Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious npm package: sonatype GHSA-w8fh-pvq2-x8c4 | Critical | Not scored | 29 Jan, 2021 | npm sonatype |
Risk of code injection CVE-2021-21278, GHSA-pgjj-866w-fc5c | Critical | 1.6% | 26 Jan, 2021 | npm rsshub |
ONLYOFFICE Docs Server Path Traversal Vulnerability CVE-2021-3199 | CriticalExploited | 30.2% | 26 Jan, 2021 | |
OS Command Injection in async-git CVE-2021-3190, GHSA-6c3f-p5wp-34mh | Critical | 5.4% | 26 Jan, 2021 | npm async-git |
XSS vulnerability leveraged through referrers could allow un-authorized admin access in Mautic CVE-2020-35124, GHSA-39wj-j3jc-858m | Critical | 2.4% | 19 Jan, 2021 | Packagist mautic/core |
Prototype pollution in JointJS CVE-2020-28480, GHSA-qwp9-52h8-xgg8 | Critical | 1.4% | 19 Jan, 2021 | npm jointjs |
Mautic stored Cross-site Scripting (XSS) CVE-2020-35129, GHSA-3px5-wjh3-9x6r | Critical | 1.0% | 19 Jan, 2021 | Packagist mautic/core |
Mautic stored Cross-site Scripting (XSS) CVE-2020-35128, GHSA-98j2-3jv7-274m | Critical | 1.7% | 19 Jan, 2021 | Packagist mautic/core |
Prototype Pollution via file load in aws-sdk and @aws-sdk/shared-ini-file-loader CVE-2020-28472, GHSA-rrc9-gqf8-8rwg | Critical | 2.2% | 19 Jan, 2021 | npm @aws-sdk/shared-ini-file-loader npm aws-sdk |
ThinkAdmin insecure unserialize vulnerability CVE-2020-23653, GHSA-4vp2-mj4m-69m4 | Critical | 4.3% | 13 Jan, 2021 | Packagist zoujingli/thinkadmin |
git-big-picture Code Execution CVE-2021-3028, GHSA-x38j-4rr5-hqrj, PYSEC-2021-15 | Critical | 2.9% | 13 Jan, 2021 | PyPI git-big-picture |
Unauthenticated remote code execution in Ignition CVE-2021-3129, GHSA-4qwp-7c67-jmcc | CriticalExploited | 99.9% | 12 Jan, 2021 | Packagist facade/ignition |
Google Chrome Use-After-Free Vulnerability CVE-2020-16017 | CriticalExploited | 2.7% | 08 Jan, 2021 | |
Command injection in buns CVE-2020-7794, GHSA-487w-pqcm-63hq | Critical | 1.6% | 08 Jan, 2021 | npm buns |
Command injection in ts-process-promises CVE-2020-7784, GHSA-ww4j-c2rq-47q8 | Critical | 1.4% | 08 Jan, 2021 | npm ts-process-promises |
pwntools Server-Side Template Injection (SSTI) vulnerability CVE-2020-28468, GHSA-7xc5-ggpp-g249, PYSEC-2021-72, SNYK-PYTHON-PWNTOOLS-1047345 | Critical | 4.4% | 08 Jan, 2021 | PyPI pwntools |
Arbitrary code execution in clickhouse-driver BIT-clickhouse-2020-26759, CVE-2020-26759, GHSA-vgv5-cxvh-vfxh, PYSEC-2021-61 | Critical | 2.7% | 06 Jan, 2021 | PyPI clickhouse-driver |
Prototype Pollution in asciitable.js CVE-2020-7771, GHSA-5pxj-mhwj-x5gv, SNYK-JS-ASCIITABLEJS-1039799 | Critical | 2.0% | 04 Jan, 2021 | npm asciitable.js |
Arbitrary code execution in djv CVE-2020-28464, GHSA-4hv7-3q38-97m8 | Critical | 3.0% | 04 Jan, 2021 | npm djv |
Remote code execution in zendframework and laminas-http CVE-2021-3007, GHSA-xx8f-qf9f-5fgw | Critical | 75.3% | 04 Jan, 2021 | Packagist laminas/laminas-http Packagist zendframework/zendframework |
SQL Injection in NukeViet CVE-2019-7726, GHSA-q4qv-fmwc-qxpx | Critical | 2.3% | 31 Dec, 2020 | Packagist nukeviet/nukeviet |
Deserialization of Untrusted Data in NukeViet CVE-2019-7725, GHSA-32wr-8wxm-852c | Critical | 2.6% | 31 Dec, 2020 | Packagist nukeviet/nukeviet |
SolarWinds Orion Authentication Bypass Vulnerability CVE-2020-10148 | CriticalExploited | 92.0% | 29 Dec, 2020 | |
Prototype pollution vulnerability in 'libnested' CVE-2020-28283, GHSA-3r9x-mjrm-2725 | Critical | 3.4% | 29 Dec, 2020 | npm libnested |
