Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Citrix SD-WAN and NetScaler SQL Injection Vulnerability CVE-2019-12989 | CriticalExploited | 95.0% | 16 Jul, 2019 | |
Prototype Pollution in lodash CVE-2019-10744, GHSA-jf85-cpcp-j695, SNYK-JS-LODASH-450202 | Critical | 5.0% | 10 Jul, 2019 | RubyGems lodash-rails npm lodash npm lodash-amd npm lodash-es +1 more |
Wikimedia MediaWiki Incorrect Access Control vulnerability CVE-2019-12468, GHSA-wrhx-3pxr-6vgg | Critical | 3.3% | 10 Jul, 2019 | Packagist mediawiki/core |
Contao SQL injection in the file manager CVE-2019-11512, GHSA-vq59-x6mq-4wgw | Critical | 1.5% | 09 Jul, 2019 | Packagist contao/contao Packagist contao/core-bundle |
CodeIgniter Rest Server XXE Vulnerability CVE-2015-3907, GHSA-cc7g-9pcj-7gwm | Critical | 1.6% | 03 Jul, 2019 | Packagist chriskacerguis/codeigniter-restserver |
Nice Linear eMerge E3-Series OS Command Injection Vulnerability CVE-2019-7256 | CriticalExploited | 97.1% | 02 Jul, 2019 | |
Improper Verification of Cryptographic Signature in django-rest-registration CVE-2019-13177, GHSA-p3w6-jcg4-52xh, PYSEC-2019-20 | Critical | 1.6% | 02 Jul, 2019 | PyPI django-rest-registration |
LinOTP replay vulnerability with auto resynchronization enabled for TOTP token CVE-2019-12887, GHSA-rqg8-xjp2-pg9w, PYSEC-2019-103 | Critical | 1.2% | 27 Jun, 2019 | PyPI LinOTP PyPI linotp |
Openstack Magnum Unsafe Credential Handling CVE-2016-7404, GHSA-793v-r35j-9rp9, PYSEC-2026-437 | Critical | 1.9% | 21 Jun, 2019 | PyPI openstack-magnum |
Command Injection in open GHSA-28xh-wpgr-7fm8 | Critical | Not scored | 20 Jun, 2019 | npm open |
Improper Certificate Validation in Twisted CVE-2019-12855, GHSA-65rm-h285-5cc5, PYSEC-2019-129 | Critical | 1.8% | 16 Jun, 2019 | PyPI twisted |
Sandbox Bypass Leading to Arbitrary Code Execution in constantinople GHSA-4vmm-mhcq-4x9j | Critical | Not scored | 14 Jun, 2019 | npm constantinople |
Failure to sanitize quotes which can lead to sql injection in squel GHSA-4qhx-g9wp-g9m6 | Critical | Not scored | 14 Jun, 2019 | npm squel |
silverstripe restfulserver and registry modules SQL injection vulnerability CVE-2019-12149, GHSA-4j6v-3895-8g2j | Critical | 1.4% | 11 Jun, 2019 | Packagist silverstripe/registry Packagist silverstripe/restfulserver |
Ubiquiti AirOS Command Injection Vulnerability CVE-2010-5330 | CriticalExploited | 40.2% | 11 Jun, 2019 | |
aubio Buffer Overflow vulnerability CVE-2018-19800, GHSA-grmf-4fq6-2r79, PYSEC-2019-162 | Critical | 2.2% | 07 Jun, 2019 | PyPI aubio |
SQL Injection in typeorm GHSA-w7q7-vjp8-7jv4 | Critical | Not scored | 06 Jun, 2019 | npm typeorm |
Exim Mail Transfer Agent (MTA) Improper Input Validation CVE-2019-10149 | CriticalExploited | 100.0% | 05 Jun, 2019 | |
phpMyAdmin SQL injection in Designer feature CVE-2019-11768, GHSA-x37v-98f9-mj32 | Critical | 3.5% | 05 Jun, 2019 | Packagist phpmyadmin/phpmyadmin |
Fortinet FortiOS SSL VPN Path Traversal Vulnerability CVE-2018-13379 | CriticalExploited | 100.0% | 04 Jun, 2019 | |
Sensitive Data Exposure in pem GHSA-pgcr-7wm4-mcv6 | Critical | Not scored | 04 Jun, 2019 | npm pem |
Command Injection in command-exists GHSA-cff4-rrq6-h78w | Critical | Not scored | 03 Jun, 2019 | npm command-exists |
Atlassian Crowd and Crowd Data Center Remote Code Execution Vulnerability CVE-2019-11580 | CriticalExploited | 95.4% | 03 Jun, 2019 | |
Sitecore CMS and Experience Platform (XP) Deserialization Vulnerability CVE-2019-9874 | CriticalExploited | 83.7% | 31 May, 2019 | |
Synacor Zimbra Collaboration Suite (ZCS) Improper Restriction of XML External Entity Reference CVE-2019-9670 | CriticalExploited | 100.0% | 29 May, 2019 | |
Symfony Incorrect Access Control CVE-2017-11365, GHSA-q87v-q8fw-gmj5 | Critical | 1.9% | 23 May, 2019 | Packagist symfony/security Packagist symfony/security-core Packagist symfony/symfony |
