Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
SQL Injection in Django BIT-django-2022-28347, CVE-2022-28347, GHSA-w24h-v9qh-8gxj, PYSEC-2022-191 | Critical | 2.9% | 12 Apr, 2022 | PyPI Django PyPI django |
VMware Workspace ONE Access and Identity Manager Server-Side Template Injection Vulnerability CVE-2022-22954 | CriticalExploited | 100.0% | 11 Apr, 2022 | |
RCE in Studio-42 elFinder on Windows before 2.1.61 CVE-2022-27115, GHSA-6p96-vfrc-fv32 | Critical | 28.6% | 11 Apr, 2022 | Packagist studio-42/elfinder |
Prototype Pollution in fullpage.js CVE-2022-1295, GHSA-vpgw-ffh3-648h | Critical | 1.3% | 11 Apr, 2022 | npm fullpage.js |
elFinder Unrestricted File Upload vulnerability CVE-2021-43421, GHSA-x4jx-hjwf-gc99 | Critical | 42.8% | 07 Apr, 2022 | Packagist studio-42/elfinder |
Insecure default value for CORS configuration CVE-2022-26969, GHSA-g27j-74fp-xfpr | Critical | 1.0% | 05 Apr, 2022 | npm directus |
Inconsistent Interpretation of HTTP Requests in twisted.web CVE-2022-24801, GHSA-c2jg-hw38-jrqq, PYSEC-2022-195 | Critical | 2.8% | 04 Apr, 2022 | PyPI twisted |
Remote code injection in dompdf/dompdf CVE-2022-28368, GHSA-x752-qjv4-c4hc | Critical | 83.9% | 03 Apr, 2022 | Packagist dompdf/dompdf |
Spring Framework JDK 9+ Remote Code Execution Vulnerability CVE-2022-22965 | CriticalExploited | 99.6% | 01 Apr, 2022 | |
VMware Tanzu Spring Cloud Function Remote Code Execution Vulnerability CVE-2022-22963 | CriticalExploited | 99.9% | 01 Apr, 2022 | |
Use of Externally-Controlled Format String in consoleme CVE-2022-27177, GHSA-74w3-2r77-fw5h, PYSEC-2022-189 | Critical | 2.3% | 01 Apr, 2022 | PyPI consoleme |
Command injection in simple-git CVE-2022-24066, GHSA-28xr-mwxg-3qc8 | Critical | 3.9% | 01 Apr, 2022 | npm simple-git |
SQL injection in pagekit/pagekit CVE-2021-44135, GHSA-45hc-r4fj-qj89 | Critical | 1.5% | 01 Apr, 2022 | Packagist pagekit/pagekit |
Prototype Pollution in deepmerge-ts CVE-2022-24802, GHSA-r9w3-g83q-m6hq | Critical | 1.7% | 01 Apr, 2022 | npm deepmerge-ts |
Variable Tampering within joomla/input class BIT-joomla-2022-23799, CVE-2022-23799, GHSA-49fj-qp6p-q544 | Critical | 1.2% | 30 Mar, 2022 | Packagist joomla/input |
Trend Micro Apex Central Arbitrary File Upload Vulnerability CVE-2022-26871 | CriticalExploited | 19.5% | 29 Mar, 2022 | |
Firebase PHP-JWT key/algorithm type confusion CVE-2021-46743, GHSA-8xf4-w7qw-pjjw | Critical | 0.9% | 29 Mar, 2022 | Packagist firebase/php-jwt |
Sandbox bypass in fenom CVE-2021-46433, GHSA-674v-3g2w-84gx | Critical | 1.1% | 28 Mar, 2022 | Packagist fenom/fenom |
Type Confusion in ImpressCMS CVE-2021-26600, GHSA-m8xh-cqc2-5q6f | Critical | 5.6% | 28 Mar, 2022 | Packagist impresscms/impresscms |
SQL Injection in ImpressCMS CVE-2021-26599, GHSA-jc4v-vvg6-xg78 | Critical | 21.0% | 28 Mar, 2022 | Packagist impresscms/impresscms |
D-Link DIR-820L Remote Code Execution Vulnerability CVE-2022-26258 | CriticalExploited | 91.6% | 28 Mar, 2022 | |
Sophos Firewall Authentication Bypass Vulnerability CVE-2022-1040 | CriticalExploited | 99.8% | 25 Mar, 2022 | |
Prototype Pollution in simple-plist CVE-2022-26260, GHSA-gff7-g5r8-mg8m | Critical | 1.3% | 22 Mar, 2022 | npm simple-plist |
Poetry before v1.1.9 contains Untrusted Search Path CVE-2022-26184, GHSA-xr2c-5w89-63pv, PYSEC-2022-234 | Critical | 1.8% | 21 Mar, 2022 | PyPI poetry |
Insufficient Protection against HTTP Request Smuggling in mitmproxy CVE-2022-24766, GHSA-gcx2-gvj7-pxv3, PYSEC-2022-170 | Critical | 1.6% | 21 Mar, 2022 | PyPI mitmproxy |
