Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
IPC messages delivered to the wrong frame in Electron CVE-2020-26272, GHSA-hvf8-h2qh-37m9 | Medium | 1.7% | 28 Jan, 2021 | npm electron |
Improper Control of Dynamically-Managed Code Resources in config-shield CVE-2021-26276, GHSA-w8h4-vw8f-rvvj | Medium | 1.2% | 27 Jan, 2021 | npm config-shield |
Inclusion of Functionality from Untrusted Control Sphere in CKEditor 4 CVE-2021-26272, GHSA-wpvm-wqr4-p7cw | Medium | 2.4% | 26 Jan, 2021 | npm ckeditor4 |
CKEditor 4 ReDoS Vulnerability CVE-2021-26271, GHSA-jv4c-7jqq-m34x | Medium | 2.0% | 26 Jan, 2021 | npm ckeditor4-dev |
XSS in Flarum Sticky extension CVE-2021-21283, GHSA-h3gg-7wx2-cq3h | Medium | 0.8% | 26 Jan, 2021 | Packagist flarum/sticky |
Tendermint Core vulnerable to Uncontrolled Resource Consumption CVE-2021-21271, GHSA-p658-8693-mhvg, GO-2022-1052 | Medium | 1.8% | 26 Jan, 2021 | Go github.com/tendermint/tendermint |
Incorrect operations on the P-224 curve in crypto/elliptic BIT-golang-2021-3114, CVE-2021-3114, GO-2021-0235 | Medium | 2.7% | 26 Jan, 2021 | Go stdlib |
Feehi CMS vulnerable to Cross-site Scripting in Username Field CVE-2020-21146, GHSA-v762-47vh-j7q3 | Medium | 0.8% | 26 Jan, 2021 | Packagist feehi/cms |
Cache Manipulation Attack in Apache Traffic Control CVE-2020-17522, GHSA-pw59-4qgf-jxr8 | Medium | 4.0% | 26 Jan, 2021 | Go github.com/apache/trafficcontrol |
Cross-site Scripting in vis-timeline CVE-2020-28487, GHSA-9mrv-456v-pf22 | Medium | 1.5% | 22 Jan, 2021 | npm vis-timeline |
NULL Pointer Dereference in Kubernetes CSI snapshot-controller CVE-2020-8569, GHSA-hwrr-rhmm-vcvf | Medium | 2.2% | 21 Jan, 2021 | Go github.com/kubernetes-csi/external-snapshotter/v2 Go github.com/kubernetes-csi/external-snapshotter/v3 |
Directory traversal in Kubernetes Secrets Store CSI Driver CVE-2020-8568, GHSA-5cgx-vhfp-6cf9, GO-2022-0629 | Medium | 1.3% | 21 Jan, 2021 | Go sigs.k8s.io/secrets-store-csi-driver |
Kubernetes Secrets Store CSI Driver plugins arbitrary file write CVE-2020-8567, GHSA-2v35-wj4r-rcmv, GO-2024-2750 | Medium | 1.5% | 21 Jan, 2021 | Go github.com/Azure/secrets-store-csi-driver-provider-azure Go github.com/GoogleCloudPlatform/secrets-store-csi-driver-provider-gcp Go github.com/hashicorp/vault-csi-provider |
Unverified Ownership in Kubernetes CVE-2020-8554, GHSA-j9wf-vvm6-4r9w | Medium | 8.7% | 21 Jan, 2021 | Go k8s.io/kubernetes |
Improper Verification of Cryptographic Signature in PySAML2 CVE-2021-21239, GHSA-5p3x-r448-pc62, PYSEC-2021-49 | Medium | 1.3% | 21 Jan, 2021 | PyPI pysaml2 |
SAML XML Signature wrapping in PySAML2 CVE-2021-21238, GHSA-f4g9-h89h-jgv9, PYSEC-2021-48 | Medium | 1.1% | 21 Jan, 2021 | PyPI pysaml2 |
