Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Exposure of Resource to Wrong Sphere in LibreNMS CVE-2020-15877, GHSA-3c33-3465-fhx2 | High | 1.9% | 21 Jul, 2020 | Packagist librenms/librenms |
Improper Input Validation in sails-hook-sockets CVE-2018-21036, GHSA-f7f4-hqp2-7prc | High | 1.8% | 21 Jul, 2020 | npm sails-hook-sockets |
Cross-Site Scripting in Wagtail CVE-2020-15118, GHSA-2473-9hgq-j7xw, PYSEC-2020-154 | High | 1.1% | 20 Jul, 2020 | PyPI wagtail |
Path traversal in servey CVE-2020-8214, GHSA-v3px-6cc8-f8j3 | High | 2.0% | 20 Jul, 2020 | npm servey |
Buffer overflow in canvas CVE-2020-8215, GHSA-73rg-x683-m3qw | High | 2.3% | 20 Jul, 2020 | npm canvas |
Server-Side Request Forgery in @uppy/companion CVE-2020-8205, GHSA-9m4x-8w29-r78g | High | 1.2% | 20 Jul, 2020 | npm @uppy/companion |
Possible pod name collisions in jupyterhub-kubespawner CVE-2020-15110, GHSA-v7m9-9497-p9gr, PYSEC-2020-51 | High | 1.1% | 17 Jul, 2020 | PyPI jupyterhub-kubespawner |
Remote code execution (RCE) in Apache Airflow BIT-airflow-2020-11978, CVE-2020-11978, GHSA-rvmq-4x66-q7j3, PYSEC-2020-14 | HighExploited | 99.2% | 17 Jul, 2020 | PyPI apache-airflow |
Microweber Discloses Sensitive Information CVE-2020-13405, GHSA-pmxg-w9c7-ffmq | High | 13.6% | 16 Jul, 2020 | Packagist microweber/microweber |
Silverstripe CMS malicious file upload enables script execution CVE-2020-9309, GHSA-h77w-655f-6j3m | High | 1.8% | 15 Jul, 2020 | Packagist silverstripe/cms |
Silverstripe CMS information disclosure BIT-silverstripe-2020-6164, CVE-2020-6164, GHSA-gm5x-hpmw-xpxg | High | 1.8% | 15 Jul, 2020 | Packagist silverstripe/cms Packagist silverstripe/framework |
Prototype Pollution in lodash CVE-2020-8203, GHSA-p6mc-m468-83gw | High | 5.2% | 15 Jul, 2020 | RubyGems lodash-rails npm lodash npm lodash-es npm lodash.pick +4 more |
Microsoft .NET Framework, SharePoint, and Visual Studio Remote Code Execution Vulnerability CVE-2020-1147 | HighExploited | 95.8% | 14 Jul, 2020 | |
"Verify All" Returns Success Despite Validation Failures in Singularity CVE-2020-13846, GHSA-6w7g-p4jh-rf92 | High | 1.3% | 14 Jul, 2020 | Go github.com/sylabs/singularity |
Execution Control List (ECL) Is Insecure in Singularity CVE-2020-13845, GHSA-pmfr-63c2-jr5c | High | 0.5% | 14 Jul, 2020 | Go github.com/sylabs/singularity |
Stored XSS in TimelineJS3 CVE-2020-15092, GHSA-2jpm-827p-j44g | High | 1.1% | 09 Jul, 2020 | npm @knight-lab/timelinejs |
D-Link DIR-610 Devices Remote Command Execution CVE-2020-9377 | HighExploited | 21.9% | 09 Jul, 2020 | |
Path Traversal in socket.io-file CVE-2020-15779, GHSA-9h4g-27m8-qjrg | High | 1.6% | 07 Jul, 2020 | npm socket.io-file |
Remote code execution in turn extension for TYPO3 CVE-2020-15515, GHSA-q7j5-9j77-g4gq | High | 1.9% | 07 Jul, 2020 | Packagist marcwillmann/turn |
