Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Backport for CVE-2021-21024 Blind SQLi from Magento 2 CVE-2021-21427, GHSA-fvrf-9428-527m | Critical | 1.1% | 21 Apr, 2021 | Packagist openmage/magento-lts |
Fixes a bug in Zend Framework's Stream HTTP Wrapper CVE-2021-21426, GHSA-m496-x567-f98c | Critical | 1.2% | 21 Apr, 2021 | Packagist openmage/magento-lts |
Command Injection in killing CVE-2021-23381, GHSA-cq77-8jpx-892g | Critical | 1.3% | 18 Apr, 2021 | npm killing |
Command injection in portkiller CVE-2021-23379, GHSA-r6fw-8m27-43c9 | Critical | 1.3% | 18 Apr, 2021 | npm portkiller |
Command Injection in picotts CVE-2021-23378, GHSA-wq7q-5v6j-xfv6 | Critical | 1.9% | 18 Apr, 2021 | npm picotts |
Command Injection in onion-oled-js CVE-2021-23377, GHSA-rhwp-9vm9-547q | Critical | 3.0% | 18 Apr, 2021 | npm onion-oled-js |
Command Injection in ffmpegdotjs CVE-2021-23376, GHSA-f39r-cpmj-whcg | Critical | 2.0% | 18 Apr, 2021 | npm ffmpegdotjs |
Command Injection in psnode CVE-2021-23375, GHSA-m8fm-mv5w-33pv | Critical | 1.3% | 18 Apr, 2021 | npm psnode |
Command Injection in ps-visitor CVE-2021-23374, GHSA-v2jv-33gh-xx29 | Critical | 1.3% | 18 Apr, 2021 | npm ps-visitor |
QNAP Network-Attached Storage (NAS) Command Injection Vulnerability CVE-2020-2509 | CriticalExploited | 34.0% | 17 Apr, 2021 | |
SQL Injection in tribalsystems/zenario CVE-2021-26830, GHSA-w4f3-7f7c-x652 | Critical | 4.6% | 16 Apr, 2021 | Packagist tribalsystems/zenario |
SQL Injection via in django-debug-toolbar CVE-2021-30459, GHSA-pghf-347x-c2gj, PYSEC-2021-10 | Critical | 1.9% | 14 Apr, 2021 | PyPI django-debug-toolbar |
After order payment process manipulation in shopware/platform and shopware/core GHSA-88rc-3p98-rgvx | Critical | Not scored | 13 Apr, 2021 | Packagist shopware/core Packagist shopware/platform |
Leak of information via Store-API aggregations in shopware/platform and shopware/core GHSA-qg7c-q3vq-rgxr | Critical | Not scored | 13 Apr, 2021 | Packagist shopware/core Packagist shopware/platform |
Prototype Pollution in swiper CVE-2021-23370, GHSA-p3hc-fv2j-rp68 | Critical | 2.2% | 12 Apr, 2021 | npm swiper |
Remote code execution in handlebars when compiling templates CVE-2021-23369, GHSA-f2jv-r9rf-7988 | Critical | 7.0% | 12 Apr, 2021 | Maven org.webjars.bowergithub.wycats:handlebars.js Maven org.webjars.npm:handlebars Maven org.webjars:handlebars npm handlebars |
SonicWall Email Security Improper Privilege Management Vulnerability CVE-2021-20021 | CriticalExploited | 88.8% | 09 Apr, 2021 | |
RSA signature validation vulnerability on maleable encoded message in jsrsasign CVE-2021-30246, GHSA-27fj-mc8w-j9wg | Critical | 1.0% | 07 Apr, 2021 | npm jsrsasign |
Client TLS credentials sent raw to server in npm package nats GHSA-prmc-5v5w-c465 | Critical | Not scored | 06 Apr, 2021 | npm nats |
Command Injection Vulnerability in systeminformation CVE-2021-21388, GHSA-jff2-qjw8-5476 | Critical | 1.9% | 06 Apr, 2021 | npm systeminformation |
Apple iOS, iPadOS, and macOS WebKit Remote Code Execution Vulnerability CVE-2021-1871 | CriticalExploited | 7.0% | 02 Apr, 2021 | |
Apple iOS, iPadOS, and macOS WebKit Remote Code Execution Vulnerability CVE-2021-1870 | CriticalExploited | 7.7% | 02 Apr, 2021 | |
F5 BIG-IP Traffic Management Microkernel Buffer Overflow CVE-2021-22991 | CriticalExploited | 62.4% | 31 Mar, 2021 | |
F5 BIG-IP and BIG-IQ Centralized Management iControl REST Remote Code Execution Vulnerability CVE-2021-22986 | CriticalExploited | 99.9% | 31 Mar, 2021 | |
Misuse of `Reference` and other transferable APIs may lead to access to nodejs isolate CVE-2021-21413, GHSA-mmhj-4w6j-76h7 | Critical | 0.7% | 30 Mar, 2021 | npm isolated-vm |
