Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
OpenZeppelin Contracts contains Improper Verification of Cryptographic Signature CVE-2023-23940, GHSA-626q-v9j4-mcp4, PYSEC-2023-39 | Medium | 0.2% | 02 Feb, 2023 | PyPI openzeppelin-cairo-contracts |
Path traversal in ubi-reader CVE-2023-0591, GHSA-vp2x-3mc3-3cj4, PYSEC-2023-51 | Medium | 0.4% | 31 Jan, 2023 | PyPI ubi-reader |
safeurl-python contains Server-Side Request Forgery CVE-2023-24622, GHSA-jgh8-vchw-q3g7, PYSEC-2023-298 | Medium | 0.6% | 27 Jan, 2023 | PyPI safeurl-python |
Cross-site Scripting in modoboa CVE-2023-0519, GHSA-jm3m-wr3p-hjrq, PYSEC-2023-31 | Medium | 0.5% | 26 Jan, 2023 | PyPI modoboa |
Cross-site Scripting in pyload-ng CVE-2023-0488, GHSA-wcm6-wv95-7jw6, PYSEC-2026-907 | Medium | 0.8% | 26 Jan, 2023 | PyPI pyload-ng |
OpenStack Cinder, glance, and Nova vulnerable to Path Traversal CVE-2022-47951, GHSA-7h75-hwxx-qpgc, PYSEC-2026-2411, PYSEC-2026-2490, PYSEC-2026-868 | Medium | 1.0% | 26 Jan, 2023 | PyPI cinder PyPI glance PyPI nova |
Cross-site Scripting in modoboa CVE-2023-0470, GHSA-c467-5c2g-jp86, PYSEC-2023-30 | Medium | 0.6% | 26 Jan, 2023 | PyPI modoboa |
LTI 1.3 Grade Pass Back Implementation has Missing Authorization Vulnerability CVE-2023-23611, GHSA-7j9p-67mm-5g87, PYSEC-2023-21 | Medium | 0.4% | 26 Jan, 2023 | PyPI lti-consumer-xblock |
Path traversal in spotipy CVE-2023-23608, GHSA-q764-g6fm-555v, PYSEC-2026-926 | Medium | 0.7% | 23 Jan, 2023 | PyPI spotipy |
Cross-Site Request Forgery in modoboa CVE-2023-0438, GHSA-9c64-x3cx-vgmm, PYSEC-2023-284 | Medium | 0.3% | 23 Jan, 2023 | PyPI modoboa |
Cross-Site Request Forgery in modoboa CVE-2023-0406, GHSA-g298-59pg-93h7, PYSEC-2023-283 | Medium | 0.4% | 19 Jan, 2023 | PyPI modoboa |
Modoboa is vulnerable to Cross-Site Request Forgery CVE-2023-0398, GHSA-v9gj-5rgp-w33r, PYSEC-2023-282 | Medium | 0.4% | 19 Jan, 2023 | PyPI modoboa |
OpenStack Swift XML external entities (XXE) Injection CVE-2022-47950, GHSA-274c-rx2j-2v3x, PYSEC-2026-927 | Medium | 1.0% | 18 Jan, 2023 | PyPI swift |
pgAdmin 4 Open Redirect vulnerability CVE-2023-22298, GHSA-894c-rg7f-3c62, PYSEC-2026-894 | Medium | 1.0% | 17 Jan, 2023 | PyPI pgadmin4 |
Apache Superset has Improper Access Control BIT-superset-2022-45438, CVE-2022-45438, GHSA-8f5j-mgx9-5hm5, PYSEC-2026-778 | Medium | 1.3% | 16 Jan, 2023 | PyPI apache-superset |
Apache Superset Open Redirect vulnerability BIT-superset-2022-43721, CVE-2022-43721, GHSA-fcg4-pm6h-9xx2, PYSEC-2026-781 | Medium | 1.0% | 16 Jan, 2023 | PyPI apache-superset |
Apache Superset vulnerable to Injection BIT-superset-2022-43720, CVE-2022-43720, GHSA-fpmr-qmgh-42x2, PYSEC-2026-782 | Medium | 1.3% | 16 Jan, 2023 | PyPI apache-superset |
Apache Superset is vulnerable to Cross-Site Scripting (XSS) BIT-superset-2022-43718, CVE-2022-43718, GHSA-79x5-cv79-49rj, PYSEC-2026-777 | Medium | 1.2% | 16 Jan, 2023 | PyPI apache-superset |
Apache Superset vulnerable to Cross-site Scripting BIT-superset-2022-43717, CVE-2022-43717, GHSA-9f88-wg5r-947j, PYSEC-2026-779 | Medium | 1.3% | 16 Jan, 2023 | PyPI apache-superset |
