Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Open Babel has out-of-bounds write in MOPAC translationVectors[] (FINAL POINT) CVE-2022-46293, GHSA-7h6r-6p76-68c9, PYSEC-2026-2775 | High | 0.9% | 21 Jul, 2023 | PyPI openbabel |
Open Babel has out-of-bounds write in MOPAC translationVectors[] (UNIT CELL TRANSLATION) CVE-2022-46292, GHSA-55f6-pf8r-c2f4, PYSEC-2026-2771 | High | 0.8% | 21 Jul, 2023 | PyPI openbabel |
Open Babel has out-of-bounds write in Gaussian translationVectors[] CVE-2022-46291, GHSA-jg3h-pv7c-4f9c, PYSEC-2026-2783 | High | 0.8% | 21 Jul, 2023 | PyPI openbabel |
Open Babel has out-of-bounds write in ORCA nAtoms parser (second variant) CVE-2022-46290, GHSA-5rff-8f7c-8jmw, PYSEC-2026-2773 | High | 0.8% | 21 Jul, 2023 | PyPI openbabel |
Open Babel has out-of-bounds write in ORCA nAtoms parser CVE-2022-46289, GHSA-rj4c-r689-cm87, PYSEC-2026-2790 | High | 0.8% | 21 Jul, 2023 | PyPI openbabel |
Open Babel has uninitialized pointer dereference in PQS pFormat CVE-2022-46280, GHSA-8qxc-57hf-hc9j, PYSEC-2026-2777 | High | 0.8% | 21 Jul, 2023 | PyPI openbabel |
Open Babel has uninitialized pointer dereference in MSI atom parser CVE-2022-44451, GHSA-jr2x-6qf6-q5mc, PYSEC-2026-2784 | High | 0.8% | 21 Jul, 2023 | PyPI openbabel |
Open Babel has out-of-bounds write in MOL2 attribute/value parser CVE-2022-43607, GHSA-vjg6-gm8m-v5g6, PYSEC-2026-2792 | High | 0.8% | 21 Jul, 2023 | PyPI openbabel |
Open Babel has out-of-bounds write in PQS coord_file parser CVE-2022-43467, GHSA-f29h-2h58-48r7, PYSEC-2026-2779 | High | 0.8% | 21 Jul, 2023 | PyPI openbabel |
Open Babel has uninitialized pointer dereference in GRO residue parser CVE-2022-42885, GHSA-mw5r-wq2m-397c, PYSEC-2026-2787 | High | 0.8% | 21 Jul, 2023 | PyPI openbabel |
Open Babel has out-of-bounds write in CSR PadString (title field) CVE-2022-41793, GHSA-p594-7xw4-g76p, PYSEC-2026-2788 | High | 0.8% | 21 Jul, 2023 | PyPI openbabel |
Open Babel has out-of-bounds write in Gaussian coords_type orientation parser CVE-2022-37331, GHSA-vr3p-gg26-45v9, PYSEC-2026-2793 | High | 0.7% | 21 Jul, 2023 | PyPI openbabel |
copyparty vulnerable to reflected cross-site scripting via hc parameter GHSA-cw7j-v52w-fp5r | Medium | Not scored | 21 Jul, 2023 | PyPI copyparty |
Indico vulnerable to Cross-Site-Scripting via confirmation prompts CVE-2023-37901, GHSA-fmqq-25x9-c6hm, PYSEC-2023-129 | Medium | 0.5% | 21 Jul, 2023 | PyPI indico |
aiohttp.web.Application vulnerable to HTTP request smuggling via llhttp HTTP request parser CVE-2023-37276, GHSA-45c4-8wx5-qw6w, PYSEC-2023-120 | High | 1.3% | 19 Jul, 2023 | PyPI aiohttp |
keylime fails to flag device as untrusted when signature does not validate CVE-2023-3674, GHSA-g4wg-cfpf-9689, PYSEC-2023-128 | Medium | 0.2% | 19 Jul, 2023 | PyPI keylime |
