Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Code Injection in script-manager CVE-2020-8129, GHSA-rhwf-hqpr-q8g2 | Critical | 2.9% | 14 Feb, 2020 | npm script-manager |
Server-Side Request Forgery and Inclusion of Functionality from Untrusted Control Sphere in jsreport CVE-2020-8128, GHSA-5fjj-cfh2-ghc5 | Critical | 2.7% | 14 Feb, 2020 | npm jsreport |
Potential Command Injection in libnotify CVE-2013-7381, GHSA-6898-wx94-8jq8 | Critical | 2.7% | 12 Feb, 2020 | npm libnotify |
Potential Command Injection in hubot-scripts CVE-2013-7378, GHSA-hwch-749c-rv63 | Critical | 2.7% | 12 Feb, 2020 | npm hubot-scripts |
JGit Improper Input Validation vulnerability CVE-2014-9390, GHSA-6vvc-c2m3-cjf3, PYSEC-2020-217 | Critical | 75.6% | 12 Feb, 2020 | Maven org.eclipse.jgit:org.eclipse.jgit PyPI mercurial |
jQuery File Upload Plugin Unrestricted file upload vulnerability CVE-2014-8739, GHSA-wxg6-f773-g2f7 | Critical | 91.9% | 08 Feb, 2020 | Packagist blueimp/jquery-file-upload |
EyesOfNetwork Use of Hard-Coded Credentials Vulnerability CVE-2020-8657 | CriticalExploited | 91.9% | 06 Feb, 2020 | |
OS Command Injection in curling CVE-2019-10789, GHSA-xmxh-g7wj-8m4m | Critical | 4.9% | 06 Feb, 2020 | npm curling |
PlaySMS Server-Side Template Injection Vulnerability CVE-2020-8644 | CriticalExploited | 86.7% | 05 Feb, 2020 | |
Incorrect threshold signature computation in TUF CVE-2020-6174, GHSA-pwqf-9h7j-7mv8, PYSEC-2020-147 | Critical | 1.0% | 05 Feb, 2020 | PyPI tuf |
OS Command Injection in im-metadata CVE-2019-10788, GHSA-qfxv-qqvg-24pg, SNYK-JS-IMMETADATA-544184 | Critical | 2.4% | 04 Feb, 2020 | npm im-metadata |
OS Command Injection in im-resize CVE-2019-10787, GHSA-r9vm-rhmf-7hxx, SNYK-JS-IMRESIZE-544183 | Critical | 3.8% | 04 Feb, 2020 | npm im-resize |
Improper Input Validation in network-manager CVE-2019-10786, GHSA-ph32-23p8-9rw5 | Critical | 2.1% | 04 Feb, 2020 | npm network-manager |
Improper Input Validation in klona CVE-2020-8125, GHSA-8f89-2fwj-5v5r | Critical | 4.1% | 04 Feb, 2020 | npm klona |
SQL injection in Django BIT-django-2020-7471, CVE-2020-7471, GHSA-hmr4-m2h5-33qx, PYSEC-2020-35 | Critical | 65.6% | 03 Feb, 2020 | PyPI Django PyPI django |
Multiple DrayTek Vigor Routers Web Management Page Vulnerability CVE-2020-8515 | CriticalExploited | 100.0% | 01 Feb, 2020 | |
OS Command Injection in lsof CVE-2019-10783, GHSA-whq6-mj2r-mjqc | Critical | 2.6% | 29 Jan, 2020 | npm lsof |
Magento security bypass vulnerability BIT-magento-2020-3718, CVE-2020-3718, GHSA-x9p7-vgp2-9pq2 | Critical | 7.5% | 29 Jan, 2020 | Packagist magento/community-edition Packagist magneto/core |
Magento deserialization vulnerability BIT-magento-2020-3716, CVE-2020-3716, GHSA-9wc9-498w-h8xv | Critical | 14.0% | 29 Jan, 2020 | Packagist magento/community-edition |
OpenSMTPD Remote Code Execution Vulnerability CVE-2020-7247 | CriticalExploited | 99.0% | 29 Jan, 2020 | |
Dolibarr Improper Restriction of Excessive Authentication Attempts BIT-dolibarr-2020-7995, CVE-2020-7995, GHSA-m5c3-3gvf-q8j5 | Critical | 4.5% | 26 Jan, 2020 | Packagist dolibarr/dolibarr |
Jasig Java CAS Client, .NET CAS Client, and phpCAS contain URL parameter injection vulnerability CVE-2014-4172, GHSA-9fc5-q25c-r2wr | Critical | 6.1% | 24 Jan, 2020 | Maven org.jasig.cas:cas-client NuGet DotNetCasClient Packagist jasig/phpcas |
Plone Unauthenticated Write Vulnerability CVE-2020-7941, GHSA-w6g9-xccc-347h, PYSEC-2020-90, PYSEC-2026-459 | Critical | 2.3% | 23 Jan, 2020 | PyPI Plone PyPI plone PyPI plone-app-contenttypes PyPI plone.app.contenttypes |
Validation Bypass in schema-inspector CVE-2019-10781, GHSA-r24h-634p-m72x, SNYK-JS-SCHEMAINSPECTOR-536970 | Critical | 1.4% | 22 Jan, 2020 | npm schema-inspector |
