Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Webcache Poisoning in shopware/platform and shopware/core GHSA-r64m-qchj-hrjp | Critical | Not scored | 24 Nov, 2021 | Packagist shopware/core Packagist shopware/platform |
Arbitrary file reading vulnerability in Aim CVE-2021-43775, GHSA-8phj-f9w2-cjcc, PYSEC-2021-839 | Critical | 1.9% | 23 Nov, 2021 | PyPI aim |
Asterix Heap-based Buffer Overflow CVE-2021-44144, GHSA-6mmf-v5q7-vw2w, PYSEC-2021-860 | Critical | 1.2% | 22 Nov, 2021 | PyPI asterix-decoder PyPI asterix_decoder |
OS Command injection in docker-cli-js CVE-2021-23732, GHSA-ff45-7prw-58vj | Critical | 1.9% | 22 Nov, 2021 | npm docker-cli-js |
Moodle vulnerable to RCE via unsafe deserialization BIT-moodle-2021-3943, CVE-2021-3943, GHSA-8jhp-2gcr-qw96 | Critical | 2.4% | 22 Nov, 2021 | Packagist moodle/moodle |
Prototype Pollution in algoliasearch-helper CVE-2021-23433, GHSA-vpf5-82c8-9v36, SNYK-JS-ALGOLIASEARCHHELPER-1570421 | Critical | 1.6% | 19 Nov, 2021 | npm algoliasearch-helper |
Roundcube Webmail SQL Injection Vulnerability CVE-2021-44026 | CriticalExploited | 69.9% | 19 Nov, 2021 | |
Incorrect Access Control in Ignition CVE-2021-43996, GHSA-vhrp-8qx4-vr6c | Critical | 1.7% | 17 Nov, 2021 | Packagist facade/ignition |
DBAL 3 SQL Injection Security Vulnerability CVE-2021-43608, GHSA-r7cj-8hjg-x622 | Critical | 2.4% | 16 Nov, 2021 | Packagist doctrine/dbal |
Withdrawn: Laravel Framework does not sufficiently block the upload of executable PHP content. CVE-2021-43617, GHSA-364w-9g92-3grq | Critical | 20.0% | 14 Nov, 2021 | Packagist laravel/framework |
json-schema is vulnerable to Prototype Pollution CVE-2021-3918, GHSA-896r-f27r-55mw | Critical | 3.8% | 13 Nov, 2021 | npm json-schema |
Dolibarr remote PHP code execution BIT-dolibarr-2021-33816, CVE-2021-33816, GHSA-vxr9-p2xw-m8cf | Critical | 3.9% | 10 Nov, 2021 | Packagist dolibarr/dolibarr |
Improper Verification of Cryptographic Signature in starkbank-ecdsa CVE-2021-43571, GHSA-q9q6-f556-gpm7 | Critical | 1.0% | 09 Nov, 2021 | npm starkbank-ecdsa |
Improper Verification of Cryptographic Signature in starkbank-ecdsa CVE-2021-43572, GHSA-92vm-mxjf-jqf3, PYSEC-2021-426 | Critical | 1.2% | 09 Nov, 2021 | PyPI starkbank-ecdsa |
Insecure Inherited Permissions in neoan3-apps/template CVE-2021-41170, GHSA-3v56-q6r6-4gcw | Critical | 1.6% | 08 Nov, 2021 | Packagist neoan3-apps/template |
Apostrophe CMS Insufficient Session Expiration vulnerability CVE-2021-25979, GHSA-9j9m-8wjc-ff96 | Critical | 1.1% | 08 Nov, 2021 | npm apostrophe |
Incomplete validation in boosted trees code BIT-tensorflow-2021-41208, CVE-2021-41208, GHSA-57wx-m983-2f88, PYSEC-2021-400, PYSEC-2021-617, PYSEC-2021-815 | Critical | 0.2% | 05 Nov, 2021 | PyPI tensorflow PyPI tensorflow-cpu PyPI tensorflow-gpu |
Sitecore XP Remote Command Execution Vulnerability CVE-2021-42237 | CriticalExploited | 97.6% | 05 Nov, 2021 | |
Embedded malware in rc GHSA-g2q5-5433-rhrf | Critical | Not scored | 04 Nov, 2021 | npm rc |
Embedded malware in coa GHSA-73qr-pfmq-6rp8 | Critical | Not scored | 04 Nov, 2021 | npm coa |
Prototype Pollution in json-pointer CVE-2021-23820, GHSA-v5vg-g7rq-363w | Critical | 1.9% | 03 Nov, 2021 | npm json-pointer |
Prototype Pollution in node-jsonpointer CVE-2021-23807, GHSA-282f-qqgm-c34q | Critical | 2.8% | 03 Nov, 2021 | npm jsonpointer npm org.webjars.npm:json-pointer |
Prototype Pollution in dotty CVE-2021-23624, GHSA-6g47-63mv-qpgh, SNYK-JS-DOTTY-1577292 | Critical | 1.3% | 03 Nov, 2021 | npm dotty |
Prototype Pollution in json-ptr CVE-2021-23509, GHSA-8gwj-8hxc-285w | Critical | 1.8% | 03 Nov, 2021 | npm json-ptr |
Vulnerability in singleCrunch function leads to arbitrary code execution via filePath parameters CVE-2020-36381, GHSA-7fw7-gh23-f832 | Critical | 1.9% | 31 Oct, 2021 | npm aaptjs |
