Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Improper Privilege Management in sap-xssec CVE-2023-50423, GHSA-6mjg-37cp-42x5, PYSEC-2023-261 | Critical | 1.1% | 12 Dec, 2023 | PyPI sap-xssec |
Improper Input Validation in mindsdb CVE-2023-49796, GHSA-crhp-7c74-cg4c, PYSEC-2023-278 | Medium | 0.5% | 11 Dec, 2023 | PyPI mindsdb |
Server-Side Request Forgery in mindsdb CVE-2023-49795, GHSA-34mr-6q8x-g9r6, PYSEC-2023-277 | Medium | 0.4% | 11 Dec, 2023 | PyPI mindsdb |
Local Privilege Escalation in Windows CVE-2023-49797, GHSA-9w2p-rh8c-v9g5, PYSEC-2023-292 | High | 0.3% | 09 Dec, 2023 | PyPI pyinstaller |
dbt-core's secret env vars written to package-lock.json in plaintext GHSA-j4g3-3q8x-jxqp | Low | Not scored | 08 Dec, 2023 | PyPI dbt-core |
DockerSpawner allows any image by default CVE-2023-48311, GHSA-hfgr-h3vc-p6c2, PYSEC-2026-1312 | Medium | 0.6% | 08 Dec, 2023 | PyPI dockerspawner |
Cross-site Scripting (XSS) in MLflow BIT-mlflow-2023-6568, CVE-2023-6568, GHSA-vwhf-3v6x-wff8, PYSEC-2023-260 | Medium | 1.6% | 07 Dec, 2023 | PyPI mlflow |
pubnub Insufficient Entropy vulnerability CVE-2023-26154, GHSA-5844-q3fc-56rh, GO-2023-2385, PYSEC-2026-1807 | Medium | 1.0% | 06 Dec, 2023 | Go github.com/pubnub/go Go github.com/pubnub/go/v5 Go github.com/pubnub/go/v6 Go github.com/pubnub/go/v7 +10 more |
PyDrive2's unsafe YAML deserialization in LoadSettingsFile allows arbitrary code execution CVE-2023-49297, GHSA-v5f6-hjmf-9mc5, PYSEC-2023-291 | High | 0.5% | 05 Dec, 2023 | PyPI PyDrive2 PyPI pydrive2 |
Information exposure in MLflow BIT-mlflow-2023-43472, CVE-2023-43472, GHSA-wqxf-447m-6f5f, PYSEC-2026-1661 | High | 36.6% | 05 Dec, 2023 | PyPI mlflow |
jupyter-server errors include tracebacks with path information CVE-2023-49080, GHSA-h56g-gq9v-vc8r, PYSEC-2023-272 | Medium | 0.8% | 04 Dec, 2023 | PyPI jupyter-server |
Cookie leakage between different users in fastapi-proxy-lib GHSA-7vwr-g6pm-9hc8 | High | Not scored | 01 Dec, 2023 | PyPI fastapi-proxy-lib |
Reflected XSS Vulnerability in dpaste CVE-2023-49277, GHSA-r8j9-5cj7-cv39, PYSEC-2026-1317 | Medium | 0.5% | 01 Dec, 2023 | PyPI Dpaste PyPI dpaste |
cryptography vulnerable to NULL-dereference when loading PKCS7 certificates CVE-2023-49083, GHSA-jfhm-5ghh-2f97, PYSEC-2023-254 | High | 1.0% | 28 Nov, 2023 | PyPI cryptography |
Apache Superset Allocation of Resources Without Limits or Throttling vulnerability BIT-superset-2023-42504, CVE-2023-42504, GHSA-3hp7-4qq4-v5c6, PYSEC-2026-1157 | Medium | 1.1% | 28 Nov, 2023 | PyPI apache-superset |
Apache Superset Exposure of Sensitive Information to an Unauthorized Actor vulnerability BIT-superset-2023-42505, CVE-2023-42505, GHSA-fgpw-4w69-j256, PYSEC-2026-1174 | Medium | 1.0% | 28 Nov, 2023 | PyPI apache-superset |
