Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Remote unauthenticated attackers able to upload files in Onionshare CVE-2021-41868, GHSA-7g47-xxff-9p85, PYSEC-2026-434 | Critical | 2.4% | 04 Oct, 2021 | PyPI onionshare-cli |
Cobbler before 3.3.0 allows log poisoning CVE-2021-40323, GHSA-cpqf-3c3r-c9g2, PYSEC-2021-373 | Critical | 86.8% | 04 Oct, 2021 | PyPI cobbler |
Lacking Protection against HTTP Request Smuggling in mitmproxy CVE-2021-39214, GHSA-22gh-3r9q-xf38, PYSEC-2021-328 | Critical | 1.1% | 16 Sep, 2021 | PyPI mitmproxy |
Missing Authentication for Critical Function in Apache Airflow BIT-airflow-2021-38540, CVE-2021-38540, GHSA-h88f-r7cw-8fv3, PYSEC-2021-326 | Critical | 80.9% | 09 Sep, 2021 | PyPI apache-airflow |
AdaptiveScale LXDUI Hardcoded JWT Secret Key CVE-2021-40494, GHSA-p4xh-4869-8vrg, PYSEC-2021-342 | Critical | 1.7% | 03 Sep, 2021 | PyPI lxdui |
Command Injection in Simiki CVE-2020-19001, GHSA-w873-xcqq-x922, PYSEC-2021-348 | Critical | 4.3% | 27 Aug, 2021 | PyPI simiki |
remote code execution via git repo provider CVE-2021-39159, GHSA-9jjr-qqfp-ppwx, PYSEC-2021-371 | Critical | 1.9% | 25 Aug, 2021 | PyPI binderhub |
OpenStack Neutron vulnerable to hardware address impersonation CVE-2021-38598, GHSA-hvm4-mc7m-22w4, PYSEC-2021-360 | Critical | 1.2% | 23 Aug, 2021 | PyPI neutron |
Lin-CMS-Flask vulnerable to Improper Authentication CVE-2020-18698, GHSA-h6r2-pgvx-683c, PYSEC-2021-339 | Critical | 2.0% | 16 Aug, 2021 | PyPI Lin-CMS PyPI lin-cms |
Incorrect Access Control in Lin-CMS-Flask v0.1.1 allows remote attackers to obtain sensitive information and/or gain privileges due to the application not invalidating a user's authentication token upon logout, which allows for replaying packets. CVE-2020-18701, PYSEC-2021-341 | Critical | 2.3% | 16 Aug, 2021 | PyPI lin-cms |
Improper Restriction of XML External Entity Reference in Quokka CVE-2020-18703, GHSA-3xg5-6c3j-vp8x, PYSEC-2021-144 | Critical | 2.8% | 16 Aug, 2021 | PyPI quokka |
Unrestricted Upload of File with Dangerous Type in django-widgy CVE-2020-18704, GHSA-98hv-qff3-8793, PYSEC-2021-336 | Critical | 2.9% | 16 Aug, 2021 | PyPI django-widgy |
Improper Restriction of XML External Entity Reference in Quokka CVE-2020-18705, GHSA-4q2r-qxp6-h5j6, PYSEC-2021-145 | Critical | 2.8% | 16 Aug, 2021 | PyPI quokka |
Improper Authorization and Origin Validation Error in OneFuzz CVE-2021-37705, GHSA-q5vh-6whw-x745, PYSEC-2021-344 | Critical | 2.4% | 13 Aug, 2021 | PyPI onefuzz |
JupyterLab: XSS due to lack of sanitization of the action attribute of an html <form> BIT-jupyterlab-2021-32797, CVE-2021-32797, GHSA-4952-p58q-6crx, PYSEC-2021-130, PYSEC-2026-688 | Critical | 2.7% | 09 Aug, 2021 | PyPI jupyterlab PyPI notebook |
