Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Moodle command execution vulnerability exists in the default legacy spellchecker plugin BIT-moodle-2021-21809, CVE-2021-21809, GHSA-c7jj-vfmr-j9mj | Critical | 24.2% | 23 Jun, 2021 | Packagist moodle/moodle |
Prototype Pollution in lutils CVE-2021-23396, GHSA-3r8w-mphv-2f3f | Critical | 1.0% | 17 Jun, 2021 | npm lutils |
Auto-merging Person Records Compromised CVE-2021-32691, GHSA-r578-pj6f-r4ff | Critical | 1.5% | 16 Jun, 2021 | npm @apollosproject/data-connector-rock |
Improper Verification of Cryptographic Signature CVE-2021-32685, GHSA-7r96-8g3x-g36m | Critical | 0.7% | 16 Jun, 2021 | npm tenvoy |
Use After Free in Hermes CVE-2021-24037, GHSA-mph8-6787-r8hw | Critical | 1.8% | 15 Jun, 2021 | npm hermes-engine |
elFinder before 2.1.59 contains multiple vulnerabilities leading to RCE CVE-2021-32682, GHSA-wph3-44rj-92pr | Critical | 69.9% | 14 Jun, 2021 | Packagist studio-42/elfinder |
elFinder unsafe upload filtering leading to remote code execution CVE-2021-23394, GHSA-qm58-cvvm-c5qr, SNYK-PHP-STUDIO42ELFINDER-1290554 | Critical | 18.9% | 13 Jun, 2021 | Packagist studio-42/elfinder |
GitLab Server-Side Request Forgery (SSRF) Vulnerability CVE-2021-22175 | CriticalExploited | 53.4% | 11 Jun, 2021 | |
set-getter Prototype Pollution Vulnerability CVE-2021-25949, GHSA-jv35-xqg7-f92r | Critical | 3.3% | 10 Jun, 2021 | npm set-getter |
Prototype Pollution CVE-2021-25948, GHSA-x3wr-v4wx-5qpc | Critical | 3.3% | 10 Jun, 2021 | npm expand-hash |
The Fuck Arbitrary File Deletion via Path Traversal CVE-2021-34363, GHSA-8wwf-2644-f8x4, PYSEC-2021-97 | Critical | 1.8% | 10 Jun, 2021 | PyPI thefuck |
Remote Command Execution in reg-keygen-git-hash-plugin CVE-2021-32673, GHSA-49q3-8867-5wmp | Critical | 1.9% | 08 Jun, 2021 | npm reg-keygen-git-hash-plugin |
XSS vulnerability with translator CVE-2021-32671, GHSA-5qjq-69w6-fg57 | Critical | 40.0% | 07 Jun, 2021 | Packagist flarum/core |
Prototype pollution in nestie CVE-2021-25947, GHSA-m7rg-8wvq-846v | Critical | 3.0% | 03 Jun, 2021 | npm nestie |
Out-of-bounds Read in Pillow BIT-pillow-2021-25287, CVE-2021-25287, GHSA-77gc-v2xv-rvvh, PYSEC-2021-137 | Critical | 2.9% | 02 Jun, 2021 | PyPI Pillow PyPI pillow |
Pillow Out-of-bounds Read vulnerability BIT-pillow-2021-25288, CVE-2021-25288, GHSA-rwv7-3v45-hg29, PYSEC-2021-138 | Critical | 2.4% | 02 Jun, 2021 | PyPI Pillow PyPI pillow |
Prototype pollution in Merge-deep CVE-2021-26707, GHSA-r6rj-9ch6-g264 | Critical | 1.9% | 02 Jun, 2021 | npm merge-deep |
Checkbox Survey Deserialization of Untrusted Data Vulnerability CVE-2021-27852 | CriticalExploited | 30.3% | 27 May, 2021 | |
Prototype pollution vulnerability in js-extend CVE-2021-25945, GHSA-mh82-55cm-6gfh | Critical | 3.0% | 26 May, 2021 | npm js-extend |
VMware vCenter Server Improper Input Validation Vulnerability CVE-2021-21985 | CriticalExploited | 100.0% | 26 May, 2021 | |
Prototype pollution in nconf-toml CVE-2021-25946, GHSA-hx7j-43w2-7rj7 | Critical | 3.3% | 25 May, 2021 | npm nconf-toml |
deep-defaults vulnerable to prototype pollution CVE-2021-25944, GHSA-h6xg-rg33-9mf4 | Critical | 3.0% | 25 May, 2021 | npm deep-defaults |
Server-Side Request Forgery in Feehi CMS CVE-2021-30108, GHSA-gc45-j3m5-8qfq | Critical | 1.1% | 24 May, 2021 | Packagist feehi/cms |
Command Injection in @ronomon/opened CVE-2021-29300, GHSA-fg5w-w99f-rj6w | Critical | 4.5% | 24 May, 2021 | npm @ronomon/opened |
Incorrect Permission Assignment for Critical Resource in Plone CVE-2021-33509, GHSA-hm2p-fhwx-9285, PYSEC-2021-81 | Critical | 2.0% | 21 May, 2021 | PyPI Plone PyPI plone |
