Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
OS Command Injection in cookiecutter CVE-2022-24065, GHSA-f4q6-9qm4-h8j4, PYSEC-2022-204, SNYK-PYTHON-COOKIECUTTER-2414281 | Critical | 4.2% | 08 Jun, 2022 | PyPI cookiecutter |
Path Traversal in django-s3file CVE-2022-24840, GHSA-4w8f-hjm9-xwgf, PYSEC-2022-208 | Critical | 2.1% | 06 Jun, 2022 | PyPI django-s3file |
Embedded Malicious Code in ctx GHSA-67r3-h899-9w95 | Critical | Not scored | 02 Jun, 2022 | PyPI ctx |
Denial of service in bottle CVE-2022-31799, GHSA-xhp9-4947-rq78, PYSEC-2022-227 | Critical | 2.1% | 02 Jun, 2022 | PyPI bottle |
Malware in ctx GHSA-4g82-3jcr-q52w | Critical | Not scored | 25 May, 2022 | PyPI ctx |
Buffer over-flow in Pillow BIT-pillow-2022-30595, CVE-2022-30595, GHSA-hr8g-f6r6-mr22, PYSEC-2022-43145 | Critical | 2.3% | 25 May, 2022 | PyPI Pillow PyPI pillow |
** DISPUTED ** Improper parsing of HTTP requests in Pallets Werkzeug v2.1.0 and below allows attackers to perform HTTP Request Smuggling using a crafted HTTP request with multiple requests included inside the body. NOTE: the vendor's position is that this behavior can only occur in unsupported confi CVE-2022-29361, PYSEC-2022-203 | Critical | 8.1% | 25 May, 2022 | PyPI werkzeug |
SQL injection in calibreweb CVE-2022-30765, GHSA-8ppf-x4gr-2x7g, PYSEC-2026-305 | Critical | 1.2% | 16 May, 2022 | PyPI calibreweb |
Code-execution backdoor in marcador CVE-2022-28470, GHSA-57qv-h9m7-jxfg, PYSEC-2022-185 | Critical | 2.3% | 08 May, 2022 | PyPI marcador |
Tenant and Verifier might not use the same registrar data CVE-2022-1053, GHSA-jf66-3q76-h5p5, GHSA-jf66-3q76-h5p5,, PYSEC-2022-184 | Critical | 1.5% | 05 May, 2022 | PyPI keylime |
Argument injection in python-libnmap CVE-2022-30284, GHSA-qwqv-j7jr-4hp6, PYSEC-2022-42999 | Critical | 5.5% | 04 May, 2022 | PyPI python-libnmap |
Improper Input Validation in httpx CVE-2021-41945, GHSA-h8pj-cxx2-jfg2, PYSEC-2022-183 | Critical | 2.1% | 28 Apr, 2022 | PyPI httpx |
Integer bounds error in Vyper CVE-2022-24845, GHSA-j2x6-9323-fp7h, PYSEC-2022-198 | Critical | 1.4% | 13 Apr, 2022 | PyPI vyper |
Buffer Overflow in vyper CVE-2022-24788, GHSA-4mrx-6fxm-8jpg, PYSEC-2022-197 | Critical | 1.0% | 13 Apr, 2022 | PyPI vyper |
SQL injection in apache-superset BIT-superset-2022-27479, CVE-2022-27479, GHSA-wh73-hpcg-v32j, PYSEC-2022-188 | Critical | 2.9% | 13 Apr, 2022 | PyPI apache-superset |
SQL Injection in Django BIT-django-2022-28346, CVE-2022-28346, GHSA-2gwj-7jmv-h26r, PYSEC-2022-190 | Critical | 18.7% | 12 Apr, 2022 | PyPI Django PyPI django |
SQL Injection in Django BIT-django-2022-28347, CVE-2022-28347, GHSA-w24h-v9qh-8gxj, PYSEC-2022-191 | Critical | 2.9% | 12 Apr, 2022 | PyPI Django PyPI django |
Inconsistent Interpretation of HTTP Requests in twisted.web CVE-2022-24801, GHSA-c2jg-hw38-jrqq, PYSEC-2022-195 | Critical | 2.8% | 04 Apr, 2022 | PyPI twisted |