Pygments vulnerable to ReDoS CVE-2022-40896, GHSA-mrwq-x4v8-fh7p, PYSEC-2023-117 | Medium | 0.5% | 19 Jul, 2023 | PyPI Pygments PyPI pygments |
MLflow Path Traversal vulnerability BIT-mlflow-2023-3765, CVE-2023-3765, GHSA-fmxj-6h9g-6vw3, PYSEC-2023-308 | Critical | 67.3% | 19 Jul, 2023 | PyPI mlflow |
Fides Webserver Vulnerable to SVG Bomb File Uploads CVE-2023-37481, GHSA-3rw2-wfc8-wmj5, PYSEC-2026-1332 | Medium | 0.7% | 18 Jul, 2023 | PyPI ethyca-fides |
Fides Webserver Vulnerable to Zip Bomb File Uploads CVE-2023-37480, GHSA-g95c-2jgm-hqc6, PYSEC-2026-1342 | Medium | 0.7% | 18 Jul, 2023 | PyPI ethyca-fides |
postgraas-server vulnerable to SQL injection CVE-2018-25088, GHSA-vghm-8cjp-hjw6, PYSEC-2026-460 | Critical | 0.7% | 18 Jul, 2023 | PyPI postgraas-server |
copyparty vulnerable to path traversal attack CVE-2023-37474, GHSA-pxfv-7rr3-2qjg, PYSEC-2023-127 | High | 44.9% | 14 Jul, 2023 | PyPI copyparty |
cryptography mishandles SSH certificates CVE-2023-38325, GHSA-cf7p-gm2m-833m, PYSEC-2023-112 | High | 0.7% | 14 Jul, 2023 | PyPI cryptography |
Apache Airflow Apache Hive Provider Improper Input Validation vulnerability CVE-2023-37415, GHSA-4q2q-q5pw-2342, PYSEC-2026-1139 | High | 1.6% | 13 Jul, 2023 | PyPI apache-airflow-providers-apache-hive |
Malicious release: Malicious code in barcodegeneratorqr (PyPI) MAL-2023-1354 | Malicious | Not scored | 12 Jul, 2023 | PyPI barcodegeneratorqr |
Apache Airflow information disclosure vulnerability BIT-airflow-2022-46651, CVE-2022-46651, GHSA-xvw9-3mhm-xjqq, PYSEC-2023-103 | High | 1.2% | 12 Jul, 2023 | PyPI apache-airflow |
Apache Airflow Path Traversal vulnerability BIT-airflow-2023-22887, CVE-2023-22887, GHSA-ggwr-4vr8-g7wv, PYSEC-2023-104 | High | 1.8% | 12 Jul, 2023 | PyPI apache-airflow |
Apache Airflow Improper Input Validation vulnerability BIT-airflow-2023-22888, CVE-2023-22888, GHSA-5946-8p38-vffp, PYSEC-2023-105 | High | 1.4% | 12 Jul, 2023 | PyPI apache-airflow |
Apache Airflow Incorrect Authorization vulnerability BIT-airflow-2023-35908, CVE-2023-35908, GHSA-2h84-3crq-vgfj, PYSEC-2023-119 | High | 1.0% | 12 Jul, 2023 | PyPI apache-airflow |
Apache Airflow Improper Input Validation vulnerability BIT-airflow-2023-36543, CVE-2023-36543, GHSA-3h4m-m55v-gx4m, PYSEC-2023-106 | High | 1.6% | 12 Jul, 2023 | PyPI apache-airflow |
xalpha vulnerable to Remote Code Execution CVE-2023-37659, GHSA-jx3q-5rgf-vrrr, PYSEC-2023-116 | Critical | 1.7% | 11 Jul, 2023 | PyPI xalpha |
Whatsapp-Chat-Exporter has Cross-Site Scripting vulnerability in HTML output of chats. GHSA-8c6x-g4fw-8rf4 | Medium | Not scored | 10 Jul, 2023 | PyPI Whatsapp-Chat-Exporter PyPI whatsapp-chat-exporter |
RestrictedPython vulnerable to arbitrary code execution via stack frame sandbox escape CVE-2023-37271, GHSA-wqc8-x2pr-7jqh, PYSEC-2023-118 | Critical | 0.8% | 10 Jul, 2023 | PyPI RestrictedPython PyPI restrictedpython |
