Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Apache Airflow Cross-site Scripting vulnerability BIT-airflow-2022-43982, CVE-2022-43982, GHSA-h63r-9xxf-f2c7, PYSEC-2022-42970 | Medium | 1.8% | 02 Nov, 2022 | PyPI apache-airflow |
Apache Airflow Open Redirect vulnerability BIT-airflow-2022-43985, CVE-2022-43985, GHSA-f9fq-78ch-4wmj, PYSEC-2022-42971 | Medium | 1.8% | 02 Nov, 2022 | PyPI apache-airflow |
Apache Spark vulnerable to Log Injection BIT-spark-2022-31777, CVE-2022-31777, GHSA-43xg-8wmj-cw8h, PYSEC-2022-42976 | Medium | 1.8% | 01 Nov, 2022 | Maven org.apache.spark:spark-core_2.10 Maven org.apache.spark:spark-core_2.11 Maven org.apache.spark:spark-core_2.12 Maven org.apache.spark:spark-core_2.13 +2 more |
OpenStack Sushy-Tools and VirtualBMC Improper Preservation of Permissions CVE-2022-44020, GHSA-5pj3-6fqm-8m7m, PYSEC-2026-1059, PYSEC-2026-3079 | Medium | 0.2% | 30 Oct, 2022 | PyPI sushy-tools PyPI virtualbmc |
Twisted vulnerable to NameVirtualHost Host header injection CVE-2022-39348, GHSA-vg46-2rrj-3647, PYSEC-2026-1055 | Medium | 1.6% | 26 Oct, 2022 | PyPI twisted |
Plaintext storage of tokens in pulp_ansible CVE-2022-3644, GHSA-qv37-mfjf-42h8, PYSEC-2026-900 | Medium | 0.3% | 25 Oct, 2022 | PyPI pulp-ansible |
OctoPrint vulnerable to Special Element Injection CVE-2022-3607, GHSA-rj5f-vm79-5j84, PYSEC-2022-42975 | Medium | 0.4% | 19 Oct, 2022 | PyPI OctoPrint PyPI octoprint |
rdiffweb vulnerable to Open Redirect CVE-2022-3438, GHSA-8g9m-vv69-7j99, PYSEC-2022-43158 | Medium | 0.7% | 10 Oct, 2022 | PyPI rdiffweb |
Twisted vulnerable to HTTP Request Smuggling Attacks GHSA-8r99-h8j2-rw64 | Medium | Not scored | 07 Oct, 2022 | PyPI twisted |
rdiffweb allows a new password to be the same as the previous password CVE-2022-3376, GHSA-7wr6-fj4x-893v, PYSEC-2022-43157 | Medium | 0.8% | 06 Oct, 2022 | PyPI rdiffweb |
LIEF vulnerable to denial of service through segmentation fault CVE-2022-40923, GHSA-rm2x-hgr8-w343, PYSEC-2022-43139 | Medium | 0.8% | 30 Sep, 2022 | PyPI lief |
Inventree vulnerable to Stored Cross-site Scripting CVE-2022-3355, GHSA-62g7-fpv9-v95f, PYSEC-2026-823 | Medium | 0.9% | 29 Sep, 2022 | PyPI inventree |
rdiffweb vulnerable to password complexity bypass leading to weak passwords CVE-2022-3326, GHSA-8wxf-c45w-g66g, PYSEC-2022-297 | Medium | 0.7% | 29 Sep, 2022 | PyPI rdiffweb |
rdiffweb vulnerable to Use of Cache Containing Sensitive Information CVE-2022-3292, GHSA-7fqm-jm52-f9vc, PYSEC-2022-296 | Medium | 0.6% | 28 Sep, 2022 | PyPI rdiffweb |
rdiffweb vulnerable to Improper Cleanup on Thrown Exception CVE-2022-3301, GHSA-qq29-5vjh-vxwr, PYSEC-2022-295 | Medium | 0.7% | 26 Sep, 2022 | PyPI rdiffweb |
rdiffweb Cross-Site Request Forgery vulnerability CVE-2022-3267, GHSA-74j6-3hh4-w3f5, PYSEC-2022-284 | Medium | 0.4% | 22 Sep, 2022 | PyPI rdiffweb |
