Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Cross-site scripting CVE-2021-21422, GHSA-7p8h-86p5-wv3p | High | 1.6% | 21 Jun, 2021 | npm mongo-express |
ReDOS in IS-SVG CVE-2021-29059, GHSA-r8j5-h5cx-65gg | High | 2.6% | 21 Jun, 2021 | npm is-svg |
Authentication granted to all firewalls instead of just one BIT-symfony-2021-32693, CVE-2021-32693, GHSA-rfcf-m67m-jcrq | High | 1.4% | 17 Jun, 2021 | Packagist symfony/security-http Packagist symfony/symfony |
PHPMailer untrusted code may be run from an overridden address validator BIT-phpmailer-2021-3603, CVE-2021-3603, GHSA-77mr-wc79-m8j3 | High | 2.3% | 17 Jun, 2021 | Packagist phpmailer/phpmailer |
Helm passes repository credentials to alternate domain BIT-helm-2021-32690, CVE-2021-32690, GHSA-56hp-xqp3-w2jf, GHSA-7jr6-prv4-5wf5, GO-2022-0384 | High | 1.4% | 16 Jun, 2021 | Go helm.sh/helm/v3 |
Remote Code Execution vulnerability in PHPMailer 6.4.1 running on Windows BIT-phpmailer-2021-34551, CVE-2021-34551, GHSA-7q44-r25x-wm4q | High | 2.8% | 16 Jun, 2021 | Packagist phpmailer/phpmailer |
Prototype pollution in supermixer CVE-2020-24939, GHSA-7prf-vw4p-qr59 | High | 1.7% | 16 Jun, 2021 | npm supermixer |
Google Chromium V8 Type Confusion Vulnerability CVE-2021-30551 | HighExploited | 64.7% | 15 Jun, 2021 | |
Prototype Pollution in nedb CVE-2021-23395, GHSA-339j-hqgx-qrrx | High | 0.9% | 15 Jun, 2021 | npm nedb |
OpenPLC ScadaBR Unrestricted Upload of File with Dangerous Type Vulnerability CVE-2021-26828 | HighExploited | 39.1% | 11 Jun, 2021 | |
Cross-Site Request Forgery (CSRF) in FastAPI CVE-2021-32677, GHSA-8h2j-cgx8-6xv7, PYSEC-2021-100 | High | 0.7% | 09 Jun, 2021 | PyPI fastapi |
Qualcomm Multiple Chipsets Improper Input Validation Vulnerability CVE-2020-11261 | HighExploited | 1.5% | 09 Jun, 2021 | |
Microsoft Windows MSHTML Platform Remote Code Execution Vulnerability CVE-2021-33742 | HighExploited | 59.4% | 08 Jun, 2021 | |
Microsoft Desktop Window Manager (DWM) Core Library Privilege Escalation Vulnerability CVE-2021-33739 | HighExploited | 6.6% | 08 Jun, 2021 | |
Microsoft Windows NTFS Privilege Escalation Vulnerability CVE-2021-31956 | HighExploited | 22.3% | 08 Jun, 2021 | |
Microsoft Windows Print Spooler Remote Code Execution Vulnerability CVE-2021-1675 | HighExploited | 85.3% | 08 Jun, 2021 | |
Remote Code Execution via traversal in TAL expressions CVE-2021-32674, GHSA-5vq5-pg3r-9ph3, GHSA-rpcg-f9q6-2mq6, PYSEC-2021-104 | High | 1.6% | 08 Jun, 2021 | PyPI Zope PyPI zope |
Django Access Control Bypass possibly leading to SSRF, RFI, and LFI attacks BIT-django-2021-33571, CVE-2021-33571, GHSA-p99v-5w3c-jqq9, PYSEC-2021-99 | High | 5.3% | 08 Jun, 2021 | PyPI Django PyPI django |
Uncontrolled Resource Consumption in locutus CVE-2021-23392, GHSA-39q4-p535-c852, SNYK-JS-LOCUTUS-1090597 | High | 1.9% | 08 Jun, 2021 | npm locutus |
Reflected cross-site scripting issue in Datasette CVE-2021-32670, GHSA-gff3-739c-gxfq, GHSA-xw7c-jx9m-xh5g, PYSEC-2021-89 | High | 1.0% | 07 Jun, 2021 | PyPI datasette |
Calipso Arbitrary File Write via Archive Extraction (Zip Slip) CVE-2021-23391, GHSA-jxcc-g75x-qgw9 | High | 0.4% | 07 Jun, 2021 | npm calipso |
Exposure of Sensitive Information to an Unauthorized Actor in foreman_fog_proxmox CVE-2021-20259, GHSA-f2rp-4rv7-fc95 | High | 0.3% | 07 Jun, 2021 | RubyGems foreman_fog_proxmox |
Withdrawn Advisory: kubernetes-nmstate Insecure Privilege Management CVE-2020-1742, GHSA-jw82-xjgr-g6f8 | High | 0.3% | 07 Jun, 2021 | Go github.com/nmstate/kubernetes-nmstate |
Observable Timing Discrepancy in aaugustin websockets library CVE-2021-33880, GHSA-8ch4-58qp-g3mp, PYSEC-2021-95 | High | 2.3% | 06 Jun, 2021 | PyPI websockets |
Reflected XSS when using flashMessages or languageDictionary CVE-2021-32641, GHSA-jr3j-whm4-9wwm | High | 1.5% | 04 Jun, 2021 | npm auth0-lock |
