Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Mattermost Server is vulnerable to a Denial of Service attack through `invite_people` command CVE-2018-21258, GHSA-5mh6-p63g-3mv5, GO-2025-4146 | High | 1.2% | 19 Jun, 2020 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 |
Mattermost Server vulnerable to Denial of Service through `@` character prefix inserted into JavaScript field names CVE-2017-18871, GHSA-jc6w-8r7f-vmp5, GO-2025-4184 | High | 1.1% | 19 Jun, 2020 | Go github.com/mattermost/mattermost-server |
rtslib-fb weak permissions for /etc/target/saveconfig.json file CVE-2020-14019, GHSA-cpcw-p965-wpqx, PYSEC-2020-250 | High | 0.3% | 19 Jun, 2020 | PyPI rtslib-fb |
EC-CUBE Directory traversal vulnerability CVE-2020-5590, GHSA-hx79-x87c-hgm3 | High | 2.1% | 19 Jun, 2020 | Packagist ec-cube/ec-cube |
Command injection in mversion CVE-2020-4059, GHSA-qjg4-w4c6-f6c6 | High | 2.6% | 18 Jun, 2020 | npm mversion |
Dolibarr SQL injection vulnerability in accountancy/customer/card.php CVE-2020-14443, GHSA-8v7v-6mmm-xjxm | High | 1.1% | 18 Jun, 2020 | Packagist dolibarr/dolibarr |
golang.org/x/text Infinite loop CVE-2020-14040, GHSA-5rcv-m4m3-hfh7, GO-2020-0015 | High | 1.9% | 17 Jun, 2020 | Go golang.org/x/text |
Drupal Core Arbitrary PHP code execution vulnerability BIT-drupal-2020-13664, CVE-2020-13664, DRUPAL-CORE-2020-005, GHSA-x72f-ggjw-v5xh | High | 3.0% | 17 Jun, 2020 | Packagist drupal/core Packagist drupal/drupal |
Drupal Core Cross-Site Request Forgery (CSRF) vulnerability BIT-drupal-2020-13663, CVE-2020-13663, DRUPAL-CORE-2020-004, GHSA-m648-hpf8-qcjw | High | 0.7% | 17 Jun, 2020 | Packagist drupal/core Packagist drupal/drupal |
MJML vulnerable to path traversal CVE-2020-12827, GHSA-4hch-r9xf-6vfr | High | 2.7% | 17 Jun, 2020 | npm mjml |
Cross-site Scripting in Sanitize CVE-2020-4054, GHSA-p4x4-rw2p-8j8m | High | 1.9% | 16 Jun, 2020 | RubyGems sanitize |
OpenStack Mistral DoS CVE-2018-16848, GHSA-443j-6p7g-6v4w, PYSEC-2020-240 | High | 1.2% | 15 Jun, 2020 | PyPI mistral |
Information disclosure in SSB-DB CVE-2020-4045, GHSA-mpgr-2cx9-327h | High | 1.3% | 11 Jun, 2020 | npm ssb-db |
Allocation of Resources Without Limits or Throttling in Hashicorp Consul BIT-consul-2020-13250, CVE-2020-13250, GHSA-rqjq-mrgx-85hp, GO-2022-0879 | High | 2.9% | 11 Jun, 2020 | Go github.com/hashicorp/consul |
Improper Input Validation in HashiCorp Consul BIT-consul-2020-13170, CVE-2020-13170, GHSA-p2j5-3f4c-224r, GO-2022-0859 | High | 1.8% | 11 Jun, 2020 | Go github.com/hashicorp/consul |
Denial of Service (DoS) in HashiCorp Consul BIT-consul-2020-12758, CVE-2020-12758, GHSA-q2qr-3c2p-9235, GO-2022-0861 | High | 1.7% | 11 Jun, 2020 | Go github.com/hashicorp/consul |
Information Disclosure in HashiCorp Vault BIT-vault-2020-13223, CVE-2020-13223, GHSA-25xj-89g5-fm6h, GO-2022-0778 | High | 1.3% | 10 Jun, 2020 | Go github.com/hashicorp/vault |
Link Following in Kata Runtime CVE-2020-2026, GHSA-877x-32pm-p28x | High | 0.5% | 10 Jun, 2020 | Go github.com/kata-containers/runtime |
Openstack cinder Improper handling of ScaleIO backend credentials CVE-2020-10755, GHSA-v3m2-pg96-w33m, PYSEC-2020-228, PYSEC-2026-891 | High | 1.2% | 10 Jun, 2020 | PyPI cinder PyPI os-brick |
Code Injection in mosc CVE-2020-7672, GHSA-j665-rvj7-2jv9 | High | 2.0% | 10 Jun, 2020 | npm mosc |
HTTP Request Smuggling in goliath CVE-2020-7671, GHSA-3892-2r52-p65m, SNYK-RUBY-GOLIATH-569136 | High | 1.3% | 10 Jun, 2020 | RubyGems goliath |
Withdrawn: HTTP Request Smuggling in Agoo CVE-2020-7670, GHSA-h385-52j6-9984 | High | 1.2% | 10 Jun, 2020 | RubyGems agoo |
Microsoft Windows Kernel Privilege Escalation Vulnerability CVE-2020-0986 | HighExploited | 16.4% | 09 Jun, 2020 | |
Apple iOS, iPadOS, and watchOS Out-of-Bounds Write Vulnerability CVE-2020-9818 | HighExploited | 2.3% | 09 Jun, 2020 | |