Apache Superset Open Redirect vulnerability BIT-superset-2023-42502, CVE-2023-42502, GHSA-hc74-9vjm-c9xv, PYSEC-2026-1182 | Medium | 0.8% | 28 Nov, 2023 | PyPI apache-superset |
Ray has arbitrary code execution via jobs submission API CVE-2023-48022, GHSA-6wgj-66m2-xxp2, PYSEC-2026-517 | Critical | 83.9% | 28 Nov, 2023 | PyPI ray |
aiohttp's ClientSession is vulnerable to CRLF injection via version CVE-2023-49081, GHSA-q3qx-c6g2-7pw2, PYSEC-2023-250 | Medium | 0.9% | 27 Nov, 2023 | PyPI aiohttp |
aiohttp's ClientSession is vulnerable to CRLF injection via method CVE-2023-49082, GHSA-qvrw-v9rv-5rjx, PYSEC-2023-251 | Medium | 0.9% | 27 Nov, 2023 | PyPI aiohttp |
aiohttp has vulnerable dependency that is vulnerable to request smuggling GHSA-pjjw-qhg8-p2p9 | Medium | Not scored | 27 Nov, 2023 | PyPI aiohttp |
Apache Superset Cross-site Scripting vulnerability BIT-superset-2023-43701, CVE-2023-43701, GHSA-wq8q-99p5-xfrw, PYSEC-2026-1190 | Medium | 1.0% | 27 Nov, 2023 | PyPI apache-superset |
Apache Superset has Incorrect Default Permissions BIT-superset-2023-42501, CVE-2023-42501, GHSA-vv65-fjfj-4736, PYSEC-2026-1188 | Medium | 0.9% | 27 Nov, 2023 | PyPI apache-superset |
Apache Superset - Elevation of Privilege BIT-superset-2023-40610, CVE-2023-40610, GHSA-f678-j579-4xf5, PYSEC-2026-1173 | High | 1.3% | 27 Nov, 2023 | PyPI apache-superset |
Ethereum ABI decoder DoS when parsing ZST GHSA-rqr8-pxh7-cq3g | Medium | Not scored | 24 Nov, 2023 | PyPI eth-abi |
Apache DolphinScheduler sensitive information disclosure CVE-2023-48796, GHSA-4vvc-r4p4-qgrr, PYSEC-2023-268 | High | 1.2% | 24 Nov, 2023 | Maven org.apache.dolphinscheduler:dolphinscheduler PyPI apache-dolphinscheduler |
Cross-site Scripting potential in custom links, job buttons, and computed fields CVE-2023-48705, GHSA-cf9f-wmhp-v4pr, PYSEC-2023-285 | High | 0.5% | 22 Nov, 2023 | PyPI nautobot |
SQL injection in Apache Submarine CVE-2023-37924, GHSA-v5gj-fx3g-hcpw, PYSEC-2023-244 | Critical | 7.2% | 22 Nov, 2023 | PyPI apache-submarine |
Malicious release: Malicious code in azureml-contrib-daskonbatch (PyPI) MAL-2023-8563 | Malicious | Not scored | 22 Nov, 2023 | PyPI azureml-contrib-daskonbatch |
Malicious release: Malicious code in yelp-cgeom1 (PyPI) MAL-2023-8564 | Malicious | Not scored | 22 Nov, 2023 | PyPI yelp-cgeom1 |
Clear Text Credentials Exposed via Onboarding Task CVE-2023-48700, GHSA-qf3c-rw9f-jh7v, PYSEC-2023-288 | Medium | 0.4% | 21 Nov, 2023 | PyPI nautobot-device-onboarding |
Download to arbitrary folder can lead to RCE CVE-2023-47890, GHSA-h73m-pcfw-25h2, PYSEC-2026-1819 | High | 1.1% | 21 Nov, 2023 | PyPI pyload-ng |
Eval Injection in fastbots CVE-2023-48699, GHSA-vccg-f4gp-45x9 | Critical | 0.7% | 21 Nov, 2023 | PyPI fastbots |
