Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
OIDC claims not updated from Identity Provider in Pomerium CVE-2021-41230, GHSA-j6wp-3859-vxfg, GO-2021-0258 | Medium | 0.9% | 10 Nov, 2021 | Go github.com/pomerium/pomerium |
Cross-site Scripting in pegasus/google-for-jobs CVE-2021-43561, GHSA-hfm8-2q22-h7hv | Medium | 0.5% | 10 Nov, 2021 | Packagist pegasus/google-for-jobs |
Microsoft Windows Installer Privilege Escalation Vulnerability CVE-2021-41379 | MediumExploited | 19.5% | 10 Nov, 2021 | |
Cross-site Scripting in apostrophe CVE-2021-25978, GHSA-4r9c-jghc-cx5m | Medium | 0.5% | 07 Nov, 2021 | npm apostrophe |
Unauthorized access to data in @sap-cloud-sdk/core CVE-2021-41251, GHSA-gp2f-254m-rh32 | Medium | 1.7% | 05 Nov, 2021 | npm @sap-cloud-sdk/core |
Deadlock in mutually recursive `tf.function` objects BIT-tensorflow-2021-41213, CVE-2021-41213, GHSA-h67m-xg8f-fxcf, PYSEC-2021-405, PYSEC-2021-622, PYSEC-2021-820 | Medium | 0.2% | 05 Nov, 2021 | PyPI tensorflow PyPI tensorflow-cpu PyPI tensorflow-gpu |
Segfault due to negative splits in `SplitV` BIT-tensorflow-2021-41222, CVE-2021-41222, GHSA-cpf4-wx82-gxp6, PYSEC-2021-414, PYSEC-2021-631, PYSEC-2021-829 | Medium | 0.2% | 05 Nov, 2021 | PyPI tensorflow PyPI tensorflow-cpu PyPI tensorflow-gpu |
Arbitrary memory read in `ImmutableConst` BIT-tensorflow-2021-41227, CVE-2021-41227, GHSA-j8c8-67vp-6mx7, PYSEC-2021-419, PYSEC-2021-636, PYSEC-2021-834 | Medium | 0.2% | 05 Nov, 2021 | PyPI tensorflow PyPI tensorflow-cpu PyPI tensorflow-gpu |
Overflow/crash in `tf.range` BIT-tensorflow-2021-41202, CVE-2021-41202, GHSA-xrqm-fpgr-6hhx, PYSEC-2021-395, PYSEC-2021-612, PYSEC-2021-810 | Medium | 0.2% | 05 Nov, 2021 | PyPI tensorflow PyPI tensorflow-cpu PyPI tensorflow-gpu |
FPE in `ParallelConcat` BIT-tensorflow-2021-41207, CVE-2021-41207, GHSA-7v94-64hj-m82h, PYSEC-2021-399, PYSEC-2021-616, PYSEC-2021-814 | Medium | 0.1% | 05 Nov, 2021 | PyPI tensorflow PyPI tensorflow-cpu PyPI tensorflow-gpu |
FPE in convolutions with zero size filters BIT-tensorflow-2021-41209, CVE-2021-41209, GHSA-6hpv-v2rx-c5g6, PYSEC-2021-401, PYSEC-2021-618, PYSEC-2021-816 | Medium | 0.1% | 05 Nov, 2021 | PyPI tensorflow PyPI tensorflow-cpu PyPI tensorflow-gpu |
Integer division by 0 in `tf.raw_ops.AllToAll` BIT-tensorflow-2021-41218, CVE-2021-41218, GHSA-9crf-c6qr-r273, PYSEC-2021-410, PYSEC-2021-627, PYSEC-2021-825 | Medium | 0.1% | 05 Nov, 2021 | PyPI tensorflow PyPI tensorflow-cpu PyPI tensorflow-gpu |
Segfault while copying constant resource tensor BIT-tensorflow-2021-41204, CVE-2021-41204, GHSA-786j-5qwq-r36x, PYSEC-2021-397, PYSEC-2021-614, PYSEC-2021-812 | Medium | 0.1% | 05 Nov, 2021 | PyPI tensorflow PyPI tensorflow-cpu PyPI tensorflow-gpu |
Null pointer exception in `DeserializeSparse` BIT-tensorflow-2021-41215, CVE-2021-41215, GHSA-x3v8-c8qx-3j3r, PYSEC-2021-407, PYSEC-2021-624, PYSEC-2021-822 | Medium | 0.2% | 05 Nov, 2021 | PyPI tensorflow PyPI tensorflow-cpu PyPI tensorflow-gpu |
Null pointer exception when `Exit` node is not preceded by `Enter` op BIT-tensorflow-2021-41217, CVE-2021-41217, GHSA-5crj-c72x-m7gq, PYSEC-2021-409, PYSEC-2021-626, PYSEC-2021-824 | Medium | 0.2% | 05 Nov, 2021 | PyPI tensorflow PyPI tensorflow-cpu PyPI tensorflow-gpu |
