Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
opencv-python versions before v4.8.1.78 bundled libwebp binaries in wheels that are vulnerable to CVE-2023-4863. opencv-python v4.8.1.78 upgrades the bundled libwebp binary to v1.3.2. PYSEC-2023-183 | Not scored | 29 Sep, 2023 | PyPI opencv-python | |
opencv-python-headless versions before v4.8.1.78 bundled libwebp binaries in wheels that are vulnerable to CVE-2023-4863. opencv-python-headless v4.8.1.78 upgrades the bundled libwebp binary to v1.3.2. PYSEC-2023-184 | Not scored | 29 Sep, 2023 | PyPI opencv-python-headless | |
When deserializing untrusted or corrupted data, it is possible for a reader to consume memory beyond the allowed constraints and thus lead to out of memory on the system.
This issue affects Java applications using Apache Avro Java SDK up to and including 1.11.2. Users should update to apache-avro CVE-2023-39410, GHSA-rhrv-645h-fjfh, PYSEC-2023-188 | High | 2.2% | 29 Sep, 2023 | PyPI avro |
Rdiffweb Allocation of Resources Without Limits or Throttling vulnerability CVE-2023-5289, GHSA-c4rv-2j6x-pq7x, PYSEC-2023-186 | High | 0.8% | 29 Sep, 2023 | PyPI rdiffweb |
pretix allows Pillow to parse EPS files CVE-2023-44464, GHSA-9jvx-p6mq-fw4v, PYSEC-2026-1801 | High | 0.3% | 29 Sep, 2023 | PyPI pretix |
TorchServe Server-Side Request Forgery vulnerability CVE-2023-43654, GHSA-8fxr-qfr9-p34w, PYSEC-2026-553 | Critical | 42.5% | 28 Sep, 2023 | PyPI torchserve |
pydash Command Injection vulnerability CVE-2023-26145, GHSA-8mjr-6c96-39w8, PYSEC-2023-179 | Critical | 3.6% | 28 Sep, 2023 | PyPI pydash |
Vyper's `_abi_decode` input not validated in complex expressions CVE-2023-42460, GHSA-cx2q-hfxr-rj97, PYSEC-2023-191 | High | 0.7% | 26 Sep, 2023 | PyPI vyper |
matrix-synapse vulnerable to improper validation of receipts allows forged read receipts CVE-2023-42453, GHSA-7565-cq32-vx2x, PYSEC-2023-180 | Medium | 0.8% | 26 Sep, 2023 | PyPI matrix-synapse |
matrix-synapse vulnerable to temporary storage of plaintext passwords during password changes CVE-2023-41335, GHSA-4f74-84v3-j9q5, PYSEC-2023-185 | Low | 0.4% | 26 Sep, 2023 | PyPI matrix-synapse |
Malicious release: Malicious code in kokokoako (PyPI) MAL-2023-8566 | Malicious | Not scored | 26 Sep, 2023 | PyPI kokokoako |
Malicious release: Malicious code in pyalsogkert (PyPI) MAL-2023-8568 | Malicious | Not scored | 26 Sep, 2023 | PyPI pyalsogkert |
Malicious release: Malicious code in pytasler (PyPI) MAL-2023-8588, SNYK-PYTHON-PYTASLER-6069630 | Malicious | Not scored | 26 Sep, 2023 | PyPI pytasler |
Searchor CLI's Search vulnerable to Arbitrary Code using Eval CVE-2023-43364, GHSA-66m2-493m-crh2, PYSEC-2023-262 | Critical | 2.9% | 25 Sep, 2023 | PyPI searchor |
yt-dlp on Windows vulnerable to `--exec` command injection when using `%q` CVE-2023-40581, GHSA-42h4-v29r-42qg, PYSEC-2026-2064 | High | 1.3% | 25 Sep, 2023 | PyPI yt-dlp |
