Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
EC-CUBE Cross-site scripting vulnerability CVE-2021-20750, GHSA-vrpv-26fm-7vf7 | Medium | 1.6% | 28 Jun, 2021 | Packagist ec-cube/ec-cube |
Cross-site Scripting in Mermaid CVE-2021-35513, GHSA-4f6x-49g2-99fm | Medium | 1.0% | 27 Jun, 2021 | npm mermaid |
Exposure of Sensitive Information to an Unauthorized Actor CVE-2021-32716, GHSA-68v9-3jjq-rvp4, GHSA-gpmh-g94g-qrhr | Medium | 1.1% | 24 Jun, 2021 | Packagist shopware/core Packagist shopware/platform |
Cross-site scripting CVE-2021-32713, GHSA-7vmw-7x57-q6jw | Medium | 0.7% | 24 Jun, 2021 | Packagist shopware/shopware |
Exposure of Sensitive Information to an Unauthorized Actor CVE-2021-32712, GHSA-qwpp-fgrj-h78q | Medium | 1.1% | 24 Jun, 2021 | Packagist shopware/shopware |
Improper network isolation in Hashicorp Nomad CVE-2021-32575, GHSA-vf6q-9f2f-mwhv, GO-2022-0709 | Medium | 0.5% | 24 Jun, 2021 | Go github.com/hashicorp/nomad |
Missing Authentication for Critical Function CVE-2021-32709, GHSA-g7w8-pp9w-7p32, GHSA-p696-gf58-9w97 | Medium | 0.6% | 24 Jun, 2021 | Packagist shopware/core Packagist shopware/platform |
Cross-site scripting in react-bootstrap-table CVE-2021-23398, GHSA-2589-w6xf-983r | Medium | 1.3% | 24 Jun, 2021 | npm react-bootstrap-table |
Potential Denial-of-Service in bindata BIT-gitlab-2021-32823, CVE-2021-32823, GHSA-hj56-84jw-67h6 | Medium | 1.9% | 23 Jun, 2021 | RubyGems bindata |
Helm passes repository credentials to alternate domain BIT-helm-2021-32690, CVE-2021-32690, GHSA-56hp-xqp3-w2jf, GHSA-7jr6-prv4-5wf5, GO-2022-0384 | Medium | 1.4% | 23 Jun, 2021 | Go helm.sh/helm/v3 |
Unchecked hostname resolution could allow access to local network resources by users outside the local network GHSA-6rg3-8h8x-5xfv, GO-2022-0389 | Medium | Not scored | 23 Jun, 2021 | Go github.com/pterodactyl/wings |
Asymmetric Resource Consumption (Amplification) in Docker containers created by Wings CVE-2021-32699, GHSA-jj6m-r8jc-2gp7, GO-2022-0919 | Medium | 0.3% | 23 Jun, 2021 | Go github.com/pterodactyl/wings |
Improper input validation in CNCF Cortex CVE-2021-31232, GHSA-m45g-f45x-vv22, GO-2022-0915 | Medium | 0.4% | 23 Jun, 2021 | Go github.com/cortexproject/cortex |
Cross site scripting in the system log CVE-2021-35210, GHSA-h58v-c6rf-g9f7 | Medium | 0.7% | 23 Jun, 2021 | Packagist contao/contao Packagist contao/core-bundle |
JetPack Exposure of Resource to Wrong Sphere CVE-2021-24374, GHSA-5hr6-r8h6-wh22 | Medium | 1.5% | 21 Jun, 2021 | Packagist automattic/jetpack |
Form validation can be skipped CVE-2021-32697, GHSA-m5vx-8chx-qvmm | Medium | 1.1% | 21 Jun, 2021 | Packagist neos/form |
Regular Expression Denial of Service (ReDOS) CVE-2021-29060, GHSA-257v-vj4p-3w2h | Medium | 3.1% | 21 Jun, 2021 | npm color-string |
Passing in a non-string 'html' argument can lead to unsanitized output CVE-2021-32696, GHSA-qxg5-2qff-p49r | Medium | 1.1% | 18 Jun, 2021 | npm striptags |
MantisBT allows XSS in manage_custom_field_edit_page.php CVE-2021-33557, GHSA-52cx-vphc-jmjm | Medium | 1.8% | 17 Jun, 2021 | Packagist mantisbt/mantisbt |
Cross-site Scripting in wagtail CVE-2021-32681, GHSA-xfrw-hxr5-ghqf, PYSEC-2021-103 | Medium | 1.1% | 17 Jun, 2021 | PyPI wagtail |
Cross-site scripting in PageKit CVE-2021-32245, GHSA-mrwr-2945-fr22 | Medium | 0.5% | 16 Jun, 2021 | Packagist pagekit/pagekit |
Moodle Cross Site Scripting (XSS) BIT-moodle-2021-32244, CVE-2021-32244, GHSA-g5m5-j48g-fr24 | Medium | 0.9% | 16 Jun, 2021 | Packagist moodle/moodle |
Automatic room upgrade handling can be used maliciously to bridge a room non-consentually CVE-2021-32659, GHSA-35g4-qx3c-vjhx | Medium | 0.9% | 16 Jun, 2021 | npm matrix-appservice-bridge |
Denial of service in Valine CVE-2021-34801, GHSA-p2c4-gxp4-j3xp | Medium | 1.7% | 16 Jun, 2021 | npm valine |
Missing Handler in @scandipwa/magento-scripts CVE-2021-32684, GHSA-52qp-gwwh-qrg4 | Medium | 0.7% | 14 Jun, 2021 | npm @scandipwa/magento-scripts |