Use of Externally-Controlled Format String in consoleme CVE-2022-27177, GHSA-74w3-2r77-fw5h, PYSEC-2022-189 | Critical | 2.3% | 01 Apr, 2022 | PyPI consoleme |
Poetry before v1.1.9 contains Untrusted Search Path CVE-2022-26184, GHSA-xr2c-5w89-63pv, PYSEC-2022-234 | Critical | 1.8% | 21 Mar, 2022 | PyPI poetry |
Insufficient Protection against HTTP Request Smuggling in mitmproxy CVE-2022-24766, GHSA-gcx2-gvj7-pxv3, PYSEC-2022-170 | Critical | 1.6% | 21 Mar, 2022 | PyPI mitmproxy |
HTTP/2 DoS Attacks: Ping, Reset, and Settings Floods GHSA-32gv-6cf3-wcmq | Critical | Not scored | 14 Mar, 2022 | PyPI twisted |
Command injection in libvcs and vcspull CVE-2022-21187, GHSA-mv2w-4jqc-6fg4, PYSEC-2022-163, PYSEC-2026-563, SNYK-PYTHON-LIBVCS-2421204 | Critical | 3.6% | 14 Mar, 2022 | PyPI libvcs PyPI vcspull |
Path traversal in Pillow BIT-pillow-2022-24303, CVE-2022-24303, GHSA-9j59-75qj-795w, PYSEC-2022-168 | Critical | 2.7% | 11 Mar, 2022 | PyPI Pillow PyPI pillow |
Improper Authorization in cobbler CVE-2022-0860, GHSA-mcg6-h362-cmq5, PYSEC-2022-177 | Critical | 2.3% | 11 Mar, 2022 | PyPI cobbler |
Duplicate Advisory: Incorrect Authorization in Gerapy CVE-2021-44597, GHSA-29vr-79w7-p649, PYSEC-2022-228 | Critical | Not scored | 10 Mar, 2022 | PyPI gerapy |
Server-Side Request Forgery in calibreweb CVE-2022-0767, GHSA-h65g-jfqg-2w6m, PYSEC-2026-306 | Critical | 1.0% | 07 Mar, 2022 | PyPI calibreweb |
Server-Side Request Forgery in calibreweb CVE-2022-0766, GHSA-2647-c639-qv2j, PYSEC-2026-304 | Critical | 1.3% | 07 Mar, 2022 | PyPI calibreweb |
Code Injection in PyTorch Lightning CVE-2022-0845, GHSA-r5qj-cvf9-p85h, PYSEC-2022-181, PYSEC-2026-3969 | Critical | 1.0% | 05 Mar, 2022 | PyPI lightning PyPI pytorch-lightning |
NULL Pointer Dereference and Access of Uninitialized Pointer in TensorFlow GHSA-h6gw-r52c-724r | Critical | Not scored | 09 Feb, 2022 | PyPI tensorflow PyPI tensorflow-cpu PyPI tensorflow-gpu |
Integer overflow in TensorFlow BIT-tensorflow-2022-23587, CVE-2022-23587, GHSA-8jj7-5vxc-pg2q, PYSEC-2022-151, PYSEC-2022-96, PYSEC-2026-3137 | Critical | 0.9% | 04 Feb, 2022 | PyPI tensorflow PyPI tensorflow-cpu PyPI tensorflow-gpu |
Server-Side Request Forgery in calibreweb CVE-2022-0339, GHSA-4w8p-x6g8-fv64, PYSEC-2022-23 | Critical | 1.0% | 30 Jan, 2022 | PyPI calibreweb |
calibre-web is vulnerable to Business Logic Errors CVE-2021-4171, GHSA-xp7p-3gx7-j6wx, PYSEC-2026-307 | Critical | 1.4% | 17 Jan, 2022 | PyPI calibreweb |
Arbitrary expression injection in Pillow BIT-pillow-2022-22817, CVE-2022-22817, GHSA-8vj2-vxx3-667w, PYSEC-2022-10 | Critical | 3.3% | 10 Jan, 2022 | PyPI Pillow PyPI pillow |
Gerapy may cause remote code execution CVE-2021-43857, GHSA-9w7f-m4j4-j3xw, PYSEC-2021-867 | Critical | 55.6% | 27 Dec, 2021 | PyPI gerapy |
