterodactyl Panel vulnerable to authentication bypass due to improper user-provided security token verification CVE-2021-41129, GHSA-5vfx-8w6m-h3v4 | High | 1.8% | 04 Oct, 2021 | Packagist pterodactyl/panel |
Insufficiently restricted permissions on plugin directories CVE-2021-41103, GHSA-c2h3-6mxw-7mvq, GO-2022-0938 | High | 0.5% | 04 Oct, 2021 | Go github.com/containerd/containerd |