Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
calibre-web is vulnerable to Business Logic Errors CVE-2021-4171, GHSA-xp7p-3gx7-j6wx, PYSEC-2026-307 | Critical | 1.4% | 17 Jan, 2022 | PyPI calibreweb |
Access of Resource Using Incompatible Type in Hermes CVE-2021-24044, GHSA-7mhc-prgv-r3q4 | Critical | 1.3% | 15 Jan, 2022 | npm hermes-engine |
NUUO NVRmini2 Devices Missing Authentication Vulnerability CVE-2022-23227 | CriticalExploited | 48.5% | 14 Jan, 2022 | |
SQL Injection in dolibarr BIT-dolibarr-2022-0224, CVE-2022-0224, GHSA-j545-frh3-r9gq | Critical | 2.0% | 14 Jan, 2022 | Packagist dolibarr/dolibarr |
Zabbix Frontend Authentication Bypass Vulnerability CVE-2022-23131 | CriticalExploited | 95.7% | 13 Jan, 2022 | |
Zalgo-like output that crashes the server GHSA-2w8g-m5j8-7m87 | Critical | Not scored | 12 Jan, 2022 | npm @soketi/soketi |
Arbitrary expression injection in Pillow BIT-pillow-2022-22817, CVE-2022-22817, GHSA-8vj2-vxx3-667w, PYSEC-2022-10 | Critical | 3.6% | 10 Jan, 2022 | PyPI Pillow PyPI pillow |
Prototype Pollution in realms-shim CVE-2021-23594, GHSA-pwm7-qr6j-3vjg | Critical | 1.8% | 10 Jan, 2022 | npm realms-shim |
Prototype Pollution in extend2 CVE-2021-23568, GHSA-gjm5-83cw-p3p2, SNYK-JS-EXTEND2-2320315 | Critical | 1.5% | 10 Jan, 2022 | npm extend2 |
Prototype Pollution in realms-shim CVE-2021-23543, GHSA-q4j7-v27r-fgcx | Critical | 1.8% | 10 Jan, 2022 | npm realms-shim |
Deserialization of Untrusted Data in Codeigniter4 BIT-codeigniter-2022-21647, CVE-2022-21647, GHSA-w6jr-wj64-mc9x | Critical | 37.7% | 04 Jan, 2022 | Packagist codeigniter4/framework |
uppy's companion module is vulnerable to Server-Side Request Forgery (SSRF) CVE-2022-0086, GHSA-x8rq-rc7x-5fg5 | Critical | 1.2% | 04 Jan, 2022 | npm @uppy/companion |
Gerapy may cause remote code execution CVE-2021-43857, GHSA-9w7f-m4j4-j3xw, PYSEC-2021-867 | Critical | 55.6% | 27 Dec, 2021 | PyPI gerapy |
Prototype Pollution in js-data CVE-2021-23574, GHSA-c6h4-gc3f-hgjq | Critical | 2.2% | 24 Dec, 2021 | npm js-data |
Command Injection in node-windows CVE-2021-45459, GHSA-53xv-c2hx-5w6q | Critical | 4.1% | 22 Dec, 2021 | npm node-windows |
Cross-site Scripting in pimcore CVE-2021-4139, GHSA-8xx9-rxrj-2m2w | Critical | 0.9% | 21 Dec, 2021 | Packagist pimcore/pimcore |
Remote Code Execution in npm-groovy-lint GHSA-qc22-qwm9-j8rx | Critical | Not scored | 20 Dec, 2021 | npm npm-groovy-lint |
Incorrect Authorization in latte/latte CVE-2021-23803, GHSA-6pj2-5fqq-xvjc, SNYK-PHP-LATTELATTE-1932226 | Critical | 1.6% | 17 Dec, 2021 | Packagist latte/latte |
Path Traversal in http-server-node CVE-2021-23797, GHSA-hj3m-v758-jwx5 | Critical | 1.8% | 17 Dec, 2021 | npm http-server-node |
Prototype Pollution in dojo CVE-2021-23450, GHSA-m8gw-hjpr-rjv7 | Critical | 30.4% | 17 Dec, 2021 | npm dojo |
vault-cli contains possible RCE when reading user-defined data CVE-2021-43837, GHSA-q34h-97wf-8r8j, PYSEC-2021-853 | Critical | 5.2% | 16 Dec, 2021 | PyPI vault-cli |
ThinkPHP5 SQL Injection vulnerability CVE-2021-44350, GHSA-q868-c4vw-qjx3 | Critical | 1.4% | 15 Dec, 2021 | Packagist topthink/framework |
BookStack is vulnerable to Improper Access Control. CVE-2021-4119, GHSA-9c5c-5j4h-8q2c | Critical | 26.9% | 15 Dec, 2021 | Packagist ssddanbrown/bookstack |
Files on the host computer can be accessed from the Gradio interface CVE-2021-43831, GHSA-rhq2-3vr9-6mcr, PYSEC-2021-873 | Critical | 3.9% | 15 Dec, 2021 | PyPI gradio |
Apache Log4j2 Deserialization of Untrusted Data Vulnerability CVE-2021-45046 | CriticalExploited | 100.0% | 14 Dec, 2021 | |
