Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Server-Side Request Forgery vulnerability in concrete5 CVE-2021-22958, GHSA-284f-f2hw-j2gx | Critical | 1.2% | 07 Oct, 2021 | Packagist concrete5/concrete5 |
Improper escaping of command arguments on Windows leading to command injection BIT-composer-2021-41116, CVE-2021-41116, GHSA-frqg-7g38-6gcf | Critical | 2.8% | 05 Oct, 2021 | Packagist composer/composer |
Apache HTTP Server Path Traversal Vulnerability CVE-2021-41773 | CriticalExploited | 100.0% | 05 Oct, 2021 | |
Remote unauthenticated attackers able to upload files in Onionshare CVE-2021-41868, GHSA-7g47-xxff-9p85, PYSEC-2026-434 | Critical | 2.4% | 04 Oct, 2021 | PyPI onionshare-cli |
Cobbler before 3.3.0 allows log poisoning CVE-2021-40323, GHSA-cpqf-3c3r-c9g2, PYSEC-2021-373 | Critical | 86.8% | 04 Oct, 2021 | PyPI cobbler |
SQL Injection in topthink/thinkphp CVE-2020-20120, GHSA-m7h5-fjjq-559f | Critical | 1.8% | 28 Sep, 2021 | Packagist topthink/thinkphp |
Prototype pollution in aurelia-path CVE-2021-41097, GHSA-3c9c-2p65-qvwv | Critical | 4.9% | 27 Sep, 2021 | npm aurelia-path |
Improper Access Control in Webauthn Framework CVE-2021-38299, GHSA-6whf-q6p5-84wg | Critical | 1.8% | 27 Sep, 2021 | Packagist web-auth/webauthn-framework |
Citrix ShareFile Improper Access Control Vulnerability CVE-2021-22941 | CriticalExploited | 53.6% | 23 Sep, 2021 | |
VMware vCenter Server File Upload Vulnerability CVE-2021-22005 | CriticalExploited | 100.0% | 23 Sep, 2021 | |
Hikvision Improper Input Validation CVE-2021-36260 | CriticalExploited | 99.9% | 22 Sep, 2021 | |
Improper Control of Generation of Code ('Code Injection') in @asyncapi/modelina CVE-2023-23619, GHSA-4jg2-84c2-pj95 | Critical | 1.1% | 21 Sep, 2021 | npm @asyncapi/modelina |
Prototype Pollution in jointjs CVE-2021-23444, GHSA-f3pp-32qc-36w4 | Critical | 1.9% | 21 Sep, 2021 | npm jointjs |
OS Command Injection in ssh2 CVE-2020-26301, GHSA-652h-xwhf-q4h6 | Critical | 3.8% | 20 Sep, 2021 | npm ssh2 |
Prototype Pollution in the merge and clone helper methods CVE-2021-39227, GHSA-fhv8-fx5f-7fxf | Critical | 1.3% | 17 Sep, 2021 | npm zrender |
Prototype Pollution in cookiex/deep CVE-2021-23442, GHSA-92v9-xh2q-fq9f, SNYK-JS-COOKIEXDEEP-1582793 | Critical | 1.6% | 17 Sep, 2021 | npm @cookiex/deep |
Apache HTTP Server-Side Request Forgery (SSRF) CVE-2021-40438 | CriticalExploited | 100.0% | 16 Sep, 2021 | |
Lacking Protection against HTTP Request Smuggling in mitmproxy CVE-2021-39214, GHSA-22gh-3r9q-xf38, PYSEC-2021-328 | Critical | 1.1% | 16 Sep, 2021 | PyPI mitmproxy |
Dahua IP Camera Authentication Bypass Vulnerability CVE-2021-33045 | CriticalExploited | 99.6% | 15 Sep, 2021 | |
Dahua IP Camera Authentication Bypass Vulnerability CVE-2021-33044 | CriticalExploited | 100.0% | 15 Sep, 2021 | |
Arbitrary Code Execution in feehi/cms CVE-2020-21322, GHSA-rf3w-29h3-r636 | Critical | 1.8% | 15 Sep, 2021 | Packagist feehi/cms |
UUPSUpgradeable vulnerability in @openzeppelin/contracts CVE-2021-41264, GHSA-5vp3-v4hc-gx76 | Critical | 1.5% | 15 Sep, 2021 | npm @openzeppelin/contracts npm @openzeppelin/contracts-upgradeable |
UUPSUpgradeable vulnerability in @openzeppelin/contracts-upgradeable GHSA-q4h9-46xg-m3x9 | Critical | Not scored | 15 Sep, 2021 | npm @openzeppelin/contracts-upgradeable |
Unrestricted Upload of File with Dangerous Type in Drupal core BIT-drupal-2020-13675, CVE-2020-13675, DRUPAL-CONTRIB-2021-029, DRUPAL-CORE-2021-008, GHSA-v8wr-r69p-mmwx | Critical | 1.4% | 15 Sep, 2021 | Packagist drupal/core Packagist:https://packages.drupal.org/8 drupal/graphql |
Microsoft Open Management Infrastructure (OMI) Remote Code Execution Vulnerability CVE-2021-38647 | CriticalExploited | 99.9% | 15 Sep, 2021 | |
