Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Out of memory error when submitting the dataset form with a specially-crafted field CVE-2023-50248, GHSA-7fgc-89cx-w8j5, PYSEC-2026-1249 | Medium | 0.6% | 13 Dec, 2023 | PyPI ckan |
Unauthenticated db-file-storage views CVE-2023-50263, GHSA-75mc-3pjc-727q, PYSEC-2023-286 | Medium | 0.8% | 12 Dec, 2023 | PyPI nautobot |
Exposure of Sensitive Information in mltable CVE-2023-35625, GHSA-m5pc-86x8-wcxg, PYSEC-2026-1664 | Medium | 0.7% | 12 Dec, 2023 | PyPI mltable |
Improper Input Validation in mindsdb CVE-2023-49796, GHSA-crhp-7c74-cg4c, PYSEC-2023-278 | Medium | 0.5% | 11 Dec, 2023 | PyPI mindsdb |
Server-Side Request Forgery in mindsdb CVE-2023-49795, GHSA-34mr-6q8x-g9r6, PYSEC-2023-277 | Medium | 0.4% | 11 Dec, 2023 | PyPI mindsdb |
DockerSpawner allows any image by default CVE-2023-48311, GHSA-hfgr-h3vc-p6c2, PYSEC-2026-1312 | Medium | 0.6% | 08 Dec, 2023 | PyPI dockerspawner |
Cross-site Scripting (XSS) in MLflow BIT-mlflow-2023-6568, CVE-2023-6568, GHSA-vwhf-3v6x-wff8, PYSEC-2023-260 | Medium | 1.7% | 07 Dec, 2023 | PyPI mlflow |
pubnub Insufficient Entropy vulnerability CVE-2023-26154, GHSA-5844-q3fc-56rh, GO-2023-2385, PYSEC-2026-1807 | Medium | 1.0% | 06 Dec, 2023 | Go github.com/pubnub/go Go github.com/pubnub/go/v5 Go github.com/pubnub/go/v6 Go github.com/pubnub/go/v7 +10 more |
jupyter-server errors include tracebacks with path information CVE-2023-49080, GHSA-h56g-gq9v-vc8r, PYSEC-2023-272 | Medium | 0.8% | 04 Dec, 2023 | PyPI jupyter-server |
Reflected XSS Vulnerability in dpaste CVE-2023-49277, GHSA-r8j9-5cj7-cv39, PYSEC-2026-1317 | Medium | 0.5% | 01 Dec, 2023 | PyPI Dpaste PyPI dpaste |
Apache Superset Allocation of Resources Without Limits or Throttling vulnerability BIT-superset-2023-42504, CVE-2023-42504, GHSA-3hp7-4qq4-v5c6, PYSEC-2026-1157 | Medium | 1.1% | 28 Nov, 2023 | PyPI apache-superset |
Apache Superset Exposure of Sensitive Information to an Unauthorized Actor vulnerability BIT-superset-2023-42505, CVE-2023-42505, GHSA-fgpw-4w69-j256, PYSEC-2026-1174 | Medium | 1.0% | 28 Nov, 2023 | PyPI apache-superset |
Apache Superset Open Redirect vulnerability BIT-superset-2023-42502, CVE-2023-42502, GHSA-hc74-9vjm-c9xv, PYSEC-2026-1182 | Medium | 0.8% | 28 Nov, 2023 | PyPI apache-superset |
aiohttp's ClientSession is vulnerable to CRLF injection via version CVE-2023-49081, GHSA-q3qx-c6g2-7pw2, PYSEC-2023-250 | Medium | 0.9% | 27 Nov, 2023 | PyPI aiohttp |
aiohttp's ClientSession is vulnerable to CRLF injection via method CVE-2023-49082, GHSA-qvrw-v9rv-5rjx, PYSEC-2023-251 | Medium | 0.9% | 27 Nov, 2023 | PyPI aiohttp |
aiohttp has vulnerable dependency that is vulnerable to request smuggling GHSA-pjjw-qhg8-p2p9 | Medium | Not scored | 27 Nov, 2023 | PyPI aiohttp |
Apache Superset Cross-site Scripting vulnerability BIT-superset-2023-43701, CVE-2023-43701, GHSA-wq8q-99p5-xfrw, PYSEC-2026-1190 | Medium | 1.0% | 27 Nov, 2023 | PyPI apache-superset |