Special Element Injection in notebook BIT-jupyter-base-notebook-2021-32798, BIT-jupyter-notebook-2021-32798, CVE-2021-32798, GHSA-hwvq-6gjx-j797, PYSEC-2021-118 | Critical | 2.1% | 09 Aug, 2021 | PyPI notebook |
XML External Entity Reference in Glances CVE-2021-23418, GHSA-r2mj-8wgq-73m6, PYSEC-2021-115, SNYK-PYTHON-GLANCES-1311807 | Critical | 1.7% | 29 Jul, 2021 | PyPI Glances PyPI glances |
Buffer Overflow in Pillow BIT-pillow-2021-34552, CVE-2021-34552, GHSA-7534-mm45-c74v, PYSEC-2021-331 | Critical | 3.2% | 13 Jul, 2021 | PyPI pillow |
SQL Injection in Django BIT-django-2021-35042, CVE-2021-35042, GHSA-xpfp-f569-q3p2, PYSEC-2021-109 | Critical | 44.4% | 02 Jul, 2021 | PyPI Django PyPI django |
The Fuck Arbitrary File Deletion via Path Traversal CVE-2021-34363, GHSA-8wwf-2644-f8x4, PYSEC-2021-97 | Critical | 1.8% | 10 Jun, 2021 | PyPI thefuck |
Out-of-bounds Read in Pillow BIT-pillow-2021-25287, CVE-2021-25287, GHSA-77gc-v2xv-rvvh, PYSEC-2021-137 | Critical | 2.9% | 02 Jun, 2021 | PyPI Pillow PyPI pillow |
Pillow Out-of-bounds Read vulnerability BIT-pillow-2021-25288, CVE-2021-25288, GHSA-rwv7-3v45-hg29, PYSEC-2021-138 | Critical | 2.4% | 02 Jun, 2021 | PyPI Pillow PyPI pillow |
Incorrect Permission Assignment for Critical Resource in Plone CVE-2021-33509, GHSA-hm2p-fhwx-9285, PYSEC-2021-81 | Critical | 2.0% | 21 May, 2021 | PyPI Plone PyPI plone |
Deserialization of Untrusted Data in Flask-Caching CVE-2021-33026, GHSA-656c-6cxf-hvcv | Critical | 7.3% | 13 May, 2021 | PyPI Flask-Caching PyPI flask-caching |
Command injection in LocalStack CVE-2021-32090, GHSA-hpr6-f4vq-mxch, PYSEC-2021-101 | Critical | 2.1% | 07 May, 2021 | PyPI localstack |
Path traversal in impacket CVE-2021-31800, GHSA-mj63-64x7-57xf, PYSEC-2021-17 | Critical | 19.4% | 05 May, 2021 | PyPI impacket |
SQL Injection via in django-debug-toolbar CVE-2021-30459, GHSA-pghf-347x-c2gj, PYSEC-2021-10 | Critical | 1.9% | 14 Apr, 2021 | PyPI django-debug-toolbar |
Improper Neutralization of Argument Delimiters in a Decompiling Package Process in APKLeaks CVE-2021-21386, GHSA-8434-v7xw-8m9x, PYSEC-2026-281 | Critical | 2.3% | 24 Mar, 2021 | PyPI APKLeaks PyPI apkleaks |
Out of bounds write in Pillow BIT-pillow-2021-25289, CVE-2021-25289, GHSA-57h3-9rgr-c24m, PYSEC-2021-35 | Critical | 2.3% | 19 Mar, 2021 | PyPI pillow |
SaltStack Salt Improper Authentication vulnerability CVE-2021-25281, GHSA-xxw3-765m-f37p, PYSEC-2021-50 | Critical | 73.1% | 27 Feb, 2021 | PyPI salt |
SaltStack Salt Directory Traversal vulnerability CVE-2021-25282, GHSA-76x4-x3p6-rpr9, PYSEC-2021-51 | Critical | 92.4% | 27 Feb, 2021 | PyPI salt |
SaltStack Salt Server Side Template Injection CVE-2021-25283, GHSA-xgmh-gfxw-2hvv, PYSEC-2021-52 | Critical | 10.2% | 27 Feb, 2021 | PyPI salt |
SaltStack Salt eauth tokens can be used once after expiration CVE-2021-3144, GHSA-w2hr-3mc8-46gh, PYSEC-2021-54 | Critical | 5.1% | 27 Feb, 2021 | PyPI salt |
