Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Denial of service in chrono-node CVE-2021-23371, GHSA-hpmr-g4pq-jhgp, SNYK-JS-CHRONONODE-1083228 | High | 2.0% | 12 Apr, 2021 | npm chrono-node |
Reject unauthorized access with GitHub PATs CVE-2021-21432, GHSA-8j3f-mhq8-gmh4, GO-2022-0812 | High | 1.0% | 09 Apr, 2021 | Go github.com/go-vela/server |
SonicWall Email Security Unrestricted Upload of File Vulnerability CVE-2021-20022 | HighExploited | 16.6% | 09 Apr, 2021 | |
Improper Input Validation in sopel-plugins.channelmgnt CVE-2021-21431, GHSA-23c7-6444-399m, PYSEC-2021-58 | High | 1.1% | 09 Apr, 2021 | PyPI sopel-plugins-channelmgnt PyPI sopel-plugins.channelmgnt |
Indico Tampering with links (e.g. password reset) in sent emails CVE-2021-30185, GHSA-wgpj-7c2j-vfjm, PYSEC-2021-18 | High | 1.0% | 07 Apr, 2021 | PyPI indico |
Crash due to malformed relay protocol message BIT-syncthing-2021-21404, CVE-2021-21404, GHSA-x462-89pf-6r5h, GO-2022-0888 | High | 2.0% | 06 Apr, 2021 | Go github.com/syncthing/syncthing |
Rebuild-bot workflow may allow unauthorised repository modifications CVE-2021-21423, GHSA-gg2g-m5wc-vccq, PYSEC-2021-111 | High | 1.4% | 06 Apr, 2021 | PyPI projen npm projen |
Command injection vulnerability in @prisma/sdk in getPackedPackage function CVE-2021-21414, GHSA-pxcc-hj8w-fmm7 | High | 2.1% | 06 Apr, 2021 | npm @prisma/sdk |
Improper Certificate Validation in phpseclib CVE-2021-30130, GHSA-vf4w-fg7r-5v94 | High | 1.1% | 06 Apr, 2021 | Packagist phpseclib/phpseclib |
Apple Multiple Products Type Confusion Vulnerability CVE-2021-1789 | HighExploited | 14.0% | 02 Apr, 2021 | |
Apple Multiple Products Race Condition Vulnerability CVE-2021-1782 | HighExploited | 2.2% | 02 Apr, 2021 | |
ApiKey secret could be revelated on network issue CVE-2021-21421, GHSA-xw22-wv29-3299 | High | 1.1% | 01 Apr, 2021 | npm node-etsy-client |
Improper Restriction of XML External Entity Reference in pikepdf CVE-2021-29421, GHSA-ccgm-3xw4-h5p8, PYSEC-2021-34 | High | 1.7% | 01 Apr, 2021 | PyPI pikepdf |
Privilege escalation in rbac CVE-2021-22538, GHSA-5v95-v8c8-3rh6, GO-2022-0798 | High | 0.7% | 31 Mar, 2021 | Go github.com/google/exposure-notifications-verification-server |
VMware Server Side Request Forgery in vRealize Operations Manager API CVE-2021-21975 | HighExploited | 78.0% | 31 Mar, 2021 | |
Arbitrary Command Injection in portprocesses CVE-2021-23348, GHSA-vm67-7vmg-66vm, SNYK-JS-PORTPROCESSES-1078536 | High | 1.8% | 31 Mar, 2021 | npm portprocesses |
[thi.ng/egf] Potential arbitrary code execution of `#gpg`-tagged property values CVE-2021-21412, GHSA-rj44-gpjc-29r7 | High | 1.3% | 30 Mar, 2021 | npm @thi.ng/egf |
Arbitrary code execution in kill-by-port CVE-2021-23363, GHSA-mm4f-47ch-f7hx, SNYK-JS-KILLBYPORT-1078531 | High | 1.8% | 30 Mar, 2021 | npm kill-by-port |
containernetworking/cni improper limitation of path name CVE-2021-20206, GHSA-xjqr-g762-pxwp, GO-2022-0230, SNYK-GOLANG-GITHUBCOMCONTAINERNETWORKINGCNIPKGINVOKE-1070549 | High | 1.5% | 26 Mar, 2021 | Go github.com/containernetworking/cni |
BuddyPress privilege escalation via REST API CVE-2021-21389, GHSA-m6j4-8r7p-wpp3 | High | 14.8% | 26 Mar, 2021 | Packagist buddypress/buddypress |
Cross-site scripting (XSS) vulnerability in the password reset endpoint CVE-2021-21332, GHSA-246w-56m2-5899, PYSEC-2021-133 | High | 1.2% | 26 Mar, 2021 | PyPI matrix-synapse |
Micro Focus Access Manager Information Leakage Vulnerability CVE-2021-22506 | HighExploited | 25.7% | 26 Mar, 2021 | |
OS Command Injection in baserCMS CVE-2021-20682, GHSA-g39q-f4rm-85x4 | High | 2.5% | 26 Mar, 2021 | Packagist baserproject/basercms |
Control character injection in console output in github.com/ipfs/go-ipfs CVE-2020-26283, GHSA-r4gv-vj59-cccm, GO-2022-0873 | High | 1.5% | 24 Mar, 2021 | Go github.com/ipfs/go-ipfs |