Apache Superset has Incorrect Default Permissions BIT-superset-2023-42501, CVE-2023-42501, GHSA-vv65-fjfj-4736, PYSEC-2026-1188 | Medium | 0.9% | 27 Nov, 2023 | PyPI apache-superset |
Ethereum ABI decoder DoS when parsing ZST GHSA-rqr8-pxh7-cq3g | Medium | Not scored | 24 Nov, 2023 | PyPI eth-abi |
Clear Text Credentials Exposed via Onboarding Task CVE-2023-48700, GHSA-qf3c-rw9f-jh7v, PYSEC-2023-288 | Medium | 0.4% | 21 Nov, 2023 | PyPI nautobot-device-onboarding |
TorchServe ZipSlip CVE-2023-48299, GHSA-m2mj-pr4f-h9jp, PYSEC-2026-1972 | Medium | 0.7% | 21 Nov, 2023 | PyPI torchserve |
yt-dlp Generic Extractor MITM Vulnerability via Arbitrary Proxy Injection CVE-2023-46121, GHSA-3ch3-jhc6-5r8x, PYSEC-2026-2063 | Medium | 0.3% | 15 Nov, 2023 | PyPI yt-dlp |
Ansible galaxy-importer Path Traversal vulnerability CVE-2023-5189, GHSA-55g2-vm3q-7w52, PYSEC-2026-1401 | Medium | 1.0% | 14 Nov, 2023 | PyPI galaxy-importer |
Aiohttp has inconsistent interpretation of `Content-Length` vs. `Transfer-Encoding` differing in C and Python fallbacks CVE-2023-47641, GHSA-xx9p-xxvh-7g8j, PYSEC-2023-247 | Medium | 0.8% | 14 Nov, 2023 | PyPI aiohttp |
Apache Airflow allows authenticated and DAG-view authorized users to modify some DAG run detail values when submitting notes BIT-airflow-2023-47037, CVE-2023-47037, GHSA-hm9r-7f84-25c9, PYSEC-2023-232 | Medium | 1.5% | 12 Nov, 2023 | PyPI apache-airflow |
AsyncSSH Rogue Extension Negotiation CVE-2023-46445, GHSA-cfc2-wr2v-gxm5, PYSEC-2023-237 | Medium | 0.6% | 09 Nov, 2023 | PyPI asyncssh |
Ethyca Fides HTML Injection Vulnerability in HTML-Formatted DSR Packages CVE-2023-47114, GHSA-3vpf-mcj7-5h38, PYSEC-2026-1333 | Medium | 0.6% | 08 Nov, 2023 | PyPI ethyca-fides |
Synapse vulnerable to leak of remote user device information CVE-2023-43796, GHSA-mp92-3jfm-3575, PYSEC-2023-230 | Medium | 0.9% | 31 Oct, 2023 | PyPI matrix-synapse |
Possible Infinite Loop when PdfWriter(clone_from) is used with a PDF CVE-2023-46250, GHSA-wjcc-cq79-p63f, PYSEC-2026-1834 | Medium | 0.2% | 31 Oct, 2023 | PyPI pypdf |
twisted.web has disordered HTTP pipeline response CVE-2023-46137, GHSA-xc8x-vp79-p3wm, PYSEC-2023-224 | Medium | 0.9% | 25 Oct, 2023 | PyPI twisted |
Command Injection in pip when used with Mercurial CVE-2023-5752, GHSA-mq26-g339-26xf, PYSEC-2023-228 | Medium | 0.5% | 25 Oct, 2023 | PyPI pip |
Fides JavaScript Injection Vulnerability in Privacy Center URL CVE-2023-46126, GHSA-fgjj-5jmr-gh83, PYSEC-2026-1340 | Medium | 0.7% | 24 Oct, 2023 | PyPI ethyca-fides |
Fides Information Disclosure Vulnerability in Config API Endpoint CVE-2023-46125, GHSA-rjxg-rpg3-9r89, PYSEC-2026-1347 | Medium | 0.9% | 24 Oct, 2023 | PyPI ethyca-fides |
Apache Airflow vulnerable to Exposure of Sensitive Information BIT-airflow-2023-46288, CVE-2023-46288, GHSA-9qqg-mh7c-chfq, PYSEC-2023-218 | Medium | 1.8% | 23 Oct, 2023 | PyPI apache-airflow |
