Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
langchain vulnerable to arbitrary code execution CVE-2023-36281, GHSA-7gfq-f96f-g85j, PYSEC-2023-151 | Critical | 3.4% | 22 Aug, 2023 | PyPI langchain |
pandasai vulnerable to prompt injection CVE-2023-39660, GHSA-w832-v3c6-m6rg, PYSEC-2026-1757 | Critical | 1.5% | 21 Aug, 2023 | PyPI pandasai |
PandasAI vulnerable to arbitrary code execution CVE-2023-39661, GHSA-8fp9-43pw-56vw, PYSEC-2026-447 | Critical | 1.4% | 15 Aug, 2023 | PyPI pandasai |
LangChain vulnerable to arbitrary code execution CVE-2023-38860, GHSA-fj32-q626-pjjc, PYSEC-2023-145 | Critical | 1.4% | 15 Aug, 2023 | PyPI langchain |
LangChain vulnerable to arbitrary code execution CVE-2023-38896, GHSA-92j5-3459-qgp4, PYSEC-2023-146 | Critical | 1.8% | 15 Aug, 2023 | PyPI langchain |
LangChain vulnerable to arbitrary code execution CVE-2023-39659, GHSA-prgp-w7vf-ch62, PYSEC-2023-147 | Critical | 1.5% | 15 Aug, 2023 | PyPI langchain |
llama-index vulnerable to arbitrary code execution CVE-2023-39662, GHSA-2xxc-73fv-36f7, PYSEC-2023-148 | Critical | 1.5% | 15 Aug, 2023 | PyPI llama-index |
Tornado vulnerable to HTTP request smuggling via improper parsing of `Content-Length` fields and chunk lengths CVE-2023-54397, GHSA-qppv-j76h-2rpx | Critical | 0.4% | 14 Aug, 2023 | PyPI tornado |
GitPython vulnerable to remote code execution due to insufficient sanitization of input arguments CVE-2023-40267, GHSA-pr76-5cm5-w9cj, PYSEC-2023-137 | Critical | 1.2% | 11 Aug, 2023 | PyPI GitPython PyPI gitpython |
Vyper has incorrectly allocated named re-entrancy locks CVE-2023-39363, GHSA-5824-cm3x-3c38, PYSEC-2023-142 | Critical | 0.8% | 07 Aug, 2023 | PyPI vyper |
langchain Code Injection vulnerability CVE-2023-36095, GHSA-gwqq-6vq7-5j86, PYSEC-2023-138 | Critical | 1.2% | 05 Aug, 2023 | PyPI langchain |
MindsDB can be made to not verify SSL certificates CVE-2023-38699, GHSA-8hx6-qv6f-xgcw, PYSEC-2023-140 | Critical | 0.3% | 01 Aug, 2023 | PyPI MindsDB PyPI mindsdb |
Sydent does not verify email server certificates CVE-2023-38686, GHSA-p6hw-wm59-3g5g, PYSEC-2023-139 | Critical | 0.3% | 31 Jul, 2023 | PyPI matrix-sydent |
Command injection in PaddlePaddle CVE-2023-38673, GHSA-9q9v-qgwx-84mr, PYSEC-2023-126 | Critical | 2.3% | 26 Jul, 2023 | PyPI paddlepaddle |
Heap buffer overflow in PaddlePaddle CVE-2023-38671, GHSA-hh7p-hvm3-rg88, PYSEC-2023-124 | Critical | 0.8% | 26 Jul, 2023 | PyPI paddlepaddle |
Use after free in PaddlePaddle CVE-2023-38669, GHSA-8wfh-qxxv-3q8c, PYSEC-2023-122 | Critical | 0.8% | 26 Jul, 2023 | PyPI paddlepaddle |
Removal of e-Tugra root certificate CVE-2023-37920, GHSA-xqr8-7jwr-rhp7, PYSEC-2023-135 | Critical | 0.6% | 25 Jul, 2023 | PyPI certifi |
MLflow Path Traversal vulnerability BIT-mlflow-2023-3765, CVE-2023-3765, GHSA-fmxj-6h9g-6vw3, PYSEC-2023-308 | Critical | 67.5% | 19 Jul, 2023 | PyPI mlflow |
