Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Magento sql injection vulnerability BIT-magento-2020-3719, CVE-2020-3719, GHSA-rr59-pjwj-6grj | High | 3.2% | 29 Jan, 2020 | Packagist magento/community-edition Packagist magento/core |
Contao core SQL Injection Vulnerability CVE-2012-4383, GHSA-9jq2-jvwc-p52f | High | 0.9% | 29 Jan, 2020 | Packagist contao/core |
Cross-Site Request Forgery in Webargs CVE-2020-7965, GHSA-fjq3-5pxw-4wj4, PYSEC-2020-156 | High | 0.6% | 29 Jan, 2020 | PyPI webargs |
Feedgen Vulnerable to XML Denial of Service Attacks CVE-2020-5227, GHSA-g8q7-xv52-hf9f, PYSEC-2020-231 | High | 2.2% | 28 Jan, 2020 | PyPI feedgen |
Segmentation faultin TensorFlow when converting a Python string to `tf.float16` BIT-tensorflow-2020-5215, CVE-2020-5215, GHSA-977j-xj7q-2jr9, PYSEC-2020-258, PYSEC-2020-303, PYSEC-2020-338 | High | 0.6% | 28 Jan, 2020 | PyPI tensorflow PyPI tensorflow-cpu PyPI tensorflow-gpu |
pyrad is vulnerable to the use of Insufficiently Random Values CVE-2013-0294, GHSA-q4v3-wmm6-hcrx, PYSEC-2020-211 | High | 2.8% | 28 Jan, 2020 | PyPI pyrad |
Improper Restriction of Excessive Authentication Attempts in py-bcrypt CVE-2013-1895, GHSA-r838-q6jp-58xx, PYSEC-2020-249 | High | 2.8% | 28 Jan, 2020 | PyPI py-bcrypt |
Improper Neutralization of Special Elements in Output Used by a Downstream Component in Codecov CVE-2020-7596, GHSA-mh2h-6j8q-x246 | High | 1.9% | 25 Jan, 2020 | npm codecov |
Session key exposure through session list in Django User Sessions CVE-2020-5224, GHSA-5fq8-3q2f-4m5g, PYSEC-2020-230 | High | 0.5% | 24 Jan, 2020 | PyPI django-user-sessions |
Tornado XSRF cookie allows side-channel attack against TLS (BREACH attack) CVE-2014-9720, GHSA-8vpw-mgpf-mpvv, PYSEC-2020-213 | High | 2.5% | 24 Jan, 2020 | PyPI tornado |
Remote Code Execution in Angular Expressions CVE-2020-5219, GHSA-hxhm-96pp-2m43 | High | 2.4% | 24 Jan, 2020 | npm angular-expressions |
Plone Privilege Escallation CVE-2020-7938, GHSA-cjg3-q24h-9qwf, PYSEC-2020-87, PYSEC-2026-2889 | High | 1.5% | 23 Jan, 2020 | PyPI Plone PyPI plone PyPI plone-restapi PyPI plone.restapi |
Plone SQL Injection Vulnerability CVE-2020-7939, GHSA-hhmf-7rgg-gcw5, PYSEC-2020-88 | High | 1.2% | 23 Jan, 2020 | PyPI Plone PyPI plone |
Plone allows weak passwords CVE-2020-7940, GHSA-cw58-gpgw-hwx2, PYSEC-2020-89 | High | 1.3% | 23 Jan, 2020 | PyPI Plone PyPI plone |
Improper Resource Shutdown or Release in HashiCorp Vault BIT-vault-2020-7220, CVE-2020-7220, GHSA-9vh5-r4qw-v3vv, GO-2022-0816 | High | 1.4% | 23 Jan, 2020 | Go github.com/hashicorp/vault |
libxml as used in Nokogiri has an infinite loop in a certain end-of-file situation CVE-2020-7595, GHSA-7553-jr98-vx47 | High | 7.8% | 21 Jan, 2020 | RubyGems nokogiri |
WhatsApp Cross-Site Scripting Vulnerability CVE-2019-18426 | HighExploited | 67.9% | 21 Jan, 2020 | |
Magento arbitrary PHP code execution via the productData parameter CVE-2015-6497, GHSA-j4fq-3fm7-wh5v | High | 7.4% | 15 Jan, 2020 | Packagist magento/core |
PyAMF vulnerable to XML external entity (XXE) CVE-2015-8549, GHSA-m7m4-4vm8-55wg, PYSEC-2020-339 | High | 1.8% | 15 Jan, 2020 | PyPI pyamf |
Microsoft Update Notification Manager Privilege Escalation Vulnerability CVE-2020-0638 | HighExploited | 2.5% | 14 Jan, 2020 | |
Certificate validation bypass on Windows in crypto/x509 BIT-golang-2020-0601, CVE-2020-0601, GO-2022-0535 | HighExploited | 89.1% | 14 Jan, 2020 | Go stdlib |
Local Privilege Escalation in PyInstaller CVE-2019-16784, GHSA-7fcj-pq9j-wh2r, PYSEC-2020-175 | High | 0.7% | 14 Jan, 2020 | PyPI PyInstaller PyPI pyinstaller |
Improper Verification of Cryptographic Signature in PySAML2 CVE-2020-5390, GHSA-qf7v-8hj3-4xw7, PYSEC-2020-94 | High | 1.2% | 13 Jan, 2020 | PyPI pysaml2 |
DOMPDF Remote Code Execution CVE-2014-5013, GHSA-jjwj-w3gc-gcw4 | High | 4.5% | 10 Jan, 2020 | Packagist dompdf/dompdf |
