Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Apple Multiple Products Type Confusion Vulnerability CVE-2021-1789 | HighExploited | 14.0% | 02 Apr, 2021 | |
Apple Multiple Products Race Condition Vulnerability CVE-2021-1782 | HighExploited | 2.2% | 02 Apr, 2021 | |
ApiKey secret could be revelated on network issue CVE-2021-21421, GHSA-xw22-wv29-3299 | High | 1.1% | 01 Apr, 2021 | npm node-etsy-client |
Improper Restriction of XML External Entity Reference in pikepdf CVE-2021-29421, GHSA-ccgm-3xw4-h5p8, PYSEC-2021-34 | High | 1.7% | 01 Apr, 2021 | PyPI pikepdf |
Privilege escalation in rbac CVE-2021-22538, GHSA-5v95-v8c8-3rh6, GO-2022-0798 | High | 0.7% | 31 Mar, 2021 | Go github.com/google/exposure-notifications-verification-server |
VMware Server Side Request Forgery in vRealize Operations Manager API CVE-2021-21975 | HighExploited | 78.0% | 31 Mar, 2021 | |
Arbitrary Command Injection in portprocesses CVE-2021-23348, GHSA-vm67-7vmg-66vm, SNYK-JS-PORTPROCESSES-1078536 | High | 1.8% | 31 Mar, 2021 | npm portprocesses |
[thi.ng/egf] Potential arbitrary code execution of `#gpg`-tagged property values CVE-2021-21412, GHSA-rj44-gpjc-29r7 | High | 1.3% | 30 Mar, 2021 | npm @thi.ng/egf |
Arbitrary code execution in kill-by-port CVE-2021-23363, GHSA-mm4f-47ch-f7hx, SNYK-JS-KILLBYPORT-1078531 | High | 1.8% | 30 Mar, 2021 | npm kill-by-port |
containernetworking/cni improper limitation of path name CVE-2021-20206, GHSA-xjqr-g762-pxwp, GO-2022-0230, SNYK-GOLANG-GITHUBCOMCONTAINERNETWORKINGCNIPKGINVOKE-1070549 | High | 1.5% | 26 Mar, 2021 | Go github.com/containernetworking/cni |
BuddyPress privilege escalation via REST API CVE-2021-21389, GHSA-m6j4-8r7p-wpp3 | High | 14.8% | 26 Mar, 2021 | Packagist buddypress/buddypress |
Cross-site scripting (XSS) vulnerability in the password reset endpoint CVE-2021-21332, GHSA-246w-56m2-5899, PYSEC-2021-133 | High | 1.2% | 26 Mar, 2021 | PyPI matrix-synapse |
Micro Focus Access Manager Information Leakage Vulnerability CVE-2021-22506 | HighExploited | 25.7% | 26 Mar, 2021 | |
OS Command Injection in baserCMS CVE-2021-20682, GHSA-g39q-f4rm-85x4 | High | 2.5% | 26 Mar, 2021 | Packagist baserproject/basercms |
Control character injection in console output in github.com/ipfs/go-ipfs CVE-2020-26283, GHSA-r4gv-vj59-cccm, GO-2022-0873 | High | 1.5% | 24 Mar, 2021 | Go github.com/ipfs/go-ipfs |
Path traversal in github.com/ipfs/go-ipfs CVE-2020-26279, GHSA-27pv-q55r-222g, GO-2022-0779 | High | 1.7% | 24 Mar, 2021 | Go github.com/ipfs/go-ipfs |
nanopb vulnerable to invalid free() call with oneofs and PB_ENABLE_MALLOC CVE-2021-21401, GHSA-7mv5-5mxh-qg88, PYSEC-2021-432 | High | 1.8% | 23 Mar, 2021 | PyPI nanopb |
Infinite Loop in Pygments CVE-2021-20270, GHSA-9w8r-397f-prfh, PYSEC-2021-140 | High | 2.8% | 23 Mar, 2021 | PyPI Pygments PyPI pygments |
OMERO.web exposes some unnecessary session information in the page CVE-2021-21376, GHSA-gfp2-w5jm-955q, PYSEC-2021-31 | High | 1.5% | 23 Mar, 2021 | PyPI omero-web |
Denial of Service in Page Error Handling BIT-typo3-2021-21359, CVE-2021-21359, GHSA-4p9g-qgx9-397p | High | 1.7% | 23 Mar, 2021 | Packagist typo3/cms Packagist typo3/cms-core |
Broken Access Control in Form Framework BIT-typo3-2021-21357, CVE-2021-21357, GHSA-3vg7-jw9m-pc3f | High | 1.6% | 23 Mar, 2021 | Packagist typo3/cms Packagist typo3/cms-core Packagist typo3/cms-form |
Unrestricted File Upload in Form Framework BIT-typo3-2021-21355, CVE-2021-21355, GHSA-2r6j-862c-m2v2 | High | 1.6% | 23 Mar, 2021 | Packagist typo3/cms Packagist typo3/cms-core Packagist typo3/cms-form |
Cleartext storage of session identifier BIT-typo3-2021-21339, CVE-2021-21339, GHSA-qx3w-4864-94ch | High | 0.9% | 23 Mar, 2021 | Packagist typo3/cms Packagist typo3/cms-core |
