Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
PaddlePaddle nullptr dereference in paddle.crop CVE-2023-52312, GHSA-qppw-c37g-xwcc, PYSEC-2024-144 | High | 0.5% | 03 Jan, 2024 | PyPI PaddlePaddle PyPI paddlepaddle |
PaddlePaddle floating point exception in paddle.argmin and paddle.argmax CVE-2023-52313, GHSA-275c-w5mq-v5m2, PYSEC-2024-145 | High | 0.5% | 03 Jan, 2024 | PyPI PaddlePaddle PyPI paddlepaddle |
PaddlePaddle command injection in convert_shape_compare CVE-2023-52314, GHSA-3cr5-2446-8pg3, PYSEC-2024-146 | Critical | 1.2% | 03 Jan, 2024 | PyPI PaddlePaddle PyPI paddlepaddle |
Hail relies on OIDC email claims to verify the validity of a user's domain. CVE-2023-51663, GHSA-487p-qx68-5vjw, PYSEC-2023-271 | Medium | 0.4% | 29 Dec, 2023 | PyPI hail |
A vulnerability, which was classified as critical, has been found in MicroPython 1.21.0/1.22.0-preview. Affected by this issue is the function poll_set_add_fd of the file extmod/modselect.c. The manipulation leads to use after free. The exploit has been disclosed to the public and may be used. The p CVE-2023-7152, PYSEC-2023-256, PYSEC-2023-257, PYSEC-2023-258, PYSEC-2023-259 | Critical | 0.9% | 29 Dec, 2023 | PyPI micropython-copy PyPI micropython-io PyPI micropython-os PyPI micropython-select |
DoS with algorithms that use PBKDF2 due to unbounded PBES2 Count value CVE-2023-6681, GHSA-cw2r-4p82-qv79, PYSEC-2024-104 | Medium | 0.9% | 28 Dec, 2023 | PyPI jwcrypto |
Open redirect vulnerability in Flask-Security-Too CVE-2023-49438, GHSA-672h-6x89-76m5, PYSEC-2023-248 | Medium | 1.1% | 26 Dec, 2023 | PyPI Flask-Security-Too PyPI flask-security-too |
Malicious release: Malicious code in multicolored (PyPI) MAL-2023-8765 | Malicious | Not scored | 25 Dec, 2023 | PyPI multicolored |
Malicious release: Malicious code in vibrant (PyPI) MAL-2023-8770 | Malicious | Not scored | 25 Dec, 2023 | PyPI vibrant |
Malicious release: Malicious code in richcolor (PyPI) MAL-2023-8769 | Malicious | Not scored | 25 Dec, 2023 | PyPI richcolor |
Malicious release: Malicious code in excaliburx (PyPI) MAL-2023-8764 | Malicious | Not scored | 25 Dec, 2023 | PyPI excaliburx |
Malicious release: Malicious code in enchantv (PyPI) MAL-2023-8763 | Malicious | Not scored | 25 Dec, 2023 | PyPI enchantv |
Malicious release: Malicious code in newpackagetest2027 (PyPI) MAL-2023-8767 | Malicious | Not scored | 25 Dec, 2023 | PyPI newpackagetest2027 |
Malicious release: Malicious code in newpackagetest2028 (PyPI) MAL-2023-8768 | Malicious | Not scored | 25 Dec, 2023 | PyPI newpackagetest2028 |
Malicious release: Malicious code in newpackagetest2026 (PyPI) MAL-2023-8766 | Malicious | Not scored | 25 Dec, 2023 | PyPI newpackagetest2026 |
Nautobot missing object-level permissions enforcement when running Job Buttons CVE-2023-51649, GHSA-vf5m-xrhm-v999, PYSEC-2023-287 | Medium | 0.4% | 22 Dec, 2023 | PyPI nautobot |