TorchServe ZipSlip CVE-2023-48299, GHSA-m2mj-pr4f-h9jp, PYSEC-2026-1972 | Medium | 0.7% | 21 Nov, 2023 | PyPI torchserve |
upydev has weak encryption padding CVE-2023-48051, GHSA-qc4j-hrj6-cppf, PYSEC-2023-302 | High | 0.2% | 20 Nov, 2023 | PyPI upydev |
Deserialization of Untrusted Data in apache-submarine CVE-2023-46302, GHSA-8hcr-5x2g-9f7j, PYSEC-2023-240 | Critical | 1.7% | 20 Nov, 2023 | PyPI apache-submarine |
Malicious release: Malicious code in discomusic (PyPI) MAL-2023-8540 | Malicious | Not scored | 18 Nov, 2023 | PyPI discomusic |
Ibis PyArrow dependency allows arbitrary code execution when loading a malicious data file GHSA-x563-6hqv-26mr | Critical | Not scored | 17 Nov, 2023 | PyPI ibis-framework |
Ray Missing Authorization vulnerability CVE-2023-6020, GHSA-6cxr-8q3m-jwrr, PYSEC-2026-516 | Critical | 14.7% | 16 Nov, 2023 | PyPI ray |
MLflow authentication requirement bypass can allow a user to arbitrarily create an account BIT-mlflow-2023-6014, CVE-2023-6014, GHSA-4qq5-mxxx-m6gg, PYSEC-2026-415 | Critical | 1.2% | 16 Nov, 2023 | PyPI mlflow |
HTTPie allows attackers to eavesdrop on communications between the host and server via a man-in-the-middle attack CVE-2023-48052, GHSA-8r96-8889-qg2x, PYSEC-2023-242 | High | 0.3% | 16 Nov, 2023 | PyPI httpie |
Missing SSL certificate validation in localstack CVE-2023-48054, GHSA-8633-g3ph-97rp, PYSEC-2023-243 | High | 0.3% | 16 Nov, 2023 | PyPI localstack |
PyPinkSign uses a non-random or static IV for Cipher Block Chaining (CBC) mode in AES encryption CVE-2023-48056, GHSA-fxff-wxxv-c2jc, PYSEC-2023-245 | High | 0.4% | 16 Nov, 2023 | PyPI pypinksign |
Cross-Site Request Forgery vulnerability in Prefect CVE-2023-6022, GHSA-4hh5-2678-83fx, PYSEC-2026-1799 | High | 0.4% | 16 Nov, 2023 | PyPI prefect |
Ray Path Traversal vulnerability CVE-2023-6021, GHSA-3pww-qvr8-6mhp, PYSEC-2026-515 | Critical | 37.1% | 16 Nov, 2023 | PyPI ray |
Ray OS Command Injection vulnerability CVE-2023-6019, GHSA-h3xg-wv58-5p43, PYSEC-2026-519 | Critical | 74.6% | 16 Nov, 2023 | PyPI ray |
Remote Code Execution due to Full Controled File Write in mlflow BIT-mlflow-2023-6018, CVE-2023-6018, GHSA-5p3h-7fwh-92rc, PYSEC-2026-417 | Critical | 47.9% | 16 Nov, 2023 | PyPI mlflow |
MLflow allowed arbitrary files to be PUT onto the server BIT-mlflow-2023-6015, CVE-2023-6015, GHSA-f798-qm4r-23r5, PYSEC-2026-420 | Critical | 4.5% | 16 Nov, 2023 | PyPI mlflow |
Ethyca Fides Cryptographically Weak Generation of One-Time Codes for Identity Verification CVE-2023-48224, GHSA-82vr-5769-6358, PYSEC-2026-1336 | Critical | 1.0% | 15 Nov, 2023 | PyPI ethyca-fides |
yt-dlp Generic Extractor MITM Vulnerability via Arbitrary Proxy Injection CVE-2023-46121, GHSA-3ch3-jhc6-5r8x, PYSEC-2026-2063 | Medium | 0.3% | 15 Nov, 2023 | PyPI yt-dlp |