Regular Expression Denial of Service (ReDoS) in es6-crawler-detect CVE-2020-28501, GHSA-jxg6-fhwc-9v9c | High | 1.5% | 22 Mar, 2021 | npm es6-crawler-detect |
Command Injection in killport CVE-2021-23360, GHSA-fc42-h7q4-qp8h, SNYK-JS-KILLPORT-1078535 | High | 2.3% | 21 Mar, 2021 | npm killport |
Regular Expression Denial-of-Service in npm schema-inspector CVE-2021-21267, GHSA-f38p-c2gq-4pmr | High | 2.1% | 19 Mar, 2021 | npm schema-inspector |
Cross-site scripting in eZ Platform Kernel CVE-2021-46875, GHSA-mrvj-7q4f-5p42 | High | 0.4% | 19 Mar, 2021 | Packagist ezsystems/ezplatform-kernel Packagist ezsystems/ezpublish-kernel |
Out-of-bounds Write in Pillow BIT-pillow-2021-25290, CVE-2021-25290, GHSA-8xjq-8fcg-g5hw, PYSEC-2021-36 | High | 2.4% | 19 Mar, 2021 | PyPI pillow |
Out of bounds read in Pillow BIT-pillow-2021-25291, CVE-2021-25291, GHSA-mvg9-xffr-p774, PYSEC-2021-37 | High | 1.4% | 19 Mar, 2021 | PyPI Pillow PyPI pillow |
Out of bounds read in Pillow BIT-pillow-2021-25293, CVE-2021-25293, GHSA-p43w-g3c5-g5mq, PYSEC-2021-39 | High | 1.6% | 19 Mar, 2021 | PyPI Pillow PyPI pillow |
Null characters not escaped CVE-2021-21384, GHSA-f2rp-38vg-j3gh | High | 0.6% | 18 Mar, 2021 | npm shescape |
Denial of service in Grafana BIT-grafana-2021-27358, CVE-2021-27358, GHSA-h5rh-w6vm-9ghc | High | 83.0% | 18 Mar, 2021 | Go github.com/grafana/grafana |
Code injection in port-killer CVE-2021-23359, GHSA-2548-q746-x5x6 | High | 1.7% | 18 Mar, 2021 | npm port-killer |
StackStorm st2 Infinite Loop Condition CVE-2021-28667, GHSA-39mj-fpg2-3jrg | High | 2.5% | 18 Mar, 2021 | PyPI st2client |
Regular Expression Denial of Service (ReDoS) in ua-parser-js CVE-2021-27292, GHSA-78cj-fxph-m83p | High | 3.4% | 17 Mar, 2021 | npm ua-parser-js |
Pygments vulnerable to Regular Expression Denial of Service (ReDoS) CVE-2021-27291, GHSA-pq64-v7f5-gqh8, PYSEC-2021-141 | High | 3.9% | 17 Mar, 2021 | PyPI Pygments PyPI pygments |
Google Chromium Blink Use-After-Free Vulnerability CVE-2021-21193 | HighExploited | 10.0% | 16 Mar, 2021 | |
Grav CMS Cross-Site Request Forgery (CSRF) CVE-2020-29553, GHSA-fqff-vcvx-68h3 | High | 1.4% | 15 Mar, 2021 | Packagist getgrav/grav |
Grav CMS Arbitrary File Deletion CVE-2020-29555, GHSA-gpmf-q5jh-hjx4 | High | 2.9% | 15 Mar, 2021 | Packagist getgrav/grav |
Potential Session Hijacking CVE-2021-32710, GHSA-h9q8-5gv2-v6mg | High | 0.9% | 12 Mar, 2021 | Packagist shopware/platform |
Vulnerability allowing for reading internal HTTP resources GHSA-hfwx-c7q6-g54c | High | Not scored | 12 Mar, 2021 | npm highcharts-export-server |
Regular Expression Denial of Service (ReDoS) CVE-2021-28092, GHSA-7r28-3m3f-r2pr | High | 2.0% | 12 Mar, 2021 | npm is-svg |
Regular Expression Denial of Service (ReDoS) CVE-2021-27290, GHSA-vx3p-948g-6vhq | High | 4.7% | 12 Mar, 2021 | npm ssri |
Prototype poisoning CVE-2021-21368, GHSA-gmjw-49p4-pcfm | High | 1.6% | 12 Mar, 2021 | npm msgpack5 |
printf vulnerable to Regular Expression Denial of Service (ReDoS) CVE-2021-23354, GHSA-xfhp-gmh8-r8v2, SNYK-JS-PRINTF-1072096 | High | 2.2% | 12 Mar, 2021 | npm printf |
/user/sessions endpoint allows detecting valid accounts GHSA-7vwg-39h8-8qp8 | High | Not scored | 11 Mar, 2021 | Packagist ezsystems/ezplatform-rest |
Microsoft Internet Explorer Remote Code Execution Vulnerability CVE-2021-27085 | HighExploited | 5.4% | 11 Mar, 2021 | |
Microsoft Office Remote Code Execution Vulnerability CVE-2021-27059 | HighExploited | 6.1% | 11 Mar, 2021 | |
Microsoft Internet Explorer Memory Corruption Vulnerability CVE-2021-26411 | HighExploited | 81.7% | 11 Mar, 2021 | |
Infinite loop when decoding inputs in encoding/xml BIT-golang-2021-27918, CVE-2021-27918, GO-2021-0234 | High | 2.5% | 11 Mar, 2021 | Go stdlib |