Arbitrary file read via window-open IPC in Electron CVE-2020-4075, GHSA-f9mq-jph6-9mhm | High | 1.2% | 07 Jul, 2020 | npm electron |
Remote code execution via user-provided local names in ActionView BIT-rails-2020-8163, CVE-2020-8163, GHSA-cr3x-7m39-c6jq | High | 82.5% | 02 Jul, 2020 | RubyGems actionview |
Directory traversal in Rack::Directory app bundled with Rack CVE-2020-8161, GHSA-5f9h-9pjv-v6j7 | High | 3.4% | 02 Jul, 2020 | RubyGems rack |
Improper Authentication CVE-2019-20894, GHSA-q9mp-79cp-9g8j, GO-2022-0774 | High | 1.6% | 02 Jul, 2020 | Go github.com/containous/traefik Go github.com/containous/traefik/v2 Go github.com/traefik/traefik/v2 |
OS Command Injection in mversion CVE-2020-7688, GHSA-6m8p-4fxj-pgc2, SNYK-JS-MVERSION-573174 | High | 0.5% | 01 Jul, 2020 | npm mversion |
Integer Overflow or Wraparound and Use of a Broken or Risky Cryptographic Algorithm in bcrypt CVE-2020-7689, GHSA-5wg4-74h6-q47v, SNYK-JS-BCRYPT-572911 | High | 0.8% | 01 Jul, 2020 | npm bcrypt |
Magento defense-in-depth security mitigation vulnerability BIT-magento-2020-9591, CVE-2020-9591, GHSA-w7rh-9w5v-rwqj | High | 3.4% | 26 Jun, 2020 | Packagist magento/community-edition Packagist magento/core |
Magento Signature verification bypass BIT-magento-2020-9588, CVE-2020-9588, GHSA-j2r4-2cr6-h3r3 | High | 2.9% | 26 Jun, 2020 | Packagist magento/community-edition Packagist magento/core Packagist magento/project-community-edition |
Magento authorization bypass vulnerability BIT-magento-2020-9587, CVE-2020-9587, GHSA-8wm7-h2qh-ff4c | High | 5.0% | 26 Jun, 2020 | Packagist magento/community-edition Packagist magento/core Packagist magento/project-community-edition |
Out-of-bounds reads in Pillow BIT-pillow-2020-10177, CVE-2020-10177, GHSA-cqhg-xjhh-p8hf, PYSEC-2020-76 | High | 1.5% | 25 Jun, 2020 | PyPI Pillow PyPI pillow |
Out-of-bounds read in Pillow BIT-pillow-2020-10378, CVE-2020-10378, GHSA-3xv8-3j54-hgrp, PYSEC-2020-77 | High | 1.1% | 25 Jun, 2020 | PyPI Pillow PyPI pillow |
Buffer overflow in Pillow BIT-pillow-2020-10379, CVE-2020-10379, GHSA-8843-m7mw-mxqm, PYSEC-2020-78 | High | 1.1% | 25 Jun, 2020 | PyPI Pillow PyPI pillow |
Out-of-bounds reads in Pillow BIT-pillow-2020-10994, CVE-2020-10994, GHSA-vj42-xq3r-hr3r, PYSEC-2020-79 | High | 1.4% | 25 Jun, 2020 | PyPI Pillow PyPI pillow |
acf-to-rest-api plugin insecure direct object reference (IDOR) via permalink manipulation CVE-2020-13700, GHSA-r345-x8hr-2r9p | High | 13.5% | 24 Jun, 2020 | Packagist airesvsg/acf-to-rest-api |
github.com/sassoftware/go-rpmutils Arbitrary File Write via Archive Extraction (Zip Slip) CVE-2020-7667, GHSA-9423-6c93-gpp8, GO-2020-0042, SNYK-GOLANG-GITHUBCOMSASSOFTWAREGORPMUTILSCPIO-570427 | High | 1.6% | 24 Jun, 2020 | Go github.com/sassoftware/go-rpmutils |
