Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Google Chromium V8 Type Confusion Vulnerability CVE-2021-21224 | HighExploited | 84.2% | 26 Apr, 2021 | |
Google Chromium V8 Improper Input Validation Vulnerability CVE-2021-21220 | HighExploited | 70.4% | 26 Apr, 2021 | |
Google Chromium Blink Use-After-Free Vulnerability CVE-2021-21206 | HighExploited | 9.3% | 26 Apr, 2021 | |
Regular Expression Denial of Service in postcss CVE-2021-23382, GHSA-566m-qj78-rww5 | High | 2.6% | 26 Apr, 2021 | npm postcss |
Prototype Pollution in jquery-bbq CVE-2021-20086, GHSA-7w8j-85wm-6xfq | High | 6.1% | 23 Apr, 2021 | npm jquery-bbq |
Prototype Pollution in backbone-query-parameters CVE-2021-20085, GHSA-8qpm-5c82-rf96 | High | 1.6% | 23 Apr, 2021 | npm backbone-query-parameters |
jquery-plugin-query-object contains prototype pollution vulnerability CVE-2021-20083, GHSA-q9xg-h756-8689 | High | 4.2% | 23 Apr, 2021 | npm jquery-query-object |
Node-Redis potential exponential regex in monitor mode CVE-2021-29469, GHSA-35q2-47q7-3pc3 | High | 1.6% | 23 Apr, 2021 | npm redis |
ExifTool Remote Code Execution Vulnerability CVE-2021-22204 | HighExploited | 100.0% | 23 Apr, 2021 | |
mootools-more vulnerable to prototype pollution CVE-2021-20088, GHSA-fw45-938v-p26j | High | 1.4% | 23 Apr, 2021 | npm mootools-more |
Prototype Pollution in jquery-deparam CVE-2021-20087, GHSA-xg68-chx2-253g | High | 2.1% | 23 Apr, 2021 | npm jquery-deparam |
Metasploit Framework user exposes Metasploit to same deserialization issue that is exploited by that module CVE-2020-7385, GHSA-xgww-h98f-24qf | High | 1.8% | 23 Apr, 2021 | RubyGems metasploit-framework |
Command Injection in SaltStack Salt CVE-2021-31607, GHSA-hcjf-rp5h-g5h3, PYSEC-2021-56 | High | 5.9% | 23 Apr, 2021 | PyPI salt |
REXML round-trip instability BIT-ruby-2021-28965, BIT-ruby-min-2021-28965, CVE-2021-28965, GHSA-8cr8-4vfw-mr7h | High | 5.1% | 21 Apr, 2021 | RubyGems rexml |
Improper validation of URLs ('Cross-site Scripting') in Wagtail rich text fields CVE-2021-29434, GHSA-wq5h-f9p5-q7fx, PYSEC-2021-114 | High | 0.6% | 19 Apr, 2021 | PyPI wagtail |
VVE-2021-0001: Memory corruption using function calls within arrays CVE-2021-48020, GHSA-22wc-c9wj-6q2v | High | 0.3% | 19 Apr, 2021 | PyPI vyper |
Arbitrary command execution in roar-pidusage CVE-2021-23380, GHSA-xfxf-qw26-hr33 | High | 1.2% | 18 Apr, 2021 | npm roar-pidusage |
Linux Kernel Privilege Escalation Vulnerability CVE-2021-3493 | HighExploited | 49.2% | 17 Apr, 2021 | |
Any logged in user could edit any other logged in user. CVE-2021-29452, GHSA-8hw9-22v6-9jr9 | High | 0.8% | 16 Apr, 2021 | npm @curveball/a12n-server |
Broken Authentication in Atlassian Connect Express CVE-2021-26073, GHSA-4v96-m8xv-x83v | High | 0.9% | 16 Apr, 2021 | npm atlassian-connect-express |
BLS Signature "Malleability" CVE-2021-21405, GHSA-4g52-pqcj-phvh, GO-2022-0905 | High | 1.0% | 15 Apr, 2021 | Go github.com/filecoin-project/lotus |
Sydent vulnerable to denial of service attack via memory exhaustion CVE-2021-29430, GHSA-wmg4-8cp2-hpg9, PYSEC-2021-21 | High | 1.8% | 15 Apr, 2021 | PyPI matrix-sydent |
socks Infinite Loop vulnerability CVE-2013-10005, GHSA-gxgj-xjcw-fv9p, GO-2020-0024 | High | 0.8% | 14 Apr, 2021 | Go github.com/btcsuite/go-socks Go github.com/btcsuitereleases/go-socks |
robbert229/jwt's token validation methods vulnerable to a timing side-channel during HMAC comparison CVE-2015-10004, GHSA-5vw4-v588-pgv8, GO-2020-0023 | High | 0.8% | 14 Apr, 2021 | Go github.com/robbert229/jwt |
Golf may allow attacker to bypass CSRF protections due to weak PRNG CVE-2016-15005, GHSA-q9qr-jwpw-3qvv, GO-2020-0045 | High | 0.4% | 14 Apr, 2021 | Go github.com/dinever/golf |
Tendermint Client package vulnerable to Uncontrolled Resource Consumption CVE-2019-25072, GHSA-3fm3-m23v-5r46, GO-2020-0037 | High | 1.2% | 14 Apr, 2021 | Go github.com/tendermint/tendermint |
