Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Cisco IOS Software and Cisco IOS XE Software Quality of Service Remote Code Execution Vulnerability CVE-2018-0151 | CriticalExploited | 14.2% | 28 Mar, 2018 | |
Drupal Core Remote Code Execution Vulnerability CVE-2018-7600, DRUPAL-CORE-2018-002, GHSA-7fh9-933g-885p | CriticalExploited | 100.0% | 28 Mar, 2018 | Packagist drupal/core Packagist drupal/drupal |
Directory Traversal in Studio 42 elFinder CVE-2018-9110, GHSA-44p8-c3wv-f28r | Critical | 2.9% | 28 Mar, 2018 | Packagist studio-42/elfinder |
elFinder Path Traversal vulnerability CVE-2018-9109, GHSA-45x3-mw7q-wf7f | Critical | 2.9% | 28 Mar, 2018 | Packagist studio-42/elfinder |
yii2-redis Potential Remote code execution CVE-2018-8073, GHSA-4hx3-m8w5-g5qh | Critical | 1.6% | 21 Mar, 2018 | Packagist yiisoft/yii2-redis |
Yii SQL injection vulnerability CVE-2018-7269, GHSA-hhg2-g6h6-c266 | Critical | 1.9% | 21 Mar, 2018 | Packagist yiisoft/yii2-dev |
MikroTik RouterOS Stack-Based Buffer Overflow Vulnerability CVE-2018-7445 | CriticalExploited | 65.8% | 19 Mar, 2018 | |
Mercurial Incorrect Access Control vulnerability CVE-2018-1000132, GHSA-4mr4-7vjv-9hm6, PYSEC-2018-87 | Critical | 2.6% | 14 Mar, 2018 | PyPI mercurial |
Eve allows execution of arbitrary code CVE-2018-8097, GHSA-8jxq-75rw-fhj9, PYSEC-2018-8 | Critical | 6.3% | 14 Mar, 2018 | PyPI eve |
Paramiko not properly checking authentication before processing other requests CVE-2018-7750, GHSA-232r-66cg-79px, PYSEC-2018-19 | Critical | 27.1% | 13 Mar, 2018 | PyPI paramiko |
django-anymail Includes Sensitive Information in Log Files CVE-2018-1000089, GHSA-qh9x-mc42-vg4g, PYSEC-2018-46 | Critical | 1.2% | 13 Mar, 2018 | PyPI django-anymail |
AsyncSSH SSH Server Authentication Bypass CVE-2018-7749, GHSA-97cv-6pjf-5f9q, PYSEC-2018-108 | Critical | 1.7% | 12 Mar, 2018 | PyPI AsyncSSH PyPI asyncssh |
Cisco Secure Access Control System Java Deserialization Vulnerability CVE-2018-0147 | CriticalExploited | 18.2% | 08 Mar, 2018 | |
Bleach URI Scheme Restriction Bypass CVE-2018-7753, GHSA-m9mq-p2f9-cfqv, PYSEC-2018-51 | Critical | 2.2% | 07 Mar, 2018 | PyPI bleach |
Bacula-web SQL Injection Vulnerabilities CVE-2017-15367, GHSA-fv4m-5j2c-787r | Critical | 23.1% | 07 Mar, 2018 | Packagist bacula-web/bacula-web |
D-Link Multiple Routers OS Command Injection Vulnerability CVE-2018-6530 | CriticalExploited | 96.7% | 06 Mar, 2018 | |
vrana/adminer vulnerable to SSRF by connecting to privileged ports CVE-2018-7667, GHSA-43f8-p5w3-5m25 | Critical | 5.0% | 05 Mar, 2018 | Packagist vrana/adminer |
mxGraph vulnerable to XXE attacks CVE-2017-18197, GHSA-wvpv-8524-wg6x | Critical | 2.9% | 24 Feb, 2018 | npm mxgraph |
Anchor CMS Logs Credentials CVE-2018-7251, GHSA-hxcw-pqqc-rv85 | Critical | 71.8% | 19 Feb, 2018 | Packagist anchorcms/anchor-cms |
Exim Buffer Overflow Vulnerability CVE-2018-6789 | CriticalExploited | 82.1% | 08 Feb, 2018 | |
Etherpad Lite Access Restriction Bypass CVE-2018-6835, GHSA-mvmv-rq2j-97p2 | Critical | 2.3% | 08 Feb, 2018 | npm ep_etherpad-lite |
Cisco VPN Routers Remote Code Execution Vulnerability CVE-2018-0125 | CriticalExploited | 55.2% | 08 Feb, 2018 | |
web2py remote code execution via hardcoded encryption key in session.connect function CVE-2016-3953, GHSA-q2rq-qgcf-m22w, PYSEC-2026-570 | Critical | 3.3% | 06 Feb, 2018 | PyPI web2py |
Django-Anymail prone to a timing attack CVE-2018-6596, GHSA-hxf9-7h4c-f5jv, PYSEC-2018-7 | Critical | 2.6% | 03 Feb, 2018 | PyPI django-anymail |
SimpleSAMLphp Use of insecure connection charset (sqlauth module) CVE-2018-6521, GHSA-qv5p-6wrc-79wg | Critical | 3.1% | 02 Feb, 2018 | Packagist simplesamlphp/simplesamlphp |
