Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
mongodb-client-encryption vulnerable to Improper Certificate Validation CVE-2021-20327, GHSA-rjmf-p882-645m | Medium | 0.2% | 25 Feb, 2021 | npm mongodb-client-encryption |
VMware vCenter Server and Cloud Foundation Server Side Request Forgery (SSRF) Vulnerability CVE-2021-21973 | MediumExploited | 88.0% | 24 Feb, 2021 | |
SSRF in Rendertron CVE-2020-8902, GHSA-xr9h-9m79-x29g | Medium | 0.3% | 23 Feb, 2021 | npm rendertron |
MantisBT XSS in manage_custom_field_update.php CVE-2020-35571, GHSA-cvrm-cr3m-qj92 | Medium | 0.7% | 22 Feb, 2021 | Packagist mantisbt/mantisbt |
Path traversal in url-parse CVE-2021-27515, GHSA-9m6j-fcg5-2442 | Medium | 2.0% | 22 Feb, 2021 | npm url-parse |
Improper Certificate Validation in TweetStream CVE-2020-24393, GHSA-6hrm-jqp3-64cv | Medium | 0.9% | 19 Feb, 2021 | RubyGems tweetstream |
Improper Certificate Validation in twitter-stream CVE-2020-24392, GHSA-p6p8-q4pj-f74m | Medium | 0.9% | 19 Feb, 2021 | RubyGems twitter-stream |
Docsify XSS Vulnerability CVE-2021-23342, GHSA-2mm9-c2fx-c7m4 | Medium | 1.7% | 19 Feb, 2021 | npm docsify |
Stored cross-site scripting in PressBooks CVE-2021-3271, GHSA-9652-78hp-w58c | Medium | 0.9% | 18 Feb, 2021 | Packagist pressbooks/pressbooks |
Improper Authentication in Apache Airflow BIT-airflow-2021-26697, CVE-2021-26697, GHSA-fh37-cx83-q542, PYSEC-2021-3 | Medium | 4.6% | 17 Feb, 2021 | PyPI apache-airflow |
Withdrawn Advisory: Insufficient Granularity of Access Control in JSDom CVE-2021-20066, GHSA-f4c9-cqv8-9v98 | Medium | 1.4% | 16 Feb, 2021 | npm jsdom |
NFStream Local Denial of Service (DoS) CVE-2020-25340, GHSA-whmq-cfm5-j8mj, PYSEC-2021-68 | Medium | 0.3% | 16 Feb, 2021 | PyPI nfstream |
Regular Expression Denial of Service (ReDoS) in lodash CVE-2020-28500, GHSA-29mw-wpgm-hmr9 | Medium | 7.3% | 15 Feb, 2021 | RubyGems lodash-rails npm lodash npm lodash-es npm lodash.trim +1 more |
Token verification bug in next-auth CVE-2021-21310, GHSA-pg53-56cg-4m8q | Medium | 1.7% | 11 Feb, 2021 | npm next-auth |
Magento Insufficient Session Expiration BIT-magento-2021-21032, CVE-2021-21032, GHSA-4jfq-f8hc-775q | Medium | 1.6% | 11 Feb, 2021 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento Insufficient Session Expiration BIT-magento-2021-21031, CVE-2021-21031, GHSA-4h3p-63x6-vwg2 | Medium | 1.7% | 11 Feb, 2021 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento Reflected Cross-site Scripting vulnerability via 'file' parameter BIT-magento-2021-21029, CVE-2021-21029, GHSA-jwxh-wj79-ccm6 | Medium | 84.6% | 11 Feb, 2021 | Packagist magento/community-edition |
Magento cross-site request forgery (CSRF) vulnerability via the GraphQL API BIT-magento-2021-21027, CVE-2021-21027, GHSA-h4xc-577p-hgj9 | Medium | 1.7% | 11 Feb, 2021 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento improper authorization vulnerability in the integrations module BIT-magento-2021-21026, CVE-2021-21026, GHSA-crjc-2v9m-8w7r | Medium | 1.8% | 11 Feb, 2021 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento stored cross-site scripting vulnerability in the admin console BIT-magento-2021-21023, CVE-2021-21023, GHSA-h5rm-m772-6qcx | Medium | 1.7% | 11 Feb, 2021 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento Insecure Direct Object Reference (IDOR) in the product module BIT-magento-2021-21022, CVE-2021-21022, GHSA-8pfq-g48p-x7w8 | Medium | 2.2% | 11 Feb, 2021 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento Improper Access Control BIT-magento-2021-21020, CVE-2021-21020, GHSA-2j6v-829g-885q | Medium | 2.4% | 11 Feb, 2021 | Packagist magento/community-edition Packagist magento/project-community-edition |
Actionpack Open Redirect Vulnerability CVE-2021-22881, GHSA-8877-prq4-9xfw | Medium | 87.3% | 11 Feb, 2021 | RubyGems actionpack |
vrana/adminer via XSS in the history parameter in SQL command CVE-2020-35572, GHSA-9pgx-gcph-mpqr | Medium | 2.0% | 09 Feb, 2021 | Packagist vrana/adminer |
XSS in apexcharts CVE-2021-23327, GHSA-w46j-8hm6-h8mm | Medium | 1.4% | 09 Feb, 2021 | npm apexcharts |
