Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Cross-site Scripting in yourls CVE-2021-3785, GHSA-m9fq-c9hp-59g7 | Medium | 0.7% | 15 Sep, 2021 | Packagist yourls/yourls |
Cross-site Scripting in yourls CVE-2021-3783, GHSA-cpq8-x35g-m439 | Medium | 0.7% | 15 Sep, 2021 | Packagist yourls/yourls |
Cross-site Scripting in peertube CVE-2021-3780, GHSA-f2c5-997w-7f5c | Medium | 0.9% | 15 Sep, 2021 | npm peertube |
matrix-js-sdk can be tricked into disclosing E2EE room keys to a participating homeserver CVE-2021-40823, GHSA-23cm-x6j7-6hq3 | Medium | 0.7% | 13 Sep, 2021 | npm matrix-js-sdk |
GNU Mailman Postorius Access Control Issues CVE-2021-40347, GHSA-v83x-78q3-gr2j, PYSEC-2021-319 | Medium | 1.2% | 10 Sep, 2021 | PyPI postorius |
HashiCorp Consul and Consul Enterprise 1.10.1 Txn.Apply endpoint allowed services to register proxies for other services, enabling access to service traffic. BIT-consul-2021-38698, CVE-2021-38698, GHSA-6hw5-6gcx-phmw, GO-2022-0559 | Medium | 1.4% | 08 Sep, 2021 | Go github.com/hashicorp/consul |
Cross-site Scripting in LibreNMS CVE-2021-31274, GHSA-2r2w-jrh2-p4gr | Medium | 0.8% | 08 Sep, 2021 | Packagist librenms/librenms |
Flask-AppBuilder Open Redirect vulnerability CVE-2021-32805, GHSA-624f-cqvr-3qw4, PYSEC-2021-359 | Medium | 0.7% | 08 Sep, 2021 | PyPI Flask-AppBuilder PyPI flask-appbuilder |
Magento Improper Authorization vulnerability in the customers module BIT-magento-2021-28567, CVE-2021-28567, GHSA-cc3w-r3w8-hfh7 | Medium | 0.8% | 08 Sep, 2021 | Packagist magento/community-edition Packagist magento/project-community-edition |
Apple macOS Unspecified Vulnerability CVE-2021-30657 | MediumExploited | 68.5% | 08 Sep, 2021 | |
Incomplete List of Disallowed Inputs in Kubernetes CVE-2021-25737, GHSA-mfv7-gq43-w965, GO-2022-0908 | Medium | 1.3% | 07 Sep, 2021 | Go k8s.io/kubernetes |
Older releases of better_errors open to Cross-Site Request Forgery attack CVE-2021-39197, GHSA-w3j4-76qw-wwjm | Medium | 0.6% | 07 Sep, 2021 | RubyGems better_errors |
Cross-site Scripting in file-upload-with-preview CVE-2021-23439, GHSA-97pv-4338-r5vp | Medium | 0.9% | 05 Sep, 2021 | npm file-upload-with-preview |
Path traversal in Grafana Loki CVE-2021-36156, GHSA-grj5-8x6q-hc9q | Medium | 1.5% | 02 Sep, 2021 | Go github.com/grafana/loki |
Traefik has an Improper Certificate Handling issue CVE-2020-9321, GHSA-7h6j-2268-fhcm, GO-2022-0808 | Medium | 0.7% | 02 Sep, 2021 | Go github.com/containous/traefik Go github.com/containous/traefik/v2 Go github.com/traefik/traefik |
Path traversal in Grafana Cortex CVE-2021-36157, GHSA-jphm-g89m-v42p | Medium | 1.4% | 02 Sep, 2021 | Go github.com/cortexproject/cortex |