Goa vulnerable to path traversal CVE-2019-25073, GHSA-fjgq-224f-fq37, GO-2020-0032 | High | 1.5% | 14 Apr, 2021 | Go github.com/goadesign/goa Go goa.design/goa Go goa.design/goa/v3 |
ahh vulnerable to Path Traversal CVE-2020-36559, GHSA-vp56-r7qv-783v, GO-2020-0033 | High | 1.2% | 14 Apr, 2021 | Go aahframe.work Go github.com/go-aah/aah |
shiyanhui/dht vulnerable to Uncontrolled Resource Consumption CVE-2020-36562, GHSA-p6fg-723f-hgpw, GO-2020-0040 | High | 0.8% | 14 Apr, 2021 | Go github.com/shiyanhui/dht |
nosurf vulnerable to improper input validation CVE-2020-36564, GHSA-5x84-q523-vvwr, GO-2020-0049 | High | 0.8% | 14 Apr, 2021 | Go github.com/justinas/nosurf |
Gin's default logger allows unsanitized input that can allow remote attackers to inject arbitrary log lines CVE-2020-36567, GHSA-6vm3-jj99-7229, GO-2020-0001 | High | 1.5% | 14 Apr, 2021 | Go github.com/gin-gonic/gin |
revel is vulnerable to resource exhaustion CVE-2020-36568, GHSA-hggr-p7v6-73p5, GO-2020-0003 | High | 1.6% | 14 Apr, 2021 | Go github.com/revel/revel |
Duplicate Advisory: gosaml2 is vulnerable to NULL Pointer Dereference from malformed XML signatures CVE-2020-7711, CVE-2020-7731, GHSA-gq5r-cc4w-g8xf, GHSA-mqqv-chpx-vq25, GHSA-prjq-f4q3-fvfr, GO-2020-0046, SNYK-GOLANG-GITHUBCOMRUSSELLHAERINGGOSAML2-608302 | High | 1.8% | 14 Apr, 2021 | Go github.com/russellhaering/gosaml2 Go github.com/russellhaering/goxmldsig |
github.com/ulikunitz/xz fixes readUvarint Denial of Service (DoS) CVE-2021-29482, GHSA-25xm-hr59-7c27, GO-2020-0016 | High | 1.4% | 14 Apr, 2021 | Go github.com/ulikunitz/xz |
Infinite loop in Yubico yubihsm-connector CVE-2021-28484, GHSA-8m9g-647g-5pxw | High | 1.5% | 14 Apr, 2021 | Go github.com/Yubico/yubihsm-connector |
Grav's Twig processing allowing dangerous PHP functions by default CVE-2021-29440, GHSA-g8r4-p96j-xfxc | High | 29.9% | 13 Apr, 2021 | Packagist getgrav/grav |
Improper Privilege Management in Azure ms-rest-nodeauth CVE-2021-28458, GHSA-qpfw-4m9x-rxx8 | High | 2.0% | 13 Apr, 2021 | npm @azure/ms-rest-nodeauth |
Microsoft Win32k Privilege Escalation Vulnerability CVE-2021-28310 | HighExploited | 8.4% | 13 Apr, 2021 | |
Denial of Service (DoS) in mongo-express CVE-2021-23372, GHSA-m2r3-8492-vx59 | High | 0.9% | 13 Apr, 2021 | npm mongo-express |
Cross-Site Request Forgery (CSRF) in trestle-auth CVE-2021-29435, GHSA-h8hx-2c5r-32cf | High | 0.7% | 13 Apr, 2021 | RubyGems trestle-auth |
Open redirect via transitional IPv6 addresses on dual-stack networks CVE-2021-21392, GHSA-5wrh-4jwv-5w78, PYSEC-2021-25 | High | 0.9% | 12 Apr, 2021 | PyPI matrix-synapse |
Denial of service in chrono-node CVE-2021-23371, GHSA-hpmr-g4pq-jhgp, SNYK-JS-CHRONONODE-1083228 | High | 2.0% | 12 Apr, 2021 | npm chrono-node |
Reject unauthorized access with GitHub PATs CVE-2021-21432, GHSA-8j3f-mhq8-gmh4, GO-2022-0812 | High | 1.0% | 09 Apr, 2021 | Go github.com/go-vela/server |
SonicWall Email Security Unrestricted Upload of File Vulnerability CVE-2021-20022 | HighExploited | 16.6% | 09 Apr, 2021 | |
Improper Input Validation in sopel-plugins.channelmgnt CVE-2021-21431, GHSA-23c7-6444-399m, PYSEC-2021-58 | High | 1.1% | 09 Apr, 2021 | PyPI sopel-plugins-channelmgnt PyPI sopel-plugins.channelmgnt |
Indico Tampering with links (e.g. password reset) in sent emails CVE-2021-30185, GHSA-wgpj-7c2j-vfjm, PYSEC-2021-18 | High | 1.0% | 07 Apr, 2021 | PyPI indico |
Crash due to malformed relay protocol message BIT-syncthing-2021-21404, CVE-2021-21404, GHSA-x462-89pf-6r5h, GO-2022-0888 | High | 2.0% | 06 Apr, 2021 | Go github.com/syncthing/syncthing |
Rebuild-bot workflow may allow unauthorised repository modifications CVE-2021-21423, GHSA-gg2g-m5wc-vccq, PYSEC-2021-111 | High | 1.4% | 06 Apr, 2021 | PyPI projen npm projen |
Command injection vulnerability in @prisma/sdk in getPackedPackage function CVE-2021-21414, GHSA-pxcc-hj8w-fmm7 | High | 2.1% | 06 Apr, 2021 | npm @prisma/sdk |
Improper Certificate Validation in phpseclib CVE-2021-30130, GHSA-vf4w-fg7r-5v94 | High | 1.1% | 06 Apr, 2021 | Packagist phpseclib/phpseclib |