Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
sr_freecap for Typo3 RCE Vulnerability CVE-2019-16699, GHSA-598p-rv6p-g7qc | Critical | 2.4% | 16 Oct, 2019 | Packagist sjbr/sr-freecap |
Rambox RCE Vulnerability CVE-2019-17625, GHSA-2gc6-2h2g-ph48 | Critical | 3.0% | 16 Oct, 2019 | npm Rambox |
XML Injection in ReportLab CVE-2019-17626, GHSA-qpg2-vx7j-3869, PYSEC-2019-117 | Critical | 9.5% | 16 Oct, 2019 | PyPI reportlab |
Sandbox Breakout / Arbitrary Code Execution in safer-eval CVE-2019-10760, GHSA-hgch-jjmr-gp7w, SNYK-JS-SAFEREVAL-473029 | Critical | 2.9% | 15 Oct, 2019 | npm safer-eval |
Sandbox Breakout / Arbitrary Code Execution in safer-eval CVE-2019-10759, GHSA-r3x4-wr4h-pw33, SNYK-JS-SAFEREVAL-173772 | Critical | 1.8% | 15 Oct, 2019 | npm safer-eval |
Nostromo nhttpd Directory Traversal Vulnerability CVE-2019-16278 | CriticalExploited | 99.0% | 14 Oct, 2019 | |
GDAL through 3.0.1 has a poolDestroy double free in OGRExpatRealloc in ogr/ogr_expat.cpp when the 10MB threshold is exceeded. CVE-2019-17545, PYSEC-2019-241 | Critical | 2.6% | 14 Oct, 2019 | PyPI gdal |
Cross-site scripting in Swagger-UI CVE-2019-17495, GHSA-c427-hjc3-wrfw | Critical | 5.7% | 10 Oct, 2019 | Maven io.springfox:springfox-swagger-ui Maven org.webjars.npm:swagger-ui Maven org.webjars:swagger-ui npm swagger-ui |
Improper Input Validation in Automattic Mongoose CVE-2019-17426, GHSA-8687-vv9j-hgph | Critical | 1.5% | 10 Oct, 2019 | npm mongoose |
SQL Injection in knex CVE-2019-10757, GHSA-58v4-qwx5-7f59, SNYK-JS-KNEX-471962 | Critical | 1.2% | 08 Oct, 2019 | npm knex |
OpenStack Octavia Amphora-Agent not requiring Client-Certificate CVE-2019-17134, GHSA-r4v4-3jj7-jc29, PYSEC-2026-433 | Critical | 2.3% | 08 Oct, 2019 | PyPI octavia |
Centreon Privilege Escalation CVE-2018-21025, GHSA-f24j-f97w-65h8 | Critical | 2.8% | 08 Oct, 2019 | Packagist centreon/centreon |
Uncontrolled deserialization of a pickled object in rediswrapper allows attackers to execute arbitrary scripts CVE-2019-17206, GHSA-vrcf-g539-x6h3, PYSEC-2019-116 | Critical | 3.2% | 05 Oct, 2019 | PyPI rediswrapper |
Sandbox Breakout in realms-shim GHSA-6jg8-7333-554w | Critical | Not scored | 04 Oct, 2019 | npm realms-shim npm ses |
Exim Out-of-bounds Write Vulnerability CVE-2019-16928 | CriticalExploited | 41.6% | 27 Sep, 2019 | |
D-Link Multiple Routers Command Injection Vulnerability CVE-2019-16920 | CriticalExploited | 100.0% | 27 Sep, 2019 | |
Missing warning can lead to unauthenticated admin access in SilverStripe CVE-2019-12204, GHSA-cg8j-8w52-735v | Critical | 1.5% | 25 Sep, 2019 | Packagist silverstripe/cms Packagist silverstripe/framework |
SQL injection in Centreon CVE-2019-16194, GHSA-wgjx-hm34-qgf7 | Critical | 1.4% | 25 Sep, 2019 | Packagist centreon/centreon |
vBulletin PHP Module Remote Code Execution Vulnerability CVE-2019-16759 | CriticalExploited | 99.7% | 24 Sep, 2019 | |
D-Link DNS-320 Remote Code Execution Vulnerability CVE-2019-16057 | CriticalExploited | 86.5% | 16 Sep, 2019 | |
JHipster Kotlin using insecure source of randomness `RandomStringUtils` before v1.2.0 CVE-2019-16303, GHSA-j3rh-8vwq-wh84, GHSA-mwp6-j9wf-968c | Critical | 3.7% | 13 Sep, 2019 | npm generator-jhipster npm generator-jhipster-kotlin |
Command Injection in gitlabhook CVE-2019-5485, GHSA-549f-73hh-mj38 | Critical | 58.8% | 13 Sep, 2019 | npm gitlabhook |
SIMalliance Toolbox Browser Command Injection Vulnerability CVE-2019-16256 | CriticalExploited | 4.9% | 12 Sep, 2019 | |
py-lmdb Invalid write operation CVE-2019-16224, GHSA-9q62-r72g-pvv7, PYSEC-2019-236 | Critical | 1.8% | 11 Sep, 2019 | PyPI lmdb |
py-lmdb Invalid write operation CVE-2019-16225, GHSA-c74c-p4p7-r8q5, PYSEC-2019-237 | Critical | 1.8% | 11 Sep, 2019 | PyPI lmdb |