Magento discloses sensitive information CVE-2021-36039, GHSA-3g7m-g8qm-x6j5 | Medium | 1.7% | 01 Sep, 2021 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento discloses sensitive information via the Multishipping Module CVE-2021-36038, GHSA-wgpr-9675-8r67 | Medium | 1.8% | 01 Sep, 2021 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento is affected by an improper authorization vulnerability CVE-2021-36037, GHSA-vrq2-w7r7-3fp2 | Medium | 1.8% | 01 Sep, 2021 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento stored cross-site scripting vulnerability CVE-2021-36027, GHSA-x2v2-2jhp-c5hv | Medium | 1.4% | 01 Sep, 2021 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento stored cross-site scripting vulnerability in the customer address upload feature CVE-2021-36026, GHSA-8gfq-m4cf-w975 | Medium | 1.7% | 01 Sep, 2021 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento affected by a business logic error in the placeOrder graphql mutation CVE-2021-36012, GHSA-3f97-7pgv-gmgr | Medium | 2.0% | 01 Sep, 2021 | Packagist magento/community-edition Packagist magento/project-community-edition |
Improper Removal of Sensitive Information Before Storage or Transfer in HashiCorp Vault BIT-vault-2021-38554, CVE-2021-38554, GHSA-6239-28c2-9mrm, GO-2022-0632 | Medium | 0.9% | 30 Aug, 2021 | Go github.com/hashicorp/vault |
Ethereum Contains Consensus Flaw During Block Processing CVE-2021-39137, GHSA-9856-9gg9-qcmq, GO-2022-0254 | Medium | 1.3% | 30 Aug, 2021 | Go github.com/ethereum/go-ethereum |
XSS vulnerability on password reset page CVE-2021-27909, GHSA-32hw-3pvh-vcvc | Medium | 4.1% | 30 Aug, 2021 | Packagist mautic/core |
Cross Site Scripting (XSS) in Simiki CVE-2020-19000, GHSA-fqr5-qphf-vfr8, PYSEC-2021-347 | Medium | 1.1% | 27 Aug, 2021 | PyPI simiki |
Mezzanine Cross Site Scripting (XSS) vulnerability CVE-2020-19002, GHSA-fpv7-hx6r-9vcx, PYSEC-2021-343 | Medium | 1.1% | 27 Aug, 2021 | PyPI Mezzanine PyPI mezzanine |
Open Redirect in ActionPack CVE-2021-22942, GHSA-2rqw-v265-jf8c | Medium | 1.7% | 26 Aug, 2021 | RubyGems actionpack |
Cross-site scripting in feehicms CVE-2020-19709, GHSA-f8pv-x7h8-687v | Medium | 0.6% | 26 Aug, 2021 | Packagist feehi/feehicms |
CKEditor 4 vulnerabilities in versions <4.16.1 GHSA-cfcv-q4qq-2ph4 | Medium | Not scored | 23 Aug, 2021 | Packagist pimcore/pimcore |
Argo Server TLS requests could be forged by attacker with network access GHSA-6c73-2v8x-qpvm, GO-2022-0388 | Medium | Not scored | 23 Aug, 2021 | Go github.com/argoproj/argo-workflows Go github.com/argoproj/argo-workflows/v2 Go github.com/argoproj/argo-workflows/v3 |
firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF) CVE-2021-3730, GHSA-c676-mcw3-qg55 | Medium | 0.5% | 23 Aug, 2021 | Packagist grumpydictator/firefly-iii |
firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF) CVE-2021-3729, GHSA-gp6w-ccqv-p7qr | Medium | 0.4% | 23 Aug, 2021 | Packagist grumpydictator/firefly-iii |
firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF) CVE-2021-3728, GHSA-xp5q-77mh-6hm2 | Medium | 0.5% | 23 Aug, 2021 | Packagist grumpydictator/firefly-iii |