Gravity Forms stored Cross-Site Scripting (XSS) vulnerability in the survey feature CVE-2020-27852, GHSA-pjv5-v9gv-3679 | Medium | 0.8% | 20 Jan, 2021 | Packagist wp-premium/gravityforms |
Gravity Forms stored HTML injection vulnerability CVE-2020-27851, GHSA-fcj2-rxqc-294c | Medium | 0.8% | 20 Jan, 2021 | Packagist wp-premium/gravityforms |
Gravity Forms stored Cross-Site Scripting (XSS) vulnerability CVE-2020-27850, GHSA-wmh7-782f-xfw5 | Medium | 0.8% | 20 Jan, 2021 | Packagist wp-premium/gravityforms |
CORS misconfiguration in socket.io CVE-2020-28481, GHSA-fxwf-4rqh-v8g3 | Medium | 0.7% | 19 Jan, 2021 | npm socket.io |
bottle HTTP Request smuggling CVE-2020-28473, GHSA-qhx9-7hx7-cp4r, PYSEC-2021-129, SNYK-PYTHON-BOTTLE-1017108 | Medium | 1.8% | 18 Jan, 2021 | PyPI bottle |
Cross-Site Request Forgery in JupyterHub BIT-jupyterhub-2020-36191, CVE-2020-36191, GHSA-7xx3-qp5w-fw96, PYSEC-2021-67 | Medium | 0.5% | 13 Jan, 2021 | PyPI jupyterhub |
rails_admin ruby gem XSS vulnerability CVE-2020-36190, GHSA-wjx2-7hqq-8h7m | Medium | 1.3% | 12 Jan, 2021 | RubyGems rails_admin |
Pillow Out-of-bounds Read BIT-pillow-2020-35655, CVE-2020-35655, GHSA-hf64-x4gq-p99h, PYSEC-2021-71 | Medium | 1.7% | 12 Jan, 2021 | PyPI pillow |
Improper Certificate Validation in node-sass CVE-2020-24025, GHSA-r8f7-9pfq-mjmv | Medium | 0.8% | 11 Jan, 2021 | npm node-sass |
Injection/XSS in Redcarpet CVE-2020-26298, GHSA-q3wr-qw3g-3p4h | Medium | 1.6% | 11 Jan, 2021 | RubyGems redcarpet |
Cross-site Scripting in jsoneditor CVE-2020-23849, GHSA-q854-j362-cfq9 | Medium | 0.7% | 11 Jan, 2021 | npm jsoneditor |
Versions of Apache DolphinScheduler prior to 1.3.2 allowed an ordinary user under any tenant to override another users password through the API interface. CVE-2020-13922, GHSA-qhh5-9738-g9mx, PYSEC-2021-876 | Medium | 1.8% | 11 Jan, 2021 | PyPI apache-dolphinscheduler |
Formstone Vulnerable to Reflected XSS CVE-2020-26768, GHSA-wc29-h54q-q8qx | Medium | 1.3% | 07 Jan, 2021 | npm formstone |
Cross-site scripting in actionpack CVE-2020-8264, GHSA-35mm-cc6r-8fjp | Medium | 67.0% | 06 Jan, 2021 | RubyGems actionpack |
Cross-site scripting vulnerability in TinyMCE CVE-2024-21911, GHSA-w7jx-j77m-wp65 | Medium | 1.2% | 06 Jan, 2021 | NuGet TinyMCE Packagist tinymce/tinymce npm tinymce |
Hostname spoofing via backslashes in URL CVE-2020-26291, GHSA-3329-pjwv-fjpg | Medium | 1.7% | 30 Dec, 2020 | npm urijs |
Path Traversal in Moby builder CVE-2020-27534, GHSA-6hwg-w5jg-9c6x | Medium | 1.8% | 30 Dec, 2020 | Go github.com/docker/docker Go github.com/moby/moby |
MantisBT SQL Injection via mc_project_get_users function CVE-2020-28413, GHSA-49w9-82cj-xr48 | Medium | 4.8% | 30 Dec, 2020 | Packagist mantisbt/mantisbt |
