Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Cross-site Scripting in kimai2 CVE-2021-3983, GHSA-67c7-5v9j-227r | Medium | 0.8% | 01 Dec, 2021 | Packagist kevinpapst/kimai2 |
elgg is vulnerable to Authorization Bypass Through User-Controlled Key CVE-2021-3964, GHSA-gwpx-q2h9-wxgx | Medium | 0.8% | 01 Dec, 2021 | Packagist elgg/elgg |
firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF) CVE-2021-4015, GHSA-g6vq-wc8w-4g69 | Medium | 0.4% | 01 Dec, 2021 | Packagist grumpydictator/firefly-iii |
showdoc is vulnerable to Cross-Site Request Forgery (CSRF) CVE-2021-3993, GHSA-6pqm-xvfc-w7p4 | Medium | 0.5% | 01 Dec, 2021 | Packagist showdoc/showdoc |
kimai2 is vulnerable to Improper Access Control CVE-2021-3992, GHSA-9w8f-7wgr-2h7g | Medium | 1.1% | 01 Dec, 2021 | Packagist kevinpapst/kimai2 |
showdoc is vulnerable to Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) CVE-2021-3990, GHSA-vrgh-5w3c-ggf8 | Medium | 0.9% | 01 Dec, 2021 | Packagist showdoc/showdoc |
showdoc is vulnerable to URL Redirection to Untrusted Site CVE-2021-3989, GHSA-f545-vpwp-r9j7 | Medium | 0.8% | 01 Dec, 2021 | Packagist showdoc/showdoc |
snipe-it is vulnerable to Cross-site Scripting CVE-2021-4018, GHSA-5fh3-25xr-g85h | Medium | 0.7% | 01 Dec, 2021 | Packagist snipe/snipe-it |
bookstack is vulnerable to Improper Access Control CVE-2021-4026, GHSA-jm6p-wfjg-xm7x | Medium | 0.9% | 30 Nov, 2021 | Packagist ssddanbrown/bookstack |
Hexo Vulnerable to XSS CVE-2021-25987, GHSA-q54r-r9pr-w7qv | Medium | 0.3% | 30 Nov, 2021 | npm hexo |
NodeBB vulnerable to path traversal in translator module CVE-2021-43788, GHSA-pfj7-2qfw-vwgm | Medium | 25.8% | 29 Nov, 2021 | npm nodebb |
Cross-site Scripting in github.com/schollz/rwtxt CVE-2021-20848, GHSA-458f-26r3-x2c3, GO-2022-0231 | Medium | 0.9% | 29 Nov, 2021 | Go github.com/schollz/rwtxt |
Denial of Service in python-ldap CVE-2021-46823, GHSA-qfr5-wjpw-q4c4, GHSA-r8wq-qrxc-hmcm, PYSEC-2026-912 | Medium | 1.9% | 29 Nov, 2021 | PyPI python-ldap |
S3Scanner allows Directory Traversal CVE-2021-32061, GHSA-qppg-v75c-r5ff, PYSEC-2021-433 | Medium | 1.6% | 29 Nov, 2021 | PyPI s3scanner |
CSV Injection in symfony/serializer BIT-symfony-2021-41270, CVE-2021-41270, GHSA-2xhg-w2g5-w95x | Medium | 1.4% | 24 Nov, 2021 | Packagist symfony/serializer Packagist symfony/symfony |
Webcache Poisoning in symfony/http-kernel BIT-symfony-2021-41267, CVE-2021-41267, GHSA-q3j3-w37x-hq2q | Medium | 1.3% | 24 Nov, 2021 | Packagist symfony/http-kernel Packagist symfony/symfony |
EC-CUBE Cross-site request forgery (CSRF) vulnerability CVE-2021-20842, GHSA-m9hv-qmqh-33qh | Medium | 0.6% | 24 Nov, 2021 | Packagist ec-cube/ec-cube |
EC-CUBE Improper access control in Management screen CVE-2021-20841, GHSA-jc55-crg7-pr35 | Medium | 1.3% | 24 Nov, 2021 | Packagist ec-cube/ec-cube |
Google Chromium Intents Improper Input Validation Vulnerability CVE-2021-38000 | MediumExploited | 4.9% | 23 Nov, 2021 | |
Cross-site Scripting in django-wiki CVE-2021-25986, GHSA-3m3h-v9hv-9j4h, PYSEC-2021-850 | Medium | 0.6% | 23 Nov, 2021 | PyPI wiki |
Denial of Service in Go-Ethereum CVE-2021-43668, GHSA-5m8f-chrv-7rw5 | Medium | 0.3% | 23 Nov, 2021 | Go github.com/ethereum/go-ethereum |
Cross-site Scripting in pekeupload CVE-2021-23673, GHSA-89q5-mj78-pw5w | Medium | 0.8% | 22 Nov, 2021 | npm pekeupload |
Moodle Insecure direct object reference (IDOR) in a calendar web service BIT-moodle-2021-43560, CVE-2021-43560, GHSA-g39c-mccf-rxjv | Medium | 1.1% | 22 Nov, 2021 | Packagist moodle/moodle |
Cross-site Scripting in moodle BIT-moodle-2021-43558, CVE-2021-43558, GHSA-wpfp-q843-v772 | Medium | 0.9% | 22 Nov, 2021 | Packagist moodle/moodle |
Broken encryption in EdgeX Foundry CVE-2021-41278, GHSA-6c7m-qwxj-mvhp | Medium | 0.4% | 19 Nov, 2021 | Go github.com/edgexfoundry/app-functions-sdk-go Go github.com/edgexfoundry/app-functions-sdk-go/v2 Go github.com/edgexfoundry/app-service-configurable |