body-parser-xml vulnerable to Prototype Pollution CVE-2021-3666, GHSA-2ghc-6v89-pw9j | Critical | 1.3% | 13 Sep, 2021 | npm body-parser-xml |
Aviatrix Controller Unrestricted Upload of File CVE-2021-40870 | CriticalExploited | 93.0% | 13 Sep, 2021 | |
Prototype Pollution in set-value CVE-2021-23440, GHSA-4jqc-8m5r-9rpr | Critical | 2.2% | 12 Sep, 2021 | NuGet set-value-nuget npm set-value |
merge vulnerable to Prototype Pollution CVE-2021-3645, GHSA-cqqh-49mx-fq63 | Critical | 1.4% | 10 Sep, 2021 | npm @viking04/merge |
Missing Authentication for Critical Function in Apache Airflow BIT-airflow-2021-38540, CVE-2021-38540, GHSA-h88f-r7cw-8fv3, PYSEC-2021-326 | Critical | 80.9% | 09 Sep, 2021 | PyPI apache-airflow |
Unrestricted File Upload in ShowDoc v2.9.5 CVE-2021-36440, GHSA-c442-3278-rhrg | Critical | 4.8% | 08 Sep, 2021 | Packagist showdoc/showdoc |
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in ZMarkdown GHSA-2c83-wfv3-q25f | Critical | Not scored | 07 Sep, 2021 | npm rebber |
Incorrect version tags linked to external repository BIT-parse-2021-47986, BIT-parse-2021-47987, CVE-2021-47986, CVE-2021-47987, GHSA-593v-wcqx-hq2w | Critical | 0.2% | 07 Sep, 2021 | npm parse-server |
Unsafe defaults in `remark-html` CVE-2021-39199, GHSA-9q5w-79cv-947m | Critical | 1.1% | 07 Sep, 2021 | npm remark-html |
Zoho ManageEngine ADSelfService Plus Authentication Bypass Vulnerability CVE-2021-40539 | CriticalExploited | 99.0% | 07 Sep, 2021 | |
objection.js Prototype Pollution vulnerability CVE-2021-3766, GHSA-r659-8xfp-j327 | Critical | 1.5% | 06 Sep, 2021 | npm objection |
AdaptiveScale LXDUI Hardcoded JWT Secret Key CVE-2021-40494, GHSA-p4xh-4869-8vrg, PYSEC-2021-342 | Critical | 1.7% | 03 Sep, 2021 | PyPI lxdui |
Prototype Pollution in immer CVE-2021-3757, GHSA-c36v-fmgq-m8hx | Critical | 1.7% | 02 Sep, 2021 | npm immer |
Type confusion in mpath CVE-2021-23438, GHSA-p92x-r36w-9395 | Critical | 1.7% | 01 Sep, 2021 | npm mpath |
Prototype Pollution in immer CVE-2021-23436, GHSA-33f9-j839-rf8h | Critical | 1.8% | 01 Sep, 2021 | npm immer |
Magento executes code via the API File Option Upload Extension CVE-2021-36042, GHSA-6cwv-wj7v-73xp | Critical | 2.5% | 01 Sep, 2021 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento has a file extension restrictions bypass CVE-2021-36040, GHSA-2pq5-gpqf-g4r3 | Critical | 2.9% | 01 Sep, 2021 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento XML Injection vulnerability in the Widgets Module CVE-2021-36033, GHSA-p746-qw73-qmmx | Critical | 3.1% | 01 Sep, 2021 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento has an XML Injection vulnerability CVE-2021-36028, GHSA-5pjj-7fq8-9gpf | Critical | 2.9% | 01 Sep, 2021 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento is affected by an improper input validation vulnerability while saving a customer's details CVE-2021-36025, GHSA-gvfx-9m9v-h839 | Critical | 2.8% | 01 Sep, 2021 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento XML Injection vulnerability in the 'City' field CVE-2021-36020, GHSA-xvpx-6hh8-7h72 | Critical | 2.7% | 01 Sep, 2021 | Packagist magento/community-edition Packagist magento/project-community-edition |
Zoho ManageEngine ServiceDesk Authentication Bypass Vulnerability CVE-2021-37415 | CriticalExploited | 99.8% | 01 Sep, 2021 | |
Atlassian Confluence Server and Data Center Object-Graph Navigation Language (OGNL) Injection Vulnerability CVE-2021-26084 | CriticalExploited | 100.0% | 30 Aug, 2021 | |
Command Injection in Simiki CVE-2020-19001, GHSA-w873-xcqq-x922, PYSEC-2021-348 | Critical | 4.3% | 27 Aug, 2021 | PyPI simiki |
TimelockController vulnerability in OpenZeppelin Contracts CVE-2021-39168, GHSA-vrw4-w73r-6mm8 | Critical | 1.6% | 27 Aug, 2021 | npm @openzeppelin/contracts-upgradeable |