Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Query Binding Exploitation BIT-laravel-2021-21263, CVE-2021-21263, GHSA-3p32-j457-pg5x | High | 1.6% | 19 Jan, 2021 | Packagist illuminate/database Packagist laravel/framework |
Cross-site Request Forgery in fastify-csrf CVE-2020-28482, GHSA-49wp-qq6x-g2rf, SNYK-JS-FASTIFYCSRF-1062044 | High | 1.0% | 19 Jan, 2021 | npm fastify-csrf |
Denial of Service (DoS) via the unsetByPath function in jsjoints CVE-2020-28479, GHSA-cq8r-fc3q-6hg2 | High | 2.1% | 19 Jan, 2021 | npm jointjs |
Prototype pollution in gsap CVE-2020-28478, GHSA-6g8v-hpgw-h2v7 | High | 1.6% | 19 Jan, 2021 | npm gsap |
Prototype Pollution in immer CVE-2020-28477, GHSA-9qmh-276g-x5pj | High | 2.3% | 19 Jan, 2021 | npm immer |
Directory Traversal in Archive_Tar BIT-drupal-2020-36193, CVE-2020-36193, GHSA-rpw6-9xfx-jvcx | HighExploited | 70.6% | 18 Jan, 2021 | Packagist pear/archive_tar |
Git LFS can execute a Git binary from the current directory on Windows BIT-git-lfs-2021-21237, CVE-2021-21237, GHSA-cx3w-xqmc-84g5, GO-2021-0098 | High | 0.5% | 15 Jan, 2021 | Go github.com/git-lfs/git-lfs |
Google Chrome Media Use-After-Free Vulnerability CVE-2020-6572 | HighExploited | 10.6% | 14 Jan, 2021 | |
Cross-site Scripting (XSS) in @scullyio/scully CVE-2020-28470, GHSA-r96p-v3cr-gfv8 | High | 0.8% | 14 Jan, 2021 | npm @scullyio/ng-lib npm @scullyio/scully |
Regular Expression Denial of Service in jquery-validation CVE-2021-21252, GHSA-jxwx-85vp-gvwm | High | 3.6% | 13 Jan, 2021 | NuGet jQuery.Validation npm jquery-validation |
Microsoft Defender Remote Code Execution Vulnerability CVE-2021-1647 | HighExploited | 39.7% | 12 Jan, 2021 | |
botframework-connector vulnerable to Improper Authentication CVE-2021-1725, GHSA-cqff-fx2x-p86v, GHSA-fvcj-hvfw-7f2v, PYSEC-2021-422 | High | 1.1% | 12 Jan, 2021 | PyPI botframework-connector npm botframework-connector |
ClusterLabs crmsh vulnerable to shell code injection CVE-2020-35459, GHSA-99xx-83jm-h24m, PYSEC-2026-799 | High | 0.7% | 12 Jan, 2021 | PyPI crmsh |
Pillow Out-of-bounds Read BIT-pillow-2020-35653, CVE-2020-35653, GHSA-f5g8-5qq7-938w, PYSEC-2021-69 | High | 1.6% | 12 Jan, 2021 | PyPI pillow |
Pillow Out-of-bounds Write BIT-pillow-2020-35654, CVE-2020-35654, GHSA-vqcj-wrf2-7v73, PYSEC-2021-70 | High | 1.9% | 12 Jan, 2021 | PyPI Pillow PyPI pillow |
CSRF can expose users authentication token CVE-2021-21241, GHSA-hh7m-rx4f-4vpv, PYSEC-2021-91 | High | 0.9% | 11 Jan, 2021 | PyPI Flask-Security-Too PyPI flask-security-too |
Cross-Site Request Forgery in ForkCMS CVE-2020-23960, GHSA-pvgf-mrr4-cw7r | High | 0.7% | 11 Jan, 2021 | Packagist forkcms/forkcms |
Improper Input Validation in GoGo Protobuf BIT-consul-2021-3121, BIT-protobuf-2021-3121, CVE-2021-3121, GHSA-c3h9-896r-86jm, GO-2021-0053 | High | 3.4% | 11 Jan, 2021 | Go github.com/gogo/protobuf |