Crash in `tf.math.segment_*` operations BIT-tensorflow-2021-41195, CVE-2021-41195, GHSA-cq76-mxrc-vchh, PYSEC-2021-842, PYSEC-2021-844, PYSEC-2021-846 | Medium | 0.2% | 05 Nov, 2021 | PyPI tensorflow PyPI tensorflow-cpu PyPI tensorflow-gpu |
Crash in `max_pool3d` when size argument is 0 or negative BIT-tensorflow-2021-41196, CVE-2021-41196, GHSA-m539-j985-hcr8, PYSEC-2021-389, PYSEC-2021-606, PYSEC-2021-804 | Medium | 0.2% | 05 Nov, 2021 | PyPI tensorflow PyPI tensorflow-cpu PyPI tensorflow-gpu |
Crashes due to overflow and `CHECK`-fail in ops with large tensor shapes BIT-tensorflow-2021-41197, CVE-2021-41197, GHSA-prcg-wp5q-rv7p, PYSEC-2021-390, PYSEC-2021-607, PYSEC-2021-805 | Medium | 0.3% | 05 Nov, 2021 | PyPI tensorflow PyPI tensorflow-cpu PyPI tensorflow-gpu |
Overflow/crash in `tf.tile` when tiling tensor is large BIT-tensorflow-2021-41198, CVE-2021-41198, GHSA-2p25-55c9-h58q, PYSEC-2021-391, PYSEC-2021-608, PYSEC-2021-806 | Medium | 0.2% | 05 Nov, 2021 | PyPI tensorflow PyPI tensorflow-cpu PyPI tensorflow-gpu |
Overflow/crash in `tf.image.resize` when size is large BIT-tensorflow-2021-41199, CVE-2021-41199, GHSA-5hx2-qx8j-qjqm, PYSEC-2021-392, PYSEC-2021-609, PYSEC-2021-807 | Medium | 0.2% | 05 Nov, 2021 | PyPI tensorflow PyPI tensorflow-cpu PyPI tensorflow-gpu |
Incomplete validation in `tf.summary.create_file_writer` BIT-tensorflow-2021-41200, CVE-2021-41200, GHSA-gh8h-7j2j-qv4f, PYSEC-2021-393, PYSEC-2021-610, PYSEC-2021-808 | Medium | 0.2% | 05 Nov, 2021 | PyPI tensorflow PyPI tensorflow-cpu PyPI tensorflow-gpu |
XSS vulnerability allowing arbitrary JavaScript execution BIT-grafana-2021-41174, CVE-2021-41174, GHSA-3j9m-hcv9-rpj8 | Medium | 85.4% | 03 Nov, 2021 | npm @grafana/data |
Cross-site Scripting in tempura CVE-2021-23784, GHSA-w4v7-hwx7-9929, SNYK-JS-TEMPURA-1569633 | Medium | 1.3% | 03 Nov, 2021 | npm tempura |
Cross-site Scripting in bootstrap-table CVE-2021-23472, GHSA-mw6q-98mp-g8g8 | Medium | 2.4% | 03 Nov, 2021 | npm bootstrap-table |
Stored XSS in Jupyter nbdime CVE-2021-41134, GHSA-p6rw-44q7-3fw4, PYSEC-2021-428 | Medium | 0.7% | 03 Nov, 2021 | PyPI nbdime npm nbdime npm nbdime-jupyterlab |
Publify `guest` role users can self-register even when the admin does not allow it BIT-publify-2021-25973, CVE-2021-25973, GHSA-x24j-87x9-jvv5 | Medium | 0.8% | 03 Nov, 2021 | RubyGems publify_core |
Cross-site Scripting in LibreNMS CVE-2021-43324, GHSA-46rx-6jg9-4fh8 | Medium | 0.6% | 03 Nov, 2021 | Packagist librenms/librenms |
Cross-site scripting vulnerability in TinyMCE plugins CVE-2024-21910, GHSA-r8hm-w5f7-wj39, PYSEC-2026-632 | Medium | 1.0% | 02 Nov, 2021 | NuGet TinyMCE Packagist tinymce/tinymce PyPI django-tinymce npm tinymce |
ReDoS vulnerability in parser_apache2 BIT-fluentd-2021-41186, CVE-2021-41186, GHSA-hwhf-64mh-r662 | Medium | 2.2% | 01 Nov, 2021 | RubyGems fluentd |
Improper Access Control in github.com/treeverse/lakefs GHSA-m836-gxwq-j2pm, GO-2022-0375 | Medium | Not scored | 28 Oct, 2021 | Go github.com/treeverse/lakefs |
Cross-Site Scripting in grav CVE-2021-3904, GHSA-5jxc-hmqf-3f73 | Medium | 0.6% | 27 Oct, 2021 | Packagist getgrav/grav |