Gevent allows remote attacker to escalate privileges CVE-2023-41419, GHSA-x7m3-jprg-wc5g, PYSEC-2023-177 | Critical | 1.8% | 25 Sep, 2023 | PyPI gevent |
Malicious release: Malicious code in pyioapso (PyPI) MAL-2023-8574, SNYK-PYTHON-PYIOAPSO-6069623 | Malicious | Not scored | 25 Sep, 2023 | PyPI pyioapso |
Malicious release: Malicious code in pykokalalz (PyPI) MAL-2023-8578, SNYK-PYTHON-PYKOKALALZ-6069633 | Malicious | Not scored | 25 Sep, 2023 | PyPI pykokalalz |
OpenStack Barbican information disclosure vulnerability CVE-2023-1636, GHSA-6rx9-c2rh-3qv4, PYSEC-2026-1214 | Medium | 0.5% | 24 Sep, 2023 | PyPI barbican |
OpenStack Barbican credential leak flaw CVE-2023-1633, GHSA-6qqp-4vm3-359v, PYSEC-2026-1213 | Medium | 0.2% | 24 Sep, 2023 | PyPI barbican |
OpenStack Heat information leak vulnerability CVE-2023-1625, GHSA-5836-grcc-8j89, PYSEC-2026-1751 | High | 0.7% | 24 Sep, 2023 | PyPI openstack-heat |
Malicious release: Malicious code in pyhjdddo (PyPI) MAL-2023-8572, SNYK-PYTHON-PYHJDDDO-6069617 | Malicious | Not scored | 24 Sep, 2023 | PyPI pyhjdddo |
Malicious release: Malicious code in pyktrkatoo (PyPI) MAL-2023-8580, SNYK-PYTHON-PYKTRKATOO-6069629 | Malicious | Not scored | 23 Sep, 2023 | PyPI pyktrkatoo |
Malicious release: Malicious code in pytarlooko (PyPI) MAL-2023-8587 | Malicious | Not scored | 23 Sep, 2023 | PyPI pytarlooko |
pgAdmin failed to properly control the server code CVE-2023-5002, GHSA-ghp8-52vx-77j4, PYSEC-2026-1774 | High | 1.8% | 22 Sep, 2023 | PyPI pgadmin4 |
Malicious release: Malicious code in pykooler (PyPI) MAL-2023-8579 | Malicious | Not scored | 22 Sep, 2023 | PyPI pykooler |
Malicious release: Malicious code in pystallerer (PyPI) MAL-2023-8585, SNYK-PYTHON-PYSTALLERER-6069641 | Malicious | Not scored | 22 Sep, 2023 | PyPI pystallerer |
Withdrawn Advisory: Mobile Security Framework (MobSF) Vulnerable to Insecure Permissions CVE-2023-42261, GHSA-cc8j-6phr-jv9x, PYSEC-2023-310 | High | 0.9% | 21 Sep, 2023 | PyPI mobsf |
plone.restapi vulnerable to Stored Cross Site Scripting with SVG image in user portrait GHSA-hc5c-r8m5-2gfh | Low | Not scored | 21 Sep, 2023 | PyPI plone-restapi PyPI plone.restapi |
Vulnerable OpenSSL included in cryptography wheels GHSA-v8gr-m533-ghj9 | Low | Not scored | 21 Sep, 2023 | PyPI cryptography |
Zope vulnerable to Stored Cross Site Scripting with SVG images CVE-2023-42458, GHSA-wm8q-9975-xh5v, PYSEC-2026-2077 | Medium | 0.7% | 21 Sep, 2023 | PyPI Zope PyPI zope |
plone.namedfile vulnerable to Stored Cross Site Scripting with SVG images CVE-2023-41048, GHSA-jj7c-jrv4-c65x, PYSEC-2023-311 | Medium | 0.6% | 21 Sep, 2023 | PyPI plone-namedfile PyPI plone.namedfile |
plone.rest vulnerable to Denial of Service when ++api++ is used many times CVE-2023-42457, GHSA-h6rp-mprm-xgcq, PYSEC-2023-178 | High | 1.0% | 21 Sep, 2023 | PyPI plone-rest PyPI plone.rest |
Malicious release: Malicious code in telethon2 (PyPI) MAL-2023-8369 | Malicious | Not scored | 21 Sep, 2023 | PyPI telethon2 |