Logic error in authentication in proxy.py CVE-2021-3116, GHSA-cmc7-mfmr-xqrx, PYSEC-2021-46 | High | 1.7% | 11 Jan, 2021 | PyPI proxy-py PyPI proxy.py |
Google Chromium V8 Incorrect Implementation Vulnerabililty CVE-2020-16013 | HighExploited | 2.8% | 08 Jan, 2021 | |
Resource exhaustion in socket.io-parser CVE-2020-36049, GHSA-xfhh-g9f5-x4m4 | High | 2.7% | 08 Jan, 2021 | npm socket.io-parser |
Resource exhaustion in engine.io CVE-2020-36048, GHSA-j4f2-536g-r55m | High | 3.3% | 08 Jan, 2021 | npm engine.io |
Regular Expression Denial of Service in CairoSVG CVE-2021-21236, GHSA-hq37-853p-g5cf, PYSEC-2021-5 | High | 1.4% | 06 Jan, 2021 | PyPI CairoSVG PyPI cairosvg |
Improper Validation of Array Index in GJSON CVE-2020-36067, GHSA-p64j-r5f4-pwwx, GO-2021-0054 | High | 1.4% | 05 Jan, 2021 | Go github.com/tidwall/gjson |
github.com/tidwall/gjson is vulnerable to Denial of service CVE-2020-36066, GHSA-wjm3-fq3r-5x46, GO-2022-0957 | High | 1.8% | 05 Jan, 2021 | Go github.com/tidwall/gjson |
Apache Flink Improper Access Control Vulnerability CVE-2020-17519 | HighExploited | 98.0% | 05 Jan, 2021 | |
Exposure of server configuration in github.com/go-vela/server CVE-2020-26294, GHSA-gv2h-gf8m-r68j, GO-2022-0838 | High | 1.8% | 04 Jan, 2021 | Go github.com/go-vela/compiler |
XSS in Vega CVE-2020-26296, GHSA-r2qc-w64x-6j54 | High | 1.7% | 30 Dec, 2020 | npm vega |
MantisBT Incorrect Authorization for bug_revision_view_page.php check CVE-2020-35849, GHSA-7j8m-fm49-xgmg | High | 1.6% | 30 Dec, 2020 | Packagist mantisbt/mantisbt |
Improper Restriction of XML External Entity Reference in Plone CVE-2020-28734, GHSA-wq6x-g685-w5f2, PYSEC-2020-246, PYSEC-2026-2880, PYSEC-2026-2883, PYSEC-2026-2886, PYSEC-2026-736 | High | 1.5% | 30 Dec, 2020 | PyPI Plone PyPI plone PyPI plone-app-dexterity PyPI plone-app-event +6 more |
SSRF attacks via tracebacks in Plone CVE-2020-28735, GHSA-x7wf-5mjc-6x76, PYSEC-2020-247, PYSEC-2026-2881, PYSEC-2026-2884, PYSEC-2026-2887, PYSEC-2026-737 | High | 1.5% | 30 Dec, 2020 | PyPI Plone PyPI plone PyPI plone-app-dexterity PyPI plone-app-event +6 more |
Improper Restriction of XML External Entity Reference in Plone CVE-2020-28736, GHSA-2c8c-84w2-j38j, PYSEC-2020-248, PYSEC-2026-2879, PYSEC-2026-2882, PYSEC-2026-2885, PYSEC-2026-735 | High | 1.5% | 30 Dec, 2020 | PyPI Plone PyPI plone PyPI plone-app-dexterity PyPI plone-app-event +6 more |
regular expression denial of service (ReDoS) CVE-2020-26289, GHSA-r92x-f52r-x54g | High | 2.2% | 24 Dec, 2020 | npm date-and-time |
Hyperledger Indy's update process of a DID does not check who signs the request CVE-2020-11093, GHSA-wh2w-39f4-rpv2, PYSEC-2020-48 | High | 1.2% | 24 Dec, 2020 | PyPI indy-node |
