Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Prototype Pollution in ini-parser CVE-2020-7617, GHSA-96r7-mrqf-jhcc | Critical | 0.9% | 02 Apr, 2020 | npm ini-parser |
Moodle Oauth 2 Insufficiently Protects Against Compromise CVE-2019-14880, GHSA-rv62-6f56-j83w | Critical | 1.1% | 31 Mar, 2020 | Packagist moodle/moodle |
Deserialization of Untrusted Data in bson CVE-2020-7610, GHSA-v8w9-2789-6hhr, SNYK-JS-BSON-561052 | Critical | 2.3% | 30 Mar, 2020 | npm bson |
Improper Input Validation in PyYAML CVE-2020-1747, GHSA-6757-jp84-gxfx, PYSEC-2020-96 | Critical | 5.4% | 24 Mar, 2020 | PyPI pyyaml |
Grandstream Networks UCM6200 Series SQL Injection Vulnerability CVE-2020-5722 | CriticalExploited | 84.3% | 23 Mar, 2020 | |
eZ Publish Kernel and Legacy Unrestricted Upload of File with Dangerous Type CVE-2020-10806, GHSA-54p5-gxq6-j98g | Critical | 2.3% | 22 Mar, 2020 | Packagist ezsystems/ezpublish-kernel Packagist ezsystems/ezpublish-legacy |
SVGlib Vulnerable to XXE Attacks CVE-2020-10799, GHSA-3vcg-8p79-jpcv, PYSEC-2020-111 | Critical | 1.5% | 20 Mar, 2020 | PyPI svglib |
Code injection in blamer CVE-2020-8137, GHSA-7vm7-j8p7-h346 | Critical | 4.3% | 20 Mar, 2020 | npm blamer |
Server-Side Request Forgery in @uppy/companion CVE-2020-8135, GHSA-mm7r-265w-jv6f | Critical | 1.3% | 20 Mar, 2020 | npm @uppy/companion |
Liferay Portal Deserialization of Untrusted Data Vulnerability CVE-2020-7961 | CriticalExploited | 99.9% | 20 Mar, 2020 | |
GitHub personal access token leaking into temporary EasyBuild (debug) logs CVE-2020-5262, GHSA-2wx6-wc87-rmjm, PYSEC-2020-268, PYSEC-2020-41 | Critical | 0.5% | 19 Mar, 2020 | PyPI easybuild PyPI easybuild-framework |
Trend Micro Apex One and OfficeScan Authentication Bypass Vulnerability CVE-2020-8599 | CriticalExploited | 11.9% | 18 Mar, 2020 | |
Dolibarr Cross-site Scripting via the qty parameter in product/fournisseurs.php CVE-2019-19212, GHSA-pm57-926c-28mr | Critical | 3.9% | 16 Mar, 2020 | Packagist dolibarr/dolibarr |
Unraid Remote Code Execution Vulnerability CVE-2020-5847 | CriticalExploited | 95.8% | 16 Mar, 2020 | |
Code injection in codiad CVE-2019-19208, GHSA-v92m-hhhw-vv9v | Critical | 19.2% | 16 Mar, 2020 | Packagist codiad/codiad |
OS Command Injection in gulkp-styledocco CVE-2020-7607, GHSA-h33p-5j96-w8qh, SNYK-JS-GULPSTYLEDOCCO-560126 | Critical | 2.6% | 15 Mar, 2020 | npm gulp-styledocco |
OS Command Injection in docker-compose-remote-api CVE-2020-7606, GHSA-q6pj-jh94-5fpr | Critical | 2.7% | 15 Mar, 2020 | npm docker-compose-remote-api |
OS Command Injection in gulp-tape CVE-2020-7605, GHSA-x67x-98x7-wv26, SNYK-JS-GULPTAPE-560124 | Critical | 2.6% | 15 Mar, 2020 | npm gulp-tape |
OS Command Injection in pulverizr CVE-2020-7604, GHSA-fmf5-j5j9-99pp | Critical | 2.6% | 15 Mar, 2020 | npm pulverizr |
OS Command Injection in closure-compiler-stream CVE-2020-7603, GHSA-m647-5wf9-3jp3 | Critical | 2.6% | 15 Mar, 2020 | npm closure-compiler-stream |
OS Command Injection in node-prompt-here CVE-2020-7602, GHSA-f8fh-8rgm-227h, SNYK-JS-NODEPROMPTHERE-560115 | Critical | 2.7% | 15 Mar, 2020 | npm node-prompt-here |
OS Command Injection in gulp-scss-lint CVE-2020-7601, GHSA-g4hj-r7r3-9rwv, SNYK-JS-GULPSCSSLINT-560114 | Critical | 2.7% | 15 Mar, 2020 | npm gulp-scss-lint |
Django Rest Framework jwt allows obtaining new token from notionally invalidated token CVE-2020-10594, GHSA-fpjm-rp2g-3r4c, PYSEC-2020-40 | Critical | 1.6% | 15 Mar, 2020 | PyPI drf-jwt |
Potential buffer overflow in psd-tools CVE-2020-10571, GHSA-22jr-vc7j-g762, PYSEC-2020-91 | Critical | 1.8% | 14 Mar, 2020 | PyPI psd-tools |