rdiffweb CSRF could lead to disabling notifications in user profile CVE-2022-3233, GHSA-9vxf-mcm6-5m42, PYSEC-2022-285 | Medium | 0.4% | 21 Sep, 2022 | PyPI rdiffweb |
rdiffweb has insecure HTTP cookies CVE-2022-3250, GHSA-m748-hjqg-rpp8, PYSEC-2022-287 | Medium | 0.5% | 21 Sep, 2022 | PyPI rdiffweb |
jwcrypto token substitution can lead to authentication bypass CVE-2022-3102, GHSA-gwp4-mcv4-w95j, PYSEC-2026-827 | Medium | Not scored | 21 Sep, 2022 | PyPI jwcrypto |
OctoPrint vulnerable to Insufficient Session Expiration. CVE-2022-2888, GHSA-937f-qh3w-6g87, PYSEC-2022-282 | Medium | 0.3% | 21 Sep, 2022 | PyPI OctoPrint PyPI octoprint |
OctoPrint vulnerable to Unrestricted Upload of File with Dangerous Type CVE-2022-2872, GHSA-49wm-4fp6-h59c, PYSEC-2022-286 | Medium | 0.7% | 21 Sep, 2022 | PyPI OctoPrint PyPI octoprint |
Apache Airflow contains open redirect BIT-airflow-2022-40754, CVE-2022-40754, GHSA-4fg5-j4mm-wfpg, PYSEC-2022-280 | Medium | 1.8% | 21 Sep, 2022 | PyPI apache-airflow |
rdiffweb CSRF vulnerability in admin area can lead to deletion of repositories and users CVE-2022-3232, GHSA-cw2v-wv4g-w4p6, PYSEC-2022-281 | Medium | 0.4% | 17 Sep, 2022 | PyPI rdiffweb |
LIEF contains segmentation violation CVE-2022-38307, GHSA-x2xx-jw5m-5j86, PYSEC-2022-275 | Medium | 0.3% | 13 Sep, 2022 | PyPI lief |
LIEF commit 365a16a was discovered to contain a reachable assertion abort via the component BinaryStream.hpp. CVE-2022-38496, PYSEC-2022-43137 | Medium | 0.3% | 13 Sep, 2022 | PyPI lief |
LIEF contains a segmentation violation CVE-2022-38497, GHSA-2p5h-hpj4-fxgg, PYSEC-2022-277 | Medium | 0.3% | 13 Sep, 2022 | PyPI lief |
rdiffweb Missing Custom Error Page CVE-2022-3175, GHSA-ch4c-278q-5654, PYSEC-2022-273 | Medium | 0.9% | 13 Sep, 2022 | PyPI rdiffweb |
OAuthLib vulnerable to DoS when attacker provides malicious IPV6 URI CVE-2022-36087, GHSA-3pgj-pg6c-r5p7, PYSEC-2022-269 | Medium | 1.7% | 09 Sep, 2022 | PyPI oauthlib |
mangadex-downloader vulnerable to unauthorized file reading CVE-2022-36082, GHSA-r9x7-2xmr-v8fw, PYSEC-2022-264 | Medium | 0.7% | 07 Sep, 2022 | PyPI mangadex-downloader |
Apache Airflow exposes arbitrary file content BIT-airflow-2022-38170, CVE-2022-38170, GHSA-q8h9-pqcx-59hw, PYSEC-2022-261 | Medium | 0.6% | 02 Sep, 2022 | PyPI apache-airflow |
sosreport Exposure of Sensitive Information vulnerability CVE-2022-2806, GHSA-7pf9-7cff-f854, PYSEC-2026-925 | Medium | 0.3% | 01 Sep, 2022 | PyPI sosreport |
openstack-barbican Denial of Service vulnerability CVE-2022-23452, GHSA-6p2h-rjj7-2j63, PYSEC-2026-785 | Medium | 1.3% | 01 Sep, 2022 | PyPI barbican |
Unexpected server crash in Next.js CVE-2022-36046, GHSA-wff4-fpwg-qqv3, PYSEC-2022-43188 | Medium | 1.2% | 30 Aug, 2022 | PyPI nextjs npm next |
python-oslo-utils has improper password parsing CVE-2022-0718, GHSA-wmqq-r32m-87c5, PYSEC-2022-258 | Medium | 1.9% | 29 Aug, 2022 | PyPI oslo-utils |