Samsung Mobile Devices Race Condition Vulnerability CVE-2021-25395 | MediumExploited | 0.4% | 11 Jun, 2021 | |
Samsung Mobile Devices Race Condition Vulnerability CVE-2021-25394 | MediumExploited | 0.4% | 11 Jun, 2021 | |
OpenPLC ScadaBR Cross-site Scripting Vulnerability CVE-2021-26829 | MediumExploited | 48.0% | 11 Jun, 2021 | |
Open redirect in Flask-Unchained CVE-2021-23393, GHSA-pjc4-3w99-j7v4, PYSEC-2021-96, SNYK-PYTHON-FLASKUNCHAINED-1293189 | Medium | 0.7% | 11 Jun, 2021 | PyPI Flask-Unchained PyPI flask-unchained |
go.mongodb.org/mongo-driver improperly validates cstrings when marshalling Go objects into BSON CVE-2021-20329, GHSA-f6mq-5m25-4r72, GO-2021-0112 | Medium | 0.9% | 10 Jun, 2021 | Go go.mongodb.org/mongo-driver |
Microsoft Windows Kernel Information Disclosure Vulnerability CVE-2021-31955 | MediumExploited | 81.1% | 08 Jun, 2021 | |
Microsoft Enhanced Cryptographic Provider Privilege Escalation Vulnerability CVE-2021-31201 | MediumExploited | 2.6% | 08 Jun, 2021 | |
Microsoft Enhanced Cryptographic Provider Privilege Escalation Vulnerability CVE-2021-31199 | MediumExploited | 3.0% | 08 Jun, 2021 | |
Improper Input Validation CVE-2021-3499, GHSA-57v4-m9jx-mh8r | Medium | 0.8% | 08 Jun, 2021 | Go github.com/ovn-org/ovn-kubernetes |
Authentication bypass in SilverStripe GraphQL BIT-silverstripe-2020-26136, CVE-2020-26136, GHSA-mg2g-8pwj-r2j2 | Medium | 1.2% | 08 Jun, 2021 | Packagist silverstripe/graphql |
FormField with square brackets in field name skips validation BIT-silverstripe-2020-26138, CVE-2020-26138, GHSA-7mv4-4xpg-xq44 | Medium | 1.3% | 08 Jun, 2021 | Packagist silverstripe/framework |
SilverStripe XXE Vulnerability in CSSContentParser BIT-silverstripe-2020-25817, CVE-2020-25817, GHSA-3vjc-5x79-m9r8 | Medium | 0.8% | 08 Jun, 2021 | Packagist silverstripe/framework |
Path Traversal in Django BIT-django-2021-33203, CVE-2021-33203, GHSA-68w8-qjq3-2gfm, PYSEC-2021-98 | Medium | 2.7% | 08 Jun, 2021 | PyPI Django PyPI django |
Cross-site scripting in ICEcoder CVE-2021-32106, GHSA-jf9v-q8vh-3fmc | Medium | 0.9% | 08 Jun, 2021 | Packagist icecoder/icecoder |
Google Chromium PopupBlocker Security Bypass Vulnerability CVE-2021-30533 | MediumExploited | 16.7% | 07 Jun, 2021 | |
Path traversal CVE-2021-32662, GHSA-pgf8-28gg-vpr6 | Medium | 1.3% | 03 Jun, 2021 | npm @backstage/techdocs-common |
Insufficient Verification of Data Authenticity in Pillow BIT-pillow-2021-28678, CVE-2021-28678, GHSA-hjfx-8p6c-g7gx, PYSEC-2021-94 | Medium | 0.7% | 02 Jun, 2021 | PyPI Pillow PyPI pillow |
Temporary urls leaked via logging CVE-2017-8761, GHSA-8fxc-qm65-vpxg, PYSEC-2026-751 | Medium | 0.8% | 02 Jun, 2021 | PyPI swift |
Action Commands (run/shell/exec) Against Library URIs Ignore Configured Remote Endpoint CVE-2021-32635, GHSA-5mv9-q7fq-9394 | Medium | 1.4% | 01 Jun, 2021 | Go github.com/sylabs/singularity |
Action Commands (run/shell/exec) Against Library URIs Ignore Configured Remote Endpoint GHSA-jq42-hfch-42f3 | Medium | Not scored | 01 Jun, 2021 | Go github.com/hpcng/singularity |
Improper Verification of Cryptographic Signature in aws-encryption-sdk-javascript GHSA-h45p-w933-jxh3 | Medium | Not scored | 01 Jun, 2021 | npm @aws-crypto/client-browser npm @aws-crypto/client-node |
Improper Verification of Cryptographic Signature in aws-encryption-sdk-cli GHSA-89v2-g37m-g3ff | Medium | Not scored | 01 Jun, 2021 | PyPI aws-encryption-sdk-cli |
Improper Verification of Cryptographic Signature in aws-encryption-sdk GHSA-x5h4-9gqw-942j | Medium | Not scored | 01 Jun, 2021 | PyPI aws-encryption-sdk |
Regular expression denial of service in forms CVE-2021-23388, GHSA-c56f-grv3-gpfr, SNYK-JS-FORMS-1296389 | Medium | 1.7% | 01 Jun, 2021 | npm forms |
Access Restriction Bypass in kube-apiserver CVE-2021-25735, GHSA-g42g-737j-qx6j, GO-2022-0907 | Medium | 5.4% | 28 May, 2021 | Go k8s.io/kubernetes |