Server-side request forgery in CarrierWave CVE-2021-21288, GHSA-fwcm-636p-68r5 | Medium | 1.2% | 08 Feb, 2021 | RubyGems carrierwave |
Improper Input Validation in sanitize-html CVE-2021-26540, GHSA-mjxr-4v3x-q3m4 | Medium | 1.8% | 08 Feb, 2021 | npm sanitize-html |
Improper Input Validation in sanitize-html CVE-2021-26539, GHSA-rjqq-98f6-6j3r | Medium | 2.0% | 08 Feb, 2021 | npm sanitize-html |
Improper Neutralization of Special Elements in Output in helm.sh/helm/v3 BIT-helm-2021-21303, CVE-2021-21303, GHSA-c38g-469g-cmgx, GO-2022-1040 | Medium | 1.1% | 05 Feb, 2021 | Go helm.sh/helm/v3 |
Open redirect in Slashify CVE-2021-3189, GHSA-f4hq-453j-p95f | Medium | 0.5% | 05 Feb, 2021 | npm slashify |
LinkedIn Oncall vulnerable to Cross-Site Scripting CVE-2021-26722, GHSA-rfw2-x9f8-2f6m, PYSEC-2021-33 | Medium | 3.2% | 05 Feb, 2021 | PyPI oncall |
"catalog's registry v2 api exposed on unauthenticated path in Harbor" BIT-harbor-2020-29662, CVE-2020-29662, GHSA-38r5-34mr-mvm7, GO-2022-0785 | Medium | 0.7% | 02 Feb, 2021 | Go github.com/goharbor/harbor |
Subdomain checking of whitelisted domains could allow unintended redirects in oauth2-proxy BIT-oauth2-proxy-2021-21291, CVE-2021-21291, GHSA-4mf2-f3wh-gvf2, GO-2022-0790 | Medium | 1.6% | 02 Feb, 2021 | Go github.com/oauth2-proxy/oauth2-proxy Go github.com/oauth2-proxy/oauth2-proxy/v7 |
Podman Origin Validation Error CVE-2021-20199, GHSA-grh6-q6m2-rh72 | Medium | 1.1% | 02 Feb, 2021 | Go github.com/containers/podman/v3 |
Elliptic Uses a Broken or Risky Cryptographic Algorithm CVE-2020-28498, GHSA-r9p9-mrjm-926w | Medium | 1.3% | 02 Feb, 2021 | npm elliptic |
moby docker daemon crash during image pull of malicious image CVE-2021-21285, GHSA-6fj5-m822-rqx8 | Medium | 3.3% | 02 Feb, 2021 | Go github.com/moby/moby |
moby Access to remapped root allows privilege escalation to real root CVE-2021-21284, GHSA-7452-xqpj-6rpc | Medium | 1.1% | 02 Feb, 2021 | Go github.com/moby/moby |
Cross-site scripting in Bleach CVE-2021-23980, GHSA-vv2x-vrpj-qqpq, PYSEC-2021-865 | Medium | 0.5% | 02 Feb, 2021 | PyPI bleach |
Django Directory Traversal via archive.extract BIT-django-2021-3281, CVE-2021-3281, GHSA-fvgf-6h6h-3322, PYSEC-2021-9 | Medium | 7.6% | 02 Feb, 2021 | PyPI django |
Regular Expression Denial of Service (ReDoS) in Jinja2 CVE-2020-28493, GHSA-g3rq-g295-4j3m, PYSEC-2021-66, SNYK-PYTHON-JINJA2-1012994 | Medium | 3.6% | 01 Feb, 2021 | PyPI jinja2 |
CKEditor 5 Markdown plugin Regular expression Denial of Service CVE-2021-21254, GHSA-hgmg-hhc8-g5wr | Medium | 1.8% | 29 Jan, 2021 | npm @ckeditor/ckeditor5-markdown-gfm |
Users can edit the tags of any discussion GHSA-32wx-4gxx-h48f | Medium | Not scored | 29 Jan, 2021 | Packagist flarum/tags |
Prototype Pollution in iniparserjs CVE-2021-23328, GHSA-2f6g-w5gj-c93h | Medium | 1.0% | 29 Jan, 2021 | npm iniparserjs |
MantisBT Incorrect Authorization in bug_actiongroup_page.php CVE-2020-29605, GHSA-pgg9-mmcg-8mxp | Medium | 0.9% | 29 Jan, 2021 | Packagist mantisbt/mantisbt |
MantisBT Missing Authorization access check in bug_actiongroup.php CVE-2020-29604, GHSA-f38c-wxp6-8xjv | Medium | 1.1% | 29 Jan, 2021 | Packagist mantisbt/mantisbt |
MantisBT Insecure Storage in manage_proj_edit_page.php CVE-2020-29603, GHSA-qpj5-f88q-x7px | Medium | 1.1% | 29 Jan, 2021 | Packagist mantisbt/mantisbt |
Moodle Client side denial of service via personal message BIT-moodle-2021-20185, CVE-2021-20185, GHSA-c3j6-33r4-89q3 | Medium | 1.4% | 28 Jan, 2021 | Packagist moodle/moodle |
Moodle Cross-site Scripting BIT-moodle-2021-20186, CVE-2021-20186, GHSA-h8m4-h385-qhqv | Medium | 0.8% | 28 Jan, 2021 | Packagist moodle/moodle |
Moodle Grade information disclosure in grade's external fetch functions BIT-moodle-2021-20184, CVE-2021-20184, GHSA-mm73-86f9-5x5c | Medium | 0.7% | 28 Jan, 2021 | Packagist moodle/moodle |
Moodle Vulnerable to Reflected Cross-site Scripting BIT-moodle-2021-20183, CVE-2021-20183, GHSA-xhfx-rm8q-c3xv | Medium | 0.8% | 28 Jan, 2021 | Packagist moodle/moodle |