Improper Certificate Validation in WP-CLI framework BIT-wp-cli-2021-29504, CVE-2021-29504, GHSA-rwgm-f83r-v3qj | Critical | 1.3% | 19 May, 2021 | Packagist wp-cli/wp-cli |
Prototype pollution in 101 CVE-2021-25943, GHSA-cwcx-rxgc-cmw3 | Critical | 3.3% | 14 May, 2021 | npm 101 |
Prototype Pollution in deep-override CVE-2021-25941, GHSA-v659-54cx-g4qr | Critical | 3.3% | 14 May, 2021 | npm deep-override |
Deserialization of Untrusted Data in Flask-Caching CVE-2021-33026, GHSA-656c-6cxf-hvcv | Critical | 7.3% | 13 May, 2021 | PyPI Flask-Caching PyPI flask-caching |
QNAP NAS Improper Authorization Vulnerability CVE-2021-28799 | CriticalExploited | 78.3% | 13 May, 2021 | |
Microsoft HTTP Protocol Stack Remote Code Execution Vulnerability CVE-2021-31166 | CriticalExploited | 99.9% | 11 May, 2021 | |
Tenda AC11 Router Stack Buffer Overflow Vulnerability CVE-2021-31755 | CriticalExploited | 86.5% | 07 May, 2021 | |
Command injection in LocalStack CVE-2021-32090, GHSA-hpr6-f4vq-mxch, PYSEC-2021-101 | Critical | 2.1% | 07 May, 2021 | PyPI localstack |
ASUS Routers Improper Authentication Vulnerability CVE-2021-32030 | CriticalExploited | 99.4% | 06 May, 2021 | |
Cisco HyperFlex HX Data Platform Command Injection Vulnerability CVE-2021-1498 | CriticalExploited | 100.0% | 06 May, 2021 | |
Cisco HyperFlex HX Installer Virtual Machine Command Injection Vulnerability CVE-2021-1497 | CriticalExploited | 99.9% | 06 May, 2021 | |
Drupal Core Access bypass vulnerability BIT-drupal-2020-13665, CVE-2020-13665, GHSA-wxqp-jwc9-g39x | Critical | 1.3% | 05 May, 2021 | Packagist drupal/core Packagist drupal/drupal |
Path traversal in impacket CVE-2021-31800, GHSA-mj63-64x7-57xf, PYSEC-2021-17 | Critical | 19.4% | 05 May, 2021 | PyPI impacket |
Prototype Pollution in handlebars CVE-2021-23383, GHSA-765h-qjxv-5f44 | Critical | 4.5% | 04 May, 2021 | npm handlebars |
Code injection in @rkesters/gnuplot CVE-2021-29369, GHSA-f2jw-pr2c-9x96 | Critical | 1.8% | 03 May, 2021 | npm @rkesters/gnuplot |
Prototype Pollution in mixme CVE-2021-28860, CVE-2021-29491, GHSA-79jw-6wg7-r9g4, GHSA-r5cq-9537-9rpf | Critical | 1.8% | 03 May, 2021 | npm mixme |
Lack of Input Validation in zendesk_api_client_php for Zendesk Subdomain CVE-2021-30492, GHSA-q348-f93x-9gx4 | Critical | Not scored | 29 Apr, 2021 | Packagist zendesk/zendesk_api_client_php |
Arcadyan Buffalo Firmware Path Traversal Vulnerability CVE-2021-20090 | CriticalExploited | 100.0% | 29 Apr, 2021 | |
Object injection in PHPMailer/PHPMailer BIT-phpmailer-2020-36326, BIT-wordpress-2020-36326, BIT-wordpress-multisite-2020-36326, CVE-2020-36326, GHSA-m298-fh5c-jc66 | Critical | 3.1% | 28 Apr, 2021 | Packagist phpmailer/phpmailer |
Insecure Deserialization of untrusted data in rmccue/requests CVE-2021-29476, GHSA-52qp-jpq7-6c54 | Critical | 2.1% | 27 Apr, 2021 | Packagist rmccue/requests |
Prototype pollution in safe-obj CVE-2021-25928, GHSA-wpgh-hmv4-r3v5 | Critical | 3.4% | 26 Apr, 2021 | npm safe-obj |
Prototype pollution in safe-flat CVE-2021-25927, GHSA-33rv-m2gp-mm2r | Critical | 3.3% | 26 Apr, 2021 | npm safe-flat |
GitLab Community and Enterprise Editions Remote Code Execution Vulnerability CVE-2021-22205 | CriticalExploited | 99.7% | 23 Apr, 2021 | |
Ivanti Pulse Connect Secure Use-After-Free Vulnerability CVE-2021-22893 | CriticalExploited | 47.2% | 23 Apr, 2021 | |
Improper Certificate Validation in xmlhttprequest-ssl CVE-2021-31597, GHSA-72mh-269x-7mh5 | Critical | 2.0% | 23 Apr, 2021 | npm xmlhttprequest-ssl |