Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
PyYAML insecurely deserializes YAML strings leading to arbitrary code execution CVE-2017-18342, GHSA-rprw-h62v-c2w7, PYSEC-2018-49 | Critical | 5.7% | 27 Jun, 2018 | PyPI PyYAML PyPI pyyaml |
Centreon RCE Vulnerability CVE-2018-11587, GHSA-c8qc-cp8v-prpx | Critical | 4.2% | 25 Jun, 2018 | Packagist centreon/centreon |
CodeIgniter Session Fixation Vulnerability CVE-2018-12071, GHSA-g434-3q2j-hj4r | Critical | 1.5% | 17 Jun, 2018 | Packagist codeigniter/framework |
Symfony Authentication Bypass CVE-2018-11407, GHSA-35c5-28pg-2qg4 | Critical | 2.4% | 13 Jun, 2018 | Packagist symfony/security Packagist symfony/security-core Packagist symfony/symfony |
Denial of Service in https-proxy-agent CVE-2018-3739, GHSA-8g7p-74h8-hg48 | Critical | 1.7% | 07 Jun, 2018 | npm https-proxy-agent |
Sandbox Breakout / Arbitrary Code Execution in static-eval CVE-2017-16226, GHSA-5mjw-6jrh-hvfq | Critical | 3.5% | 07 Jun, 2018 | npm static-eval |
Chromium Remote Code Execution in electron CVE-2017-16151, GHSA-4w88-rjj3-x7wp | Critical | 2.7% | 07 Jun, 2018 | npm electron |
npm-script-demo is malware CVE-2017-16128, GHSA-322m-p39j-r5m2 | Critical | 1.4% | 07 Jun, 2018 | npm npm-script-demo |
pandora-doomsday is malware CVE-2017-16127, GHSA-428f-mh7w-6w2x | Critical | 1.4% | 07 Jun, 2018 | npm pandora-doomsday |
Command Injection in dns-sync CVE-2017-16100, GHSA-jcw8-r9xm-32c6 | Critical | 5.1% | 07 Jun, 2018 | npm dns-sync |
Sandbox Breakout in safe-eval CVE-2017-16088, GHSA-ww6v-677g-p656 | Critical | 3.4% | 07 Jun, 2018 | npm safe-eval |
Remote Code Execution in pg CVE-2017-16082, GHSA-wc9v-mj63-m9g5 | Critical | 10.4% | 07 Jun, 2018 | npm pg |
Growl before 1.10.0 vulnerable to Command Injection CVE-2017-16042, GHSA-qh2h-chj9-jffq | Critical | 4.6% | 04 Jun, 2018 | npm growl |
Unsafe eval() in summit allows arbitrary code execution CVE-2017-16020, GHSA-cwcp-6c48-fm7m | Critical | 2.5% | 04 Jun, 2018 | npm summit |
Command Injection in pdf-image CVE-2018-3757, GHSA-5gwh-g79j-vh4q | Critical | 4.6% | 01 Jun, 2018 | npm pdf-image |
Command Injection in pdfinfojs CVE-2018-3746, GHSA-3pxp-6963-46r9 | Critical | 4.9% | 01 Jun, 2018 | npm pdfinfojs |
Forgeable Public/Private Tokens in jwt-simple CVE-2016-10555, GHSA-vgrx-w6rg-8fqf | Critical | 4.8% | 31 May, 2018 | npm jwt-simple |
SQL Injection in sequelize CVE-2016-10554, GHSA-x2jc-pwfj-h9p3 | Critical | 1.9% | 31 May, 2018 | npm sequelize |
Potential SQL Injection in sequelize CVE-2016-10553, GHSA-2v7q-2xqx-f4q5 | Critical | 1.3% | 31 May, 2018 | npm sequelize |
SQL Injection in sequelize CVE-2016-10550, GHSA-98pq-pmw9-4gpm | Critical | 1.9% | 31 May, 2018 | npm sequelize |
Arbitrary Code Injection in reduce-css-calc CVE-2016-10548, GHSA-4662-j96g-mv46 | Critical | 1.2% | 31 May, 2018 | npm reduce-css-calc |
Arbitrary Code Injection in pouchdb CVE-2016-10546, GHSA-cgqv-x5cx-xvqh | Critical | 2.6% | 31 May, 2018 | npm pouchdb |
Potential Command Injection in shell-quote CVE-2016-10541, GHSA-qg8p-v9q4-gh34 | Critical | 2.2% | 31 May, 2018 | npm shell-quote |
Authentication Bypass in console-io CVE-2016-10532, GHSA-q52j-4q2q-hcj6 | Critical | 2.3% | 31 May, 2018 | npm console-io |
Quest KACE System Management Appliance Remote Command Execution Vulnerability CVE-2018-11138 | CriticalExploited | 91.7% | 31 May, 2018 | |
Out-of-bounds Read in atob CVE-2018-3745, GHSA-8w4h-3cm3-2pm2 | Critical | 2.1% | 29 May, 2018 | npm atob |