Microsoft SMBv3 Remote Code Execution Vulnerability CVE-2020-0796 | CriticalExploited | 99.8% | 12 Mar, 2020 | |
Improper Input Validation in Twisted CVE-2020-10108, GHSA-h96w-mmrf-2h6v, PYSEC-2020-259 | Critical | 4.0% | 12 Mar, 2020 | PyPI Twisted PyPI twisted |
HTTP Request Smuggling in Twisted CVE-2020-10109, GHSA-p5xh-vx83-mxcj, PYSEC-2020-260 | Critical | 3.3% | 12 Mar, 2020 | PyPI Twisted PyPI twisted |
Improper Neutralization of Special Elements used in an OS Command in Blamer CVE-2019-10807, GHSA-8cxp-cjm8-fj36, SNYK-JS-BLAMER-559541 | Critical | 2.4% | 11 Mar, 2020 | npm blamer |
Sumavision EMR Cross-Site Request Forgery (CSRF) Vulnerability CVE-2020-10181 | CriticalExploited | 14.9% | 11 Mar, 2020 | |
Fat-Free Framework arbitrary code execution CVE-2020-5203, GHSA-hpj2-4hfj-g233 | Critical | 2.1% | 11 Mar, 2020 | Packagist bcosca/fatfree |
SAP Solution Manager Missing Authentication for Critical Function Vulnerability CVE-2020-6207 | CriticalExploited | 98.1% | 10 Mar, 2020 | |
Zoho ManageEngine Desktop Central File Upload Vulnerability CVE-2020-10189 | CriticalExploited | 99.9% | 06 Mar, 2020 | |
Zyxel Multiple NAS Devices OS Command Injection Vulnerability CVE-2020-9054 | CriticalExploited | 100.0% | 04 Mar, 2020 | |
SEOmatic for CraftCMS allows Server-Side Template Injection CVE-2020-9757, GHSA-6q4j-8pjm-5mgc | Critical | 72.8% | 04 Mar, 2020 | Packagist nystudio107/craft-seomatic |
OS Command Injection in serial-number CVE-2019-10804, GHSA-3fw4-4h3m-892h, SNYK-JS-SERIALNUMBER-559010 | Critical | 2.8% | 28 Feb, 2020 | npm serial-number |
push-dir Enables OS Command Injection CVE-2019-10803, GHSA-926x-m6m5-3mmp, SNYK-JS-PUSHDIR-559009 | Critical | 2.8% | 28 Feb, 2020 | npm push-dir |
OS Command Injection in giting CVE-2019-10802, GHSA-53xj-v576-3ch2 | Critical | 2.5% | 28 Feb, 2020 | npm giting |
OS Command Injection in enpeem CVE-2019-10801, GHSA-hmw2-mvvh-jf5j, SNYK-JS-ENPEEM-559007 | Critical | 2.8% | 28 Feb, 2020 | npm enpeem |
Improper Input Validation and Code Injection in pdf-image CVE-2020-8132, GHSA-rv7p-mmwq-x674 | Critical | 2.0% | 28 Feb, 2020 | npm pdf-image |
OS Command Injection and Command Injection in kill-port-process CVE-2019-15609, GHSA-xp4x-j9vh-c3wf | Critical | 4.0% | 28 Feb, 2020 | npm kill-port-process |
Apache Tomcat Improper Privilege Management Vulnerability CVE-2020-1938 | CriticalExploited | 99.3% | 24 Feb, 2020 | |
OS Command Injection in rpi CVE-2019-10796, GHSA-vf26-7gjf-f92r | Critical | 2.8% | 24 Feb, 2020 | npm rpi |
Ansible Remote Code Execution CVE-2014-4657, GHSA-qg47-5px9-32g7, PYSEC-2020-199 | Critical | 4.4% | 20 Feb, 2020 | PyPI ansible |
Ansible Code Injection Vulnerability CVE-2014-4678, GHSA-66c7-5pwv-mm3j, PYSEC-2020-203 | Critical | 5.2% | 20 Feb, 2020 | PyPI ansible |
Deserialization of Untrusted Data in PyYAML CVE-2019-20477, GHSA-3pqx-4fqf-j49f, PYSEC-2020-176 | Critical | 5.1% | 19 Feb, 2020 | PyPI pyyaml |
Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery Vulnerability CVE-2020-7796 | CriticalExploited | 93.6% | 18 Feb, 2020 | |
promise-probe OS command injection vulnerability CVE-2019-10791, GHSA-vmqq-7qvx-68qx | Critical | 2.0% | 18 Feb, 2020 | npm promise-probe |
Ansible Arbitrary Code Execution CVE-2014-4966, GHSA-wqq5-c89p-3wc3, PYSEC-2020-204 | Critical | 3.5% | 18 Feb, 2020 | PyPI ansible |
Ansible Arbitrary Code Execution CVE-2014-4967, GHSA-64cw-m57j-65xj, PYSEC-2020-205 | Critical | 3.5% | 18 Feb, 2020 | PyPI ansible |
Zend Framework SQL injection vulnerability CVE-2014-8089, GHSA-qh9w-r7g5-q939 | Critical | 2.5% | 17 Feb, 2020 | Packagist zendframework/zend-db Packagist zendframework/zendframework Packagist zendframework/zendframework1 |