phpMyAdmin SQL injection in user accounts page BIT-phpmyadmin-2020-5504, CVE-2020-5504, GHSA-fgj8-93xx-f6g6 | High | 28.0% | 09 Jan, 2020 | Packagist phpmyadmin/phpmyadmin |
Publify vulnerable to DoS attack CVE-2014-3211, GHSA-vq74-9583-hrm4 | High | 1.1% | 09 Jan, 2020 | RubyGems publify_core |
Ansible unsafe evaluation of some strings CVE-2014-2686, GHSA-49m5-2838-q2rv, PYSEC-2020-198 | High | 1.2% | 09 Jan, 2020 | PyPI ansible |
PrestaShop gamification module ZIP archives were vulnerable from CVE-2017-9841 GHSA-769f-539v-f5jg | High | Not scored | 08 Jan, 2020 | Packagist prestashop/gamification |
PrestaShop autoupgrade module ZIP archives were vulnerable from CVE-2017-9841 GHSA-wqq8-mqj9-697f | High | Not scored | 08 Jan, 2020 | Packagist prestashop/autoupgrade |
PrestaShop module ps_facetedsearch might be vulnerable from CVE-2017-9841 GHSA-f884-gm86-cg3q | High | Not scored | 07 Jan, 2020 | Packagist prestashop/ps_facetedsearch |
HashBrown CMS Directory Traversal CVE-2020-5840, GHSA-q7hx-mrv5-6mrp | High | 1.5% | 06 Jan, 2020 | npm hashbrown-cms |
Cross-Site Scripting in seeftl CVE-2019-15603, GHSA-4g46-5grc-wq49 | High | 0.8% | 06 Jan, 2020 | npm seeftl |
Cross-Site Scripting in fileview CVE-2019-15602, GHSA-gvr4-7xgc-gx3w | High | 0.8% | 06 Jan, 2020 | npm fileview |
Uncontrolled Resource Consumption in Pillow CVE-2019-19911, GHSA-5gm3-px64-rw72, PYSEC-2020-172 | High | 2.2% | 05 Jan, 2020 | PyPI pillow |
Out-of-bounds Write in OpenCV CVE-2019-5064, GHSA-q799-q27x-vp7w, PYSEC-2026-2802, PYSEC-2026-2828, PYSEC-2026-2841, PYSEC-2026-725 | High | 10.7% | 03 Jan, 2020 | PyPI opencv-contrib-python PyPI opencv-contrib-python-headless PyPI opencv-python PyPI opencv-python-headless |
Out-of-bounds Write in OpenCV CVE-2019-5063, GHSA-m6vm-8g8v-xfjh, PYSEC-2026-2801, PYSEC-2026-2826, PYSEC-2026-2840, PYSEC-2026-724 | High | 21.1% | 03 Jan, 2020 | PyPI opencv-contrib-python PyPI opencv-contrib-python-headless PyPI opencv-python PyPI opencv-python-headless |
Out-of-bounds Read in Pillow BIT-pillow-2020-5313, CVE-2020-5313, GHSA-hj69-c76v-86wr, PYSEC-2020-84 | High | 2.6% | 03 Jan, 2020 | PyPI Pillow PyPI pillow |
ovirt-engine-sdk-python improper validation of hostname in x.509 certificate CVE-2014-0161, GHSA-wf9j-m9fv-92gq, PYSEC-2020-245 | High | 0.4% | 02 Jan, 2020 | PyPI ovirt-engine-sdk-python |
Denial of Service in ecstatic CVE-2019-10775, GHSA-jc84-3g44-wf2q | High | 1.3% | 02 Jan, 2020 | npm ecstatic |
Validation Bypass in kind-of CVE-2019-20149, GHSA-6c8f-qphg-qjgp | High | 2.3% | 30 Dec, 2019 | npm kind-of |
Apache Solr VelocityResponseWriter Plug-In Remote Code Execution Vulnerability CVE-2019-17558 | HighExploited | 98.6% | 30 Dec, 2019 | |
TVT NVMS-1000 Directory Traversal Vulnerability CVE-2019-20085 | HighExploited | 96.1% | 30 Dec, 2019 | |
HTTP Request Smuggling in Waitress: Invalid whitespace characters in headers (Follow-up) CVE-2019-16789, GHSA-968f-66r5-5v74, PYSEC-2019-138 | High | 2.6% | 26 Dec, 2019 | PyPI waitress |
HTTP Request Smuggling: Invalid whitespace characters in headers in Waitress GHSA-m5ff-3wj3-8ph4 | High | Not scored | 26 Dec, 2019 | PyPI waitress |
HTTP Request Smuggling: Invalid Transfer-Encoding in Waitress CVE-2019-16786, GHSA-g2xc-35jw-c63p, PYSEC-2019-137 | High | 2.4% | 20 Dec, 2019 | PyPI waitress |
HTTP Request Smuggling: LF vs CRLF handling in Waitress CVE-2019-16785, GHSA-pg36-wpm5-g57p, PYSEC-2019-136 | High | 2.5% | 20 Dec, 2019 | PyPI waitress |
SonicWall SMA100 Directory Traversal Vulnerability CVE-2019-7483 | HighExploited | 4.0% | 19 Dec, 2019 | |
Singularity insecure permissions CVE-2019-19724, GHSA-mj73-5x75-9phh | High | 1.2% | 18 Dec, 2019 | Go github.com/sylabs/singularity |
Cross-Site Scripting in http_server CVE-2019-15600, GHSA-754x-4jwp-cqp6 | High | 2.5% | 18 Dec, 2019 | npm http_server |
Path Traversal in statics-server CVE-2019-15596, GHSA-j27j-4w6m-8fc4 | High | 1.5% | 18 Dec, 2019 | npm statics-server |