Apache Superset's SQL Alchemy connector vulnerable to SQL Injection BIT-superset-2022-41703, CVE-2022-41703, GHSA-cxvp-3frm-3876, PYSEC-2026-780 | Medium | 1.2% | 16 Jan, 2023 | PyPI apache-superset |
Pyload Insufficient Session Expiration vulnerability CVE-2023-0227, GHSA-rv9x-wmw4-44qj, PYSEC-2026-906 | Medium | 0.7% | 12 Jan, 2023 | PyPI pyload-ng |
dompurify vulnerable to Cross-site Scripting GHSA-h6p3-p4vx-wr8q | Medium | Not scored | 11 Jan, 2023 | PyPI dompurify |
dompurify vulnerable to Cross-site Scripting GHSA-pgjv-jrg2-gq3v | Medium | Not scored | 11 Jan, 2023 | PyPI dompurify |
django-ucamlookup Cross-site Scripting vulnerability CVE-2016-15010, GHSA-pjx4-3f3p-29v3, PYSEC-2023-14 | Medium | 0.6% | 05 Jan, 2023 | PyPI django-ucamlookup |
LdapCherry Cross-site Scripting vulnerbaility CVE-2019-25095, GHSA-vq8w-x8v7-f88m, PYSEC-2023-19 | Medium | 0.6% | 05 Jan, 2023 | PyPI ldapcherry |
pyLoad vulnerable to Improper Restriction of Rendered UI Layers or Frames CVE-2023-0057, GHSA-h8r9-467r-vjjf, PYSEC-2026-904 | Medium | 0.5% | 05 Jan, 2023 | PyPI pyload-ng |
Pyload contains Sensitive Cookie in HTTPS Session Without 'Secure' Attribute CVE-2023-0055, GHSA-m3g7-wrrq-v5c8, PYSEC-2026-905 | Medium | 0.5% | 04 Jan, 2023 | PyPI pyload-ng |
nsupdate.info has Sensitive Cookie Without 'HttpOnly' Flag CVE-2019-25091, GHSA-mwvp-qr62-cvjx, PYSEC-2026-885 | Medium | 0.7% | 27 Dec, 2022 | PyPI nsupdate |
Graphite Web Cross-site Scripting vulnerability CVE-2022-4730, GHSA-m973-4vpc-x43c, PYSEC-2026-819 | Medium | 0.8% | 27 Dec, 2022 | PyPI graphite-web |
Graphite Web Cross-site Scripting vulnerability CVE-2022-4729, GHSA-q99p-78hp-xg5c, PYSEC-2026-820 | Medium | 0.8% | 27 Dec, 2022 | PyPI graphite-web |
Graphite Web Cross-site Scripting vulnerability CVE-2022-4728, GHSA-3c5x-4hvx-qrrr, PYSEC-2026-818 | Medium | 0.8% | 27 Dec, 2022 | PyPI graphite-web |
rdiffweb vulnerable to Special Element Injection CVE-2022-4721, GHSA-83pm-7v48-5jp4, PYSEC-2022-43007 | Medium | 0.5% | 27 Dec, 2022 | PyPI rdiffweb |
binwalk vulnerable to UNIX Symbolic Link (Symlink) Following CVE-2021-4287, GHSA-8m3f-g62j-3vx8, PYSEC-2026-788 | Medium | 2.1% | 27 Dec, 2022 | PyPI binwalk |
rdiffweb Open Redirect vulnerability CVE-2022-4644, GHSA-639f-hxcv-84mc, PYSEC-2022-43003 | Medium | 0.6% | 22 Dec, 2022 | PyPI rdiffweb |
collective.contact.widget is vulnerable to cross-site scripting CVE-2022-4638, GHSA-5pqf-rvm7-3wgw, PYSEC-2022-42988 | Medium | 0.4% | 21 Dec, 2022 | PyPI collective-contact-widget PyPI collective.contact.widget |
Terms and Conditions Module vulnerable to Open Redirect CVE-2022-4589, GHSA-6rmf-cv6p-4h27, PYSEC-2026-805 | Medium | 0.5% | 17 Dec, 2022 | PyPI django-termsandconditions |
django-photologue vulnerable to Cross-site Scripting CVE-2022-4526, GHSA-287q-jfcp-9vhv, PYSEC-2022-43061 | Medium | 0.6% | 15 Dec, 2022 | PyPI django-photologue |
collective.task Cross-site Scripting vulnerability CVE-2022-4527, GHSA-4r9h-x77w-mffv, PYSEC-2022-42990 | Medium | 0.6% | 15 Dec, 2022 | PyPI collective-task PyPI collective.task |
The Apache Bookkeeper Java Client (before 4.14.6 and also 4.15.0) does not close the connection to the bookkeeper server when TLS hostname verification fails. This leaves
the bookkeeper client vulnerable to a man in the middle attack.
