Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
DOM XSS in Theme Preview BIT-ghost-2021-29484, CVE-2021-29484, GHSA-9fgx-q25h-jxrg | Medium | 7.9% | 29 Apr, 2021 | npm ghost |
Regular Expression Denial of Service in browserslist CVE-2021-23364, GHSA-w8qv-6jwh-64r5 | Medium | 2.4% | 28 Apr, 2021 | npm browserslist |
Server-Side Request Forgery in yoast_seo CVE-2021-31779, GHSA-m2q4-qghh-p9cq | Medium | 0.5% | 28 Apr, 2021 | Packagist yoast-seo-for-typo3/yoast_seo |
Cross-site scripting in media2click CVE-2021-31778, GHSA-xpxm-pf7g-2534 | Medium | 0.5% | 28 Apr, 2021 | Packagist amazing/media2click |
Cross-Site Scripting in Bootstrap Package BIT-typo3-2021-21365, CVE-2021-21365, GHSA-p48w-vf3c-rqjx | Medium | 0.9% | 27 Apr, 2021 | Packagist bk2k/bootstrap-package |
Open Redirect in Apache Superset BIT-superset-2021-28125, CVE-2021-28125, GHSA-pfwg-rxf4-97c3, PYSEC-2021-128, PYSEC-2026-3078 | Medium | 64.0% | 27 Apr, 2021 | PyPI apache-superset PyPI superset |
Cross-site Scripting in React Draft Wysiwyg CVE-2021-31712, GHSA-qcg2-h349-vwm3 | Medium | 0.8% | 24 Apr, 2021 | npm react-draft-wysiwyg |
Drupal core Cross-site Scripting (XSS) vulnerability BIT-drupal-2020-13672, CVE-2020-13672, DRUPAL-CORE-2021-002, GHSA-3m36-mjwj-352c | Medium | 0.7% | 21 Apr, 2021 | Packagist drupal/core Packagist drupal/drupal |
HashiCorp Consul Cross-site Scripting vulnerability BIT-consul-2020-25864, CVE-2020-25864, GHSA-8xmx-h8rq-h94j, GO-2023-1851 | Medium | 6.1% | 20 Apr, 2021 | Go github.com/hashicorp/consul |
SonicWall Email Security Path Traversal Vulnerability CVE-2021-20023 | MediumExploited | 51.7% | 20 Apr, 2021 | |
VVE-2021-0002: Incorrect `returndatasize` when using simple forwarder proxies deployed prior to EIP-1167 adoption CVE-2021-48019, GHSA-375m-5fvv-xq23 | Medium | 0.2% | 19 Apr, 2021 | PyPI vyper |
Padding Oracle Attack due to Observable Timing Discrepancy in jose-node-cjs-runtime CVE-2021-29446, GHSA-rvcw-f68w-8h8h | Medium | 1.1% | 16 Apr, 2021 | npm jose-node-cjs-runtime |
Padding Oracle Attack due to Observable Timing Discrepancy in jose-node-esm-runtime CVE-2021-29445, GHSA-4v4g-726h-xvfv | Medium | 1.1% | 16 Apr, 2021 | npm jose-node-esm-runtime |
Padding Oracle Attack due to Observable Timing Discrepancy in jose-browser-runtime CVE-2021-29444, GHSA-94hh-pjjg-rwmr | Medium | 1.1% | 16 Apr, 2021 | npm jose-browser-runtime |
Padding Oracle Attack due to Observable Timing Discrepancy in jose CVE-2021-29443, GHSA-58f5-hfqc-jgch | Medium | 1.2% | 16 Apr, 2021 | npm jose |
SSRF in Sydent due to missing validation of hostnames CVE-2021-29431, GHSA-9jhm-8m8c-c3f4, PYSEC-2021-22 | Medium | 1.2% | 15 Apr, 2021 | PyPI matrix-sydent |
Malicious users could abuse Sydent to control the content of invitation emails CVE-2021-29432, GHSA-mh74-4m5g-fcjx, PYSEC-2021-23 | Medium | 0.9% | 15 Apr, 2021 | PyPI matrix-sydent |