Path traversal in github.com/ipfs/go-ipfs CVE-2020-26279, GHSA-27pv-q55r-222g, GO-2022-0779 | High | 1.7% | 24 Mar, 2021 | Go github.com/ipfs/go-ipfs |
nanopb vulnerable to invalid free() call with oneofs and PB_ENABLE_MALLOC CVE-2021-21401, GHSA-7mv5-5mxh-qg88, PYSEC-2021-432 | High | 1.8% | 23 Mar, 2021 | PyPI nanopb |
Infinite Loop in Pygments CVE-2021-20270, GHSA-9w8r-397f-prfh, PYSEC-2021-140 | High | 2.8% | 23 Mar, 2021 | PyPI Pygments PyPI pygments |
OMERO.web exposes some unnecessary session information in the page CVE-2021-21376, GHSA-gfp2-w5jm-955q, PYSEC-2021-31 | High | 1.5% | 23 Mar, 2021 | PyPI omero-web |
Denial of Service in Page Error Handling BIT-typo3-2021-21359, CVE-2021-21359, GHSA-4p9g-qgx9-397p | High | 1.7% | 23 Mar, 2021 | Packagist typo3/cms Packagist typo3/cms-core |
Broken Access Control in Form Framework BIT-typo3-2021-21357, CVE-2021-21357, GHSA-3vg7-jw9m-pc3f | High | 1.6% | 23 Mar, 2021 | Packagist typo3/cms Packagist typo3/cms-core Packagist typo3/cms-form |
Unrestricted File Upload in Form Framework BIT-typo3-2021-21355, CVE-2021-21355, GHSA-2r6j-862c-m2v2 | High | 1.6% | 23 Mar, 2021 | Packagist typo3/cms Packagist typo3/cms-core Packagist typo3/cms-form |
Cleartext storage of session identifier BIT-typo3-2021-21339, CVE-2021-21339, GHSA-qx3w-4864-94ch | High | 0.9% | 23 Mar, 2021 | Packagist typo3/cms Packagist typo3/cms-core |
Regular Expression Denial of Service (ReDoS) in es6-crawler-detect CVE-2020-28501, GHSA-jxg6-fhwc-9v9c | High | 1.5% | 22 Mar, 2021 | npm es6-crawler-detect |
Command Injection in killport CVE-2021-23360, GHSA-fc42-h7q4-qp8h, SNYK-JS-KILLPORT-1078535 | High | 2.3% | 21 Mar, 2021 | npm killport |
Regular Expression Denial-of-Service in npm schema-inspector CVE-2021-21267, GHSA-f38p-c2gq-4pmr | High | 2.1% | 19 Mar, 2021 | npm schema-inspector |
Cross-site scripting in eZ Platform Kernel CVE-2021-46875, GHSA-mrvj-7q4f-5p42 | High | 0.4% | 19 Mar, 2021 | Packagist ezsystems/ezplatform-kernel Packagist ezsystems/ezpublish-kernel |
Out-of-bounds Write in Pillow BIT-pillow-2021-25290, CVE-2021-25290, GHSA-8xjq-8fcg-g5hw, PYSEC-2021-36 | High | 2.4% | 19 Mar, 2021 | PyPI pillow |
Out of bounds read in Pillow BIT-pillow-2021-25291, CVE-2021-25291, GHSA-mvg9-xffr-p774, PYSEC-2021-37 | High | 1.4% | 19 Mar, 2021 | PyPI Pillow PyPI pillow |
Out of bounds read in Pillow BIT-pillow-2021-25293, CVE-2021-25293, GHSA-p43w-g3c5-g5mq, PYSEC-2021-39 | High | 1.6% | 19 Mar, 2021 | PyPI Pillow PyPI pillow |
Null characters not escaped CVE-2021-21384, GHSA-f2rp-38vg-j3gh | High | 0.6% | 18 Mar, 2021 | npm shescape |
Denial of service in Grafana BIT-grafana-2021-27358, CVE-2021-27358, GHSA-h5rh-w6vm-9ghc | High | 83.0% | 18 Mar, 2021 | Go github.com/grafana/grafana |
Code injection in port-killer CVE-2021-23359, GHSA-2548-q746-x5x6 | High | 1.7% | 18 Mar, 2021 | npm port-killer |
StackStorm st2 Infinite Loop Condition CVE-2021-28667, GHSA-39mj-fpg2-3jrg | High | 2.5% | 18 Mar, 2021 | PyPI st2client |
Regular Expression Denial of Service (ReDoS) in ua-parser-js CVE-2021-27292, GHSA-78cj-fxph-m83p | High | 3.4% | 17 Mar, 2021 | npm ua-parser-js |
Pygments vulnerable to Regular Expression Denial of Service (ReDoS) CVE-2021-27291, GHSA-pq64-v7f5-gqh8, PYSEC-2021-141 | High | 3.9% | 17 Mar, 2021 | PyPI Pygments PyPI pygments |
Google Chromium Blink Use-After-Free Vulnerability CVE-2021-21193 | HighExploited | 10.0% | 16 Mar, 2021 | |
Grav CMS Cross-Site Request Forgery (CSRF) CVE-2020-29553, GHSA-fqff-vcvx-68h3 | High | 1.4% | 15 Mar, 2021 | Packagist getgrav/grav |
Grav CMS Arbitrary File Deletion CVE-2020-29555, GHSA-gpmf-q5jh-hjx4 | High | 2.9% | 15 Mar, 2021 | Packagist getgrav/grav |
Potential Session Hijacking CVE-2021-32710, GHSA-h9q8-5gv2-v6mg | High | 0.9% | 12 Mar, 2021 | Packagist shopware/platform |
Vulnerability allowing for reading internal HTTP resources GHSA-hfwx-c7q6-g54c | High | Not scored | 12 Mar, 2021 | npm highcharts-export-server |