The filename of uploaded files vulnerable to stored XSS CVE-2020-4041, GHSA-68q3-7wjp-7q3j | High | 2.1% | 08 Jun, 2020 | Packagist bolt/bolt |
CSRF issue on preview pages in Bolt CMS CVE-2020-4040, GHSA-2q66-6cc3-6xm8 | High | 1.8% | 08 Jun, 2020 | Packagist bolt/bolt |
Reflected XSS in GraphQL Playground CVE-2020-4038, GHSA-4852-vrh7-28rf | High | 7.2% | 08 Jun, 2020 | npm graphql-playground-html |
Apple Multiple Products Code Execution Vulnerability CVE-2020-9859 | HighExploited | 0.8% | 05 Jun, 2020 | |
Regular expression denial of service in url-regex CVE-2020-7661, GHSA-v4rh-8p82-6h5w | High | 2.7% | 04 Jun, 2020 | npm url-regex |
Signature Malleabillity in elliptic CVE-2020-13822, GHSA-vh7m-p724-62c2 | High | 2.7% | 04 Jun, 2020 | npm elliptic |
Server Side Request Forgery in Grafana BIT-grafana-2020-13379, CVE-2020-13379, GHSA-wc9w-wvq2-ffm9 | High | 99.9% | 03 Jun, 2020 | Go github.com/grafana/grafana |
Cryptographic Issues in ECK CVE-2020-7010, GHSA-vfp4-xx6m-7vf6 | High | 1.4% | 03 Jun, 2020 | Go github.com/elastic/cloud-on-k8s |
Data leakage via cache key collision in Django BIT-django-2020-13254, CVE-2020-13254, GHSA-wpjr-j57x-wxfw, PYSEC-2020-31 | High | 6.1% | 03 Jun, 2020 | PyPI Django PyPI django |
Gravity Forms plugin leak hashed passwords CVE-2020-13764, GHSA-m983-q76g-cwpq | High | 1.8% | 02 Jun, 2020 | Packagist wp-premium/gravityforms |
Improper Verification of Cryptographic Signature in fastecdsa CVE-2020-12607, GHSA-56wv-2wr9-3h9r, PYSEC-2020-42 | High | 1.3% | 02 Jun, 2020 | PyPI fastecdsa |
Regular Expression Denial of Service in websocket-extensions (RubyGem) CVE-2020-7663, GHSA-g6wq-qcwm-j5g2, SNYK-RUBY-WEBSOCKETEXTENSIONS-570830 | High | 4.6% | 02 Jun, 2020 | RubyGems websocket-extensions |
Regular Expression Denial of Service in websocket-extensions (NPM package) CVE-2020-7662, GHSA-g78m-2chm-r7qv, SNYK-JS-WEBSOCKETEXTENSIONS-570623 | High | 3.1% | 02 Jun, 2020 | npm websocket-extensions |
VMware Tanzu Spring Cloud Config Directory Traversal Vulnerability CVE-2020-5410 | HighExploited | 95.6% | 02 Jun, 2020 | |
Python-RSA decryption of ciphertext leads to DoS CVE-2020-13757, GHSA-537h-rv9q-vvph, PYSEC-2020-99 | High | 1.4% | 01 Jun, 2020 | PyPI rsa |
Insecure serialization leading to RCE in serialize-javascript CVE-2020-7660, GHSA-hxcc-f52p-wc94 | High | 3.0% | 01 Jun, 2020 | npm serialize-javascript |
HTTP Request Smuggling in reel CVE-2020-7659, GHSA-x3v4-pxvm-63j8, SNYK-RUBY-REEL-569135 | High | 1.4% | 01 Jun, 2020 | RubyGems reel |
Information Exposure in Snyk Broker CVE-2020-7654, GHSA-mgh5-4h95-qj4p, SNYK-JS-SNYKBROKER-570613 | High | 1.1% | 29 May, 2020 | npm snyk-broker |
Pi-Hole AdminLTE Remote Code Execution Vulnerability CVE-2020-8816 | HighExploited | 78.3% | 29 May, 2020 | |
Insufficient output escaping of attachment names in PHPMailer BIT-phpmailer-2020-13625, CVE-2020-13625, GHSA-f7hx-fqxw-rvvj | High | 3.8% | 27 May, 2020 | Packagist phpmailer/phpmailer |
Circumvention of file size limits in ActiveStorage CVE-2020-8162, GHSA-m42x-37p3-fv5w | High | 3.0% | 26 May, 2020 | RubyGems activestorage |
Possible Strong Parameters Bypass in ActionPack CVE-2020-8164, GHSA-8727-m6gj-mc37 | High | 4.9% | 26 May, 2020 | RubyGems actionpack |
Improper Certificate Validation in EM-HTTP-Request CVE-2020-13482, GHSA-q27f-v3r6-9v77 | High | 0.9% | 25 May, 2020 | RubyGems em-http-request |
Image Resizer Cross-Site Request Forgery (CSRF) CVE-2020-13458, GHSA-5v5q-3m7m-97j7 | High | 0.5% | 25 May, 2020 | Packagist verbb/image-resizer |
HTTP Smuggling via Transfer-Encoding Header in Puma CVE-2020-11077, GHSA-w64w-qqph-5gxm | High | 2.9% | 22 May, 2020 | RubyGems puma |
HTTP Smuggling via Transfer-Encoding Header in Puma CVE-2020-11076, GHSA-x7jg-6pwg-fx5h | High | 4.1% | 22 May, 2020 | RubyGems puma |