ReportLab vulnerable to remote code execution via paraparser CVE-2019-19450, GHSA-pj98-2xf6-cff5, PYSEC-2026-522 | Critical | 6.0% | 20 Sep, 2023 | PyPI reportlab |
UNKNOWN READ in bytes1_char_at OSV-2023-885 | Not scored | 20 Sep, 2023 | PyPI mrab-regex | |
Pillow versions before v10.0.1 bundled libwebp binaries in wheels that are vulnerable to CVE-2023-5129 (previously CVE-2023-4863). Pillow v10.0.1 upgrades the bundled libwebp binary to v1.3.2. PYSEC-2023-175 | Not scored | 20 Sep, 2023 | PyPI pillow | |
imagecodecs versions before v2023.9.18 bundled libwebp binaries in wheels that are vulnerable to CVE-2023-5129 (previously CVE-2023-4863). imagecodecs v2023.9.18 upgrades the bundled libwebp binary to v1.3.2. PYSEC-2023-174 | Not scored | 20 Sep, 2023 | PyPI imagecodecs | |
Vyper vulnerable to memory corruption in certain builtins utilizing `msize` CVE-2023-42443, GHSA-c647-pxm2-c52w, PYSEC-2023-306 | High | 0.8% | 18 Sep, 2023 | PyPI vyper |
Vyper has incorrect re-entrancy lock when key is empty string CVE-2023-42441, GHSA-3hg2-r75x-g69m, PYSEC-2023-305 | Medium | 0.5% | 18 Sep, 2023 | PyPI vyper |
Malicious release: Malicious code in pylioner (PyPI) MAL-2023-8581 | Malicious | Not scored | 18 Sep, 2023 | PyPI pylioner |
Malicious release: Malicious code in pyowler (PyPI) MAL-2023-8583, SNYK-PYTHON-PYOWLER-6069632 | Malicious | Not scored | 18 Sep, 2023 | PyPI pyowler |
Malicious release: Malicious code in pystob (PyPI) MAL-2023-8586 | Malicious | Not scored | 17 Sep, 2023 | PyPI pystob |
Gradio arbitrary file upload vulnerability CVE-2023-41626, GHSA-v4q9-qgqf-7jwp, PYSEC-2026-1422 | Medium | 0.4% | 15 Sep, 2023 | PyPI gradio |
GeoNode vulnerable to SSRF Bypass to return internal host data CVE-2023-42439, GHSA-pxg5-h34r-7q8p, PYSEC-2023-176 | High | 1.0% | 15 Sep, 2023 | PyPI GeoNode PyPI geonode |
Apache HDFS Provider error message suggested CVE-2023-41267, GHSA-5hj9-m76g-xrc8, PYSEC-2026-1138 | High | 0.6% | 14 Sep, 2023 | PyPI apache-airflow-providers-apache-hdfs |
Denial of Service Vulnerability in gRPC TCP Server (Posix-compatible platforms) CVE-2023-4785, GHSA-p25m-jpj4-qcrr, PYSEC-2026-1428 | High | 0.8% | 13 Sep, 2023 | PyPI grpcio RubyGems grpc |
libwebp: OOB write in BuildHuffmanTable A-299477569, ASB-A-299477569, CVE-2023-4863, CVE-2023-5129, GHSA-j7hp-h8jx-5ppr, PYSEC-2026-1794, RUSTSEC-2023-0060, RUSTSEC-2023-0061 | HighExploited | 100.0% | 12 Sep, 2023 | Go github.com/chai2010/webp NuGet SkiaSharp NuGet magick.net-q16-anycpu NuGet magick.net-q16-hdri-anycpu +10 more |
Piccolo's current `BaseUser.login` implementation is vulnerable to time based user enumeration CVE-2023-41885, GHSA-h7cm-mrvq-wcfr, PYSEC-2023-173 | Medium | 0.6% | 12 Sep, 2023 | PyPI piccolo |
Malicious release: Malicious code in aws-consoler2 (PyPI) MAL-2023-8358 | Malicious | Not scored | 12 Sep, 2023 | PyPI aws-consoler2 |