Jenkins Remote Code Execution Vulnerability CVE-2017-1000353 | CriticalExploited | 99.7% | 29 Jan, 2018 | |
Primetek Primefaces Remote Code Execution Vulnerability CVE-2017-1000486 | CriticalExploited | 94.1% | 03 Jan, 2018 | |
Cobbler vulnerable to arbitrary code execution CVE-2017-1000469, GHSA-96hw-v598-jvgh, PYSEC-2026-314 | Critical | 5.6% | 03 Jan, 2018 | PyPI cobbler |
Smarty PHP code injection CVE-2017-1000480, GHSA-9m49-vhwv-422g | Critical | 3.1% | 03 Jan, 2018 | Packagist smarty/smarty |
pysaml2 Improper Authentication vulnerability CVE-2017-1000433, GHSA-924m-4pmx-c67h, PYSEC-2018-48 | Critical | 2.5% | 02 Jan, 2018 | PyPI pysaml2 |
Dolibarr SQL injection vulnerability in fourn/index.php CVE-2017-17900, GHSA-6frc-vfw9-wm27 | Critical | 1.9% | 27 Dec, 2017 | Packagist dolibarr/dolibarr |
Dolibarr SQL injection vulnerability in adherents/subscription/info.php CVE-2017-17899, GHSA-7789-v767-37r5 | Critical | 1.9% | 27 Dec, 2017 | Packagist dolibarr/dolibarr |
Dolibarr SQL injection vulnerability in comm/multiprix.php CVE-2017-17897, GHSA-9v7m-f3cv-68rw | Critical | 1.9% | 27 Dec, 2017 | Packagist dolibarr/dolibarr |
Palo Alto Networks PAN-OS Remote Code Execution Vulnerability CVE-2017-15944 | CriticalExploited | 98.3% | 11 Dec, 2017 | |
Mercurial vulnerable to arbitrary code injection CVE-2017-17458, GHSA-6v56-cpg6-3rpx, PYSEC-2017-90 | Critical | 6.3% | 07 Dec, 2017 | PyPI mercurial |
Arbitrary Code Execution in mathjs CVE-2017-1001003, GHSA-pv8x-p9hq-j328 | Critical | 1.7% | 27 Nov, 2017 | npm mathjs |
Arbitrary Code Execution in mathjs CVE-2017-1001002, GHSA-vx5c-87qx-cv6c | Critical | 2.4% | 27 Nov, 2017 | npm mathjs |
Ansible Insertion of Sensitive Information into Log File vulnerability CVE-2017-7550, GHSA-588w-w6mv-3cw5, PYSEC-2017-4 | Critical | 3.6% | 21 Nov, 2017 | PyPI ansible |
OpenStack Swauth object/proxy server writing Auth Token to log file CVE-2017-16613, GHSA-qhq8-xwqv-pvv9, PYSEC-2017-84 | Critical | 8.4% | 21 Nov, 2017 | PyPI swauth |
ejs is vulnerable to remote code execution due to weak input validation CVE-2017-1000228, GHSA-3w5v-p54c-f74x | Critical | 6.4% | 17 Nov, 2017 | npm ejs |
October CMS File Upload Vulnerability CVE-2017-1000194, GHSA-8vh6-8w76-v6m3 | Critical | 1.2% | 17 Nov, 2017 | Packagist october/october |
PIDUsage Enables OS Command Injection CVE-2017-1000220, GHSA-h2p3-h48h-9jj7 | Critical | 5.1% | 17 Nov, 2017 | npm pidusage |
Command Execution in windows-cpu CVE-2017-1000219, GHSA-63m4-fhf2-cmf7 | Critical | 4.2% | 17 Nov, 2017 | npm windows-cpu |
Recurly vulnerable to SSRF CVE-2017-0906, GHSA-38rv-5jqc-m2cv, PYSEC-2017-68 | Critical | 2.6% | 13 Nov, 2017 | PyPI recurly |
Unsafe deserialization in confire CVE-2017-16763, GHSA-m85c-9mf8-m2m6, PYSEC-2017-78 | Critical | 4.5% | 10 Nov, 2017 | PyPI confire |
django_make_app is vulnerable to Code Injection CVE-2017-16764, GHSA-9pv8-q5rx-c8gq, PYSEC-2017-79 | Critical | 3.5% | 10 Nov, 2017 | PyPI django-make-app PyPI django_make_app |
MetalGenix GeniXCMS vulnerable to SQL Injection CVE-2015-3933, GHSA-q4hw-62mx-q37w | Critical | 3.8% | 08 Nov, 2017 | Packagist genix/cms |
Unsafe deserialization in MLAlchemy CVE-2017-16615, GHSA-xpm8-98mx-h4c5, PYSEC-2017-19 | Critical | 3.4% | 08 Nov, 2017 | PyPI MLAlchemy PyPI mlalchemy |
Unsafe pyyaml load usage in PyAnyAPI CVE-2017-16616, GHSA-vg8g-jpm9-jh8r, PYSEC-2017-23 | Critical | 3.6% | 08 Nov, 2017 | PyPI pyanyapi |
Unsafe deserialization in owlmixin CVE-2017-16618, GHSA-ccmq-qvcp-5mrm, PYSEC-2017-22 | Critical | 4.5% | 08 Nov, 2017 | PyPI owlmixin |