Predictable CSRF tokens in centreon/centreon CVE-2021-28055, GHSA-7rg4-266c-jqw6 | Medium | 0.8% | 15 Apr, 2021 | Packagist centreon/centreon |
Sydent DoS (via resource exhaustion) due to improper input validation CVE-2021-29433, GHSA-pw4v-gr34-2553, PYSEC-2021-24 | Medium | 0.9% | 15 Apr, 2021 | PyPI matrix-sydent |
reflected XSS in tribalsystems/zenario CVE-2021-27673, GHSA-8hcm-jj4x-4gmr | Medium | 1.1% | 15 Apr, 2021 | Packagist tribalsystems/zenario |
SQL Injection in tribalsystems/zenario CVE-2021-27672, GHSA-gxcm-36qw-j29v | Medium | 1.3% | 15 Apr, 2021 | Packagist tribalsystems/zenario |
go-saml's XML Digital Signatures use SHA-1 CVE-2020-36563, GHSA-5rhg-xhgr-5hfj, GO-2020-0047 | Medium | 0.3% | 14 Apr, 2021 | Go github.com/RobotsAndPencils/go-saml |
Echo vulnerable to directory traversal CVE-2020-36565, GHSA-j453-hm5x-c46w, GO-2021-0051 | Medium | 1.4% | 14 Apr, 2021 | Go github.com/labstack/echo/v4 |
YAML Go package vulnerable to denial of service CVE-2021-4235, GHSA-r88r-gmrh-7j83, GO-2021-0061 | Medium | 0.4% | 14 Apr, 2021 | Go github.com/go-yaml/yaml Go gopkg.in/yaml.v2 |
Cross Site Scripting (XSS) in LavaLite 5.8.0 CVE-2020-28124, GHSA-6r6h-vhg7-53x7 | Medium | 0.5% | 14 Apr, 2021 | Packagist lavalite/cms |
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in @nextcloud/dialogs CVE-2021-29438, GHSA-g3fq-3v3g-mh32 | Medium | 0.7% | 13 Apr, 2021 | npm @nextcloud/dialogs |
Exposure of .env if project root is configured as web root in shopware/production GHSA-3pcr-4982-548m | Medium | Not scored | 13 Apr, 2021 | Packagist shopware/production Packagist shopware/shopware |
Potential API key leak GHSA-63rq-p8fp-524q | Medium | Not scored | 13 Apr, 2021 | PyPI sopel-modules-weather PyPI sopel-modules.weather |
Denial of service (via resource exhaustion) due to improper input validation on groups/communities endpoints CVE-2021-21393, GHSA-jrh7-mhhx-6h88, PYSEC-2021-26 | Medium | 1.6% | 12 Apr, 2021 | PyPI matrix-synapse |
Cross-site Scripting in quill CVE-2021-3163, GHSA-4943-9vgg-gr5r | Medium | 1.3% | 12 Apr, 2021 | npm quill |
Denial of service (via resource exhaustion) due to improper input validation on third-party identifier endpoints CVE-2021-21394, GHSA-w9fg-xffh-p362, PYSEC-2021-27 | Medium | 1.5% | 12 Apr, 2021 | PyPI matrix-synapse |
MongoDB Tools Improper Certificate Validation vulnerability CVE-2020-7924, GHSA-6cwm-wm82-hgrw, GO-2024-2550 | Medium | 0.7% | 12 Apr, 2021 | Go github.com/mongodb/mongo-tools |
Regular Expression Denial of Service in postcss CVE-2021-23368, GHSA-hwj9-h5mp-3pm3 | Medium | 3.5% | 12 Apr, 2021 | npm postcss |
Cross-site scripting in SiCKRAGE CVE-2021-25925, GHSA-rmp7-f2vp-3rq4, PYSEC-2021-147 | Medium | 0.7% | 12 Apr, 2021 | PyPI sickrage |
