Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Samsung Mobile Devices Unspecified Vulnerability CVE-2021-25371 | MediumExploited | 0.8% | 26 Mar, 2021 | |
Samsung Mobile Devices Memory Corruption Vulnerability CVE-2021-25370 | MediumExploited | 0.9% | 26 Mar, 2021 | |
Samsung Mobile Devices Improper Access Control Vulnerability CVE-2021-25369 | MediumExploited | 1.1% | 26 Mar, 2021 | |
Craft CMS Cross-site Scripting Vulnerability CVE-2020-19626, GHSA-33jj-92px-m4g7 | Medium | 0.8% | 26 Mar, 2021 | Packagist craftcms/cms |
Cross-site Scripting (XSS) in baserCMS CVE-2021-20683, GHSA-v9w8-hq92-v39m | Medium | 0.7% | 26 Mar, 2021 | Packagist baserproject/basercms |
Cross-site Scripting (XSS) in baserCMS CVE-2021-20681, GHSA-24p5-x9f9-vvpx | Medium | 0.7% | 26 Mar, 2021 | Packagist baserproject/basercms |
Plone XSS Vulnerability CVE-2021-29002, GHSA-38g6-x6jv-jwff, PYSEC-2021-889 | Medium | 0.8% | 24 Mar, 2021 | PyPI plone |
Mautic vulnerable to secret data exfiltration via symfony parameters CVE-2021-27908, GHSA-4hjq-422q-4vpx | Medium | 0.3% | 23 Mar, 2021 | Packagist mautic/core |
Regular Expression Denial of Service in hosted-git-info CVE-2021-23362, GHSA-43f8-2h32-f4cj | Medium | 3.6% | 23 Mar, 2021 | npm hosted-git-info |
OMERO webclient does not validate URL redirects on login or switching group. CVE-2021-21377, GHSA-g4rf-pc26-6hmr, PYSEC-2021-32 | Medium | 0.8% | 23 Mar, 2021 | PyPI omero-web |
Cross-Site Scripting in Content Preview (CType menu) BIT-typo3-2021-21370, CVE-2021-21370, GHSA-x7hc-x7fm-f7qh | Medium | 0.9% | 23 Mar, 2021 | Packagist typo3/cms Packagist typo3/cms-backend Packagist typo3/cms-core |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in typo3/cms-form BIT-typo3-2021-21358, CVE-2021-21358, GHSA-x79j-wgqv-g8h2 | Medium | 0.9% | 23 Mar, 2021 | Packagist typo3/cms Packagist typo3/cms-core Packagist typo3/cms-form |
Cross-Site Scripting in Content Preview BIT-typo3-2021-21340, CVE-2021-21340, GHSA-fjh3-g8gq-9q92 | Medium | 0.9% | 23 Mar, 2021 | Packagist typo3/cms Packagist typo3/cms-backend Packagist typo3/cms-core |
Open Redirection in Login Handling BIT-typo3-2021-21338, CVE-2021-21338, GHSA-4jhw-2p6j-5wmp | Medium | 1.1% | 23 Mar, 2021 | Packagist typo3/cms Packagist typo3/cms-core |
lxml vulnerable to Cross-Site Scripting CVE-2021-28957, GHSA-jq4v-f5q6-mjqq, PYSEC-2021-19 | Medium | 4.0% | 21 Mar, 2021 | PyPI lxml |
Reflected XSS in Zen Cart before 1.5.7a CVE-2020-6578, GHSA-wxxx-2x6v-979f | Medium | 0.8% | 19 Mar, 2021 | Packagist zencart/zencart |
Regular Expression Denial of Service (ReDoS) in Pillow BIT-pillow-2021-25292, CVE-2021-25292, GHSA-9hx2-hgq2-2g4f, PYSEC-2021-38 | Medium | 1.7% | 19 Mar, 2021 | PyPI Pillow PyPI pillow |