OS Command injection in Bolt CVE-2020-28925, GHSA-w8cj-mvf9-mpc9 | Medium | 1.1% | 30 Dec, 2020 | Packagist bolt/bolt |
Nokogiri::XML::Schema trusts input by default, exposing risk of XXE vulnerability CVE-2020-26247, GHSA-vr8q-g5c7-m54m | Medium | 1.2% | 30 Dec, 2020 | RubyGems nokogiri |
OpenCart Stored Cross-Site Scripting CVE-2020-29471, GHSA-7vrp-3pff-c3j4 | Medium | 1.3% | 29 Dec, 2020 | Packagist opencart/opencart |
OpenCart Cross-site Scripting (XSS) in the Subject field of mail. CVE-2020-29470, GHSA-87cv-57p8-j33x | Medium | 1.7% | 29 Dec, 2020 | Packagist opencart/opencart |
Roundcube Webmail Cross-Site Scripting (XSS) Vulnerability CVE-2020-35730 | MediumExploited | 32.9% | 28 Dec, 2020 | |
Parse Server stores password in plain text BIT-parse-2020-26288, CVE-2020-26288, GHSA-4w46-w44m-3jq3 | Medium | 0.8% | 28 Dec, 2020 | npm parse-server |
dhowden tag panic due to out-of-bounds read CVE-2020-29242, CVE-2020-29243, CVE-2020-29244, CVE-2020-29245, GHSA-27mh-3343-6hg5, GHSA-9wm7-rc47-g56m, GHSA-9xm8-8qvc-vw3p, GHSA-wg79-2cgp-qrjm, GO-2021-0097 | Medium | 1.1% | 28 Dec, 2020 | Go github.com/dhowden/tag |
WooCommerce Incorrect Authorization CVE-2020-29156, GHSA-wwh8-v3j3-gxfw | Medium | 4.0% | 27 Dec, 2020 | Packagist woocommerce/woocommerce |
Open Redirect in autobahn CVE-2020-35678, GHSA-gwp7-vqr5-h33h, PYSEC-2020-25 | Medium | 1.4% | 27 Dec, 2020 | PyPI autobahn |
Symbolic links in an unpacking routine may enable attackers to read and/or write to arbitrary locations in dbdeployer CVE-2020-26277, GHSA-47wr-426j-fr82, GO-2022-0787 | Medium | 1.2% | 21 Dec, 2020 | Go github.com/datacharmer/dbdeployer |
Jupyter Server open redirect vulnerability CVE-2020-26275, GHSA-9f66-54xg-pc2c, PYSEC-2020-346, PYSEC-2020-50 | Medium | 1.4% | 21 Dec, 2020 | PyPI jupyter-server |
Enumeration of users in HashiCorp Vault BIT-vault-2020-35177, CVE-2020-35177, GHSA-rpgp-9hmg-j25x, GO-2024-2508 | Medium | 1.3% | 17 Dec, 2020 | Go github.com/hashicorp/vault |
Apache Airflow logs passwords in plaintext BIT-airflow-2020-17511, CVE-2020-17511, GHSA-cvcq-gmc3-q6m8, PYSEC-2020-262 | Medium | 2.6% | 14 Dec, 2020 | PyPI apache-airflow |
SSRF vulnerability in Apache Airflow BIT-airflow-2020-17513, CVE-2020-17513, GHSA-6r3p-fcvm-xh7c, PYSEC-2020-20 | Medium | 4.4% | 14 Dec, 2020 | PyPI apache-airflow |
Code Injection in mquery CVE-2020-35149, GHSA-45q2-34rf-mr94 | Medium | 1.0% | 11 Dec, 2020 | npm mquery |
Consensus flaw during block processing in github.com/ethereum/go-ethereum CVE-2020-26265, GHSA-xw37-57qp-9mm4, GO-2021-0105 | Medium | 0.9% | 11 Dec, 2020 | Go github.com/ethereum/go-ethereum |