Gradio makes the `/file` secure against file traversal and server-side request forgery attacks CVE-2023-51449, GHSA-6qm2-wpxq-7qh2, PYSEC-2023-249 | High | 28.3% | 21 Dec, 2023 | PyPI gradio |
Apache Airflow has a stored cross-site scripting vulnerability BIT-airflow-2023-47265, CVE-2023-47265, GHSA-pxch-wr7m-rwxj, PYSEC-2023-264 | Medium | 1.3% | 21 Dec, 2023 | PyPI apache-airflow |
Apache Airflow vulnerable to Exposure of Resource to Wrong Sphere BIT-airflow-2023-48291, CVE-2023-48291, GHSA-8f57-wcmg-4jmh, PYSEC-2023-265 | Medium | 1.8% | 21 Dec, 2023 | PyPI apache-airflow |
Apache Airflow Cross-Site Request Forgery vulnerability BIT-airflow-2023-49920, CVE-2023-49920, GHSA-6m9r-7wrx-xmr6, PYSEC-2023-266 | Medium | 1.0% | 21 Dec, 2023 | PyPI apache-airflow |
Apache Airflow Improper Access Control vulnerability BIT-airflow-2023-50783, CVE-2023-50783, GHSA-5938-79hg-xh3q, PYSEC-2023-267 | Medium | 1.4% | 21 Dec, 2023 | PyPI apache-airflow |
transformers has a Deserialization of Untrusted Data vulnerability CVE-2023-7018, GHSA-v68g-wm8c-6x7j, PYSEC-2023-301 | High | 0.7% | 20 Dec, 2023 | PyPI transformers |
MLflow Local File Disclosure Vulnerability BIT-mlflow-2023-6977, CVE-2023-6977, GHSA-qg8p-32gr-gh6x, PYSEC-2026-1659 | High | 3.9% | 20 Dec, 2023 | PyPI mlflow |
MLflow Path Traversal Vulnerability BIT-mlflow-2023-6976, CVE-2023-6976, GHSA-wv8q-4f85-2p8p, PYSEC-2026-1662 | High | 1.0% | 20 Dec, 2023 | PyPI mlflow |
MLFlow Path Traversal Vulnerability BIT-mlflow-2023-6975, CVE-2023-6975, GHSA-hh8p-p8mp-gqhm, PYSEC-2026-422 | Critical | 2.0% | 20 Dec, 2023 | PyPI mlflow |
MLflow Server-Side Request Forgery (SSRF) BIT-mlflow-2023-6974, CVE-2023-6974, GHSA-59v3-898r-qwhj, PYSEC-2026-416 | Critical | 1.5% | 20 Dec, 2023 | PyPI mlflow |
Expired tokens can be renewed without validating the account password GHSA-9wgg-m99q-hhfc | High | Not scored | 19 Dec, 2023 | PyPI emailproxy |
transformers has a Deserialization of Untrusted Data vulnerability CVE-2023-6730, GHSA-3863-2447-669p, PYSEC-2023-300 | Critical | 0.9% | 19 Dec, 2023 | PyPI transformers |
Apache Superset SQL injection vulnerability BIT-superset-2023-49736, CVE-2023-49736, GHSA-jfxj-xf67-x723, PYSEC-2026-1184 | High | 1.2% | 19 Dec, 2023 | PyPI apache-superset |
Apache Superset incorrect write permissions vulnerability BIT-superset-2023-49734, CVE-2023-49734, GHSA-g49j-j489-3xpf, PYSEC-2026-1180 | High | 0.9% | 19 Dec, 2023 | PyPI apache-superset |
Apache Superset uncontrolled resource consumption BIT-superset-2023-46104, CVE-2023-46104, GHSA-95mg-jgfx-54v9, PYSEC-2026-1167 | Medium | 1.7% | 19 Dec, 2023 | PyPI apache-superset |
mlflow Command Injection vulnerability BIT-mlflow-2023-6940, CVE-2023-6940, GHSA-hvc6-42vf-jhf8, PYSEC-2026-1652 | High | 1.2% | 19 Dec, 2023 | PyPI mlflow |