Concrete CMS Cross-site Scripting via Survey Blocks CVE-2021-28145, GHSA-7388-7vq2-m4f4 | Medium | 0.9% | 18 Mar, 2021 | Packagist concrete5/concrete5 |
Aimeos Typo3 extension contains Cross-site Scripting vulnerability CVE-2021-28380, GHSA-73wv-rgj7-vjj9 | Medium | 0.6% | 16 Mar, 2021 | Packagist aimeos/aimeos-typo3 |
XSS in CreateQueuedJobTask CVE-2021-27938, GHSA-xgpf-p52j-pf7m | Medium | 0.8% | 16 Mar, 2021 | Packagist symbiote/silverstripe-queuedjobs |
Missing permission check in Moodle BIT-moodle-2021-20283, CVE-2021-20283, GHSA-2m72-m5cw-3g9h | Medium | 1.1% | 15 Mar, 2021 | Packagist moodle/moodle |
Moodle Bypass email verification secret when confirming account registration BIT-moodle-2021-20282, CVE-2021-20282, GHSA-grj4-g57c-9xmv | Medium | 1.3% | 15 Mar, 2021 | Packagist moodle/moodle |
Moodle allowed some users without permission to view other users' full names BIT-moodle-2021-20281, CVE-2021-20281, GHSA-93wh-35r4-6qmw | Medium | 1.4% | 15 Mar, 2021 | Packagist moodle/moodle |
Cross-site scripting (XSS) and Server side request forgery (SSRF) in moodle BIT-moodle-2021-20280, CVE-2021-20280, GHSA-x2jp-hh65-4xvf | Medium | 1.3% | 15 Mar, 2021 | Packagist moodle/moodle |
Moodle contains Stored XSS via ID number user profile field BIT-moodle-2021-20279, CVE-2021-20279, GHSA-h7h6-fwpv-ggvx | Medium | 1.0% | 15 Mar, 2021 | Packagist moodle/moodle |
Grav CMS Local File Injection CVE-2020-29556, GHSA-r3rg-jrjq-w4mr | Medium | 1.0% | 15 Mar, 2021 | Packagist getgrav/grav |
Using default SSLContext for HTTPS requests in an HTTPS proxy doesn't verify certificate hostname for proxy connection CVE-2021-28363, GHSA-5phf-pp7p-vc2r, PYSEC-2021-59 | Medium | 2.2% | 15 Mar, 2021 | PyPI urllib3 |
Authenticated remote code execution GHSA-pjj4-jjgc-h3r8 | Medium | Not scored | 12 Mar, 2021 | Packagist shopware/platform |
Verification flaw in Solid identity-token-verifier GHSA-xmh9-rg6f-j3mr | Medium | Not scored | 12 Mar, 2021 | npm @solid/identity-token-verifier |
Command Injection in @theia/messages CVE-2021-28162, GHSA-c94v-8fff-73ph | Medium | 0.8% | 12 Mar, 2021 | npm @theia/messages |
Improper Neutralization of Input in Theia console CVE-2021-28161, GHSA-cwg9-c9cr-p5fq | Medium | 0.7% | 12 Mar, 2021 | npm @theia/console |
Misinterpretation of malicious XML input CVE-2021-21366, GHSA-h6q6-9hqw-rwfv | Medium | 1.3% | 12 Mar, 2021 | npm xmldom |
/user/sessions endpoint allows detecting valid accounts CVE-2021-46876, GHSA-gmrf-99gw-vvwj | Medium | 0.5% | 11 Mar, 2021 | Packagist ezsystems/ezpublish-kernel |
Cross-site scripting (XSS) CVE-2021-28088, GHSA-79hv-pfx6-hhpj | Medium | 0.9% | 11 Mar, 2021 | Packagist impresscms/impresscms |
containerd environment variable leak CVE-2021-21334, GHSA-6g2q-w5j3-fwh4 | Medium | 1.9% | 10 Mar, 2021 | Go github.com/containerd/containerd |
