Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
TimelockController vulnerability in OpenZeppelin Contracts CVE-2021-39167, GHSA-fg47-3c2x-m2wr | Critical | 1.6% | 27 Aug, 2021 | npm @openzeppelin/contracts |
Account Takeover in Octobercms CVE-2021-32648, GHSA-mxr5-mc97-63rc | CriticalExploited | 91.2% | 26 Aug, 2021 | Packagist october/system |
remote code execution via git repo provider CVE-2021-39159, GHSA-9jjr-qqfp-ppwx, PYSEC-2021-371 | Critical | 1.9% | 25 Aug, 2021 | PyPI binderhub |
Prototype Pollution in mootools CVE-2021-23432, GHSA-x6hx-7gh3-3q98 | Critical | 0.9% | 24 Aug, 2021 | npm mootools |
Code Injection in pac-resolver CVE-2021-23406, GHSA-9j49-mfvp-vmhm | Critical | 2.9% | 24 Aug, 2021 | npm degenerator npm pac-resolver |
OpenStack Neutron vulnerable to hardware address impersonation CVE-2021-38598, GHSA-hvm4-mc7m-22w4, PYSEC-2021-360 | Critical | 1.2% | 23 Aug, 2021 | PyPI neutron |
SafeCurl before 0.9.2 has a DNS rebinding vulnerability. CVE-2020-36474, GHSA-x2xg-6wcj-6xf9 | Critical | 1.8% | 20 Aug, 2021 | Packagist vanilla/safecurl |
Command injection in mail agent settings CVE-2021-37708, GHSA-xh55-2fqp-p775 | Critical | 2.4% | 16 Aug, 2021 | Packagist shopware/core Packagist shopware/platform |
Lin-CMS-Flask vulnerable to Improper Authentication CVE-2020-18698, GHSA-h6r2-pgvx-683c, PYSEC-2021-339 | Critical | 2.0% | 16 Aug, 2021 | PyPI Lin-CMS PyPI lin-cms |
Incorrect Access Control in Lin-CMS-Flask v0.1.1 allows remote attackers to obtain sensitive information and/or gain privileges due to the application not invalidating a user's authentication token upon logout, which allows for replaying packets. CVE-2020-18701, PYSEC-2021-341 | Critical | 2.3% | 16 Aug, 2021 | PyPI lin-cms |
Improper Restriction of XML External Entity Reference in Quokka CVE-2020-18703, GHSA-3xg5-6c3j-vp8x, PYSEC-2021-144 | Critical | 2.8% | 16 Aug, 2021 | PyPI quokka |
Unrestricted Upload of File with Dangerous Type in django-widgy CVE-2020-18704, GHSA-98hv-qff3-8793, PYSEC-2021-336 | Critical | 2.9% | 16 Aug, 2021 | PyPI django-widgy |
Improper Restriction of XML External Entity Reference in Quokka CVE-2020-18705, GHSA-4q2r-qxp6-h5j6, PYSEC-2021-145 | Critical | 2.8% | 16 Aug, 2021 | PyPI quokka |
Realtek AP-Router SDK Buffer Overflow Vulnerability CVE-2021-35395 | CriticalExploited | 98.1% | 16 Aug, 2021 | |
Realtek Jungle SDK Remote Code Execution Vulnerability CVE-2021-35394 | CriticalExploited | 99.9% | 16 Aug, 2021 | |
Dolibarr Cross-site Scripting vulnerability CVE-2021-25955, GHSA-cpv8-6xgr-rmf6 | Critical | 0.9% | 15 Aug, 2021 | Packagist dolibarr/dolibarr |
Improper Authorization and Origin Validation Error in OneFuzz CVE-2021-37705, GHSA-q5vh-6whw-x745, PYSEC-2021-344 | Critical | 2.4% | 13 Aug, 2021 | PyPI onefuzz |
SQL injection in TYPO3 extension CVE-2021-38302, GHSA-hqm2-gwqf-r5g5 | Critical | 1.0% | 13 Aug, 2021 | Packagist ecodev/newsletter |
Sunhillo SureLine OS Command Injection Vulnerablity CVE-2021-36380 | CriticalExploited | 97.8% | 13 Aug, 2021 | |
Prototype Pollution in merge-change CVE-2021-23421, GHSA-f9cv-665r-275h | Critical | 1.1% | 11 Aug, 2021 | npm merge-change |
Deserialization of Untrusted Data in codeception/codeception CVE-2021-23420, GHSA-4574-qv3w-fcmg, SNYK-PHP-CODECEPTIONCODECEPTION-1324585 | Critical | 2.7% | 11 Aug, 2021 | Packagist codeception/codeception |
Incorrect Authorization in serverless-offline CVE-2021-38384, GHSA-h97f-5258-5593 | Critical | 1.5% | 10 Aug, 2021 | npm serverless-offline |
JupyterLab: XSS due to lack of sanitization of the action attribute of an html <form> BIT-jupyterlab-2021-32797, CVE-2021-32797, GHSA-4952-p58q-6crx, PYSEC-2021-130, PYSEC-2026-688 | Critical | 2.7% | 09 Aug, 2021 | PyPI jupyterlab PyPI notebook |