Deluge Web-UI vulnerable to XSS through a crafted torrent file CVE-2021-3427, GHSA-5c8p-qhch-qhx6, PYSEC-2022-256 | Medium | 1.0% | 26 Aug, 2022 | PyPI deluge |
ansible-runner has default temporary files written to world R/W locations CVE-2021-3701, GHSA-wwch-cmqr-hhrm, PYSEC-2022-43067 | Medium | 0.3% | 23 Aug, 2022 | PyPI ansible-runner |
ansible-runner vulnerable to Race Condition CVE-2021-3702, GHSA-772j-xvf9-qpf5, PYSEC-2022-43068 | Medium | 0.2% | 23 Aug, 2022 | PyPI ansible-runner |
mofh Vulnerable to Improper Restriction of XML External Entity Reference GHSA-7r9x-qrpr-3cxw | Medium | Not scored | 11 Aug, 2022 | PyPI mofh |
nbconvert vulnerable to cross-site scripting (XSS) via multiple exploit paths CVE-2021-32862, GHSA-9jmq-rx5f-8jwq, GHSA-h274-fcvj-h2wm, PYSEC-2022-249 | Medium | 1.5% | 10 Aug, 2022 | PyPI nbconvert |
Flask-Security vulnerable to Open Redirect CVE-2021-23385, GHSA-cg8c-gc2j-2wf7, PYSEC-2026-809 | Medium | 1.2% | 02 Aug, 2022 | PyPI Flask-Security PyPI flask-security |
Streamlit directory traversal vulnerability CVE-2022-35918, GHSA-v4hr-4jpx-56gc, PYSEC-2022-248 | Medium | 1.8% | 01 Aug, 2022 | PyPI streamlit |
Fava vulnerable to reflected cross-site scripting CVE-2022-2589, GHSA-6hcj-qrw3-m66q, PYSEC-2022-246 | Medium | 0.8% | 01 Aug, 2022 | PyPI fava |
Scrapy before 2.6.2 and 1.8.3 vulnerable to one proxy sending credentials to another GHSA-9x8m-2xpf-crp3 | Medium | Not scored | 29 Jul, 2022 | PyPI scrapy |
WASM3 segmentation fault CVE-2022-34529, GHSA-gq4p-4hxv-5rg9, PYSEC-2022-43057 | Medium | 0.3% | 27 Jul, 2022 | PyPI pywasm3 crates.io wasm3 |
Fava time and filter parameters vulnerable to reflected Cross-site Scripting CVE-2022-2514, GHSA-xrf4-39fm-j5f2, PYSEC-2022-239, PYSEC-2022-43182 | Medium | 0.9% | 25 Jul, 2022 | PyPI fava |
Fava vulnerable to Reflected Cross-site Scripting CVE-2022-2523, GHSA-q8hg-3vqv-f8v3, PYSEC-2022-240 | Medium | 0.9% | 25 Jul, 2022 | PyPI fava |
Django REST framework XSS Vulnerability CVE-2018-25045, GHSA-xqcf-hj92-967m, PYSEC-2026-804 | Medium | 0.8% | 23 Jul, 2022 | PyPI django-rest-framework |
OpenZeppelin Contracts for Cairo account cannot process transactions on Goerli CVE-2022-31153, GHSA-8mjr-jr5h-q2xr, PYSEC-2026-890 | Medium | 1.5% | 15 Jul, 2022 | PyPI openzeppelin-cairo-contracts |
Microsoft: CBC Padding Oracle in Azure Blob Storage Encryption Library CVE-2022-30187, GHSA-64x4-9hc6-r2h6, PYSEC-2026-2388, PYSEC-2026-784 | Medium | 0.5% | 12 Jul, 2022 | Maven com.azure:azure-storage-blob NuGet Azure.Storage.Blobs NuGet Azure.Storage.Queues PyPI azure-storage-blob +1 more |
Whoogle Search Cross-site Scripting via string parameter CVE-2022-25303, GHSA-mxvc-fwgx-j778, PYSEC-2022-226, SNYK-PYTHON-WHOOGLESEARCH-2803306 | Medium | 1.0% | 12 Jul, 2022 | PyPI whoogle-search |