Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Critical severity vulnerability in Ignition CVE-2020-13909, GHSA-m5v7-pr32-mjx2 | Critical | 1.5% | 07 Jun, 2020 | Packagist facade/ignition |
Potential unauthorized access to stored request & session data when plugin is misconfigured in October CMS Debugbar CVE-2020-11094, GHSA-c8wh-6jw4-2h79 | Critical | 1.0% | 03 Jun, 2020 | Packagist rainlab/debugbar-plugin |
Sabberworm PHP CSS Parser Code injection vulnerability in allSelectors() CVE-2020-13756, GHSA-phrq-v4q2-hmq6 | Critical | 49.8% | 03 Jun, 2020 | Packagist sabberworm/php-css-parser |
bbPress unauthenticated privilege-escalation CVE-2020-13693, GHSA-mwxh-6j9v-45ph | Critical | 43.9% | 29 May, 2020 | Packagist bbpress/bbpress |
Command injection in node-dns-sync CVE-2020-11079, GHSA-wh69-wc6q-7888 | Critical | 2.7% | 28 May, 2020 | npm dns-sync |
Exposure of Sensitive Information to an Unauthorized Actor in AEgir CVE-2020-11059, GHSA-qfcv-5whw-7pcw | Critical | 1.1% | 27 May, 2020 | npm aegir |
Knock Knock plugin IP Whitelist bypass via an X-Forwarded-For HTTP header CVE-2020-13485, GHSA-wxvr-qqm7-6h65 | Critical | 1.4% | 25 May, 2020 | Packagist verbb/knock-knock |
OS Command Injection in jw.util CVE-2020-13388, GHSA-h72c-w3q3-55qq, PYSEC-2020-341 | Critical | 4.5% | 22 May, 2020 | PyPI jw-util PyPI jw.util |
Arbitrary shell command execution in logkitty CVE-2020-8149, GHSA-v8v8-6859-qxm4 | Critical | 2.0% | 15 May, 2020 | npm logkitty |
** DISPUTED ** pandas through 1.0.3 can unserialize and execute commands from an untrusted file that is passed to the read_pickle() function, if __reduce__ makes an os.system call. NOTE: third parties dispute this issue because the read_pickle() function is documented as unsafe and it is the user's CVE-2020-13091, PYSEC-2020-73 | Critical | 3.5% | 15 May, 2020 | PyPI pandas |
scikit-learn Deserialization of Untrusted Data CVE-2020-13092, GHSA-jjw5-xxj6-pcv5, PYSEC-2020-107 | Critical | 3.4% | 15 May, 2020 | PyPI scikit-learn |
Maltego incorrectly shares a MISP connection across users in a remote-transform use case CVE-2020-12889, GHSA-fj35-m94r-9h4c, PYSEC-2020-66 | Critical | 1.2% | 15 May, 2020 | PyPI MISP-maltego PyPI misp-maltego |
Class destructors causing side-effects when being unserialized in TYPO3 CMS BIT-typo3-2020-11066, CVE-2020-11066, GHSA-2rxh-h6h9-qrqc | Critical | 1.5% | 13 May, 2020 | Packagist typo3/cms Packagist typo3/cms-core |
False-negative validation results in MINT transactions with invalid baton CVE-2020-11072, GHSA-4w97-57v2-3w44 | Critical | 1.0% | 12 May, 2020 | npm slp-validate |
False-negative validation results in MINT transactions with invalid baton CVE-2020-11071, GHSA-jc83-cpf9-q7c6 | Critical | 0.9% | 12 May, 2020 | npm slpjs |
Potential Code Injection in Sprout Forms CVE-2020-11056, GHSA-px8v-hxxx-2rgh | Critical | 1.0% | 07 May, 2020 | Packagist barrelstrength/sprout-base-email Packagist barrelstrength/sprout-forms |
IBM Data Risk Manager Remote Code Execution Vulnerability CVE-2020-4428 | CriticalExploited | 61.7% | 07 May, 2020 | |
IBM Data Risk Manager Security Bypass Vulnerability CVE-2020-4427 | CriticalExploited | 70.0% | 07 May, 2020 | |
curlrequest allows execution of arbitrary commands CVE-2020-7646, GHSA-m8xj-5v73-3hh8, SNYK-JS-CURLREQUEST-568274 | Critical | 1.9% | 07 May, 2020 | npm curlrequest |
Roundcube Webmail Remote Code Execution Vulnerability CVE-2020-12641 | CriticalExploited | 84.4% | 04 May, 2020 | |
Juniper Junos OS Path Traversal Vulnerability CVE-2020-1631 | CriticalExploited | 4.9% | 04 May, 2020 | |
chrome-launcher subject to OS Command Injection CVE-2020-7645, GHSA-gp2j-mg4w-2rh5, SNYK-JS-CHROMELAUNCHER-537575 | Critical | 1.0% | 02 May, 2020 | npm chrome-launcher |
