Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Apache Superset Cross-site Scripting (XSS) vulnerability on the Explore page BIT-superset-2021-32609, CVE-2021-32609, GHSA-f8vc-f28w-x9c9, PYSEC-2021-377 | Medium | 1.7% | 18 Oct, 2021 | PyPI apache-superset |
Magento Open Source allows Cross-Site Request Forgery (CSRF) CVE-2021-39864, GHSA-94wq-87g6-8h77 | Medium | 1.6% | 15 Oct, 2021 | Packagist magento/community-edition Packagist magento/project-community-edition |
Cross site scripting in kindeditor CVE-2021-42227, GHSA-wv83-jrfh-rp33 | Medium | 0.9% | 14 Oct, 2021 | npm kindeditor |
Email relay in Apache Traffic Control CVE-2021-42009, GHSA-gw97-f6h8-gm94, GO-2022-0602 | Medium | 2.8% | 13 Oct, 2021 | Go github.com/apache/trafficcontrol |
MediaWiki allows a denial of service BIT-mediawiki-2021-41800, CVE-2021-41800, GHSA-c8wv-qwwc-6j73 | Medium | 1.9% | 11 Oct, 2021 | Packagist mediawiki/core |
Cross-site Scripting in django-unicorn CVE-2021-42134, GHSA-ggmv-6q9p-9gm6, PYSEC-2021-369 | Medium | 0.7% | 11 Oct, 2021 | PyPI django-unicorn |
Google Chromium Information Disclosure Vulnerability CVE-2021-37976 | MediumExploited | 19.9% | 08 Oct, 2021 | |
Cross-site Scripting in Limesurvey BIT-limesurvey-2021-42112, CVE-2021-42112, GHSA-h9ph-jcgh-gf69 | Medium | 1.5% | 08 Oct, 2021 | Packagist limesurvey/limesurvey |
Cross-site Scripting in teddy CVE-2021-23447, GHSA-5f38-9jw2-6r6h, SNYK-JS-TEDDY-1579557 | Medium | 1.1% | 07 Oct, 2021 | npm teddy |
SilverStripe GraphQL Server permission checker not inherited by query subclass. BIT-silverstripe-2021-28661, CVE-2021-28661, GHSA-r7rh-g777-g5gx | Medium | 0.8% | 07 Oct, 2021 | Packagist silverstripe/graphql |
Cross-site Scripting in SilverStripe Framework BIT-silverstripe-2021-36150, CVE-2021-36150, GHSA-j66h-cc96-c32q | Medium | 0.9% | 07 Oct, 2021 | Packagist silverstripe/admin |
Cross-site scripting in Unicorn framework CVE-2021-42053, GHSA-c87f-fq5g-63r2, PYSEC-2021-357 | Medium | 2.5% | 07 Oct, 2021 | PyPI django-unicorn |
Samsung Mobile Devices Improper Input Validation Vulnerability CVE-2021-25489 | MediumExploited | 0.5% | 06 Oct, 2021 | |
Cross-site Scripting in Sidekiq CVE-2021-30151, GHSA-grh7-935j-hg6w | Medium | 4.2% | 06 Oct, 2021 | RubyGems sidekiq |
Scrapy HTTP authentication credentials potentially leaked to target websites CVE-2021-41125, GHSA-jwqp-28gf-p498, PYSEC-2021-363 | Medium | 1.3% | 06 Oct, 2021 | PyPI Scrapy PyPI scrapy |
Verification check bypass in Gate One CVE-2020-19003, GHSA-q6j2-g8qf-wvf7, PYSEC-2021-423 | Medium | 0.8% | 06 Oct, 2021 | PyPI gateone |
missing clamps for decimal args in external functions CVE-2021-41122, GHSA-c7pr-343r-5c46, PYSEC-2021-366 | Medium | 0.8% | 05 Oct, 2021 | PyPI vyper |
URL Redirection to Untrusted Site ('Open Redirect') in fastify-static CVE-2021-22963, GHSA-p6vg-p826-qp3v | Medium | 1.2% | 05 Oct, 2021 | npm fastify-static |
HTTP Host Header Injection BIT-typo3-2021-41114, CVE-2021-41114, GHSA-m2jh-fxw4-gphm | Medium | 1.2% | 05 Oct, 2021 | Packagist typo3/cms Packagist typo3/cms-core |
Insufficiently restricted permissions on plugin directories CVE-2021-41103, GHSA-c2h3-6mxw-7mvq, GO-2022-0938 | Medium | 0.5% | 04 Oct, 2021 | Go github.com/containerd/containerd |
Information disclosure vulnerability in OnionShare CVE-2021-41867, GHSA-6rvj-pw9w-jcvc, PYSEC-2026-696 | Medium | 1.8% | 04 Oct, 2021 | PyPI onionshare-cli |
Cross-site scripting in application/controllers/dropbox.php in JustWriting CVE-2021-41467, GHSA-gxmc-5wj3-jx64 | Medium | 3.6% | 01 Oct, 2021 | Packagist hjue/justwriting |
Cross-site scripting in demos/demo.mysqli.php in getID3 CVE-2021-40926, GHSA-x2gw-85w6-fjjw | Medium | 1.0% | 01 Oct, 2021 | Packagist james-heinrich/getid3 |
Cross-site Scripting in shuup CVE-2021-25963, GHSA-5pcx-vqjp-p34w, PYSEC-2021-350 | Medium | 1.0% | 30 Sep, 2021 | PyPI shuup |
Cross-site Scripting in LaraCMS CVE-2020-20129, GHSA-m72g-42q6-gvc2 | Medium | 0.6% | 29 Sep, 2021 | Packagist wanglelecc/laracms |