Vulnerability in crunch function leads to arbitrary code execution via filePath parameters CVE-2020-36380, GHSA-m7p2-ghfh-pjvx | Critical | 2.2% | 31 Oct, 2021 | npm aaptjs |
Vulnerability in remove function leads to arbitrary code execution via filePath parameters CVE-2020-36379, GHSA-9cq3-fj2h-ggj5 | Critical | 1.9% | 31 Oct, 2021 | npm aaptjs |
Vulnerability in packageCmd function leads to arbitrary code execution via filePath parameters CVE-2020-36378, GHSA-4qwq-q4pr-rr7r | Critical | 1.9% | 31 Oct, 2021 | npm aaptjs |
Vulnerability in dump function leads to arbitrary code execution via filePath parameters CVE-2020-36377, GHSA-r496-7hgp-53wf | Critical | 1.9% | 31 Oct, 2021 | npm aaptjs |
Vulnerability in list function leads to arbitrary code execution via filePath parameters CVE-2020-36376, GHSA-4g7x-7vgq-3j28 | Critical | 1.9% | 31 Oct, 2021 | npm aaptjs |
XML External Entity vulnerability in Easy-XML CVE-2020-26705, GHSA-v899-28g4-qmh8, PYSEC-2021-388 | Critical | 1.3% | 31 Oct, 2021 | PyPI easy-xml |
XML External Entity vulnerability in MODX CMS BIT-modx-2020-25911, CVE-2020-25911, GHSA-vhfp-9wvj-gwvg | Critical | 2.4% | 31 Oct, 2021 | Packagist modx/revolution |
Improper Access Control in jupyterhub-firstuseauthenticator CVE-2021-41194, GHSA-5xvc-vgmp-jgc3, PYSEC-2021-384 | Critical | 1.4% | 28 Oct, 2021 | PyPI jupyterhub-firstuseauthenticator |
Workers for local Dask clusters mistakenly listened on public interfaces CVE-2021-42343, GHSA-hwqr-f3v9-hwxr, GHSA-j8fq-86c5-5v2r, PYSEC-2021-387, PYSEC-2021-871, PYSEC-2021-872 | Critical | 3.0% | 26 Oct, 2021 | PyPI dask PyPI distributed |
BQE BillQuick Web Suite SQL Injection Vulnerability CVE-2021-42258 | CriticalExploited | 75.2% | 22 Oct, 2021 | |
Showdoc File Upload Vulnerability CVE-2021-41745, GHSA-4286-h47h-m5v6 | Critical | 1.4% | 22 Oct, 2021 | Packagist showdoc/showdoc |
Improper Neutralization of Special Elements used in a Command in Shell-quote CVE-2021-42740, GHSA-g4rg-993r-mgx7 | Critical | 4.2% | 21 Oct, 2021 | npm shell-quote |
Prototype Pollution in x-assign CVE-2021-23452, GHSA-4mvj-rq4v-2fxw | Critical | 1.6% | 20 Oct, 2021 | npm x-assign |
Nameko Arbitrary code execution due to YAML deserialization CVE-2021-41078, GHSA-6p52-jr3q-c94g, PYSEC-2021-383 | Critical | 1.5% | 19 Oct, 2021 | PyPI nameko |
Prototype Pollution in vm2 CVE-2021-23449, GHSA-rjf2-j2r6-q8gr, SNYK-JS-VM2-1585918 | Critical | 3.6% | 18 Oct, 2021 | npm vm2 |
Policies not properly enforced in bluemonday CVE-2021-42576, GHSA-x95h-979x-cf3j, GO-2022-0588, PYSEC-2021-849 | Critical | 1.6% | 18 Oct, 2021 | Go github.com/microcosm-cc/bluemonday PyPI pybluemonday |
Yealink Device Management Server-Side Request Forgery (SSRF) Vulnerability CVE-2021-27561 | CriticalExploited | 82.9% | 15 Oct, 2021 | |
Ops CLI Deserialization of Untrusted Data vulnerability CVE-2021-40720, GHSA-x23q-4j9j-9cxw, PYSEC-2021-380 | Critical | 9.5% | 15 Oct, 2021 | PyPI ops-cli |
Inconsistent input sanitisation leads to XSS vectors CVE-2021-41132, GHSA-g67g-hvc3-xmvf, PYSEC-2021-372, PYSEC-2021-379 | Critical | 1.0% | 14 Oct, 2021 | PyPI omero-figure PyPI omero-web |
Froxlor SQL injection vulnerability CVE-2021-42325, GHSA-6fvw-x6gw-4wv8 | Critical | 11.8% | 12 Oct, 2021 | Packagist froxlor/froxlor |
Prototype Pollution in config-handler CVE-2021-23448, GHSA-2w3f-9w3q-qw77, SNYK-JS-CONFIGHANDLER-1564947 | Critical | 1.2% | 11 Oct, 2021 | npm config-handler |
Insecure random number generation in keypair CVE-2021-41117, GHSA-3f99-hvg4-qjwj | Critical | 3.2% | 11 Oct, 2021 | npm keypair |
Google Chromium Portals Use-After-Free Vulnerability CVE-2021-37973 | CriticalExploited | 11.7% | 08 Oct, 2021 | |
Google Chromium Indexed DB API Use-After-Free Vulnerability CVE-2021-30633 | CriticalExploited | 33.2% | 08 Oct, 2021 | |
Apache HTTP Server Path Traversal Vulnerability CVE-2021-42013 | CriticalExploited | 100.0% | 07 Oct, 2021 |