Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Command Injection Vulnerability CVE-2021-21315, GHSA-2m8v-572m-ff2v | HighExploited | 90.7% | 16 Feb, 2021 | npm systeminformation |
Zip slip in Microweber CVE-2020-28337, GHSA-pqcf-v8v5-jmcg | High | 16.6% | 15 Feb, 2021 | Packagist microweber/microweber |
qlib Deserialization of Untrusted Data vulnerability CVE-2021-23338, GHSA-hjr4-fhgp-23g9, PYSEC-2021-86, SNYK-PYTHON-QLIB-1054635 | High | 3.7% | 15 Feb, 2021 | PyPI pyqlib |
Nagios XI OS Command Injection CVE-2021-25298 | HighExploited | 73.6% | 15 Feb, 2021 | |
Nagios XI OS Command Injection CVE-2021-25297 | HighExploited | 56.7% | 15 Feb, 2021 | |
Nagios XI OS Command Injection CVE-2021-25296 | HighExploited | 71.9% | 15 Feb, 2021 | |
Command Injection in lodash CVE-2021-23337, GHSA-35jh-r3h4-6jhm | High | 21.3% | 15 Feb, 2021 | RubyGems lodash-rails npm lodash npm lodash-es npm lodash-template +1 more |
SSRF in adminer CVE-2021-21311, GHSA-x5r2-hj5c-8jx6 | HighExploited | 98.5% | 11 Feb, 2021 | Packagist vrana/adminer |
Magento stored cross-site scripting (XSS) in the customer address upload feature BIT-magento-2021-21030, CVE-2021-21030, GHSA-6988-g89m-27vf | High | 5.7% | 11 Feb, 2021 | Packagist magento/community-edition Packagist magento/project-community-edition |
Adobe Acrobat and Reader Heap-based Buffer Overflow Vulnerability CVE-2021-21017 | HighExploited | 86.3% | 11 Feb, 2021 | |
Magento OS command injection via the customer attribute save controller BIT-magento-2021-21015, CVE-2021-21015, GHSA-w2p4-2c8c-2g7h | High | 2.9% | 11 Feb, 2021 | Packagist magento/community-edition |
Denial of Service in get-ip-range CVE-2021-27191, GHSA-6q4w-3wp4-q5wf | High | 2.1% | 11 Feb, 2021 | npm get-ip-range |
Active Record subject to Regular Expression Denial-of-Service (ReDoS) CVE-2021-22880, GHSA-8hc4-xxm3-5ppp | High | 4.5% | 11 Feb, 2021 | RubyGems activerecord |
Improper Authorization in github.com/containers/libpod CVE-2021-20188, GHSA-9h63-7qf6-mv6r, GO-2022-0641 | High | 0.3% | 11 Feb, 2021 | Go github.com/containers/libpod |
LDAP Injection in is-user-valid CVE-2021-23335, GHSA-22cm-3qf2-2wc7 | High | 1.4% | 11 Feb, 2021 | npm is-user-valid |
McAfee Total Protection (MTP) Improper Privilege Management Vulnerability CVE-2021-23874 | HighExploited | 1.1% | 10 Feb, 2021 | |
Google Chromium V8 Heap Buffer Overflow Vulnerability CVE-2021-21148 | HighExploited | 20.0% | 09 Feb, 2021 | |
Regular Expression Denial of Service (REDoS) in Marked CVE-2021-21306, GHSA-4r62-v4vq-hr96 | High | 2.5% | 08 Feb, 2021 | npm marked |
Regular Expression Denial of Service (REDoS) in httplib2 CVE-2021-21240, GHSA-93xj-8mrv-444m, PYSEC-2021-16 | High | 3.7% | 08 Feb, 2021 | PyPI httplib2 |
Code Injection vulnerability in CarrierWave::RMagick CVE-2021-21305, GHSA-cf3w-g86h-35x4 | High | 13.2% | 08 Feb, 2021 | RubyGems carrierwave |
Authentication bypass by capture-replay in github.com/cosmos/ethermint CVE-2021-25835, GHSA-x5f3-qmwj-4f84, GO-2022-0889 | High | 1.3% | 08 Feb, 2021 | Go github.com/cosmos/ethermint |
Authentication bypass by capture-replay in github.com/cosmos/ethermint CVE-2021-25834, GHSA-93p5-8fqw-wjx3, GO-2022-0813 | High | 1.2% | 08 Feb, 2021 | Go github.com/cosmos/ethermint |
SQL Injection in librenms CVE-2020-35700, GHSA-h59f-p56g-g75v | High | 2.4% | 08 Feb, 2021 | Packagist librenms/librenms |
Buffer Overflow in gitea BIT-gitea-2021-3382, CVE-2021-3382, GHSA-9f8c-pfvv-p4gm, GO-2024-2757 | High | 1.8% | 05 Feb, 2021 | Go code.gitea.io/gitea Go github.com/go-gitea/gitea |
Prototype Pollution in decal CVE-2020-28450, GHSA-j32x-j8pj-pg2h | High | 1.8% | 04 Feb, 2021 | npm decal |