NukeViet Cross-Site Request Forgery (CSRF) CVE-2020-13155, GHSA-7rw5-6pr4-fgh3 | High | 0.7% | 23 Jun, 2020 | Packagist nukeviet/nukeviet |
github.com/unknwon/cae Path Traversal vulnerability CVE-2020-7668, GHSA-88jf-7rch-32qc, GO-2020-0041 | High | 1.4% | 23 Jun, 2020 | Go github.com/unknwon/cae |
Path Traversal in github.com/unknwon/cae/zip CVE-2020-7664, GHSA-vpx7-vm66-qx8r, GO-2021-0228 | High | 1.5% | 23 Jun, 2020 | Go github.com/unknwon/cae |
Command Injection in Limdu CVE-2020-4066, GHSA-77qv-gh6f-pgh4 | High | 1.6% | 22 Jun, 2020 | npm limdu |
ECDSA signature validation vulnerability by accepting wrong ASN.1 encoding in jsrsasign CVE-2020-14966, GHSA-p8c3-7rj8-q963 | High | 1.2% | 22 Jun, 2020 | npm jsrsasign |
WooCommerce Cross-Site Request Forgery (CSRF) CVE-2019-20891, GHSA-rcmf-88p4-9wrg | High | 0.5% | 19 Jun, 2020 | Packagist woocommerce/woocommerce |
Mattermost Server uses weak hashing for OAuth, email verification tokens and invitations CVE-2017-18917, GHSA-jxc4-w54c-qv5r, GO-2026-4463 | High | 0.7% | 19 Jun, 2020 | Go github.com/mattermost/mattermost-server |
Mattermost Server vulnerable to user account takeover when Single Sign-On OAuth2 is used CVE-2017-18906, GHSA-fpcr-4rr5-hpcp, GO-2026-4477 | High | 0.8% | 19 Jun, 2020 | Go github.com/mattermost/mattermost-server |
Mattermost Server does not check if cookies are used over SSL CVE-2016-11076, GHSA-379p-37xc-q963, GO-2025-4054 | High | 0.9% | 19 Jun, 2020 | Go github.com/mattermost/mattermost-server |
Mattermost Server does not enforce rate limits on password change attempts CVE-2016-11069, GHSA-qrf6-h5fc-7m96, GO-2025-4051 | High | 0.9% | 19 Jun, 2020 | Go github.com/mattermost/mattermost-server |
Mattermost Server: initial_load API exposes unnecessary information CVE-2016-11066, GHSA-r93j-3mmp-px57, GO-2025-4047 | High | 1.2% | 19 Jun, 2020 | Go github.com/mattermost/mattermost-server |
Mattermost Server SAML implementation does not require encryption or signature verification as default CVE-2017-18909, GHSA-r6j5-fqx9-7qv9, GO-2026-4478 | High | 0.7% | 19 Jun, 2020 | Go github.com/mattermost/mattermost-server |
Mattermost Server vulnerable to CSRF if CORS is enabled CVE-2017-18903, GHSA-fcwg-45jh-5qhf, GO-2026-4305 | High | 0.4% | 19 Jun, 2020 | Go github.com/mattermost/mattermost-server |
Mattermost Server has intermittent Authorization bypass for resource-owners CVE-2017-18894, GHSA-gg42-mwr6-p82c, GO-2026-4297 | High | 0.8% | 19 Jun, 2020 | Go github.com/mattermost/mattermost-server |
Mattermost Server does not properly restrict use of slash commands CVE-2017-18886, GHSA-wvjg-33p9-938h, GO-2025-4204 | High | 1.0% | 19 Jun, 2020 | Go github.com/mattermost/mattermost-server |
Rack allows Percent-encoded cookies to overwrite existing prefixed cookie names CVE-2020-8184, GHSA-j6w9-fv6q-3q52 | High | 3.0% | 19 Jun, 2020 | RubyGems rack |