Path Traversal in Studio-42 elFinder through 2.1.60 CVE-2022-26960, GHSA-7q88-jxvp-9gp2 | Critical | 51.0% | 21 Mar, 2022 | Packagist studio-42/elfinder |
Remote Code Execution in Contao Managed Edition CVE-2022-26265, GHSA-rggc-4g3r-j7ff | Critical | 30.4% | 18 Mar, 2022 | Packagist contao/managed-edition |
Apple Memory Corruption Vulnerability CVE-2022-22587 | CriticalExploited | 11.6% | 18 Mar, 2022 | |
Improper Privilege Management in Open Web Analytics CVE-2022-24637, GHSA-pr9q-v585-qv2w | Critical | 99.1% | 18 Mar, 2022 | Packagist open-web-analytics/open-web-analytics |
Veeam Backup & Replication Remote Code Execution Vulnerability CVE-2022-26501 | CriticalExploited | 4.1% | 17 Mar, 2022 | |
Prototype Pollution in minimist CVE-2021-44906, GHSA-xvch-5gv4-984h | Critical | 4.6% | 17 Mar, 2022 | npm minimist |
Code injection in accesslog CVE-2022-25760, GHSA-8m2f-74r2-x3f2 | Critical | 1.6% | 17 Mar, 2022 | npm accesslog |
Prototype Pollution in set-in CVE-2022-25354, GHSA-6956-83fg-5wc5, SNYK-JS-SETIN-2388571 | Critical | 1.9% | 17 Mar, 2022 | npm set-in |
Prototype Pollution in libnested CVE-2022-25352, GHSA-x5m8-2r8v-8f97, SNYK-JS-LIBNESTED-2342117 | Critical | 2.1% | 17 Mar, 2022 | npm libnested |
Arbitrary code execution in post-loader CVE-2022-0748, GHSA-66ww-999q-mffq, SNYK-JS-POSTLOADER-2403737 | Critical | 2.1% | 17 Mar, 2022 | npm post-loader |
Prototype Pollution in Sails.js CVE-2021-44908, GHSA-8v3j-jfg3-v3fv | Critical | 1.8% | 17 Mar, 2022 | npm sails |
Code injection in npm git CVE-2021-23632, GHSA-9gqr-xp86-f87h, SNYK-JS-GIT-1568518 | Critical | 2.4% | 17 Mar, 2022 | npm git |
Embedded Malicious Code in node-ipc CVE-2022-23812, GHSA-97m3-w2cp-4xx6 | Critical | 4.2% | 16 Mar, 2022 | npm node-ipc |
DQL injection through sorting parameters blocked CVE-2022-24752, GHSA-2xmm-g482-4439 | Critical | 1.4% | 15 Mar, 2022 | Packagist sylius/grid-bundle |
HTTP/2 DoS Attacks: Ping, Reset, and Settings Floods GHSA-32gv-6cf3-wcmq | Critical | Not scored | 14 Mar, 2022 | PyPI twisted |
Command injection in libvcs and vcspull CVE-2022-21187, GHSA-mv2w-4jqc-6fg4, PYSEC-2022-163, PYSEC-2026-563, SNYK-PYTHON-LIBVCS-2421204 | Critical | 3.6% | 14 Mar, 2022 | PyPI libvcs PyPI vcspull |
Cross-site Scripting in showdoc/showdoc CVE-2022-0960, GHSA-rphc-h572-2x9f | Critical | 0.9% | 14 Mar, 2022 | Packagist showdoc/showdoc |
SQL Injection in WordPress Zero Spam WordPress plugin CVE-2022-0254, GHSA-pq2f-3fg3-rw99 | Critical | 2.0% | 14 Mar, 2022 | Packagist bmarshall511/wordpress_zero_spam |
Unrestricted Upload of File with Dangerous Type in Zenario CMS CVE-2021-42171, GHSA-rgg3-3wh7-w935 | Critical | 2.5% | 14 Mar, 2022 | Packagist tribalsystems/zenario |
Command injection in Parse Server through prototype pollution BIT-parse-2022-24760, CVE-2022-24760, GHSA-p6h4-93qp-jhcm | Critical | 49.4% | 11 Mar, 2022 | npm parse-server |
Path traversal in Pillow BIT-pillow-2022-24303, CVE-2022-24303, GHSA-9j59-75qj-795w, PYSEC-2022-168 | Critical | 2.7% | 11 Mar, 2022 | PyPI Pillow PyPI pillow |
Command injection in simple-git CVE-2022-24433, GHSA-3f95-r44v-8mrg | Critical | 3.7% | 11 Mar, 2022 | npm simple-git |
Server-side Template Injection in nystudio107/craft-seomatic CVE-2021-44618, GHSA-m3xv-x3ph-mq22 | Critical | 1.4% | 11 Mar, 2022 | Packagist nystudio107/craft-seomatic |
Improper Authorization in cobbler CVE-2022-0860, GHSA-mcg6-h362-cmq5, PYSEC-2022-177 | Critical | 2.3% | 11 Mar, 2022 | PyPI cobbler |
Duplicate Advisory: Incorrect Authorization in Gerapy CVE-2021-44597, GHSA-29vr-79w7-p649, PYSEC-2022-228 | Critical | Not scored | 10 Mar, 2022 | PyPI gerapy |