Prototype pollution in getobject CVE-2020-28282, GHSA-957j-59c2-j692 | Critical | 4.2% | 29 Dec, 2020 | npm getobject |
Prototype pollution in set-object-value CVE-2020-28281, GHSA-4jj4-m52p-8rx3 | Critical | 3.7% | 29 Dec, 2020 | npm set-object-value |
Prototype pollution vulnerability in 'predefine' CVE-2020-28280, GHSA-mx3x-ghqm-r43h | Critical | 3.1% | 29 Dec, 2020 | npm predefine |
flattenizer vulnerable to prototype pollution CVE-2020-28279, GHSA-vq33-26pr-r4h6 | Critical | 3.1% | 29 Dec, 2020 | npm flattenizer |
shvl vulnerable to prototype pollution CVE-2020-28278, GHSA-pqwc-3vhw-qcvq | Critical | 3.1% | 29 Dec, 2020 | npm shvl |
dset vulnerable to prototype pollution CVE-2020-28277, GHSA-q4xc-7cw8-cgfj | Critical | 3.1% | 29 Dec, 2020 | npm dset |
Prototype pollution vulnerability in 'deep-set' CVE-2020-28276, GHSA-wgxm-rg53-h2c6 | Critical | 3.1% | 29 Dec, 2020 | npm deep-set |
Zyxel Multiple Products Use of Hard-Coded Credentials Vulnerability CVE-2020-29583 | CriticalExploited | 90.2% | 22 Dec, 2020 | |
Prototype Pollution in multi-ini CVE-2020-28448, GHSA-g78f-549w-c354 | Critical | 1.5% | 22 Dec, 2020 | npm multi-ini |
jsonpickle unsafe deserialization CVE-2020-22083, GHSA-j66q-qmrc-89rx, PYSEC-2020-49 | Critical | 6.5% | 17 Dec, 2020 | PyPI jsonpickle |
Command injection in connection-tester CVE-2020-7781, GHSA-w5mp-8p8w-mhh8, SNYK-JS-CONNECTIONTESTER-1048337 | Critical | 2.0% | 16 Dec, 2020 | npm connection-tester |
Prototype Pollution in js-data CVE-2020-28442, GHSA-mqgv-67vx-g4m5 | Critical | 2.0% | 15 Dec, 2020 | npm js-data |
CyberoamOS (CROS) SQL Injection Vulnerability CVE-2020-29574 | CriticalExploited | 4.7% | 11 Dec, 2020 | |
Command Injection in corenlp-js-interface CVE-2020-28440, GHSA-ffxg-xm4w-3wg9 | Critical | 2.0% | 11 Dec, 2020 | npm corenlp-js-interface |
Command injection in corenlp-js-prefab CVE-2020-28439, GHSA-h73g-8g27-xxcx | Critical | 1.6% | 11 Dec, 2020 | npm corenlp-js-prefab |
Apache Struts Remote Code Execution Vulnerability CVE-2020-17530 | CriticalExploited | 96.3% | 11 Dec, 2020 | |
ini before 1.3.6 vulnerable to Prototype Pollution via ini.parse CVE-2020-7788, GHSA-qqgx-2p2h-9c37, SNYK-JS-INI-1048974 | Critical | 3.7% | 10 Dec, 2020 | npm ini |
Prototype pollution vulnerability in 'deepref' CVE-2020-28274, GHSA-7c7g-72q7-4xhm | Critical | 2.3% | 08 Dec, 2020 | npm deepref |
Kirby Panel users could upload PHP Phar archives as content files before v2.5.14 and v3.4.5 CVE-2020-26255, GHSA-g3h8-cg9x-47qw | Critical | 1.5% | 08 Dec, 2020 | Packagist getkirby/cms Packagist getkirby/panel |
Prototype pollution in set-in CVE-2020-28273, GHSA-qr4p-c9wr-phr6 | Critical | 4.0% | 02 Dec, 2020 | npm set-in |
keyget vulnerable to prototype pollution CVE-2020-28272, GHSA-8mp8-28xh-r486 | Critical | 3.4% | 02 Dec, 2020 | npm keyget |
Prototype Pollution in systeminformation CVE-2020-26245, GHSA-4v2w-h9jm-mqjg | Critical | 2.2% | 27 Nov, 2020 | npm systeminformation |
XXE in petl CVE-2020-29128, GHSA-69q2-p9xp-739v, GHSA-f5gc-p5m3-v347, PYSEC-2020-75 | Critical | 2.3% | 26 Nov, 2020 | PyPI petl |
Implementation trusts the "me" field returned by the authorization server without verifying it GHSA-mjcr-rqjg-rhg3 | Critical | Not scored | 24 Nov, 2020 | PyPI datasette-indieauth |
Multiple VMware Products Command Injection Vulnerability CVE-2020-4006 | CriticalExploited | 17.3% | 23 Nov, 2020 | |
Server-Side Request Forgery in private-ip CVE-2020-28360, GHSA-43ch-2h55-2vj7 | Critical | 3.1% | 23 Nov, 2020 | npm private-ip |