The disqualify lead action may be executed without CSRF token check CVE-2021-39198, GHSA-vf7h-6246-hm43 | Medium | 0.3% | 19 Nov, 2021 | Packagist oro/crm |
Inefficient Regular Expression Complexity in Validator.js GHSA-xx4c-jj58-r7x6 | Medium | Not scored | 19 Nov, 2021 | npm validator |
Server-Side Request Forgery in Concrete CMS CVE-2021-22969, GHSA-mcxr-fx5f-96qq | Medium | 0.9% | 19 Nov, 2021 | Packagist concrete5/core |
Cross-site Scripting in kimai2 CVE-2021-3963, GHSA-gf2c-93hm-r9j5 | Medium | 0.4% | 19 Nov, 2021 | Packagist kevinpapst/kimai2 |
Cross-site Scripting in kimai2 CVE-2021-3957, GHSA-2xwq-h7r9-6w27 | Medium | 0.4% | 19 Nov, 2021 | Packagist kevinpapst/kimai2 |
Cross-site Scripting in kimai2 CVE-2021-3976, GHSA-427q-jp8v-ww95 | Medium | 0.4% | 19 Nov, 2021 | Packagist kevinpapst/kimai2 |
Kibana Sensitive Data Disclosure CVE-2021-37939, GHSA-hp5f-qqrw-c8gj | Medium | 0.5% | 18 Nov, 2021 | npm kibana |
Cross-Site Request Forgery allowing sending of test emails and generation of node auto-deployment keys CVE-2021-41273, GHSA-wwgq-9jhf-qgw6 | Medium | 0.4% | 17 Nov, 2021 | Packagist pterodactyl/panel |
Cross-site scripting (XSS) from image block content in the site frontend CVE-2021-41258, GHSA-cq58-r77c-5jjw | Medium | 0.8% | 16 Nov, 2021 | Packagist getkirby/cms |
Cross-site scripting (XSS) from writer field content in the site frontend CVE-2021-41252, GHSA-x7j7-qp7j-hw3q | Medium | 0.9% | 16 Nov, 2021 | Packagist getkirby/cms |
Rails Multisite secure/signed cookies share secrets between sites in a multi-site application CVE-2021-41263, GHSA-844m-cpr9-jcmh | Medium | 0.6% | 15 Nov, 2021 | RubyGems rails_multisite |
showdoc is vulnerable to Cross-Site Request Forgery (CSRF) CVE-2021-3776, GHSA-m4hj-wg2r-qpcr | Medium | 0.4% | 13 Nov, 2021 | Packagist showdoc/showdoc |
showdoc is vulnerable to Cross-Site Request Forgery (CSRF) CVE-2021-3775, GHSA-pjjf-hc4q-g298 | Medium | 0.4% | 13 Nov, 2021 | Packagist showdoc/showdoc |
showdoc is vulnerable to Cross-Site Request Forgery (CSRF) CVE-2021-3683, GHSA-x5jp-9fmm-m9pf | Medium | 0.4% | 13 Nov, 2021 | Packagist showdoc/showdoc |
snipe-it is vulnerable to Cross-site Scripting CVE-2021-3938, GHSA-2cqg-q7jm-j35c | Medium | 0.5% | 13 Nov, 2021 | Packagist snipe/snipe-it |
twill is vulnerable to Cross-Site Request Forgery (CSRF) CVE-2021-3932, GHSA-f99g-pg48-wrfc | Medium | 0.4% | 13 Nov, 2021 | Packagist area17/twill |
snipe-it is vulnerable to Cross-Site Request Forgery (CSRF) CVE-2021-3931, GHSA-533p-cp2g-99wp | Medium | 0.4% | 13 Nov, 2021 | Packagist snipe/snipe-it |
firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF) CVE-2021-3921, GHSA-q2cv-94xm-qvg4 | Medium | 0.4% | 13 Nov, 2021 | Packagist grumpydictator/firefly-iii |
Dolibarr ERP and CRM contain XSS Vulnerability BIT-dolibarr-2021-33618, CVE-2021-33618, GHSA-fc6h-769x-gff5 | Medium | 79.3% | 10 Nov, 2021 | Packagist dolibarr/dolibarr |
OctoRPKI crashes when processing GZIP bomb returned via malicious repository CVE-2021-3912, GHSA-g9wh-3vrx-r7hg, GO-2022-0253 | Medium | 0.9% | 10 Nov, 2021 | Go github.com/cloudflare/cfrpki |
Infinite certificate chain depth results in OctoRPKI running forever CVE-2021-3908, GHSA-g5gj-9ggf-9vmq, GO-2022-0249 | Medium | 0.7% | 10 Nov, 2021 | Go github.com/cloudflare/cfrpki |
Infinite open connection causes OctoRPKI to hang forever CVE-2021-3909, GHSA-8cvr-4rrf-f244, GO-2022-0250 | Medium | 1.6% | 10 Nov, 2021 | Go github.com/cloudflare/cfrpki |
Misconfigured IP address field in ROA leads to OctoRPKI crash CVE-2021-3911, GHSA-w6ww-fmfx-2x22, GO-2022-0252 | Medium | 0.9% | 10 Nov, 2021 | Go github.com/cloudflare/cfrpki |
Insufficient Granularity of Access Control in github.com/google/exposure-notifications-verification-server CVE-2021-22565, GHSA-wx8q-rgfr-cf6v, GO-2022-0270 | Medium | 0.4% | 10 Nov, 2021 | Go github.com/google/exposure-notifications-verification-server |
Improper Verification of Communication Channel in @theia/plugin-ext CVE-2021-41038, GHSA-w6v7-w58j-pg5r | Medium | 0.7% | 10 Nov, 2021 | npm @theia/plugin-ext |