SaltStack Salt Unauthenticated Remote Code Execution CVE-2020-11651, GHSA-pjhf-vpx3-33r3, PYSEC-2020-102 | CriticalExploited | 96.6% | 30 Apr, 2020 | PyPI salt |
OS Command Injection in pixl-class CVE-2020-7640, GHSA-vm5j-vqr6-v7v8, SNYK-JS-PIXLCLASS-564968 | Critical | 2.1% | 27 Apr, 2020 | npm pixl-class |
Code Injection in node-rules CVE-2020-7609, GHSA-f78f-353m-cf4j, SNYK-JS-NODERULES-560426 | Critical | 1.6% | 27 Apr, 2020 | npm node-rules |
Sophos SFOS SQL Injection Vulnerability CVE-2020-12271 | CriticalExploited | 42.4% | 27 Apr, 2020 | |
Path Traversal in decompress CVE-2020-12265, GHSA-qgfr-5hqp-vrw9 | Critical | 2.1% | 26 Apr, 2020 | npm decompress |
Cisco IP Phones Web Server Remote Code Execution and Denial-of-Service Vulnerability CVE-2020-3161 | CriticalExploited | 83.9% | 15 Apr, 2020 | |
Incorrect Calculation in the MSR JavaScript Cryptography Library CVE-2020-1026, GHSA-9x9j-836w-8f55 | Critical | 2.6% | 15 Apr, 2020 | npm msrcrypto |
Oracle WebLogic Server Unspecified Vulnerability CVE-2020-2883 | CriticalExploited | 94.6% | 15 Apr, 2020 | |
VMware vCenter Server Information Disclosure Vulnerability CVE-2020-3952 | CriticalExploited | 90.4% | 10 Apr, 2020 | |
Command Injection in npm-programmatic CVE-2020-7614, GHSA-426h-24vj-qwxf | Critical | 3.6% | 07 Apr, 2020 | npm npm-programmatic |
OS Command Injection in adb-driver CVE-2020-7636, GHSA-4m6q-rxhm-675w | Critical | 4.4% | 06 Apr, 2020 | npm adb-driver |
Command Injection in compass-compile CVE-2020-7635, GHSA-7q9f-x6rm-qmxr | Critical | 4.4% | 06 Apr, 2020 | npm compass-compile |
OS Command Injection in heroku-addonpool CVE-2020-7634, GHSA-3q9x-w53p-jg53 | Critical | 2.8% | 06 Apr, 2020 | npm heroku-addonpool |
apiconnect-cli-plugins vulnerable to OS Command Injection CVE-2020-7633, GHSA-c9m9-48pw-6mpv | Critical | 4.4% | 06 Apr, 2020 | npm apiconnect-cli-plugins |
OS Command Injection in node-mpv CVE-2020-7632, GHSA-cqr2-xhg6-p268 | Critical | 4.4% | 06 Apr, 2020 | npm node-mpv |
OS Command Injection in diskusage-ng CVE-2020-7631, GHSA-3269-x4pw-vffg | Critical | 3.9% | 06 Apr, 2020 | npm diskusage-ng |
Prototype Pollution CVE-2020-8147, GHSA-6pq3-928q-x6w6 | Critical | 3.1% | 03 Apr, 2020 | npm utils-extend |
OS Command Injection in git-add-remote CVE-2020-7630, GHSA-h9v8-rm3m-5h5f, SNYK-JS-GITADDREMOTE-564269 | Critical | 4.2% | 02 Apr, 2020 | npm git-add-remote |
OS Command Injection in install-package CVE-2020-7629, GHSA-6m4r-m3gc-h4r5, SNYK-JS-INSTALLPACKAGE-564267 | Critical | 4.2% | 02 Apr, 2020 | npm install-package |
Command Injection in umount CVE-2020-7628, GHSA-6q48-vjq2-mwcj | Critical | 1.8% | 02 Apr, 2020 | npm umount |
OS Command Injection in node-key-sender CVE-2020-7627, GHSA-4xrw-wvmq-8jmh | Critical | 4.2% | 02 Apr, 2020 | npm node-key-sender |
karma-mojo enables OS Command Injection CVE-2020-7626, GHSA-pf8j-vhg8-xmc3 | Critical | 4.3% | 02 Apr, 2020 | npm karma-mojo |
Injection in op-browser CVE-2020-7625, GHSA-3hq6-rmv7-39vh | Critical | 4.2% | 02 Apr, 2020 | npm op-browser |
Withdrawn Advisory: OS Command Injection in effect CVE-2020-7624, GHSA-6hr9-4692-fch9 | Critical | 4.2% | 02 Apr, 2020 | npm effect |
OS Command Injection in jscover CVE-2020-7623, GHSA-c5hm-xc74-pqrg, SNYK-JS-JSCOVER-564250 | Critical | 3.6% | 02 Apr, 2020 | npm jscover |
OS Command Injection in strong-nginx-controller CVE-2020-7621, GHSA-4v9w-pvwr-38h3, SNYK-JS-STRONGNGINXCONTROLLER-564248 | Critical | 3.0% | 02 Apr, 2020 | npm strong-nginx-controller |
OS Command Injection in pomelo-monitor CVE-2020-7620, GHSA-4j54-mxf6-wxx2 | Critical | 2.2% | 02 Apr, 2020 | npm pomelo-monitor |
Command injection in get-git-data CVE-2020-7619, GHSA-wj6h-7chw-x4h2 | Critical | 2.2% | 02 Apr, 2020 | npm get-git-data |