File reference keys leads to incorrect hashes on HMAC algorithms CVE-2021-41106, GHSA-7322-jrq4-x5hf | Medium | 0.2% | 28 Sep, 2021 | Packagist lcobucci/jwt |
Cross-site Scripting in GilaCMS CVE-2020-20696, GHSA-h7mq-27r7-w972 | Medium | 0.5% | 27 Sep, 2021 | Packagist gilacms/gila |
Cross-site Scripting in GilaCMS CVE-2020-20695, GHSA-6675-wwqr-jhmf | Medium | 0.5% | 27 Sep, 2021 | Packagist gilacms/gila |
Cross-site Scripting in Gitea BIT-gitea-2021-28378, CVE-2021-28378, GHSA-g95p-88p4-76cm, GO-2022-0832 | Medium | 8.8% | 27 Sep, 2021 | Go code.gitea.io/gitea |
SonicWall SMA100 Appliances OS Command Injection Vulnerability CVE-2021-20035 | MediumExploited | 4.4% | 27 Sep, 2021 | |
Cross site scripting in datatables.net CVE-2021-23445, GHSA-h73q-5wmj-q8pj | Medium | 2.0% | 27 Sep, 2021 | npm datatables.net |
Reliance on Cookies without Validation and Integrity Checking in getgrav/grav CVE-2021-3818, GHSA-cg3q-59w7-rvc2 | Medium | 2.5% | 27 Sep, 2021 | Packagist getgrav/grav |
Improper Access Control in passport-oauth2 CVE-2021-41580, GHSA-f794-r6xc-hf3v | Medium | 1.3% | 27 Sep, 2021 | npm passport-oauth2 |
furlongm openvpn-monitor allows CSRF to disconnect an arbitrary client CVE-2021-31604, GHSA-vw35-c8hf-fwmq, PYSEC-2021-352 | Medium | 0.7% | 27 Sep, 2021 | PyPI openvpn-monitor |
Member account takeover GHSA-65p7-pjj8-ggmr | Medium | Not scored | 23 Sep, 2021 | npm ghost |
Cross-site Scripting in Mattermost CVE-2021-37860, GHSA-hv5f-73mr-7vvj, GO-2022-0604 | Medium | 0.6% | 23 Sep, 2021 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 |
VMware vCenter Server Improper Access Control CVE-2021-22017 | MediumExploited | 49.2% | 23 Sep, 2021 | |
Improperly Implemented path matching for in-toto-golang CVE-2021-41087, GHSA-vrxp-mg9f-hwf3, GO-2022-0936 | Medium | 0.4% | 22 Sep, 2021 | Go github.com/in-toto/in-toto-golang |
Regular Expression Denial of Service in millisecond GHSA-m489-xr35-fjxr | Medium | Not scored | 22 Sep, 2021 | npm millisecond |
Denial of Service in node-static GHSA-8r4g-cg4m-x23c | Medium | Not scored | 22 Sep, 2021 | npm node-static |
Confused Deputy in Kubernetes CVE-2020-8561, GHSA-74j8-88mm-7496 | Medium | 2.1% | 21 Sep, 2021 | Go k8s.io/kubernetes |
Cross-site Scripting in edge.js CVE-2021-23443, GHSA-55r9-7mf8-m382, SNYK-JS-EDGEJS-1579556 | Medium | 0.9% | 21 Sep, 2021 | npm edge.js |
Remote command injection when using sendmail email transport GHSA-wfrj-qqc2-83cm | Medium | Not scored | 20 Sep, 2021 | npm ghost |
Wrong type for `Linker`-define functions when used across two `Engine`s CVE-2021-39216, CVE-2021-39218, CVE-2021-39219, GHSA-4873-36h9-wv49, GHSA-q879-9g95-56mx, GHSA-v4cp-h94r-m7xf, PYSEC-2021-320, PYSEC-2021-321, PYSEC-2021-322, RUSTSEC-2021-0110 | Medium | 0.4% | 17 Sep, 2021 | PyPI wasmtime crates.io wasmtime |
Cross-site Scripting in Beego CVE-2021-39391, GHSA-c77f-4rgj-jfr4 | Medium | 0.8% | 15 Sep, 2021 | Go github.com/beego/beego/v2 |
Incorrect Authorization in Drupal core BIT-drupal-2020-13676, CVE-2020-13676, DRUPAL-CORE-2021-009, GHSA-qfhg-m6r8-xxpj | Medium | 0.8% | 15 Sep, 2021 | Packagist drupal/core |
Cross-Site Request Forgery in Drupal core BIT-drupal-2020-13674, CVE-2020-13674, DRUPAL-CORE-2021-007, GHSA-j586-cj67-vg4p | Medium | 0.5% | 15 Sep, 2021 | Packagist drupal/core |
This advisory addresses a similar issue to [Drupal core - Moderately critical - Cross Site Request Forgery - SA-CORE-2021-006](https://www.drupal.org/sa-core-2021-006).
The Entity Embed module provides a filter to allow embedding entities in content fields. In certain circumstances, the filter coul CVE-2020-13673, DRUPAL-CONTRIB-2021-028, DRUPAL-CORE-2021-006 | Medium | 0.3% | 15 Sep, 2021 | Packagist drupal/core Packagist:https://packages.drupal.org/8 drupal/entity_embed |
Observable Response Discrepancy in Lost Password Service CVE-2021-39189, GHSA-579x-cjvr-cqj9 | Medium | 1.4% | 15 Sep, 2021 | Packagist pimcore/pimcore |
prismjs Regular Expression Denial of Service vulnerability CVE-2021-3801, GHSA-hqhp-5p83-hx96 | Medium | 1.0% | 15 Sep, 2021 | npm prismjs |