Prototype Pollution in decal CVE-2020-28449, GHSA-vp77-fqqp-79j8 | High | 1.8% | 04 Feb, 2021 | npm decal |
Command Injection Vulnerability in Mechanize CVE-2021-21289, GHSA-qrqm-fpv6-6r8g | High | 3.5% | 02 Feb, 2021 | RubyGems mechanize |
Unexpected database bindings GHSA-x7p5-p2c9-phvg | High | Not scored | 02 Feb, 2021 | Packagist illuminate/database Packagist laravel/framework |
Denial of Service in uap-core CVE-2021-21317, GHSA-p4pj-mg4r-x6v4 | High | 2.5% | 02 Feb, 2021 | npm uap-core |
Prototype pollution in total.js CVE-2020-28495, GHSA-6cf8-qhqj-vjqm, SNYK-JS-TOTALJS-1046671 | High | 3.8% | 02 Feb, 2021 | npm total.js |
Command injection in total.js CVE-2020-28494, GHSA-4449-hg37-77v8, SNYK-JS-TOTALJS-1046672 | High | 1.7% | 02 Feb, 2021 | npm total.js |
Improper Privilege Management in HashiCorp Nomad CVE-2021-3283, GHSA-35qp-xq9f-2rjx, GO-2022-0622 | High | 1.5% | 01 Feb, 2021 | Go github.com/hashicorp/nomad |
Improper Authentication in HashiCorp Vault BIT-vault-2021-3282, CVE-2021-3282, GHSA-rq95-xf66-j689, GO-2024-2509 | High | 1.3% | 01 Feb, 2021 | Go github.com/hashicorp/vault |
Command injection in kill-process-on-port CVE-2020-28426, GHSA-5wqj-f379-6jh4 | High | 2.0% | 01 Feb, 2021 | npm kill-process-on-port |
Angular Expressions - Remote Code Execution CVE-2021-21277, GHSA-j6px-jwvv-vpwq | High | 2.8% | 01 Feb, 2021 | npm angular-expressions |
Prototype pollution in nested-object-assign CVE-2021-23329, GHSA-c497-v8pv-ch6x, SNYK-JS-NESTEDOBJECTASSIGN-1065977 | High | 1.5% | 31 Jan, 2021 | npm nested-object-assign |
Processing untrusted theming resources might execute arbitrary code (ACE) CVE-2021-21316, GHSA-3crj-w4f5-gwh4 | High | 1.0% | 29 Jan, 2021 | npm less-openui5 |
XSS in Mautic CVE-2021-3142, GHSA-p7v4-gm6j-cw9m | High | Not scored | 29 Jan, 2021 | Packagist mautic/core |
Moodle Arbitrary PHP code execution by site admins via Shibboleth configuration BIT-moodle-2021-20187, CVE-2021-20187, GHSA-2jrm-gww7-wch2 | High | 1.6% | 28 Jan, 2021 | Packagist moodle/moodle |
Codiad Vulnerable to PHP Magic Hash Vulnerability CVE-2020-23355, GHSA-8fhh-hf9w-55p7 | High | 1.0% | 27 Jan, 2021 | Packagist codiad/codiad |
Sudo Heap-Based Buffer Overflow Vulnerability CVE-2021-3156 | HighExploited | 100.0% | 26 Jan, 2021 | |
Zen Cart vulnerable to authenticated remote code execution CVE-2021-3291, GHSA-38f9-4vhq-9cr8 | High | 17.0% | 26 Jan, 2021 | Packagist zencart/zencart |
Path traversal in Node-RED-Dashboard CVE-2021-3223, GHSA-2hw7-mxvj-m455 | High | 18.9% | 26 Jan, 2021 | npm node-red-dashboard |
Arbitrary code injection via the go command with cgo on Windows in cmd/go BIT-golang-2021-3115, CVE-2021-3115, GO-2021-0068 | High | 6.9% | 26 Jan, 2021 | Go toolchain |
Path Traversal in node-red-contrib-huemagic CVE-2021-25864, GHSA-frpw-jrwx-hcfv | High | 9.3% | 26 Jan, 2021 | npm node-red-contrib-huemagic |
CakePHP allows method override parameters to bypass CSRF checks CVE-2020-35239, GHSA-9pgx-pf36-w46r | High | 0.6% | 26 Jan, 2021 | Packagist cakephp/cakephp |
Feehi CMS arbitrary file upload vulnerability CVE-2020-22643, GHSA-65x8-9vgm-5fg5 | High | 2.0% | 26 Jan, 2021 | Packagist feehi/cms |
Zip slip directory exploit in github.com/deislabs/oras BIT-oras-2021-21272, CVE-2021-21272, GHSA-g5v4-5x39-vwhx, GO-2021-0099 | High | 1.5% | 25 Jan, 2021 | Go github.com/deislabs/oras |
Inconsistent Interpretation of HTTP Requests in github.com/gin-gonic/gin CVE-2020-28483, GHSA-h395-qcrw-5vmq, GO-2021-0052, SNYK-GOLANG-GITHUBCOMGINGONICGIN-1041736 | High | 1.3% | 20 Jan, 2021 | Go github.com/gin-gonic/gin |
Command Injection in @graphql-tools/git-loader CVE-2021-23326, GHSA-vhhw-xjvf-wprr, SNYK-JS-GRAPHQLTOOLSGITLOADER-1062543 | High | 2.8% | 20 Jan, 2021 | npm @graphql-tools/git-loader |