Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Prefix escape CVE-2021-21321, GHSA-qmw8-3v4g-gwj4 | Critical | 1.8% | 02 Mar, 2021 | npm fastify-reply-from |
Veritas Backup Exec Agent Improper Authentication Vulnerability CVE-2021-27877 | CriticalExploited | 64.9% | 01 Mar, 2021 | |
Prototype Pollution Vulnerability in object-collider CVE-2021-25914, GHSA-85g2-29m8-qf2p | Critical | 3.7% | 01 Mar, 2021 | npm object-collider |
SaltStack Salt Improper Authentication vulnerability CVE-2021-25281, GHSA-xxw3-765m-f37p, PYSEC-2021-50 | Critical | 73.1% | 27 Feb, 2021 | PyPI salt |
SaltStack Salt Directory Traversal vulnerability CVE-2021-25282, GHSA-76x4-x3p6-rpr9, PYSEC-2021-51 | Critical | 92.4% | 27 Feb, 2021 | PyPI salt |
SaltStack Salt Server Side Template Injection CVE-2021-25283, GHSA-xgmh-gfxw-2hvv, PYSEC-2021-52 | Critical | 10.2% | 27 Feb, 2021 | PyPI salt |
SaltStack Salt eauth tokens can be used once after expiration CVE-2021-3144, GHSA-w2hr-3mc8-46gh, PYSEC-2021-54 | Critical | 5.1% | 27 Feb, 2021 | PyPI salt |
SaltStack Salt command injection in the Salt-API when using the Salt-SSH client CVE-2021-3148, GHSA-ghc2-hx3w-jqmp, PYSEC-2021-55 | Critical | 8.2% | 27 Feb, 2021 | PyPI salt |
SaltStack Salt is vulnerable to shell injection via ProxyCommand argument CVE-2021-3197, GHSA-8rp6-x3r7-5qw3, PYSEC-2021-57 | Critical | 71.7% | 27 Feb, 2021 | PyPI salt |
Remote code execution in vscode-npm-script CVE-2021-26700, GHSA-r84v-qff8-jv5g | Critical | 6.0% | 25 Feb, 2021 | npm vscode-npm-script |
VMware vCenter Server Remote Code Execution Vulnerability CVE-2021-21972 | CriticalExploited | 99.9% | 24 Feb, 2021 | |
Cross-site Scripting (XSS) in Eclipse Theia CVE-2020-27224, GHSA-gcm9-cc3r-c6vj | Critical | 2.6% | 24 Feb, 2021 | npm @theia/preview |
Command Injection in geojson2kml CVE-2020-28429, GHSA-w83x-fp72-p9qc | Critical | 63.3% | 23 Feb, 2021 | npm geojson2kml |
PHP Code Injection by malicious function name in smarty CVE-2021-26120, GHSA-3rpf-5rqv-689q | Critical | 82.3% | 22 Feb, 2021 | Packagist smarty/smarty |
Prototype Pollution in merge CVE-2020-28499, GHSA-7wpw-2hjm-89gp | Critical | 1.4% | 18 Feb, 2021 | npm merge |
Command Injection in async-git CVE-2020-28490, GHSA-6qpr-9mc5-7gch, SNYK-JS-ASYNCGIT-1064877 | Critical | 2.5% | 18 Feb, 2021 | npm async-git |
Accellion FTA OS Command Injection Vulnerability CVE-2021-27104 | CriticalExploited | 56.7% | 16 Feb, 2021 | |
Accellion FTA Server-Side Request Forgery (SSRF) Vulnerability CVE-2021-27103 | CriticalExploited | 11.4% | 16 Feb, 2021 | |
Accellion FTA SQL Injection Vulnerability CVE-2021-27101 | CriticalExploited | 6.0% | 16 Feb, 2021 | |
Magento vulnerable to a file upload restriction bypass BIT-magento-2021-21014, CVE-2021-21014, GHSA-269w-pqc7-68q9 | Critical | 4.2% | 11 Feb, 2021 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento XPath Injection BIT-magento-2021-21025, CVE-2021-21025, GHSA-h437-qjj9-vmq4 | Critical | 3.3% | 11 Feb, 2021 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento Blind SQL Injection in the Search module BIT-magento-2021-21024, CVE-2021-21024, GHSA-rj4f-cp4v-hvcv | Critical | 2.8% | 11 Feb, 2021 | Packagist magento/community-edition |
Magento XML injection in the Widgets module BIT-magento-2021-21019, CVE-2021-21019, GHSA-mw95-gmw4-883p | Critical | 3.6% | 11 Feb, 2021 | Packagist magento/community-edition |
Magento OS Command Injection BIT-magento-2021-21018, CVE-2021-21018, GHSA-rv48-v862-mp92 | Critical | 4.0% | 11 Feb, 2021 | Packagist magento/community-edition |