Improper Authentication in Buildbot CVE-2019-12300, GHSA-g86p-hgx5-2pfh, PYSEC-2019-6 | Critical | 1.8% | 23 May, 2019 | PyPI buildbot |
Schneider Electric U.motion Builder SQL Injection Vulnerability CVE-2018-7841 | CriticalExploited | 72.5% | 22 May, 2019 | |
Citrix Workspace Application and Receiver for Windows Remote Code Execution Vulnerability CVE-2019-11634 | CriticalExploited | 8.1% | 22 May, 2019 | |
Invalid HTTP method overrides allow possible XSS or other attacks in Symfony CVE-2019-10913, GHSA-x92h-wmg2-6hp7 | Critical | 1.9% | 16 May, 2019 | Packagist symfony/http-foundation Packagist symfony/symfony |
Symfony Service IDs Allow Injection CVE-2019-10910, GHSA-pgwj-prpq-jpc2 | Critical | 6.0% | 16 May, 2019 | Packagist symfony/dependency-injection Packagist symfony/proxy-manager-bridge Packagist symfony/symfony |
Microsoft Remote Desktop Services Remote Code Execution Vulnerability CVE-2019-0708 | CriticalExploited | 100.0% | 16 May, 2019 | |
LG N1A1 NAS Remote Command Execution Vulnerability CVE-2018-14839 | CriticalExploited | 89.2% | 14 May, 2019 | |
WhatsApp VOIP Stack Buffer Overflow Vulnerability CVE-2019-3568 | CriticalExploited | 30.1% | 14 May, 2019 | |
PharStreamWrapper for Typo3 unsafe deserialization vulnerability CVE-2019-11830, GHSA-3hxw-g85p-qgxm | Critical | 2.7% | 09 May, 2019 | Packagist typo3/phar-stream-wrapper |
Ivanti Pulse Connect Secure Arbitrary File Read Vulnerability CVE-2019-11510 | CriticalExploited | 100.0% | 08 May, 2019 | |
Directory Traversal in typo3/phar-stream-wrapper CVE-2019-11831, DRUPAL-CORE-2019-007, GHSA-xv7v-rf6g-xwrc | Critical | 5.4% | 08 May, 2019 | Packagist drupal/core Packagist drupal/drupal Packagist typo3/phar-stream-wrapper |
Zyxel P660HN-T1A Routers Command Injection Vulnerability CVE-2017-18368 | CriticalExploited | 94.5% | 02 May, 2019 | |
Crestron Multiple Products Command Injection Vulnerability CVE-2019-3929 | CriticalExploited | 99.0% | 30 Apr, 2019 | |
Oracle WebLogic Server, Injection CVE-2019-2725 | CriticalExploited | 100.0% | 26 Apr, 2019 | |
Contao SQL injection in the backend and listing module CVE-2017-16558, GHSA-w38g-hj45-mjjp | Critical | 1.5% | 25 Apr, 2019 | Packagist contao/contao Packagist contao/core-bundle Packagist contao/listing-bundle |
LibreNMS arbitrary OS commands execution CVE-2018-20434, GHSA-62q7-qj6g-gvr7 | Critical | 71.5% | 24 Apr, 2019 | Packagist librenms/librenms |
Integer Overflow or Wraparound in Google TensorFlow CVE-2018-7575, GHSA-mw6v-crh8-8533, PYSEC-2019-205, PYSEC-2019-223, PYSEC-2019-230 | Critical | 0.6% | 24 Apr, 2019 | PyPI tensorflow PyPI tensorflow-cpu PyPI tensorflow-gpu |
Contao Does Not Expire Tokens Correctly CVE-2019-10643, GHSA-j99g-qjvx-995g | Critical | 1.3% | 17 Apr, 2019 | Packagist contao/contao Packagist contao/core-bundle |
Contao Does Not Invalidate Existing Sessions When Password Changes CVE-2019-10641, GHSA-vcgg-hp4r-87gx | Critical | 1.3% | 17 Apr, 2019 | Packagist contao/contao Packagist contao/core Packagist contao/core-bundle |
Authentication bypass via incorrect XML canonicalization and DOM traversal in saml2-js CVE-2017-11429, GHSA-5p5w-j3g7-w4wv | Critical | 2.7% | 17 Apr, 2019 | npm saml2-js |
Python-saml allows manipulation of SAML data without invalidation of cryptographic signature CVE-2017-11427, GHSA-j8j8-348v-wfm3, PYSEC-2019-198 | Critical | 4.4% | 17 Apr, 2019 | PyPI python-saml |
Silverstripe Framework SQLi Vulnerability CVE-2019-5715, GHSA-wvfw-w3x6-g526 | Critical | 1.6% | 11 Apr, 2019 | Packagist silverstripe/framework |
Magento 2 Community Edition SQLi Vulnerability CVE-2019-7139, GHSA-4j6w-9rf8-hg7r | Critical | 22.2% | 10 Apr, 2019 | Packagist magento/community-edition |
ThinkAdmin Administrator cookies still working after password change CVE-2019-11018, GHSA-qv5j-rwq3-m823 | Critical | 1.4% | 08 Apr, 2019 | Packagist zoujingli/thinkadmin |