Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Sony Neural Network Libraries reliance on untrusted inputs prior to v1.0.10 CVE-2019-10844, GHSA-4q2w-rw7m-xqw6, PYSEC-2019-107 | Critical | 1.6% | 04 Apr, 2019 | PyPI nnabla |
Kentico Xperience Deserialization of Untrusted Data Vulnerability CVE-2019-10068 | CriticalExploited | 95.1% | 26 Mar, 2019 | |
OS Command Injection in node-opencv CVE-2019-10061, GHSA-mc7w-4cjf-c973 | Critical | 4.2% | 26 Mar, 2019 | npm opencv |
Kibana Arbitrary Code Execution CVE-2019-7609 | CriticalExploited | 95.3% | 25 Mar, 2019 | |
Atlassian Confluence Server and Data Center Server-Side Template Injection Vulnerability CVE-2019-3396 | CriticalExploited | 99.9% | 25 Mar, 2019 | |
Moodle Blind SSRF Risk in /badges/mybackpack.php CVE-2019-3809, GHSA-jp4g-r8c9-3534 | Critical | 0.8% | 25 Mar, 2019 | Packagist moodle/moodle |
ipycache is vulnerable to Code Injection CVE-2019-7539, GHSA-gcm4-q2pg-xw89, PYSEC-2019-180 | Critical | 1.6% | 21 Mar, 2019 | PyPI ipycache |
Donfig Command Injection in collect_yaml method CVE-2019-7537, GHSA-3qr5-h7w4-3gx3, PYSEC-2019-21 | Critical | 3.4% | 21 Mar, 2019 | PyPI donfig |
Sonatype Nexus Repository Manager Incorrect Access Control Vulnerability CVE-2019-7238 | CriticalExploited | 76.6% | 21 Mar, 2019 | |
Code Injection in morgan CVE-2019-5413, GHSA-gwg9-rgvj-4h5j | Critical | 3.4% | 21 Mar, 2019 | npm morgan |
splunk-sdk does not properly verify untrusted TLS server certificates CVE-2019-5729, GHSA-f58w-649r-qjr9, PYSEC-2019-203 | Critical | 0.7% | 21 Mar, 2019 | PyPI splunk-sdk |
Jenkins Matrix Project Plugin Remote Code Execution Vulnerability CVE-2019-1003030 | CriticalExploited | 97.1% | 08 Mar, 2019 | |
Jenkins Script Security Plugin Sandbox Bypass Vulnerability CVE-2019-1003029 | CriticalExploited | 74.4% | 08 Mar, 2019 | |
Dolibarr SQL injection via the integer parameters qty and value_unit CVE-2018-16809, GHSA-h34q-878w-w96r | Critical | 2.3% | 07 Mar, 2019 | Packagist dolibarr/dolibarr |
Microsoft SharePoint Remote Code Execution Vulnerability CVE-2019-0604 | CriticalExploited | 99.9% | 05 Mar, 2019 | |
elFinder command injection vulnerability in the PHP connector CVE-2019-9194, GHSA-4223-qj94-7x9p | Critical | 96.7% | 26 Feb, 2019 | Packagist studio-42/elfinder |
irisnet-crypto RCE Vulnerability CVE-2019-9115, GHSA-5fh8-x9xc-hxmc | Critical | 2.3% | 25 Feb, 2019 | npm irisnet-crypto |
SQLAlchemy vulnerable to SQL Injection via order_by parameter CVE-2019-7164, GHSA-887w-45rq-vxgf, PYSEC-2019-123 | Critical | 3.5% | 20 Feb, 2019 | PyPI SQLAlchemy PyPI sqlalchemy |
Joomla! Object Injection Vulnerability CVE-2019-7743, GHSA-5m3w-rvvh-8fx6 | Critical | 2.7% | 12 Feb, 2019 | Packagist joomla/joomla-cms |
SQLAlchemy is vulnerable to SQL Injection via group_by parameter CVE-2019-7548, GHSA-38fc-9xqv-7f7q, PYSEC-2019-124 | Critical | 1.8% | 06 Feb, 2019 | PyPI SQLAlchemy PyPI sqlalchemy |
Critical severity vulnerability that affects Haraka CVE-2016-1000282, GHSA-w5m8-5v9m-xhx5 | Critical | 13.5% | 05 Feb, 2019 | npm Haraka |
Kaseya VSA Remote Code Execution Vulnerability CVE-2018-20753 | CriticalExploited | 29.6% | 05 Feb, 2019 | |
Kaseya VSA SQL Injection Vulnerability CVE-2017-18362 | CriticalExploited | 86.8% | 05 Feb, 2019 | |
TeamPass Storing Passwords in a Recoverable Format vulnerability CVE-2019-1000001, GHSA-q9qr-h33g-fw3j | Critical | 1.7% | 04 Feb, 2019 | Packagist nilsteampassnet/teampass |
Prototype Pollution in extend CVE-2018-16492, GHSA-qrmc-fj45-qfc2 | Critical | 3.0% | 01 Feb, 2019 | npm extend |
Prototype Pollution in node.extend CVE-2018-16491, GHSA-r96c-57pf-9jjm | Critical | 1.7% | 01 Feb, 2019 | npm node.extend |