Magento OS command injection via the WebAPI BIT-magento-2021-21016, CVE-2021-21016, GHSA-792f-c8mp-2cr5 | Critical | 4.9% | 11 Feb, 2021 | Packagist magento/community-edition Packagist magento/project-community-edition |
Command injection in samba-client CVE-2021-27185, GHSA-r3j7-x2g5-9gx6 | Critical | 4.8% | 10 Feb, 2021 | npm samba-client |
File System Bounds Escape CVE-2020-26299, GHSA-pmw4-jgxx-pcq9 | Critical | 1.9% | 10 Feb, 2021 | npm ftp-srv |
Exposure of Sensitive Information to an Unauthorized Actor CVE-2021-32711, GHSA-2p89-5f22-8qvf, GHSA-f2vv-h5x4-57gr | Critical | 1.4% | 10 Feb, 2021 | Packagist shopware/platform |
Mautic is vulnerable to XSS vulnerability CVE-2020-35125, GHSA-42q7-95j7-w62m | Critical | 2.7% | 09 Feb, 2021 | Packagist mautic/core |
Improper Input Validation in PyYAML CVE-2020-14343, GHSA-8q59-q68h-6hv4, PYSEC-2021-142 | Critical | 6.0% | 09 Feb, 2021 | PyPI PyYAML PyPI pyyaml |
Prototype Pollution in set-or-get CVE-2021-25913, GHSA-6rv4-4qv6-88g2 | Critical | 4.2% | 08 Feb, 2021 | npm set-or-get |
Micro Focus Operation Bridge Report (OBR) Remote Code Execution Vulnerability CVE-2021-22502 | CriticalExploited | 96.7% | 08 Feb, 2021 | |
Command Injection in macfromip CVE-2020-7786, GHSA-vh8f-xw5v-8993 | Critical | 2.0% | 08 Feb, 2021 | npm macfromip |
Command injection in node-ps CVE-2020-7785, GHSA-4rv9-5vc4-88cg | Critical | 2.5% | 08 Feb, 2021 | npm node-ps |
Command injection in spritesheet-js CVE-2020-7782, GHSA-333x-qr3v-g4xx | Critical | 2.5% | 08 Feb, 2021 | npm spritesheet-js |
Prototype Pollution in Dynamoose CVE-2021-21304, GHSA-rrqm-p222-8ph2 | Critical | 1.9% | 08 Feb, 2021 | npm dynamoose |
Command injection in gitlog CVE-2021-26541, GHSA-67mm-m3wx-j7fr | Critical | 5.4% | 08 Feb, 2021 | npm gitlog |
PyCA Cryptography symmetrically encrypting large values can lead to integer overflow CVE-2020-36242, GHSA-rhm9-p9w5-fwm7, PYSEC-2021-63 | Critical | 6.7% | 07 Feb, 2021 | PyPI cryptography |
October CMS Session ID not invalidated after logout CVE-2021-3311, GHSA-7ggw-h8pp-r95r | Critical | 2.9% | 05 Feb, 2021 | Packagist october/rain |
SonicWall SSLVPN SMA100 SQL Injection Vulnerability CVE-2021-20016 | CriticalExploited | 40.0% | 04 Feb, 2021 | |
QNAP Helpdesk Improper Access Control Vulnerability CVE-2020-2506 | CriticalExploited | 2.0% | 03 Feb, 2021 | |
Prototype pollution in dotty CVE-2021-25912, GHSA-f5c9-x9j6-87qp | Critical | 3.5% | 02 Feb, 2021 | npm dotty |
Improper neutralization of arguments in freediskspace CVE-2020-7775, GHSA-4gfq-6m28-m5mg | Critical | 1.3% | 02 Feb, 2021 | npm freediskspace |
D-Link DNS-320 Device Command Injection Vulnerability CVE-2020-25506 | CriticalExploited | 100.0% | 02 Feb, 2021 | |
SQL Injection in thinkjs CVE-2020-21176, GHSA-q5mq-6fjg-4mw8 | Critical | 1.5% | 01 Feb, 2021 | npm thinkjs |
Command injection in launchpad CVE-2021-23330, GHSA-7h8x-wmq2-7mff, SNYK-JS-LAUNCHPAD-1044065 | Critical | 5.3% | 01 Feb, 2021 | npm launchpad |
Steam Socialite Provider v1 does not correctly validate openid server GHSA-hhw9-35p2-q2c5 | Critical | Not scored | 29 Jan, 2021 | Packagist socialiteproviders/steam |
D-Link DIR-825 R1 Devices Buffer Overflow Vulnerability CVE-2020-29557 | CriticalExploited | 55.7% | 29 Jan, 2021 | |
Malicious npm package: an0n-chat-lib GHSA-7xcv-wvr7-4h6p | Critical | Not scored | 29 Jan, 2021 | npm an0n-chat-lib |
Malicious npm package: discord-fix GHSA-qv2g-99x4-45x6 | Critical | Not scored | 29 Jan, 2021 | npm discord-fix |