postgraas-server vulnerable to SQL injection CVE-2018-25088, GHSA-vghm-8cjp-hjw6, PYSEC-2026-460 | Critical | 0.7% | 18 Jul, 2023 | PyPI postgraas-server |
xalpha vulnerable to Remote Code Execution CVE-2023-37659, GHSA-jx3q-5rgf-vrrr, PYSEC-2023-116 | Critical | 1.7% | 11 Jul, 2023 | PyPI xalpha |
RestrictedPython vulnerable to arbitrary code execution via stack frame sandbox escape CVE-2023-37271, GHSA-wqc8-x2pr-7jqh, PYSEC-2023-118 | Critical | 0.8% | 10 Jul, 2023 | PyPI RestrictedPython PyPI restrictedpython |
Withdrawn: Use after free in SciPy CVE-2023-29824, GHSA-jrfm-2h82-xg28, PYSEC-2023-114 | Critical | 1.3% | 06 Jul, 2023 | PyPI scipy |
langchain vulnerable to arbitrary code execution CVE-2023-36188, GHSA-57fc-8q82-gfp3, PYSEC-2023-109 | Critical | 1.9% | 06 Jul, 2023 | PyPI langchain |
langchain arbitrary code execution vulnerability CVE-2023-36258, GHSA-2qmj-7962-cjq8, PYSEC-2023-98 | Critical | 1.1% | 03 Jul, 2023 | PyPI langchain |
Apache Airflow Hive Provider Beeline remote code execution with Principal CVE-2023-35797, GHSA-hg6c-qqcm-r79r, PYSEC-2026-273 | Critical | 2.8% | 03 Jul, 2023 | PyPI apache-airflow-providers-apache-hive |
pipreqs vulnerable to Dependency Confusion CVE-2023-31543, GHSA-v4f4-23wc-99mh, PYSEC-2023-99 | Critical | 1.2% | 30 Jun, 2023 | PyPI pipreqs |
fief-server Server-Side Template Injection vulnerability GHSA-hj8m-9fhf-v7jp | Critical | Not scored | 23 Jun, 2023 | PyPI fief-server |
Langchain vulnerable to arbitrary code execution CVE-2023-34541, GHSA-6643-h7h5-x9wh, PYSEC-2023-92 | Critical | 0.9% | 20 Jun, 2023 | PyPI langchain |
Langchain OS Command Injection vulnerability CVE-2023-34540, GHSA-x32c-59v5-h7fg, PYSEC-2023-91 | Critical | 1.7% | 14 Jun, 2023 | PyPI langchain |
Gradio vulnerable to arbitrary file read and proxying of arbitrary URLs CVE-2023-34239, GHSA-3qqg-pgqq-3695, PYSEC-2023-90 | Critical | 0.7% | 08 Jun, 2023 | PyPI gradio |
toui allows user-specific variables to be shared between users CVE-2023-33175, GHSA-hh7j-pg39-q563, PYSEC-2026-555 | Critical | 0.7% | 24 May, 2023 | PyPI toui |
Ckan remote code execution and private information access via crafted resource ids CVE-2023-32321, GHSA-446m-hmmm-hm8m, PYSEC-2026-312 | Critical | 1.7% | 24 May, 2023 | PyPI ckan |
mlflow Path Traversal vulnerability BIT-mlflow-2023-2780, CVE-2023-2780, GHSA-wjq3-7jxx-whj9, PYSEC-2023-69 | Critical | 6.4% | 17 May, 2023 | PyPI mlflow |
Vyper vulnerable to OOB DynArray access when array is on both LHS and RHS of an assignment CVE-2023-31146, GHSA-3p37-3636-q8wv, PYSEC-2023-77 | Critical | 1.3% | 11 May, 2023 | PyPI vyper |
Apache Airflow vulnerable to Privilege Context Switching Error BIT-airflow-2023-25754, CVE-2023-25754, GHSA-jchm-fm4q-c2fp, PYSEC-2023-59 | Critical | 2.3% | 08 May, 2023 | PyPI apache-airflow |