Cross-site scripting in sickrage CVE-2021-25926, GHSA-x823-j7c4-vpc5, PYSEC-2021-148 | Medium | 0.8% | 12 Apr, 2021 | PyPI sickrage |
subrion CMS Cross Site Scripting (XSS) vulnerability CVE-2020-23761, GHSA-xhc3-5pgf-p576 | Medium | 1.0% | 09 Apr, 2021 | Packagist intelliants/subrion |
Wikimedia Parsoid vulnerable to Cross-site Scripting (XSS) CVE-2021-30458, GHSA-5pqx-77vf-85rw | Medium | 1.0% | 09 Apr, 2021 | Packagist wikimedia/parsoid |
Regular expression Denial of Service in multiple packages CVE-2021-21391, GHSA-3rh3-wfr4-76mj | Medium | 1.7% | 06 Apr, 2021 | npm @ckeditor/ckeditor5-engine npm @ckeditor/ckeditor5-font npm @ckeditor/ckeditor5-image npm @ckeditor/ckeditor5-list +4 more |
Directory Traversal in Django BIT-django-2021-28658, CVE-2021-28658, GHSA-xgxc-v2qg-chmh, PYSEC-2021-6 | Medium | 3.8% | 06 Apr, 2021 | PyPI Django PyPI django |
Cross-site Scripting in Froala Editor CVE-2021-30109, GHSA-cq6w-w5rj-p9x8 | Medium | 1.2% | 05 Apr, 2021 | npm froala-editor |
Docsify vulnerable to cross-site scripting due to mishandled encoding CVE-2021-30074, GHSA-5h7x-68wj-jhwc | Medium | 0.8% | 02 Apr, 2021 | npm docsify |
Apple iOS, iPadOS, and watchOS WebKit Cross-Site Scripting (XSS) Vulnerability CVE-2021-1879 | MediumExploited | 7.1% | 02 Apr, 2021 | |
Improper Locking in github.com/containers/storage CVE-2021-20291, GHSA-7qw8-847f-pggm, GO-2021-0100 | Medium | 1.6% | 01 Apr, 2021 | Go github.com/containers/storage |
A flaw was found in several ansible modules, where parameters containing credentials, such as secrets, were being logged in plain-text on managed nodes, as well as being made visible on the controller node when run in verbose mode. These parameters were not protected by the no_log feature. An attack CVE-2021-3447, PYSEC-2021-107 | Medium | 0.3% | 01 Apr, 2021 | PyPI ansible |
Potential XSS injection in the newsletter conditions field CVE-2021-21418, GHSA-vwfx-hh3w-fj99 | Medium | 0.8% | 31 Mar, 2021 | Packagist prestashop/ps_emailsubscription |
Regular Expression Denial of Service (ReDoS) in braces CVE-2018-1109, GHSA-cwfw-4gq5-mrqx | Medium | 1.4% | 30 Mar, 2021 | npm braces |
Regular expression deinal of service (ReDoS) in is-my-json-valid CVE-2018-1107, GHSA-4hpf-3wq7-5rpr | Medium | 1.2% | 30 Mar, 2021 | npm is-my-json-valid |
OAuth2-Proxy's `--gitlab-group` GitLab Group Authorization config flag stopped working in v7.0.0 BIT-oauth2-proxy-2021-21411, CVE-2021-21411, GHSA-652x-m2gr-hppm, GO-2025-3832 | Medium | 1.1% | 26 Mar, 2021 | Go github.com/oauth2-proxy/oauth2-proxy Go github.com/oauth2-proxy/oauth2-proxy/v7 |
HTML injection in email and account expiry notifications CVE-2021-21333, GHSA-c5f8-35qr-q4fm, PYSEC-2021-134 | Medium | 1.4% | 26 Mar, 2021 | PyPI matrix-synapse |
Samsung Mobile Devices Improper Boundary Check Vulnerability CVE-2021-25372 | MediumExploited | 0.8% | 26 Mar, 2021 |