Malicious release: Malicious code in servantcord (PyPI) MAL-2023-1407 | Malicious | Not scored | 07 Jul, 2023 | PyPI servantcord |
Sentry CORS misconfiguration CVE-2023-36829, GHSA-4xqm-4p72-87h6, PYSEC-2023-115 | Medium | 0.7% | 06 Jul, 2023 | PyPI sentry |
Withdrawn: Use after free in SciPy CVE-2023-29824, GHSA-jrfm-2h82-xg28, PYSEC-2023-114 | Critical | 1.3% | 06 Jul, 2023 | PyPI scipy |
yt-dlp File Downloader cookie leak CVE-2023-35934, GHSA-v8mc-9377-rwjj, PYSEC-2026-2067 | High | 1.0% | 06 Jul, 2023 | PyPI yt-dlp |
SQLFluff users with access to config file, using `libary_path` may call arbitrary python code CVE-2023-36830, GHSA-jqhc-m2j3-fjrx, PYSEC-2023-111 | High | 0.4% | 06 Jul, 2023 | PyPI sqlfluff |
langchain vulnerable to arbitrary code execution CVE-2023-36188, GHSA-57fc-8q82-gfp3, PYSEC-2023-109 | Critical | 1.9% | 06 Jul, 2023 | PyPI langchain |
langchain SQL Injection vulnerability CVE-2023-36189, GHSA-7q94-qpjr-xpgm, PYSEC-2023-110 | High | 1.2% | 06 Jul, 2023 | PyPI langchain |
Kiwi TCMS's misconfigured HTTP headers allow stored XSS execution with Firefox CVE-2023-36809, GHSA-jpgw-2r9m-8qfw, PYSEC-2026-1499 | High | 0.7% | 05 Jul, 2023 | PyPI kiwitcms |
ethyca-fides Webserver API Path Traversal vulnerability CVE-2023-36827, GHSA-r25m-cr6v-p9hq, PYSEC-2023-107 | High | 1.5% | 05 Jul, 2023 | PyPI ethyca-fides |
MechanicalSoup vulnerable to malicious web server reading arbitrary files on client using file input inside HTML form CVE-2023-34457, GHSA-x456-3ccm-m6j4, PYSEC-2023-108 | High | 1.1% | 05 Jul, 2023 | PyPI MechanicalSoup PyPI mechanicalsoup |
Withdrawn: scipy memory leak vulnerability CVE-2023-25399, GHSA-9jx5-6pgf-crrp, PYSEC-2023-102 | Medium | 0.4% | 05 Jul, 2023 | PyPI scipy |
langchain arbitrary code execution vulnerability CVE-2023-36258, GHSA-2qmj-7962-cjq8, PYSEC-2023-98 | Critical | 1.1% | 03 Jul, 2023 | PyPI langchain |
Products.CMFCore unauthenticated denial of service and crash via unchecked use of input with Python's marshal module CVE-2023-36814, GHSA-4hpj-8rhv-9x87, PYSEC-2023-113 | High | 0.7% | 03 Jul, 2023 | PyPI Products.CMFCore PyPI products-cmfcore |
Django has regular expression denial of service vulnerability in EmailValidator/URLValidator BIT-django-2023-36053, CVE-2023-36053, GHSA-jh3w-4vvf-mjgr, PYSEC-2023-100 | High | 3.0% | 03 Jul, 2023 | PyPI Django PyPI django |
Apache Airflow Hive Provider Beeline remote code execution with Principal CVE-2023-35797, GHSA-hg6c-qqcm-r79r, PYSEC-2026-273 | Critical | 2.8% | 03 Jul, 2023 | PyPI apache-airflow-providers-apache-hive |
Malicious release: Malicious code in pyjwtrequest (PyPI) MAL-2023-1392 | Malicious | Not scored | 01 Jul, 2023 | PyPI pyjwtrequest |
pipreqs vulnerable to Dependency Confusion CVE-2023-31543, GHSA-v4f4-23wc-99mh, PYSEC-2023-99 | Critical | 1.2% | 30 Jun, 2023 | PyPI pipreqs |