ImpressPages CMS RCE CVE-2011-4943, GHSA-4xf9-4r44-86rc | Critical | 1.8% | 22 Jan, 2020 | Packagist impresspages/impresspages |
SaltStack Salt is vulnerable to command injection CVE-2019-17361, GHSA-q53j-p6r2-g2v4, PYSEC-2020-177 | Critical | 15.2% | 17 Jan, 2020 | PyPI salt |
Oracle Multiple Products Remote Code Execution Vulnerability CVE-2020-2555 | CriticalExploited | 97.1% | 15 Jan, 2020 | |
Oracle Fusion Middleware Unspecified Vulnerability CVE-2020-2551 | CriticalExploited | 92.8% | 15 Jan, 2020 | |
Microsoft .NET Framework Remote Code Execution Vulnerability CVE-2020-0646 | CriticalExploited | 99.2% | 14 Jan, 2020 | |
Drupal SQL Injection vulnerability CVE-2011-2715, GHSA-hcq9-hmgf-6qr9 | Critical | 1.1% | 14 Jan, 2020 | Packagist drupal/core |
Privilege Escalation in cordova-plugin-inappbrowser CVE-2019-0219, GHSA-c6pw-q7f2-97hv | Critical | 7.8% | 14 Jan, 2020 | npm cordova-plugin-inappbrowser |
HashBrown CMS RCE CVE-2020-6948, GHSA-4gjv-5jjp-rcgh | Critical | 2.8% | 13 Jan, 2020 | npm hashbrown-cms |
Command Injection in hot-formula-parser CVE-2020-6836, GHSA-rc77-xxq6-4mff | Critical | 2.1% | 11 Jan, 2020 | npm hot-formula-parser |
OS command injection in aws-lambda CVE-2019-10777, GHSA-934x-72xh-5hrg | Critical | 1.6% | 08 Jan, 2020 | npm aws-lambda |
OS Command Injection in devcert-sanscache CVE-2019-10778, GHSA-4gp3-p7ph-x2jr | Critical | 3.5% | 08 Jan, 2020 | npm devcert-sanscache |
OS command injection in git-diff-apply CVE-2019-10776, GHSA-84cm-v6jp-gjmr | Critical | 2.1% | 07 Jan, 2020 | npm git-diff-apply |
Integer overflow in Pillow BIT-pillow-2020-5310, CVE-2020-5310, GHSA-vcqg-3p29-xw73, PYSEC-2020-81 | Critical | 2.0% | 03 Jan, 2020 | PyPI pillow |
Buffer Copy without Checking Size of Input in Pillow BIT-pillow-2020-5311, CVE-2020-5311, GHSA-r7rm-8j6h-r933, PYSEC-2020-82 | Critical | 4.2% | 03 Jan, 2020 | PyPI pillow |
PCX P mode buffer overflow in Pillow BIT-pillow-2020-5312, CVE-2020-5312, GHSA-p49h-hjvm-jg3h, PYSEC-2020-83 | Critical | 3.7% | 03 Jan, 2020 | PyPI Pillow PyPI pillow |
Improper Verification of Cryptographic Signature in Pure-Python ECDSA CVE-2019-14859, GHSA-8qxj-f9rh-9fg2, PYSEC-2020-163 | Critical | 1.5% | 02 Jan, 2020 | PyPI ecdsa |
D-Link DIR-859 Router Command Execution Vulnerability CVE-2019-17621 | CriticalExploited | 90.6% | 30 Dec, 2019 | |
php-shellcommand command injection vulnerability CVE-2019-10774, GHSA-c7fv-wv9f-cgjw, SNYK-PHP-MIKEHAERTLPHPSHELLCOMMAND-538426 | Critical | 4.6% | 30 Dec, 2019 | Packagist mikehaertl/php-shellcommand |
Citrix ADC, Gateway, and SD-WAN WANOP Appliance Code Execution Vulnerability CVE-2019-19781 | CriticalExploited | 100.0% | 27 Dec, 2019 | |
Remote Code Execution Vulnerability in NPM mongo-express CVE-2019-10758, GHSA-h47j-hc6x-h3qq, SNYK-JS-MONGOEXPRESS-473215 | CriticalExploited | 84.7% | 24 Dec, 2019 | npm mongo-express |
Prototype Pollution in handlebars CVE-2019-19919, GHSA-w457-6q6x-cgp9 | Critical | 7.1% | 20 Dec, 2019 | RubyGems bootstrap-wysihtml5-rails npm handlebars |
Duplicate Advisory: Inconsistent Interpretation of HTTP Requests in Waitress CVE-2019-16792, GHSA-4ppp-gpcr-7qf6, GHSA-j7j6-7hfx-5522, PYSEC-2020-178 | Critical | 2.0% | 20 Dec, 2019 | PyPI waitress |
Command Injection in tree-kill CVE-2019-15599, GHSA-884p-74jh-xrg2 | Critical | 2.7% | 18 Dec, 2019 | npm tree-kill |
Treekill Enables OS Command Injection CVE-2019-15598, GHSA-j7fq-p9q7-5wfv | Critical | 2.7% | 18 Dec, 2019 | npm tree-kill |
Command Injection in node-df CVE-2019-15597, GHSA-wp7m-mrvf-599c | Critical | 2.7% | 18 Dec, 2019 | npm node-df |
Django Potential account hijack via password reset form CVE-2019-19844, GHSA-vfq6-hq5r-27r6, PYSEC-2019-16 | Critical | 53.6% | 18 Dec, 2019 | PyPI Django PyPI django |