Prototype Pollution in just-extend CVE-2018-16489, GHSA-675m-85rw-j3w4 | Critical | 1.8% | 01 Feb, 2019 | npm just-extend |
Prototype Pollution in defaults-deep CVE-2018-16486, GHSA-pjxw-22xf-6pwc | Critical | 1.5% | 01 Feb, 2019 | npm defaults-deep |
phpMyAdmin SQL injection in Designer feature CVE-2019-6798, GHSA-f732-fxh6-g4qj | Critical | 3.6% | 26 Jan, 2019 | Packagist phpmyadmin/phpmyadmin |
Apache Airflow vulnerable to XSS CVE-2017-17836, GHSA-9gqg-3fxr-9hv7, PYSEC-2019-149 | Critical | 3.2% | 23 Jan, 2019 | PyPI apache-airflow |
Arbitrary PHP code execution in Drupal CVE-2019-6339, DRUPAL-CORE-2019-002, GHSA-8cw5-rv98-5c46 | Critical | 35.9% | 16 Jan, 2019 | Packagist drupal/core Packagist drupal/drupal |
Numpy Deserialization of Untrusted Data CVE-2019-6446, GHSA-9fq2-x9r6-wfmf, PYSEC-2019-108 | Critical | 17.5% | 16 Jan, 2019 | PyPI numpy |
Drupal Entity access bypass for entities that do not have UUIDs or have protected revisions CVE-2017-6925, GHSA-f4qx-jqfq-7785 | Critical | 3.0% | 15 Jan, 2019 | Packagist drupal/core Packagist drupal/drupal |
modulemd uses an unsafe function for processing externally provided data CVE-2017-1002157, GHSA-jhjh-ghwx-6h7r, PYSEC-2019-153 | Critical | 2.9% | 10 Jan, 2019 | PyPI modulemd |
Nuclide Improper Input Validation CVE-2018-6333, GHSA-r83x-wj75-v89r | Critical | 2.3% | 31 Dec, 2018 | npm nuclide |
react-dev-utils on Windows vulnerable to Remote Code Execution CVE-2018-6342, GHSA-29gp-92wp-94q8 | Critical | 2.8% | 31 Dec, 2018 | npm react-dev-utils |
GIGABYTE Multiple Products Privilege Escalation Vulnerability CVE-2018-19323 | CriticalExploited | 8.4% | 21 Dec, 2018 | |
Code injection in Danijar Definitions CVE-2018-20325, GHSA-v4x4-98cg-wr4g, PYSEC-2018-82 | Critical | 3.5% | 21 Dec, 2018 | PyPI definitions |
Code injection in ymlref CVE-2018-20133, GHSA-8r8j-xvfj-36f9, PYSEC-2018-103 | Critical | 1.8% | 17 Dec, 2018 | PyPI ymlref |
ThinkPHP "noneCms" Remote Code Execution Vulnerability CVE-2018-20062 | CriticalExploited | 99.5% | 11 Dec, 2018 | |
Exposure of Sensitive Information to an Unauthorized Actor in urllib3 CVE-2018-20060, GHSA-www2-v7xj-xrc6, PYSEC-2018-32 | Critical | 4.5% | 11 Dec, 2018 | PyPI urllib3 |
Jenkins Stapler Web Framework Deserialization of Untrusted Data Vulnerability CVE-2018-1000861 | CriticalExploited | 98.3% | 10 Dec, 2018 | |
Critical severity vulnerability that affects event-stream and flatmap-stream GHSA-mh6f-8j2x-4483 | Critical | Not scored | 26 Nov, 2018 | npm event-stream npm flatmap-stream |
Paessler PRTG Network Monitor Local File Inclusion Vulnerability CVE-2018-19410 | CriticalExploited | 97.9% | 21 Nov, 2018 | |
FineUploader php-traditional-server unauthenticated arbitrary file upload vulnerability CVE-2018-9209, GHSA-j78w-6r73-22vh | Critical | 1.8% | 19 Nov, 2018 | Packagist fineuploader/php-traditional-server |
Unrestricted Upload of File with Dangerous Type in jquery-file-upload CVE-2018-9207, GHSA-mxr5-p36v-479m | Critical | 3.5% | 19 Nov, 2018 | npm jquery-file-upload |
Centreon allows SNMP trap SQL Injection CVE-2018-19281, GHSA-w2xf-4gg9-87wr | Critical | 1.8% | 14 Nov, 2018 | Packagist centreon/centreon |
Deserialization of Untrusted Data in superset CVE-2018-8021, GHSA-vxp9-wv2f-wqmw, PYSEC-2018-74 | Critical | 53.4% | 07 Nov, 2018 | PyPI superset |
Red Hat JBoss RichFaces Framework Expression Language Injection Vulnerability CVE-2018-14667 | CriticalExploited | 74.2% | 06 Nov, 2018 | |
Command Injection in apex-publish-static-files CVE-2018-16462, GHSA-9jm3-5835-537m | Critical | 7.0% | 30 Oct, 2018 | npm apex-publish-static-files |