Zoho Desktop Central Authentication Bypass Vulnerability CVE-2021-44515 | CriticalExploited | 99.9% | 12 Dec, 2021 | |
Prototype Pollution in merge-deep2. CVE-2021-23700, GHSA-j28q-p8ww-cp87 | Critical | 1.2% | 10 Dec, 2021 | npm merge-deep2 |
Prototype Pollution in sey CVE-2021-23663, GHSA-wjpc-cgvw-xx23 | Critical | 1.2% | 10 Dec, 2021 | npm sey |
Code Injection in md-to-pdf. CVE-2021-23639, GHSA-x949-7cm6-fm6p, SNYK-JS-MDTOPDF-1657880 | Critical | 5.4% | 10 Dec, 2021 | npm md-to-pdf |
Prototype Pollution in comb CVE-2021-23561, GHSA-vxr4-rxw7-g7v6 | Critical | 1.2% | 10 Dec, 2021 | npm comb |
Apache Log4j2 Remote Code Execution Vulnerability CVE-2021-44228 | CriticalExploited | 100.0% | 10 Dec, 2021 | |
Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA) Code Injection Vulnerability CVE-2021-44529 | CriticalExploited | 99.1% | 08 Dec, 2021 | |
Prototype Pollution in @fabiocaccamo/utils.js CVE-2021-3815, GHSA-3xph-cp8f-2229 | Critical | 0.9% | 08 Dec, 2021 | npm @fabiocaccamo/utils.js |
SonicWall SMA 100 Appliances Stack-Based Buffer Overflow Vulnerability CVE-2021-20038 | CriticalExploited | 99.9% | 08 Dec, 2021 | |
SQL injection in prestashop/prestashop CVE-2021-43789, GHSA-6xxj-gcjq-wgf4 | Critical | 4.7% | 07 Dec, 2021 | Packagist prestashop/prestashop |
Command injection in git-it-electron CVE-2021-44685, GHSA-wjqc-j537-j9gj | Critical | 3.5% | 07 Dec, 2021 | npm git-it-electron |
Command injection in github-todos CVE-2021-44684, GHSA-792j-9wj3-j634 | Critical | 2.6% | 07 Dec, 2021 | npm github-todos |
Deserialization of Untrusted Data in topthink/framework CVE-2021-36567, GHSA-qrvj-274h-hfcg | Critical | 2.5% | 06 Dec, 2021 | Packagist topthink/framework |
Deserialization of Untrusted Data in topthink/framework CVE-2021-36564, GHSA-33gc-6cw9-w3g4 | Critical | 1.9% | 06 Dec, 2021 | Packagist topthink/framework |
Ajax.NET Professional Deserialization of Untrusted Data Vulnerability CVE-2021-23758 | CriticalExploited | 82.6% | 03 Dec, 2021 | |
Path manipulation in matyhtf/framework CVE-2021-43676, GHSA-mh9j-v6mq-pfch | Critical | 1.4% | 03 Dec, 2021 | Packagist matyhtf/framework |
Path traversal in librenms/librenms CVE-2021-44278, GHSA-7289-chwj-7h86 | Critical | 1.5% | 03 Dec, 2021 | Packagist librenms/librenms |
kimai2 is vulnerable to Cross-site Scripting CVE-2021-3985, GHSA-x68c-4gmm-5g43 | Critical | 1.3% | 01 Dec, 2021 | Packagist kevinpapst/kimai2 |
django-helpdesk is vulnerable to Cross-site Scripting CVE-2021-3994, GHSA-2v5j-q74q-r53f, PYSEC-2021-438 | Critical | 1.4% | 01 Dec, 2021 | PyPI django-helpdesk |
SQL Injection in rosariosis CVE-2021-44427, GHSA-wf5p-f5xr-c4jj | Critical | 50.6% | 29 Nov, 2021 | Packagist francoisjacquet/rosariosis |
XSS via prototype pollution in NodeBB CVE-2021-43787, GHSA-wx69-rvg3-x7fc | Critical | 1.3% | 29 Nov, 2021 | npm nodebb |
API token verification can be bypassed in NodeBB CVE-2021-43786, GHSA-hf2m-j98r-4fqw | Critical | 2.4% | 29 Nov, 2021 | npm nodebb |
Zoho ManageEngine ServiceDesk Plus Remote Code Execution Vulnerability CVE-2021-44077 | CriticalExploited | 93.3% | 29 Nov, 2021 | |
Improper Neutralization of Formula Elements in a CSV File in html-2-csv CVE-2021-23654, GHSA-fwf6-rw69-hhj4, PYSEC-2021-866, SNYK-PYTHON-HTMLTOCSV-1582784 | Critical | 1.2% | 26 Nov, 2021 | PyPI html-to-csv |
OS Command Injection Vulnerability and Potential Zip Slip Vulnerability in baserCMS CVE-2021-41243, GHSA-7rpc-9m88-cf9w | Critical | 2.2% | 26 Nov, 2021 | Packagist baserproject/basercms |