Path Traversal in html-pages CVE-2018-3744, GHSA-fm87-46vv-jqrr | Critical | 2.2% | 29 May, 2018 | npm html-pages |
SQL Injection in waterline-sequel CVE-2016-10551, GHSA-cgpp-wm2h-6hqx | Critical | 1.8% | 29 May, 2018 | npm waterline-sequel |
Authentication Bypass in hapi-auth-jwt2 CVE-2016-10525, GHSA-mg8r-9g6j-hwv9 | Critical | 2.5% | 29 May, 2018 | npm hapi-auth-jwt2 |
SQL Injection in mysql CVE-2015-9244, GHSA-fvq6-55gv-jx9f | Critical | 2.4% | 29 May, 2018 | npm mysql |
Verification Bypass in jsonwebtoken CVE-2015-9235, GHSA-c7hr-j4mj-j2w6 | Critical | 8.5% | 29 May, 2018 | npm jsonwebtoken |
Dolibarr SQL Injection vulnerability CVE-2018-9019, GHSA-fff9-m6f6-q3mh | Critical | 3.8% | 22 May, 2018 | Packagist dolibarr/dolibarr |
Dolibarr SQL injection vulnerability CVE-2018-10094, GHSA-57wj-22w9-wm9r | Critical | 69.3% | 22 May, 2018 | Packagist dolibarr/dolibarr |
Adobe ColdFusion Deserialization of Untrusted Data Vulnerability CVE-2018-4939 | CriticalExploited | 61.8% | 19 May, 2018 | |
Ansible fails to cache SSH host keys CVE-2013-2233, GHSA-9x6q-5423-w5v9, PYSEC-2018-36 | Critical | 1.9% | 04 May, 2018 | PyPI ansible |
Dasan GPON Routers Command Injection Vulnerability CVE-2018-10562 | CriticalExploited | 99.9% | 04 May, 2018 | |
Dasan GPON Routers Authentication Bypass Vulnerability CVE-2018-10561 | CriticalExploited | 92.8% | 04 May, 2018 | |
phpMyAdmin Improper Privilege Management CVE-2017-18264, GHSA-5868-g58j-vrj5 | Critical | 2.8% | 01 May, 2018 | Packagist phpmyadmin/phpmyadmin |
Drupal Core Remote Code Execution Vulnerability CVE-2018-7602, DRUPAL-CORE-2018-004, GHSA-297x-j9pm-xjgg | CriticalExploited | 99.2% | 25 Apr, 2018 | Packagist drupal/core Packagist drupal/drupal |
Ansible is vulnerable to an improper input validation in Ansible's handling of data sent from client systems CVE-2016-9587, GHSA-m956-frf4-m2wr, PYSEC-2018-39 | Critical | 17.1% | 24 Apr, 2018 | PyPI ansible |
SaltStack Salt allows compromised salt-minions to impersonate the salt-master CVE-2017-7893, GHSA-g283-88v5-rmq2, PYSEC-2018-50 | Critical | 1.4% | 23 Apr, 2018 | PyPI salt |
thinkphp SQL Injection via the index.php s parameter CVE-2018-10225, GHSA-xvhr-7q4q-qjgp | Critical | 1.1% | 19 Apr, 2018 | Packagist topthink/framework |
Oracle WebLogic Server Unspecified Vulnerability CVE-2018-2628 | CriticalExploited | 100.0% | 19 Apr, 2018 | |
CSV Injection vulnerability with exported contact lists in Mautic CVE-2018-8092, GHSA-29v9-2fpx-j5g9 | Critical | 1.6% | 18 Apr, 2018 | Packagist mautic/core |
Diffoscope may write to arbitrary locations due to an untrusted archive CVE-2017-0359, GHSA-8p5c-f328-9fvv, PYSEC-2018-83 | Critical | 2.2% | 13 Apr, 2018 | PyPI diffoscope |
VMware Tanzu Spring Data Commons Property Binder Vulnerability CVE-2018-1273 | CriticalExploited | 97.0% | 11 Apr, 2018 | |
Code injection in rope CVE-2014-3539, GHSA-r38r-qp28-2m63, PYSEC-2018-100 | Critical | 3.0% | 06 Apr, 2018 | PyPI rope |
Koji hub call does not perform correct access checks CVE-2018-1002150, GHSA-6mww-xvh7-fq4f, PYSEC-2018-86 | Critical | 1.7% | 04 Apr, 2018 | PyPI koji |
SiCKRAGE Discloses Plaintext Credentials CVE-2018-9160, GHSA-jrcv-3c5h-rh3q, PYSEC-2018-101 | Critical | 75.6% | 31 Mar, 2018 | PyPI sickrage |
Cisco IOS and IOS XE Software Smart Install Remote Code Execution Vulnerability CVE-2018-0171 | CriticalExploited | 99.5% | 28 Mar, 2018 |