Dolibarr authenticated Remote Code Execution BIT-dolibarr-2020-35136, CVE-2020-35136, GHSA-7x8g-h246-gvx3 | High | 6.6% | 23 Dec, 2020 | Packagist dolibarr/dolibarr |
Prototype pollution in multi-ini CVE-2020-28460, GHSA-67mq-h2r9-rh2m, SNYK-JS-MULTIINI-1053229 | High | 1.5% | 22 Dec, 2020 | npm multi-ini |
Hugo can execute a binary from the current directory on Windows CVE-2020-26284, GHSA-8j34-9876-pvfq | High | 1.5% | 21 Dec, 2020 | Go github.com/gohugoio/hugo |
Incorrect Session Validation in Apache Airflow BIT-airflow-2020-17526, CVE-2020-17526, GHSA-7mx5-x372-xh87, PYSEC-2020-22 | High | 23.9% | 21 Dec, 2020 | PyPI apache-airflow |
RSA weakness in tslite-ng CVE-2020-26263, GHSA-wvcv-832q-fjg7, PYSEC-2020-143 | High | 1.5% | 21 Dec, 2020 | PyPI tlslite-ng |
OpenSlides is a free, Web-based presentation and assembly system for managing and projecting agenda, motions, and elections of assemblies. OpenSlides version 3.2, due to unsufficient user input validation and escaping, it is vulnerable to persistant cross-site scripting (XSS). In the web application CVE-2020-26280, GHSA-w5wr-98qm-jx92, PYSEC-2020-72 | High | 1.4% | 18 Dec, 2020 | PyPI openslides |
golang.org/x/crypto/ssh NULL Pointer Dereference vulnerability CVE-2020-29652, GHSA-3vm4-22fp-5rfm, GO-2021-0227 | High | 3.2% | 17 Dec, 2020 | Go golang.org/x/crypto |
Command Injection Vulnerability in systeminformation CVE-2020-26274, GHSA-m57p-p67h-mq74 | High | 2.7% | 16 Dec, 2020 | npm systeminformation |
datatables.net vulnerable to Prototype Pollution due to incomplete fix CVE-2020-28458, GHSA-m7j4-fhg6-xf5v | High | 3.7% | 16 Dec, 2020 | npm datatables.net |
Denial of Service in jsonparser CVE-2020-35381, GHSA-8vrw-m3j9-j27c, GO-2021-0057 | High | 2.3% | 15 Dec, 2020 | Go github.com/buger/jsonparser |
Denial of service in GJSON CVE-2020-35380, GHSA-w942-gw6m-p62c, GO-2021-0059 | High | 1.5% | 15 Dec, 2020 | Go github.com/tidwall/gjson |
ua-parser-js Regular Expression Denial of Service vulnerability CVE-2020-7793, GHSA-394c-5j6w-4xmx | High | 3.9% | 11 Dec, 2020 | npm ua-parser-js |
Prototype Pollution in mout CVE-2020-7792, GHSA-pc58-wgmc-hfjr | High | 2.1% | 11 Dec, 2020 | npm mout |
TensorFlow vulnerable to heap out of bounds read in filesystem glob matching BIT-tensorflow-2020-26269, CVE-2020-26269, GHSA-9jjw-hf72-3mxw, PYSEC-2020-141, PYSEC-2020-300, PYSEC-2020-335 | High | 0.7% | 10 Dec, 2020 | PyPI tensorflow PyPI tensorflow-cpu PyPI tensorflow-gpu |
Lack of validation in data format attributes in TensorFlow BIT-tensorflow-2020-26267, CVE-2020-26267, GHSA-c9f3-9wfr-wgh7, PYSEC-2020-140, PYSEC-2020-298, PYSEC-2020-333 | High | 0.2% | 10 Dec, 2020 | PyPI tensorflow PyPI tensorflow-cpu PyPI tensorflow-gpu |
Microsoft Exchange Server Remote Code Execution Vulnerability CVE-2020-17144 | HighExploited | 36.5% | 10 Dec, 2020 |