The problem affects BookKeeper client prior to versions 4.14.6 a CVE-2022-32531, GHSA-gxq5-79m2-gvvq, PYSEC-2022-43060 | Medium | 1.1% | 15 Dec, 2022 | PyPI apache-bookkeeper-client |
collective.dms.basecontent Cross-site Scripting vulnerability CVE-2022-4495, GHSA-r48c-4vfj-h426, PYSEC-2022-42989 | Medium | 0.5% | 14 Dec, 2022 | PyPI collective-dms-basecontent PyPI collective.dms.basecontent |
pyRdfa3 Cross-site Scripting vulnerability CVE-2022-4396, GHSA-894q-wpg5-mf2h, PYSEC-2026-910 | Medium | 0.6% | 10 Dec, 2022 | PyPI pyRdfa3 PyPI pyrdfa3 |
Sentry vulnerable to invite code reuse via cookie manipulation CVE-2022-23485, GHSA-jv85-mqxj-3f9j, PYSEC-2022-43011 | Medium | 0.5% | 10 Dec, 2022 | PyPI sentry |
GuardDog vulnerable to arbitrary file write when scanning a specially-crafted remote PyPI package CVE-2022-23530, GHSA-78m5-jpmf-ch7v, PYSEC-2022-42993 | Medium | 0.8% | 05 Dec, 2022 | PyPI guarddog |
OS Command Injection in Apache Airflow BIT-airflow-2022-40954, CVE-2022-40954, GHSA-45r6-j3cc-6mxx, PYSEC-2026-770 | Medium | 1.4% | 22 Nov, 2022 | PyPI apache-airflow |
Cross-site Scripting in kiwitcms CVE-2022-4105, GHSA-hf94-8mx5-2vvj, PYSEC-2026-837 | Medium | 0.5% | 21 Nov, 2022 | PyPI kiwitcms |
Rdiffweb vulnerable to Missing Authentication for Critical Function CVE-2022-4018, GHSA-4wph-9vrm-6v3w, PYSEC-2022-43001 | Medium | 0.9% | 16 Nov, 2022 | PyPI rdiffweb |
Apache Airflow Contains Open Redirect BIT-airflow-2022-45402, CVE-2022-45402, GHSA-rg94-84xj-7gq3, PYSEC-2022-42984 | Medium | 81.8% | 15 Nov, 2022 | PyPI apache-airflow |
Lin CMS vulnerable to Improper Authentication CVE-2022-44244, GHSA-4vrc-q7m6-vq7w, PYSEC-2026-839 | Medium | 1.1% | 09 Nov, 2022 | Maven io.github.talelin:lin-cms-core PyPI Lin-CMS PyPI lin-cms |
diplib Double Free CVE-2021-39432, GHSA-xf2w-5673-h6ww, PYSEC-2022-43131 | Medium | 0.9% | 04 Nov, 2022 | PyPI diplib |
Vulnerable OpenSSL included in cryptography wheels GHSA-39hc-v87j-747x | Medium | Not scored | 02 Nov, 2022 | PyPI cryptography |