Django bypasses validation when using one form field to upload multiple files BIT-django-2023-31047, CVE-2023-31047, GHSA-r3xc-prgr-mg9p, PYSEC-2023-61 | Critical | 1.4% | 07 May, 2023 | PyPI Django PyPI django |
Mage-ai missing user authentication CVE-2023-31143, GHSA-c6mm-2g84-v4m7, PYSEC-2023-64 | Critical | 0.7% | 05 May, 2023 | PyPI mage-ai |
Remote file access vulnerability in `mlflow server` and `mlflow ui` CLIs GHSA-83fm-w79m-64r5 | Critical | Not scored | 01 May, 2023 | PyPI mlflow |
Unrestricted file upload in kiwi TCMS CVE-2023-30613, GHSA-fwcf-753v-fgcj, PYSEC-2026-1498 | Critical | 1.0% | 24 Apr, 2023 | PyPI kiwitcms |
Apache superset missing check for default SECRET_KEY BIT-superset-2023-27524, CVE-2023-27524, GHSA-5cx2-vq3h-x52c, PYSEC-2026-1161 | CriticalExploited | 98.1% | 24 Apr, 2023 | PyPI apache-superset |
Improper Authorization in modoboa CVE-2023-2227, GHSA-67mg-gm8m-ph5r, PYSEC-2023-35 | Critical | 44.0% | 21 Apr, 2023 | PyPI modoboa |
Modoboa has Weak Password Requirements CVE-2023-2160, GHSA-9gxx-32p7-ff7m, PYSEC-2023-34 | Critical | 0.6% | 18 Apr, 2023 | PyPI modoboa |
Apache Spark vulnerable to Improper Privilege Management BIT-spark-2023-22946, CVE-2023-22946, GHSA-329j-jfvr-rhr6, PYSEC-2023-44 | Critical | 1.1% | 17 Apr, 2023 | Maven org.apache.spark:spark-core_2.12 Maven org.apache.spark:spark-core_2.13 PyPI pyspark |
Incorrect Authorization vulnerability in Apache Software Foundation Apache IoTDB.This issue affects the iotdb-web-workbench component on 0.13.3. iotdb-web-workbench is an optional component of IoTDB, providing a web console of the database.
This problem is fixed from version 0.13.4 of iotdb-web-wor CVE-2023-30771, PYSEC-2023-8 | Critical | 1.4% | 17 Apr, 2023 | PyPI apache-iotdb |
Apache IoTDB Grafana Connector vulnerable to Improper Authentication CVE-2023-24831, GHSA-pvjv-386f-c8wh, PYSEC-2023-7 | Critical | 1.2% | 17 Apr, 2023 | Maven org.apache.iotdb:iotdb-grafana-connector PyPI apache-iotdb |
Weak Password Requirements in calibreweb CVE-2023-2106, GHSA-mhmp-m6g7-7c24, PYSEC-2026-1233 | Critical | 0.7% | 15 Apr, 2023 | PyPI calibreweb |
Improper Restriction of Excessive Authentication Attempts in calibreweb CVE-2022-2525, GHSA-jg8w-wgx2-g7q4, PYSEC-2026-1231 | Critical | 0.8% | 15 Apr, 2023 | PyPI calibreweb |
Apache Airflow Hive Provider vulnerable to code injection CVE-2023-28706, GHSA-5cvg-9pp5-mxcj, PYSEC-2026-271 | Critical | 2.8% | 07 Apr, 2023 | PyPI apache-airflow-providers-apache-hive |
LangChain vulnerable to code injection CVE-2023-29374, GHSA-fprp-p869-w6q2, PYSEC-2023-18 | Critical | 39.7% | 05 Apr, 2023 | PyPI langchain |
Use of hard-coded, security-relevant constants in deepset-ai/haystack CVE-2023-1712, GHSA-w7qg-j435-78qw, PYSEC-2026-337 | Critical | 0.9% | 30 Mar, 2023 | PyPI farm-haystack |