Remote code execution in mongo-express CVE-2020-24391, GHSA-hxmg-hm46-cf62 | Critical | 74.5% | 30 Mar, 2021 | npm mongodb-query-parser |
netmask npm package mishandles octal input data CVE-2021-28918, CVE-2021-29418, GHSA-4c7m-wxvm-r7gc, GHSA-pch5-whg9-qr2r | Critical | 15.0% | 29 Mar, 2021 | npm netmask |
Arbitrary Code Execution in underscore CVE-2021-23358, GHSA-cf4h-3jhx-xvhq | Critical | 4.2% | 29 Mar, 2021 | npm underscore |
Improper Neutralization of Argument Delimiters in a Decompiling Package Process in APKLeaks CVE-2021-21386, GHSA-8434-v7xw-8m9x, PYSEC-2026-281 | Critical | 2.3% | 24 Mar, 2021 | PyPI APKLeaks PyPI apkleaks |
Prototype Pollution in copy-props CVE-2020-28503, GHSA-897m-rjf5-jp39 | Critical | 1.7% | 23 Mar, 2021 | npm copy-props |
Resource Exhaustion Denial of Service in http-proxy-agent CVE-2019-10196, GHSA-86wf-436m-h424 | Critical | 1.4% | 19 Mar, 2021 | npm http-proxy-agent |
Out of bounds write in Pillow BIT-pillow-2021-25289, CVE-2021-25289, GHSA-57h3-9rgr-c24m, PYSEC-2021-35 | Critical | 2.3% | 19 Mar, 2021 | PyPI pillow |
Command injection in eslint-fixer CVE-2021-26275, GHSA-45w5-pvr8-4rh5 | Critical | 3.0% | 19 Mar, 2021 | npm eslint-fixer |
SQL injection in vhs (aka VHS: Fluid ViewHelpers) CVE-2021-28381, GHSA-wq4r-8342-jmc9 | Critical | 1.1% | 16 Mar, 2021 | Packagist fluidtypo3/vhs |
Prototype pollution vulnerability in 'patchmerge' CVE-2021-25916, GHSA-84g3-cv89-m9gm | Critical | 3.5% | 16 Mar, 2021 | npm patchmerge |
ShopXO RCE Vulnerability CVE-2021-27817, GHSA-xx77-w6p5-xvmj | Critical | 3.2% | 15 Mar, 2021 | Packagist shopxo/shopxo |
Code injection in kill-process-by-name CVE-2021-23356, GHSA-qc65-cgvr-93p6 | Critical | 1.1% | 15 Mar, 2021 | npm kill-process-by-name |
Command Injection in ps-kill CVE-2021-23355, GHSA-7qmm-q394-fmch | Critical | 1.2% | 15 Mar, 2021 | npm ps-kill |
Code injection in nobelprizeparser GHSA-4wv4-mgfq-598v | Critical | Not scored | 12 Mar, 2021 | npm nobelprizeparser |
Madge vulnerable to command injection CVE-2021-23352, GHSA-753c-phhg-cj29, SNYK-JS-MADGE-1082875 | Critical | 2.1% | 09 Mar, 2021 | npm madge |
Changeset vulnerable to prototype pollution CVE-2021-25915, GHSA-2gqw-q9r9-7f79 | Critical | 3.5% | 09 Mar, 2021 | npm changeset |
xmlhttprequest and xmlhttprequest-ssl vulnerable to Arbitrary Code Injection CVE-2020-28502, GHSA-h4j5-c7cj-74xg | Critical | 4.6% | 05 Mar, 2021 | npm xmlhttprequest npm xmlhttprequest-ssl |
Command injection in fs-path CVE-2020-8298, GHSA-8mrf-64fw-2x75 | Critical | 11.2% | 04 Mar, 2021 | npm fs-path |
total.js Remote Code Execution Vulnerability CVE-2021-23344, GHSA-3wj8-vp9h-rm6m, SNYK-JS-TOTALJS-1077069 | Critical | 4.9% | 04 Mar, 2021 | npm total.js |
qcubed PHP object injection CVE-2020-24914, GHSA-7w3c-jgh7-cwjw | Critical | 5.0% | 04 Mar, 2021 | Packagist qcubed/qcubed |
qcubed SQL injection vulnerability in profile.php via the strQuery parameter CVE-2020-24913, GHSA-8fj6-pc5r-347q | Critical | 40.9% | 04 Mar, 2021 | Packagist qcubed/qcubed |
Rockwell Multiple Products Insufficient Protected Credentials Vulnerability CVE-2021-22681 | CriticalExploited | 63.6% | 03 Mar, 2021 | |
Remote code execution via the `pretty` option. CVE-2021-21353, GHSA-p493-635q-r6gr | Critical | 4.3% | 03 Mar, 2021 | npm pug npm pug-code-gen |
Microsoft Exchange Server Remote Code Execution Vulnerability CVE-2021-26855 | CriticalExploited | 100.0% | 03 Mar, 2021 | |
Prefix escape CVE-2021-21322, GHSA-c4qr-gmr9-v23w | Critical | 1.6% | 02 Mar, 2021 | npm fastify-http-proxy |