Maloja error page XSS vulnerability GHSA-4h72-34j6-j8x7 | Medium | Not scored | 18 Dec, 2023 | PyPI malojaserver |
AsyncSSH vulnerable to Prefix Truncation Attack (a.k.a. Terrapin Attack) against ChaCha20-Poly1305 and Encrypt-then-MAC GHSA-hfmc-7525-mj55 | Medium | Not scored | 18 Dec, 2023 | PyPI asyncssh |
Prefix Truncation Attack against ChaCha20-Poly1305 and Encrypt-then-MAC aka Terrapin CVE-2023-48795, GHSA-45x7-px36-x8w8, GO-2023-2402, PYSEC-2026-1758 | Medium | 93.5% | 18 Dec, 2023 | Go golang.org/x/crypto PyPI paramiko crates.io russh |
Ansible symlink attack vulnerability CVE-2023-5115, GHSA-jpvw-p8pr-9g2x, PYSEC-2026-1120 | Medium | 1.0% | 18 Dec, 2023 | PyPI ansible |
MLflow Path Traversal Vulnerability BIT-mlflow-2023-6909, CVE-2023-6909, GHSA-5r3q-93q3-f978, PYSEC-2023-252 | High | 89.7% | 18 Dec, 2023 | PyPI mlflow |
GitHub Security Lab (GHSL) Vulnerability Report: Arbitary write GHSL-2023-182 CVE-2023-50731, GHSA-j8w6-2r9h-cxhj, PYSEC-2023-279 | Critical | 1.0% | 15 Dec, 2023 | PyPI mindsdb |
User accounts disclosed to unauthenticated actors on the LAN CVE-2023-50715, GHSA-jqpc-rc7g-vf83, PYSEC-2026-1451 | Medium | 0.9% | 15 Dec, 2023 | PyPI homeassistant |
Path traversal in MLflow BIT-mlflow-2023-6831, CVE-2023-6831, GHSA-554w-xh4j-8w64, PYSEC-2023-253 | Critical | 3.3% | 15 Dec, 2023 | PyPI mlflow |
Gradio Exposure of Sensitive Information to an Unauthorized Actor vulnerability CVE-2023-6572, GHSA-gqvf-3hgp-5hxv, PYSEC-2023-255 | Critical | 1.7% | 14 Dec, 2023 | PyPI gradio |
External Control of File Name or Path in h2oai/h2o-3 CVE-2023-6569, GHSA-gqrq-j6pm-98c2, PYSEC-2026-350 | Critical | 0.7% | 14 Dec, 2023 | PyPI h2o |
Out of memory error when submitting the dataset form with a specially-crafted field CVE-2023-50248, GHSA-7fgc-89cx-w8j5, PYSEC-2026-1249 | Medium | 0.6% | 13 Dec, 2023 | PyPI ckan |
Improper validation in meraki GHSA-6x4h-9622-fqr6 | High | Not scored | 13 Dec, 2023 | PyPI meraki |
incorrect storage layout for contracts containing large arrays CVE-2023-46247, GHSA-6m97-7527-mh74, PYSEC-2023-307 | High | 0.7% | 13 Dec, 2023 | PyPI vyper |
Path traversal in MLflow BIT-mlflow-2023-6753, CVE-2023-6753, GHSA-v945-r3rc-6fjm, PYSEC-2023-309 | High | 1.1% | 13 Dec, 2023 | PyPI mlflow |
Unauthenticated db-file-storage views CVE-2023-50263, GHSA-75mc-3pjc-727q, PYSEC-2023-286 | Medium | 0.7% | 12 Dec, 2023 | PyPI nautobot |
Ansible template injection vulnerability CVE-2023-5764, GHSA-7j69-qfc3-2fq9, PYSEC-2026-1122 | High | 0.6% | 12 Dec, 2023 | PyPI ansible-core |
Exposure of Sensitive Information in mltable CVE-2023-35625, GHSA-m5pc-86x8-wcxg, PYSEC-2026-1664 | Medium | 0.7% | 12 Dec, 2023 | PyPI mltable |
Jinja2 template injection in mlflow BIT-mlflow-2023-6709, CVE-2023-6709, GHSA-cxfr-5q3r-2rc2, PYSEC-2023-281 | High | 0.9% | 12 Dec, 2023 | PyPI mlflow |