WebAssembly wabt 1.0.33 has an Out-of-Bound Memory Read in in DataSegment::IsValidRange(), which lead to segmentation fault. CVE-2023-46331, PYSEC-2023-319 | Medium | 0.2% | 23 Oct, 2023 | PyPI wabt |
WebAssembly wabt 1.0.33 contains an Out-of-Bound Memory Write in DataSegment::Drop(), which lead to segmentation fault. CVE-2023-46332, PYSEC-2023-320 | Medium | 0.3% | 23 Oct, 2023 | PyPI wabt |
Wagtail CRX CodeRed Extensions vulnerable to Path Traversal CVE-2021-46897, GHSA-h454-rq3m-89rc, PYSEC-2023-210 | Medium | 0.9% | 22 Oct, 2023 | PyPI coderedcms |
Django Grappelli Open Redirect vulnerability CVE-2021-46898, GHSA-9x43-5qcq-h79q, PYSEC-2023-211 | Medium | 0.6% | 22 Oct, 2023 | PyPI django-grappelli |
Home Assistant vulnerable to account takeover via auth_callback login CVE-2023-41893, GHSA-qhhj-7hrc-gqj5, PYSEC-2023-214 | Medium | 0.5% | 20 Oct, 2023 | PyPI homeassistant |
urllib3's request body not stripped after redirect from 303 status changes request method to GET CVE-2023-45803, GHSA-g4mx-q9vg-27p4, PYSEC-2023-212 | Medium | 0.6% | 17 Oct, 2023 | PyPI urllib3 |
Authorization Header forwarded on redirect CVE-2018-25091, GHSA-gwvm-45gx-3cf8, PYSEC-2023-207 | Medium | 0.6% | 15 Oct, 2023 | PyPI urllib3 |
Apache Airflow vulnerable to sensitive information exposure BIT-airflow-2023-42663, CVE-2023-42663, GHSA-32wr-qqw6-5mfp, PYSEC-2023-197 | Medium | 2.0% | 14 Oct, 2023 | PyPI apache-airflow |
Apache Airflow vulnerable to sensitive information exposure when users list warnings for all DAGs BIT-airflow-2023-42780, CVE-2023-42780, GHSA-cgx2-rrmr-jx43, PYSEC-2023-202 | Medium | 1.4% | 14 Oct, 2023 | PyPI apache-airflow |
Apache Airflow vulnerable to privilege escalation BIT-airflow-2023-42792, CVE-2023-42792, GHSA-j3w8-2p2h-mrr9, PYSEC-2023-203 | Medium | 1.9% | 14 Oct, 2023 | PyPI apache-airflow |
Apache Airflow vulnerable to sensitive information exposure when expose-config is set to non-sensitive-only BIT-airflow-2023-45348, CVE-2023-45348, GHSA-fpxx-xv4c-gxqp, PYSEC-2023-204 | Medium | 1.6% | 14 Oct, 2023 | PyPI apache-airflow |
Defining resource name as integer may give unintended access in vantage6 CVE-2023-28635, GHSA-7x94-6g2m-3hp2, PYSEC-2023-198, PYSEC-2026-2006 | Medium | 0.5% | 11 Oct, 2023 | PyPI vantage6 PyPI vantage6-node |
vantage6 does not properly delete linked resources when deleting a collaboration CVE-2023-41881, GHSA-rf54-7qrr-96j6, PYSEC-2023-200 | Medium | 0.4% | 11 Oct, 2023 | PyPI vantage6 |
Improper Access Control in vantage6 CVE-2023-41882, GHSA-gc57-xhh5-m94r, PYSEC-2023-201 | Medium | 0.5% | 11 Oct, 2023 | PyPI vantage6 |
Microsoft Common Data Model SDK Denial of Service Vulnerability CVE-2023-36566, GHSA-vm2m-7hpw-fpmq, PYSEC-2026-1261 | Medium | 3.0% | 10 Oct, 2023 | Maven com.microsoft.commondatamodel:objectmodel NuGet Microsoft.CommonDataModel.ObjectModel PyPI commondatamodel-objectmodel |
matrix-synapse vulnerable to denial of service due to malicious server ACL events CVE-2023-45129, GHSA-5chr-wjw5-3gq4, PYSEC-2023-199 | Medium | 1.4% | 10 Oct, 2023 | PyPI matrix-synapse |