SaltStack Salt command injection in the Salt-API when using the Salt-SSH client CVE-2021-3148, GHSA-ghc2-hx3w-jqmp, PYSEC-2021-55 | Critical | 8.2% | 27 Feb, 2021 | PyPI salt |
SaltStack Salt is vulnerable to shell injection via ProxyCommand argument CVE-2021-3197, GHSA-8rp6-x3r7-5qw3, PYSEC-2021-57 | Critical | 71.7% | 27 Feb, 2021 | PyPI salt |
Improper Input Validation in PyYAML CVE-2020-14343, GHSA-8q59-q68h-6hv4, PYSEC-2021-142 | Critical | 6.0% | 09 Feb, 2021 | PyPI PyYAML PyPI pyyaml |
PyCA Cryptography symmetrically encrypting large values can lead to integer overflow CVE-2020-36242, GHSA-rhm9-p9w5-fwm7, PYSEC-2021-63 | Critical | 6.7% | 07 Feb, 2021 | PyPI cryptography |
git-big-picture Code Execution CVE-2021-3028, GHSA-x38j-4rr5-hqrj, PYSEC-2021-15 | Critical | 2.9% | 13 Jan, 2021 | PyPI git-big-picture |
pwntools Server-Side Template Injection (SSTI) vulnerability CVE-2020-28468, GHSA-7xc5-ggpp-g249, PYSEC-2021-72, SNYK-PYTHON-PWNTOOLS-1047345 | Critical | 4.4% | 08 Jan, 2021 | PyPI pwntools |
Arbitrary code execution in clickhouse-driver BIT-clickhouse-2020-26759, CVE-2020-26759, GHSA-vgv5-cxvh-vfxh, PYSEC-2021-61 | Critical | 2.7% | 06 Jan, 2021 | PyPI clickhouse-driver |
jsonpickle unsafe deserialization CVE-2020-22083, GHSA-j66q-qmrc-89rx, PYSEC-2020-49 | Critical | 6.5% | 17 Dec, 2020 | PyPI jsonpickle |
XXE in petl CVE-2020-29128, GHSA-69q2-p9xp-739v, GHSA-f5gc-p5m3-v347, PYSEC-2020-75 | Critical | 2.3% | 26 Nov, 2020 | PyPI petl |
Implementation trusts the "me" field returned by the authorization server without verifying it GHSA-mjcr-rqjg-rhg3 | Critical | Not scored | 24 Nov, 2020 | PyPI datasette-indieauth |
MoinMoin vulnerable to remote code execution via cache action CVE-2020-25074, GHSA-52q8-877j-gghq, PYSEC-2020-67 | Critical | 6.6% | 10 Nov, 2020 | PyPI moin |
Authentication bypass in Apache Airflow BIT-airflow-2020-13927, CVE-2020-13927, GHSA-hhx9-p69v-cx2j, PYSEC-2020-18 | CriticalExploited | 99.8% | 10 Nov, 2020 | PyPI apache-airflow |
LDAP authentication bypass with empty password CVE-2020-26214, GHSA-5hmm-x8q8-w5jh, PYSEC-2020-159 | Critical | 65.9% | 06 Nov, 2020 | PyPI alerta-server |
SaltStack Salt Command Injection in netapi ssh client CVE-2020-16846, GHSA-qr38-h96j-2j3w, PYSEC-2020-104 | CriticalExploited | 99.6% | 06 Nov, 2020 | PyPI salt |
SaltStack Salt Improper Validation of eauth credentials and tokens in salt-netapi CVE-2020-25592, GHSA-29j3-2446-5j4w, PYSEC-2020-106 | Critical | 56.8% | 06 Nov, 2020 | PyPI salt |
Markdown-supplied Shell Command Execution CVE-2020-15271, GHSA-c84h-w6cr-5v8q, PYSEC-2020-61 | Critical | 2.3% | 26 Oct, 2020 | PyPI lookatme |
libtaxii Server-Side Request Forgery vulnerability CVE-2020-27197, GHSA-836c-xg97-8p4h, PYSEC-2020-59 | Critical | 2.3% | 17 Oct, 2020 | PyPI libtaxii |