Cross-Site Request Forgery in firefly-iii CVE-2021-3900, GHSA-pfj7-w373-gqch | Medium | 0.6% | 27 Oct, 2021 | Packagist grumpydictator/firefly-iii |
Cross site scripting in froala-editor CVE-2020-22864, GHSA-97x5-cc53-cv4v | Medium | 0.9% | 26 Oct, 2021 | npm froala-editor |
Authenticated Stored XSS in shopware/shopware CVE-2021-41188, GHSA-4p3x-8qw9-24w9 | Medium | 0.8% | 26 Oct, 2021 | Packagist shopware/shopware |
XSS in `*Text` options of the Datepicker widget in jquery-ui BIT-drupal-2021-41183, CVE-2021-41183, GHSA-j7qv-pgf6-hvh4 | Medium | 8.5% | 26 Oct, 2021 | Maven org.webjars.npm:jquery-ui NuGet jQuery.UI.Combined RubyGems jquery-ui-rails npm jquery-ui |
XSS in the `of` option of the `.position()` util in jquery-ui BIT-drupal-2021-41184, CVE-2021-41184, GHSA-gpqq-952q-5327 | Medium | 40.8% | 26 Oct, 2021 | Maven org.webjars.npm:jquery-ui NuGet jQuery.UI.Combined RubyGems jquery-ui-rails npm jquery-ui |
XSS in the `altField` option of the Datepicker widget in jquery-ui BIT-drupal-2021-41182, CVE-2021-41182, GHSA-9gj3-hwp5-pmwc | Medium | 39.4% | 26 Oct, 2021 | Maven org.webjars.npm:jquery-ui NuGet jQuery.UI.Combined RubyGems jquery-ui-rails npm jquery-ui |
Geth Node Vulnerable to DoS via maliciously crafted p2p message CVE-2021-41173, GHSA-59hh-656j-3p7v, GO-2022-0256 | Medium | 1.2% | 25 Oct, 2021 | Go github.com/ethereum/go-ethereum |
pterodactyl/panel CSRF allowing an external page to trigger a user logout event CVE-2021-41176, GHSA-m49f-hcxp-6hm6 | Medium | 0.5% | 25 Oct, 2021 | Packagist pterodactyl/panel |
Foxlor cross-site scripting (XSS) vulnerability CVE-2020-28957, GHSA-cv24-vh45-4hjm | Medium | 0.6% | 22 Oct, 2021 | Packagist froxlor/froxlor |
Cross-site scripting in forkcms CVE-2020-23049, GHSA-3374-7h99-xr85 | Medium | 0.6% | 22 Oct, 2021 | Packagist forkcms/forkcms |
Cross-site scripting vulnerability in TinyMCE CVE-2024-21908, GHSA-5h9g-x5rv-25wg | Medium | 1.1% | 22 Oct, 2021 | NuGet TinyMCE Packagist tinymce/tinymce npm tinymce |
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in sulu/sulu CVE-2021-41169, GHSA-h58v-g3q6-q9fx | Medium | 0.6% | 21 Oct, 2021 | Packagist sulu/sulu |
Authz Module Non-Determinism CVE-2021-41135, GHSA-2p6r-37p9-89p2 | Medium | 1.7% | 21 Oct, 2021 | Go github.com/cosmos/cosmos-sdk |
Cross Site Scripting in Microweber CVE-2021-33988, GHSA-w7x8-cq7r-g5g9 | Medium | 1.1% | 19 Oct, 2021 | Packagist microweber/microweber |
Cross site scripting in actionpack Rubygem CVE-2011-1497, GHSA-q58j-fmvf-9rq6 | Medium | 1.3% | 19 Oct, 2021 | RubyGems actionpack |
Cross-site Scripting in snipe-it CVE-2021-3879, GHSA-9g3v-j3cr-6fc6 | Medium | 0.8% | 19 Oct, 2021 | Packagist snipe/snipe-it |
Cross-site Scripting in snipe-it CVE-2021-3863, GHSA-5rg2-6qr5-2xp8 | Medium | 0.8% | 19 Oct, 2021 | Packagist snipe/snipe-it |
Open Redirect in firefly-iii CVE-2021-3851, GHSA-5fvx-5p2r-4mvp | Medium | 0.6% | 19 Oct, 2021 | Packagist grumpydictator/firefly-iii |
Path Traversal in @backstage/plugin-scaffolder-backend CVE-2021-41151, GHSA-pvv8-8fx9-h673 | Medium | 1.3% | 18 Oct, 2021 | npm @backstage/plugin-scaffolder-backend |