Special Element Injection in notebook BIT-jupyter-base-notebook-2021-32798, BIT-jupyter-notebook-2021-32798, CVE-2021-32798, GHSA-hwvq-6gjx-j797, PYSEC-2021-118 | Critical | 2.1% | 09 Aug, 2021 | PyPI notebook |
Prototype Pollution in open-graph CVE-2021-23419, GHSA-g452-6rfc-vrvx, SNYK-JS-OPENGRAPH-1536747 | Critical | 1.1% | 08 Aug, 2021 | npm open-graph |
Obsidian does not require user confirmation for non-http/https URLs. CVE-2021-38148, GHSA-45mx-g85m-wwm3 | Critical | 1.2% | 07 Aug, 2021 | npm obsidian |
SonicWall Secure Remote Access (SRA) SQL Injection Vulnerability CVE-2021-20028 | CriticalExploited | 30.1% | 04 Aug, 2021 | |
NukeViet SQL Injection vulnerability CVE-2020-21809, GHSA-m8jx-mxf9-2rpw | Critical | 1.6% | 30 Jul, 2021 | Packagist nukeviet/nukeviet |
NukeViet SQL Injection vulnerability via topicsid parameter CVE-2020-21808, GHSA-84gf-rw24-pfqg | Critical | 1.6% | 30 Jul, 2021 | Packagist nukeviet/nukeviet |
XML External Entity Reference in Glances CVE-2021-23418, GHSA-r2mj-8wgq-73m6, PYSEC-2021-115, SNYK-PYTHON-GLANCES-1311807 | Critical | 1.7% | 29 Jul, 2021 | PyPI Glances PyPI glances |
Prototype Pollution in deepmergefn CVE-2021-23417, GHSA-vj72-mwrj-m2xq | Critical | 1.1% | 28 Jul, 2021 | npm deepmergefn |
Code injection in topthink/think CVE-2020-17952, GHSA-ch3r-vp46-8g22 | Critical | 2.5% | 26 Jul, 2021 | Packagist topthink/think |
Command injection in gitlogplus CVE-2021-23412, GHSA-3fxp-vwxm-2r5p | Critical | 4.0% | 23 Jul, 2021 | npm gitlogplus |
ForgeRock Access Management (AM) Core Server Remote Code Execution Vulnerability CVE-2021-35464 | CriticalExploited | 100.0% | 22 Jul, 2021 | |
SolarWinds Serv-U Remote Code Execution Vulnerability CVE-2021-35211 | CriticalExploited | 91.2% | 14 Jul, 2021 | |
SQL Injection in Subrion CMS CVE-2020-18155, GHSA-7q44-gfvq-6g93 | Critical | 1.3% | 14 Jul, 2021 | Packagist intelliants/subrion |
Microsoft Exchange Server Privilege Escalation Vulnerability CVE-2021-34523 | CriticalExploited | 100.0% | 14 Jul, 2021 | |
Microsoft Exchange Server Remote Code Execution Vulnerability CVE-2021-34473 | CriticalExploited | 100.0% | 14 Jul, 2021 | |
Prototype Pollution in putil-merge CVE-2021-25953, GHSA-9x7m-9hpg-xxmw | Critical | 3.0% | 14 Jul, 2021 | npm putil-merge |
Buffer Overflow in Pillow BIT-pillow-2021-34552, CVE-2021-34552, GHSA-7534-mm45-c74v, PYSEC-2021-331 | Critical | 3.2% | 13 Jul, 2021 | PyPI pillow |
Code Injection in total4 CVE-2021-23390, GHSA-g7mq-rfj2-25wq, SNYK-JS-TOTAL4-1130527 | Critical | 3.0% | 12 Jul, 2021 | npm total4 |
Code Injection in total.js CVE-2021-23389, GHSA-7fm6-gxqg-2pwr, SNYK-JS-TOTALJS-1088607 | Critical | 3.6% | 12 Jul, 2021 | npm total.js |
Kaseya Virtual System/Server Administrator (VSA) Information Disclosure Vulnerability CVE-2021-30116 | CriticalExploited | 85.7% | 09 Jul, 2021 | |
Prototype polluation in just-safe-set CVE-2021-25952, GHSA-v26w-gcxh-v4r7 | Critical | 3.3% | 07 Jul, 2021 | npm just-safe-set |
Prototype Pollution in ts-nodash CVE-2021-23403, GHSA-5xjx-4xcm-hpcm | Critical | 1.3% | 02 Jul, 2021 | npm ts-nodash |
Prototype Pollution in record-like-deep-assign CVE-2021-23402, GHSA-7qm6-9v49-38m9 | Critical | 1.2% | 02 Jul, 2021 | npm record-like-deep-assign |
SQL Injection in Django BIT-django-2021-35042, CVE-2021-35042, GHSA-xpfp-f569-q3p2, PYSEC-2021-109 | Critical | 44.4% | 02 Jul, 2021 | PyPI Django PyPI django |
Craft CMS Remote Code Injection CVE-2021-27903, GHSA-x2j7-6hxm-87p3 | Critical | 2.8% | 30 Jun, 2021 | Packagist craftcms/cms |
Arbitrary Command Injection CVE-2021-23399, GHSA-v85c-hgq5-7pfw | Critical | 1.3% | 28 Jun, 2021 | npm wincred |
Time-of-check Time-of-use (TOCTOU) Race Condition in league/flysystem CVE-2021-32708, GHSA-9f46-5r25-5wfm | Critical | 3.5% | 24 Jun, 2021 | Packagist league/flysystem |