vault-cli contains possible RCE when reading user-defined data CVE-2021-43837, GHSA-q34h-97wf-8r8j, PYSEC-2021-853 | Critical | 5.2% | 16 Dec, 2021 | PyPI vault-cli |
Files on the host computer can be accessed from the Gradio interface CVE-2021-43831, GHSA-rhq2-3vr9-6mcr, PYSEC-2021-873 | Critical | 3.9% | 15 Dec, 2021 | PyPI gradio |
django-helpdesk is vulnerable to Cross-site Scripting CVE-2021-3994, GHSA-2v5j-q74q-r53f, PYSEC-2021-438 | Critical | 1.4% | 01 Dec, 2021 | PyPI django-helpdesk |
Improper Neutralization of Formula Elements in a CSV File in html-2-csv CVE-2021-23654, GHSA-fwf6-rw69-hhj4, PYSEC-2021-866, SNYK-PYTHON-HTMLTOCSV-1582784 | Critical | 1.2% | 26 Nov, 2021 | PyPI html-to-csv |
Arbitrary file reading vulnerability in Aim CVE-2021-43775, GHSA-8phj-f9w2-cjcc, PYSEC-2021-839 | Critical | 1.9% | 23 Nov, 2021 | PyPI aim |
Asterix Heap-based Buffer Overflow CVE-2021-44144, GHSA-6mmf-v5q7-vw2w, PYSEC-2021-860 | Critical | 1.2% | 22 Nov, 2021 | PyPI asterix-decoder PyPI asterix_decoder |
Improper Verification of Cryptographic Signature in starkbank-ecdsa CVE-2021-43572, GHSA-92vm-mxjf-jqf3, PYSEC-2021-426 | Critical | 1.2% | 09 Nov, 2021 | PyPI starkbank-ecdsa |
Incomplete validation in boosted trees code BIT-tensorflow-2021-41208, CVE-2021-41208, GHSA-57wx-m983-2f88, PYSEC-2021-400, PYSEC-2021-617, PYSEC-2021-815 | Critical | 0.2% | 05 Nov, 2021 | PyPI tensorflow PyPI tensorflow-cpu PyPI tensorflow-gpu |
XML External Entity vulnerability in Easy-XML CVE-2020-26705, GHSA-v899-28g4-qmh8, PYSEC-2021-388 | Critical | 1.3% | 31 Oct, 2021 | PyPI easy-xml |
Improper Access Control in jupyterhub-firstuseauthenticator CVE-2021-41194, GHSA-5xvc-vgmp-jgc3, PYSEC-2021-384 | Critical | 1.4% | 28 Oct, 2021 | PyPI jupyterhub-firstuseauthenticator |
Workers for local Dask clusters mistakenly listened on public interfaces CVE-2021-42343, GHSA-hwqr-f3v9-hwxr, GHSA-j8fq-86c5-5v2r, PYSEC-2021-387, PYSEC-2021-871, PYSEC-2021-872 | Critical | 3.0% | 26 Oct, 2021 | PyPI dask PyPI distributed |
Nameko Arbitrary code execution due to YAML deserialization CVE-2021-41078, GHSA-6p52-jr3q-c94g, PYSEC-2021-383 | Critical | 1.5% | 19 Oct, 2021 | PyPI nameko |
Policies not properly enforced in bluemonday CVE-2021-42576, GHSA-x95h-979x-cf3j, GO-2022-0588, PYSEC-2021-849 | Critical | 1.6% | 18 Oct, 2021 | Go github.com/microcosm-cc/bluemonday PyPI pybluemonday |
Ops CLI Deserialization of Untrusted Data vulnerability CVE-2021-40720, GHSA-x23q-4j9j-9cxw, PYSEC-2021-380 | Critical | 9.5% | 15 Oct, 2021 | PyPI ops-cli |
Inconsistent input sanitisation leads to XSS vectors CVE-2021-41132, GHSA-g67g-hvc3-xmvf, PYSEC-2021-372, PYSEC-2021-379 | Critical | 1.0% | 14 Oct, 2021 | PyPI omero-figure PyPI omero-web |