py-lmdb Invalid write operation CVE-2019-16227, GHSA-pf3p-v9xp-mrvf, PYSEC-2019-239 | Critical | 2.0% | 11 Sep, 2019 | PyPI lmdb |
Missing Authentication for Critical Function in LibreNMS CVE-2019-10668, GHSA-277v-gwfr-hmpj | Critical | 1.6% | 09 Sep, 2019 | Packagist librenms/librenms |
LibreNMS Information Disclosure CVE-2019-10665, GHSA-q5rg-wg7h-73m5 | Critical | 1.5% | 09 Sep, 2019 | Packagist librenms/librenms |
Total.js CMS RCE Vulnerability CVE-2019-15954, GHSA-v287-9w3v-x5c5 | Critical | 78.7% | 05 Sep, 2019 | npm total4 |
OpenStack os-vif Ageing time of 0 disables linuxbridge MAC learning CVE-2019-15753, GHSA-mcpw-cp35-p3h8, PYSEC-2026-440 | Critical | 2.6% | 28 Aug, 2019 | PyPI os-vif |
Potential memory corruption in arrayfire CVE-2018-20998, GHSA-69fv-gw6g-8ccg, PYSEC-2019-144, RUSTSEC-2018-0011 | Critical | 1.7% | 26 Aug, 2019 | PyPI arrayfire crates.io arrayfire |
Arbitrary Code Execution in eslint-utils CVE-2019-15657, GHSA-3gx7-xhv7-5mx3 | Critical | 2.3% | 26 Aug, 2019 | npm eslint-utils |
BEdita vulnerable to SQL injection CVE-2019-15570, GHSA-9gv2-2m38-j6cx | Critical | 1.5% | 26 Aug, 2019 | Packagist bedita/bedita |
Spoon Library as used in Fork CMS allows PHP object injection CVE-2019-15521, GHSA-2p2x-mw56-jc98 | Critical | 2.5% | 26 Aug, 2019 | Packagist spoon/library |
SQL Injection in SimpleSAMLphp CVE-2019-15537, GHSA-852q-xxj4-x2rx | Critical | 1.6% | 23 Aug, 2019 | Packagist cesnet/simplesamlphp-module-proxystatistics |
Prototype Pollution in deeply CVE-2019-10750, GHSA-8j4w-5fw4-rm27 | Critical | 1.7% | 23 Aug, 2019 | npm deeply |
Prototype Pollution in set-value CVE-2019-10747, GHSA-4g88-fppr-53pp, SNYK-JS-SETVALUE-450213 | Critical | 2.5% | 23 Aug, 2019 | npm set-value |
Prototype Pollution in mixin-deep CVE-2019-10746, GHSA-fhjf-83wg-r2j9, SNYK-JS-MIXINDEEP-450212 | Critical | 3.7% | 23 Aug, 2019 | npm mixin-deep |
Identity Spoofing in libp2p-secio GHSA-rch7-f4h5-x9rj | Critical | Not scored | 23 Aug, 2019 | npm libp2p-secio |
MantisBT allows cross-site scripting (XSS) via crafted filename CVE-2019-15074, GHSA-gg4j-279j-22ph | Critical | 2.1% | 21 Aug, 2019 | Packagist mantisbt/mantisbt |
Undirectional routing wasn't respected in some cases in Mitogen CVE-2019-15149, GHSA-8rf6-w2mx-4xjh, PYSEC-2019-104 | Critical | 1.6% | 18 Aug, 2019 | PyPI mitogen |
Webmin Command Injection Vulnerability CVE-2019-15107 | CriticalExploited | 99.7% | 16 Aug, 2019 | |
SAP Commerce Cloud Deserialization of Untrusted Data Vulnerability CVE-2019-0344 | CriticalExploited | 7.5% | 14 Aug, 2019 | |
Atlassian Jira Server and Data Center Server-Side Template Injection Vulnerability CVE-2019-11581 | CriticalExploited | 84.6% | 09 Aug, 2019 | |
SQL Injection in Django CVE-2019-14234, GHSA-6r97-cj55-9hrq, PYSEC-2019-13 | Critical | 47.7% | 09 Aug, 2019 | PyPI Django PyPI django |
Access of Resource Using Incompatible Type ('Type Confusion') in yourls/yourls CVE-2019-14537, GHSA-vf23-f26f-mjj9 | Critical | 6.1% | 07 Aug, 2019 | Packagist yourls/yourls |
Openstack ironic-inspector has SQL injection vulnerability in node_cache CVE-2019-10141, GHSA-c7fc-cm7p-92r2, PYSEC-2019-152 | Critical | 2.5% | 30 Jul, 2019 | PyPI ironic-inspector |
Mozilla Firefox and Thunderbird Sandbox Escape Vulnerability CVE-2019-11708 | CriticalExploited | 55.9% | 23 Jul, 2019 | |
SaltStack Salt SQL Injection vulnerability in mysql.user_chpass function CVE-2019-1010259, GHSA-h8xp-h3jf-wv4v, PYSEC-2019-119 | Critical | 1.9% | 18 Jul, 2019 | PyPI salt |
Improper Restriction of XML External Entity Reference in ladon CVE-2019-1010268, GHSA-vg35-vc9f-q7x2, PYSEC-2019-184 | Critical | 5.9% | 18 Jul, 2019 | PyPI ladon |