Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Code Injection in SLO Generator CVE-2021-22557, GHSA-j28r-j54m-gpc4, PYSEC-2021-429 | High | 1.6% | 04 Oct, 2021 | PyPI slo-generator |
Cobbler before 3.3.0 allows arbitrary file write operations via upload_log_data. CVE-2021-40324, GHSA-4cfr-gjfx-fj3x, PYSEC-2021-374 | High | 68.6% | 04 Oct, 2021 | PyPI cobbler |
Cobbler before 3.3.0 allows authorization bypass for modification of settings. CVE-2021-40325, GHSA-cr3f-r24j-3chw, PYSEC-2021-375 | High | 1.4% | 04 Oct, 2021 | PyPI cobbler |
LiveQuery publishes user session tokens in parse-server BIT-parse-2021-41109, CVE-2021-41109, GHSA-7pr3-p5fm-8r9x | High | 1.2% | 30 Sep, 2021 | npm parse-server |
CSV Injection Vulnerability CVE-2021-41824, GHSA-h7vq-5qgw-jwwq | High | 1.4% | 30 Sep, 2021 | Packagist craftcms/cms |
Inefficient Regular Expression Complexity in handsontable CVE-2021-23446, GHSA-hf66-r44g-p7j9 | High | 3.0% | 29 Sep, 2021 | npm handsontable |
User can obtain JWT token even if account is disabled GHSA-36mj-6r7r-mqhf | High | Not scored | 29 Sep, 2021 | Packagist ezsystems/ezplatform-rest |
CSV injection in shuup CVE-2021-25962, GHSA-663j-rjcr-789f, PYSEC-2021-355 | High | 1.1% | 29 Sep, 2021 | PyPI shuup |
Basic auth bypass in esphome CVE-2021-41104, GHSA-48mj-p7x2-5jfm, PYSEC-2021-351 | High | 1.2% | 28 Sep, 2021 | PyPI esphome |
Cross-Site Request Forgery in GilaCMS CVE-2020-20693, GHSA-hwqc-pgjw-vjqp | High | 0.7% | 27 Sep, 2021 | Packagist gilacms/gila |
Improper Restriction of XML External Entity Reference (XXE) in Nokogiri on JRuby CVE-2021-41098, GHSA-2rr5-8q37-2w7h | High | 1.5% | 27 Sep, 2021 | RubyGems nokogiri |
Regular Expression Denial of Service in jsoneditor CVE-2021-3822, GHSA-hhfg-6hfc-rvxm | High | 1.4% | 27 Sep, 2021 | npm jsoneditor |
inflect vulnerable to Inefficient Regular Expression Complexity CVE-2021-3820, GHSA-x55w-vjjp-222r | High | 1.2% | 27 Sep, 2021 | npm i |
Cross-Site Request Forgery in firefly-iii CVE-2021-3819, GHSA-356r-77q8-f64f | High | 0.5% | 27 Sep, 2021 | Packagist grumpydictator/firefly-iii |
NLTK Vulnerable to REDoS CVE-2021-3828, GHSA-2ww3-fxvq-293j, PYSEC-2021-356 | High | 1.6% | 27 Sep, 2021 | PyPI nltk |
furlongm openvpn-monitor command injection CVE-2021-31605, GHSA-4258-vcjw-wwxx, PYSEC-2021-353 | High | 3.4% | 27 Sep, 2021 | PyPI openvpn-monitor |
furlongm openvpn-monitor allows Authorization Bypass to disconnect arbitrary clients CVE-2021-31606, GHSA-5w5c-3g26-8mmc, PYSEC-2021-354 | High | 2.6% | 27 Sep, 2021 | PyPI openvpn-monitor |
D-Link DIR-605 Router Information Disclosure Vulnerability CVE-2021-40655 | HighExploited | 87.0% | 24 Sep, 2021 | |
Elvish vulnerable to remote code execution via the web UI backend CVE-2021-41088, GHSA-fpv6-f8jw-rc3r, GO-2022-0937 | High | 0.5% | 23 Sep, 2021 | Go github.com/elves/elvish |
Regular Expression Denial of Service in Leo Editor CVE-2020-23478, GHSA-x38q-xg2h-rxgx, PYSEC-2021-338 | High | 1.2% | 22 Sep, 2021 | PyPI leo |
Improper Input Validation and Command Injection in Ansible CVE-2021-3583, GHSA-2pfh-q76x-gwvm, PYSEC-2021-358 | High | 0.9% | 22 Sep, 2021 | PyPI ansible |
Clipboard-based XSS CVE-2021-41086, GHSA-qh7x-j4v8-qw5w | High | 0.9% | 21 Sep, 2021 | npm jsuites |
Apprise vulnerable to regex injection with IFTTT Plugin CVE-2021-39229, GHSA-qhmp-h54x-38qr, PYSEC-2021-327 | High | 1.9% | 20 Sep, 2021 | PyPI apprise |
Prototype Pollution in mixme GHSA-84p7-fh9c-6g8h | High | Not scored | 20 Sep, 2021 | npm mixme |
Files or Directories Accessible to External Parties in kubernetes CVE-2021-25741, GHSA-f5f7-6478-qm6p, GO-2022-0910 | High | 8.0% | 20 Sep, 2021 | Go k8s.io/kubernetes |