react-dev-utils OS Command Injection in function `getProcessForPort` CVE-2021-24033, GHSA-5q6m-3h65-w53x | Medium | 3.3% | 09 Mar, 2021 | npm react-dev-utils |
Exposure of Sensitive Information to an Unauthorized Actor in Products.GenericSetup CVE-2021-21360, GHSA-jff3-mwp3-f8cw, PYSEC-2021-43 | Medium | 1.5% | 09 Mar, 2021 | PyPI Products.GenericSetup PyPI products-genericsetup |
URL Redirection to Untrusted Site ('Open Redirect') in Products.PluggableAuthService CVE-2021-21337, GHSA-p44j-xrqg-4xrr, PYSEC-2021-45 | Medium | 8.4% | 08 Mar, 2021 | PyPI Products.PluggableAuthService PyPI products-pluggableauthservice |
github.com/pires/go-proxyproto denial of service vulnerability CVE-2021-23351, GHSA-fqh4-rh59-xhvf, SNYK-GOLANG-GITHUBCOMPIRESGOPROXYPROTO-1081577 | Medium | 1.9% | 08 Mar, 2021 | Go github.com/pires/go-proxyproto |
ansi_up cross-site scripting vulnerability CVE-2021-3377, GHSA-2v5f-23xc-v9qr | Medium | 8.0% | 05 Mar, 2021 | npm ansi_up |
Apache Superset Stored XSS on Dashboard markdown BIT-superset-2021-27907, CVE-2021-27907, GHSA-w358-rj93-r5qv, PYSEC-2021-127 | Medium | 86.4% | 05 Mar, 2021 | PyPI apache-superset |
Rancher Cross-site Scripting Vulnerability CVE-2021-25313, GHSA-6m8r-jh89-rq7h | Medium | 1.5% | 05 Mar, 2021 | Go github.com/rancher/rancher |
Activerecord-session_store Vulnerable to Timing Attack CVE-2019-25025, GHSA-cvw2-xj8r-mjf7 | Medium | 1.8% | 05 Mar, 2021 | RubyGems activerecord-session_store |
Path Traversal within joomla/archive zip class BIT-joomla-2021-26028, CVE-2021-26028, GHSA-vgwr-773q-7j3c | Medium | 1.0% | 04 Mar, 2021 | Packagist joomla/archive |
html-parse-stringify and html-parse-stringify2 vulnerable to Regular expression denial of service (ReDoS) CVE-2021-23346, GHSA-545q-3fg6-48m7 | Medium | 2.1% | 04 Mar, 2021 | npm html-parse-stringify npm html-parse-stringify2 |
qcubed reflected cross-site scripting (XSS) vulnerability CVE-2020-24912, GHSA-xj4v-gp4q-h6qq | Medium | 6.3% | 04 Mar, 2021 | Packagist qcubed/qcubed |
Possible XSS when using SSO with the CLI in github.com/argoproj/argo-cd/v2 BIT-argo-cd-2021-23347, CVE-2021-23347, GHSA-qq5v-f4c3-395c, GO-2022-0869, SNYK-GOLANG-GITHUBCOMARGOPROJARGOCDCMD-1078291 | Medium | 0.6% | 03 Mar, 2021 | Go github.com/argoproj/argo-cd Go github.com/argoproj/argo-cd/v2 |
User content sandbox can be confused into opening arbitrary documents CVE-2021-21320, GHSA-52mq-6jcv-j79x | Medium | 0.9% | 02 Mar, 2021 | npm matrix-react-sdk |
Weak JSON Web Token in yapi-vendor CVE-2021-27884, GHSA-2h3h-vw8r-82rp | Medium | 0.3% | 01 Mar, 2021 | npm yapi-vendor |
SaltStack Salt Cleartext Storage of Sensitive Information via cmdmod CVE-2021-25284, GHSA-r55w-xph5-xvx2, PYSEC-2021-53 | Medium | 0.5% | 27 Feb, 2021 | PyPI salt |