An uncontrolled memory allocation in DataBufdata(subBox.length-sizeof(box)) function of Exiv2 0.27 allows attackers to cause a denial of service (DOS) via a crafted input. CVE-2020-18899, PYSEC-2021-879 | Medium | 1.7% | 19 Aug, 2021 | PyPI exiv2 |
parse-server new anonymous user session acts as if it's created with password BIT-parse-2021-39138, CVE-2021-39138, GHSA-23r4-5mxp-c7g5 | Medium | 1.0% | 19 Aug, 2021 | npm parse-server |
Cross-site scripting in pywb CVE-2021-39286, GHSA-947x-pv47-pp3q, PYSEC-2021-120 | Medium | 0.7% | 18 Aug, 2021 | PyPI pywb |
Uncontrolled Resource Consumption in trim-off-newlines CVE-2021-23425, GHSA-38fc-wpqx-33j7 | Medium | 1.9% | 18 Aug, 2021 | npm trim-off-newlines |
Insecure direct object reference of log files of the Import/Export feature CVE-2021-37709, GHSA-54gp-qff8-946c | Medium | 0.8% | 16 Aug, 2021 | Packagist shopware/core Packagist shopware/platform |
hbs: Insertion of Sensitive Information into Externally-Accessible File or Directory and Exposure of Sensitive Information to an Unauthorized Actor CVE-2021-32822, GHSA-7f5c-rpf4-86p8 | Medium | 1.0% | 16 Aug, 2021 | npm hbs |
Lin-CMS-Flask Cross Site Scripting (XSS) vulnerability CVE-2020-18699, GHSA-rvf8-c35m-8289, PYSEC-2021-340 | Medium | 1.3% | 16 Aug, 2021 | PyPI lin-cms |
Cross Site Scripting (XSS) in Quokka CVE-2020-18702, GHSA-5m69-3chg-6f8m, PYSEC-2021-143 | Medium | 1.3% | 16 Aug, 2021 | PyPI quokka |
Missing Authorization in Apache Airflow BIT-airflow-2021-35936, CVE-2021-35936, GHSA-m6h2-jx9v-58w6, PYSEC-2021-122 | Medium | 5.5% | 16 Aug, 2021 | PyPI apache-airflow |
Cross-site scripting in imgURL CVE-2021-38713, GHSA-f2rp-j8hv-g5gx | Medium | 0.5% | 16 Aug, 2021 | Packagist helloxz/imgurl |
Atlassian Jira Server and Data Center Path Traversal Vulnerability CVE-2021-26086 | MediumExploited | 100.0% | 16 Aug, 2021 | |
Cross-site Scripting in the yoast_seo TYPO3 extension CVE-2021-36788, GHSA-28w5-j8xj-2xwc | Medium | 0.5% | 13 Aug, 2021 | Packagist yoast-seo-for-typo3/yoast_seo |
Cross-site Scripting in the femanager TYPO3 extension CVE-2021-36787, GHSA-f3rf-v9qm-9c89 | Medium | 1.3% | 13 Aug, 2021 | Packagist in2code/femanager |
Cross-site Scripting in TYPO3 extension CVE-2021-36785, GHSA-jj8r-p9f5-fmvv | Medium | 0.5% | 13 Aug, 2021 | Packagist miniorange/miniorange-saml |
Use after free and segfault in shape inference functions BIT-tensorflow-2021-37690, CVE-2021-37690, GHSA-3hxh-8cp2-g4hg, PYSEC-2021-312, PYSEC-2021-603, PYSEC-2021-801 | Medium | 0.2% | 13 Aug, 2021 | PyPI tensorflow PyPI tensorflow-cpu PyPI tensorflow-gpu |
FPE in `tf.raw_ops.UnravelIndex` BIT-tensorflow-2021-37668, CVE-2021-37668, GHSA-2wmv-37vq-52g5, PYSEC-2021-290, PYSEC-2021-581, PYSEC-2021-779 | Medium | 0.2% | 12 Aug, 2021 | PyPI tensorflow PyPI tensorflow-cpu PyPI tensorflow-gpu |