Script injection CVE-2021-32661, GHSA-gg96-f8wr-p89f | High | 1.2% | 03 Jun, 2021 | npm @backstage/plugin-techdocs |
Script injection CVE-2021-32660, GHSA-pwhf-39xg-4rxw | High | 1.3% | 03 Jun, 2021 | npm @backstage/techdocs-common |
glob-parent vulnerable to Regular Expression Denial of Service in enclosure regex BIT-gulp-2020-28469, CVE-2020-28469, GHSA-ww39-953v-wcq6 | High | 4.6% | 03 Jun, 2021 | npm glob-parent |
Invalid session token expiration BIT-vault-2021-32923, CVE-2021-32923, GHSA-38j9-7pp9-2hjw, GO-2022-0623 | High | 1.4% | 03 Jun, 2021 | Go github.com/hashicorp/vault |
Potential infinite loop in Pillow BIT-pillow-2021-28676, CVE-2021-28676, GHSA-7r7m-5h27-29hp, PYSEC-2021-92 | High | 2.5% | 02 Jun, 2021 | PyPI Pillow PyPI pillow |
Uncontrolled Resource Consumption in Pillow BIT-pillow-2021-28677, CVE-2021-28677, GHSA-q5hq-fp76-qmrc, PYSEC-2021-93 | High | 2.5% | 02 Jun, 2021 | PyPI Pillow PyPI pillow |
Pillow denial of service BIT-pillow-2021-28675, CVE-2021-28675, GHSA-g6rj-rv7j-xwp4, PYSEC-2021-139 | High | 1.0% | 02 Jun, 2021 | PyPI Pillow PyPI pillow |
Catastrophic backtracking in URL authority parser when passed URL containing many @ characters CVE-2021-33503, GHSA-q2q7-5pp4-w6pg, PYSEC-2021-108 | High | 3.3% | 01 Jun, 2021 | PyPI urllib3 |
Access control flaw in Kiali CVE-2021-3495, GHSA-mv55-23xp-3wp8, GO-2022-0645 | High | 1.0% | 01 Jun, 2021 | Go github.com/kiali/kiali |
Regular expression denial of service in react-native CVE-2020-1920, GHSA-7f53-fmmv-mfjv | High | 1.4% | 01 Jun, 2021 | npm react-native |
Denial of service in css-what CVE-2021-33587, GHSA-q8pj-2vqx-8ggc | High | 2.0% | 28 May, 2021 | npm css-what |
constructEvent does not verify header GHSA-4g53-vp7q-gfjv | High | Not scored | 28 May, 2021 | npm @worker-tools/stripe-webhook |
Openstack Neutron has Insufficient Verification of IPv6 addresses CVE-2021-20267, GHSA-w8hx-f868-pvch, PYSEC-2021-136 | High | 1.0% | 28 May, 2021 | PyPI neutron |
Uncontrolled Resource Consumption in trim-newlines CVE-2021-33623, GHSA-7p7h-4mm5-852v | High | 2.9% | 28 May, 2021 | npm trim-newlines |
Listing of upload directory contents possible GHSA-qmfx-75ff-8mw6, GO-2022-0407 | High | Not scored | 27 May, 2021 | Go github.com/ThomasLeister/prosody-filer |
Ivanti Pulse Connect Secure Unrestricted File Upload Vulnerability CVE-2021-22900 | HighExploited | 14.1% | 27 May, 2021 | |
Ivanti Pulse Connect Secure Command Injection Vulnerability CVE-2021-22899 | HighExploited | 22.9% | 27 May, 2021 | |
Ivanti Pulse Connect Secure Collaboration Suite Buffer Overflow Vulnerability CVE-2021-22894 | HighExploited | 41.3% | 27 May, 2021 | |
Arbitrary Code Execution in json-ptr GHSA-rrqv-vjrw-hrcr | High | Not scored | 26 May, 2021 | npm json-ptr |
golang.org/x/net/html Infinite Loop vulnerability BIT-golang-2021-33194, CVE-2021-33194, GHSA-83g2-8m93-v3w7, GO-2021-0238 | High | 7.5% | 26 May, 2021 | Go golang.org/x/net |
Exposure of sensitive information to an unauthorized actor in HyperKitty CVE-2021-33038, GHSA-h39g-q63v-4h9p, PYSEC-2021-77 | High | 1.8% | 26 May, 2021 | PyPI HyperKitty PyPI hyperkitty |
Insertion of Sensitive Information into Log File in ansible CVE-2021-20178, GHSA-wv5p-gmmv-wh9v, PYSEC-2021-106 | High | 0.3% | 26 May, 2021 | PyPI ansible |
mount destinations can be swapped via symlink-exchange to cause mounts outside the rootfs CVE-2021-30465, GHSA-c3xm-pvg7-gh7r, GO-2022-0914 | High | 10.2% | 25 May, 2021 | Go github.com/opencontainers/runc |
Improper rate limiting in Koel CVE-2021-33563, GHSA-r37h-j483-cjjm | High | 0.8% | 24 May, 2021 | Packagist phanan/koel |
Arm Mali GPU Kernel Driver Use-After-Free Vulnerability CVE-2021-29256 | HighExploited | 3.0% | 24 May, 2021 |