LIEF heap-buffer-overflow CVE-2021-32297, GHSA-22x7-vwh9-5w4g, PYSEC-2021-324 | High | 1.6% | 20 Sep, 2021 | PyPI lief |
Delta Electronics DOPSoft 2 Improper Input Validation Vulnerability CVE-2021-38406 | HighExploited | 76.4% | 17 Sep, 2021 | |
Inefficient Regular Expression Complexity in code-server CVE-2021-3810, GHSA-49x3-8228-3w3m | High | 1.3% | 17 Sep, 2021 | npm code-server |
Inefficient Regular Expression Complexity in chalk/ansi-regex CVE-2021-3807, GHSA-93q8-gq69-wqmw | High | 3.6% | 17 Sep, 2021 | npm ansi-regex |
Inefficient Regular Expression Complexity in taro CVE-2021-3804, GHSA-468q-v4jj-485h | High | 1.3% | 17 Sep, 2021 | npm @tarojs/helper |
Inefficient Regular Expression Complexity in nth-check CVE-2021-3803, GHSA-rp65-9cf3-cjxr | High | 2.2% | 17 Sep, 2021 | npm nth-check |
Prototype Pollution in object-path CVE-2021-3805, GHSA-8v63-cqqc-6r2c | High | 2.0% | 17 Sep, 2021 | npm object-path |
semver-regex Regular Expression Denial of Service (ReDOS) CVE-2021-3795, GHSA-44c6-4v22-4mhx | High | 1.5% | 15 Sep, 2021 | npm semver-regex |
Drupal core access bypass vulnerability BIT-drupal-2020-13677, CVE-2020-13677, DRUPAL-CORE-2021-010, GHSA-3xr3-phjp-g6p2 | High | 1.2% | 15 Sep, 2021 | Packagist drupal/core |
Inefficient Regular Expression Complexity in vuelidate CVE-2021-3794, GHSA-vvf2-ppj9-pp49 | High | 1.2% | 15 Sep, 2021 | npm @vuelidate/validators |
Microsoft MSHTML Remote Code Execution Vulnerability CVE-2021-40444 | HighExploited | 97.8% | 15 Sep, 2021 | |
Microsoft Open Management Infrastructure (OMI) Privilege Escalation Vulnerability CVE-2021-38649 | HighExploited | 2.9% | 15 Sep, 2021 | |
Microsoft Open Management Infrastructure (OMI) Privilege Escalation Vulnerability CVE-2021-38648 | HighExploited | 11.4% | 15 Sep, 2021 | |
Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability CVE-2021-38646 | HighExploited | 8.0% | 15 Sep, 2021 | |
Microsoft Open Management Infrastructure (OMI) Privilege Escalation Vulnerability CVE-2021-38645 | HighExploited | 2.7% | 15 Sep, 2021 | |
Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability CVE-2021-36955 | HighExploited | 4.1% | 15 Sep, 2021 | |
tmpl vulnerable to Inefficient Regular Expression Complexity which may lead to resource exhaustion CVE-2021-3777, GHSA-jgrx-mgxx-jf9v | High | 1.3% | 15 Sep, 2021 | npm tmpl |
Any storage file can be downloaded from p.sh if full server path is known GHSA-2rh5-jvgx-pgw3 | High | Not scored | 14 Sep, 2021 | Packagist ezsystems/ezplatform |
Any storage file can be downloaded from p.sh if full server path is known GHSA-gqcf-83rq-gpfr | High | Not scored | 14 Sep, 2021 | Packagist ibexa/post-install |
SAP NetWeaver Unrestricted File Upload Vulnerability CVE-2021-38163 | HighExploited | 36.9% | 14 Sep, 2021 | |
Clearance Gem Open Redirect Vulnerability CVE-2021-23435, GHSA-4hpq-rjcx-7vj9, SNYK-RUBY-CLEARANCE-1577284 | High | 0.7% | 12 Sep, 2021 | RubyGems clearance |
Deserialization of Untrusted Data in parlai CVE-2021-24040, CVE-2021-39207, GHSA-m87f-9fvv-2mgg, GHSA-mwgj-7x7j-6966, PYSEC-2021-330, PYSEC-2021-334 | High | 17.4% | 10 Sep, 2021 | PyPI parlai |
StripComments filter contains a regular expression that is vulnerable to ReDOS (Regular Expression Denial of Service) CVE-2021-32839, GHSA-p5w8-wqhj-9hhf, PYSEC-2021-333 | High | 2.3% | 10 Sep, 2021 | PyPI sqlparse |
Infinite Loop in rencode CVE-2021-40839, GHSA-gh8j-2pgf-x458, PYSEC-2021-345 | High | 5.5% | 10 Sep, 2021 | PyPI rencode |
Incorrect Authorization with specially crafted requests BIT-envoy-2021-39206, CVE-2021-39206, GHSA-cfc2-wjcm-c8fm | High | 1.5% | 09 Sep, 2021 | Go github.com/pomerium/pomerium |