Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Header injection possible in Django BIT-django-2021-32052, CVE-2021-32052, GHSA-qm57-vhq3-3fwf, PYSEC-2021-8 | Medium | 3.2% | 06 May, 2021 | PyPI Django PyPI django |
Cross-site Scripting in Apache Airflow BIT-airflow-2021-28359, CVE-2021-28359, GHSA-3xxv-p78r-4fc6, PYSEC-2021-4 | Medium | 14.4% | 02 May, 2021 | PyPI apache-airflow |
Open Redirect in Apache Superset BIT-superset-2021-28125, CVE-2021-28125, GHSA-pfwg-rxf4-97c3, PYSEC-2021-128, PYSEC-2026-3078 | Medium | 64.0% | 27 Apr, 2021 | PyPI apache-superset PyPI superset |
VVE-2021-0002: Incorrect `returndatasize` when using simple forwarder proxies deployed prior to EIP-1167 adoption CVE-2021-48019, GHSA-375m-5fvv-xq23 | Medium | 0.2% | 19 Apr, 2021 | PyPI vyper |
SSRF in Sydent due to missing validation of hostnames CVE-2021-29431, GHSA-9jhm-8m8c-c3f4, PYSEC-2021-22 | Medium | 1.2% | 15 Apr, 2021 | PyPI matrix-sydent |
Malicious users could abuse Sydent to control the content of invitation emails CVE-2021-29432, GHSA-mh74-4m5g-fcjx, PYSEC-2021-23 | Medium | 0.9% | 15 Apr, 2021 | PyPI matrix-sydent |
Sydent DoS (via resource exhaustion) due to improper input validation CVE-2021-29433, GHSA-pw4v-gr34-2553, PYSEC-2021-24 | Medium | 0.9% | 15 Apr, 2021 | PyPI matrix-sydent |
Potential API key leak GHSA-63rq-p8fp-524q | Medium | Not scored | 13 Apr, 2021 | PyPI sopel-modules-weather PyPI sopel-modules.weather |
Denial of service (via resource exhaustion) due to improper input validation on groups/communities endpoints CVE-2021-21393, GHSA-jrh7-mhhx-6h88, PYSEC-2021-26 | Medium | 1.6% | 12 Apr, 2021 | PyPI matrix-synapse |
Denial of service (via resource exhaustion) due to improper input validation on third-party identifier endpoints CVE-2021-21394, GHSA-w9fg-xffh-p362, PYSEC-2021-27 | Medium | 1.5% | 12 Apr, 2021 | PyPI matrix-synapse |
Cross-site scripting in SiCKRAGE CVE-2021-25925, GHSA-rmp7-f2vp-3rq4, PYSEC-2021-147 | Medium | 0.7% | 12 Apr, 2021 | PyPI sickrage |
Cross-site scripting in sickrage CVE-2021-25926, GHSA-x823-j7c4-vpc5, PYSEC-2021-148 | Medium | 0.8% | 12 Apr, 2021 | PyPI sickrage |
Directory Traversal in Django BIT-django-2021-28658, CVE-2021-28658, GHSA-xgxc-v2qg-chmh, PYSEC-2021-6 | Medium | 3.8% | 06 Apr, 2021 | PyPI Django PyPI django |
A flaw was found in several ansible modules, where parameters containing credentials, such as secrets, were being logged in plain-text on managed nodes, as well as being made visible on the controller node when run in verbose mode. These parameters were not protected by the no_log feature. An attack CVE-2021-3447, PYSEC-2021-107 | Medium | 0.3% | 01 Apr, 2021 | PyPI ansible |
HTML injection in email and account expiry notifications CVE-2021-21333, GHSA-c5f8-35qr-q4fm, PYSEC-2021-134 | Medium | 1.4% | 26 Mar, 2021 | PyPI matrix-synapse |
Plone XSS Vulnerability CVE-2021-29002, GHSA-38g6-x6jv-jwff, PYSEC-2021-889 | Medium | 0.8% | 24 Mar, 2021 | PyPI plone |
OMERO webclient does not validate URL redirects on login or switching group. CVE-2021-21377, GHSA-g4rf-pc26-6hmr, PYSEC-2021-32 | Medium | 0.8% | 23 Mar, 2021 | PyPI omero-web |
lxml vulnerable to Cross-Site Scripting CVE-2021-28957, GHSA-jq4v-f5q6-mjqq, PYSEC-2021-19 | Medium | 4.0% | 21 Mar, 2021 | PyPI lxml |
Regular Expression Denial of Service (ReDoS) in Pillow BIT-pillow-2021-25292, CVE-2021-25292, GHSA-9hx2-hgq2-2g4f, PYSEC-2021-38 | Medium | 1.7% | 19 Mar, 2021 | PyPI Pillow PyPI pillow |
Using default SSLContext for HTTPS requests in an HTTPS proxy doesn't verify certificate hostname for proxy connection CVE-2021-28363, GHSA-5phf-pp7p-vc2r, PYSEC-2021-59 | Medium | 2.2% | 15 Mar, 2021 | PyPI urllib3 |
Exposure of Sensitive Information to an Unauthorized Actor in Products.GenericSetup CVE-2021-21360, GHSA-jff3-mwp3-f8cw, PYSEC-2021-43 | Medium | 1.5% | 09 Mar, 2021 | PyPI Products.GenericSetup PyPI products-genericsetup |
URL Redirection to Untrusted Site ('Open Redirect') in Products.PluggableAuthService CVE-2021-21337, GHSA-p44j-xrqg-4xrr, PYSEC-2021-45 | Medium | 8.4% | 08 Mar, 2021 | PyPI Products.PluggableAuthService PyPI products-pluggableauthservice |
Apache Superset Stored XSS on Dashboard markdown BIT-superset-2021-27907, CVE-2021-27907, GHSA-w358-rj93-r5qv, PYSEC-2021-127 | Medium | 86.4% | 05 Mar, 2021 | PyPI apache-superset |
SaltStack Salt Cleartext Storage of Sensitive Information via cmdmod CVE-2021-25284, GHSA-r55w-xph5-xvx2, PYSEC-2021-53 | Medium | 0.5% | 27 Feb, 2021 | PyPI salt |
Denial of service attack via .well-known lookups CVE-2021-21274, GHSA-2hwx-mjrm-v3g8, PYSEC-2021-132 | Medium | 2.2% | 26 Feb, 2021 | PyPI matrix-synapse |
Open redirects on some federation and push requests CVE-2021-21273, GHSA-v936-j8gp-9q3p, PYSEC-2021-131 | Medium | 1.8% | 26 Feb, 2021 | PyPI matrix-synapse |
`aiohttp` Open Redirect vulnerability (`normalize_path_middleware` middleware) CVE-2021-21330, GHSA-v6wp-4m6f-gcjg, PYSEC-2021-76 | Medium | 1.9% | 26 Feb, 2021 | PyPI aiohttp |
Improper Authentication in Apache Airflow BIT-airflow-2021-26697, CVE-2021-26697, GHSA-fh37-cx83-q542, PYSEC-2021-3 | Medium | 4.6% | 17 Feb, 2021 | PyPI apache-airflow |
NFStream Local Denial of Service (DoS) CVE-2020-25340, GHSA-whmq-cfm5-j8mj, PYSEC-2021-68 | Medium | 0.3% | 16 Feb, 2021 | PyPI nfstream |
LinkedIn Oncall vulnerable to Cross-Site Scripting CVE-2021-26722, GHSA-rfw2-x9f8-2f6m, PYSEC-2021-33 | Medium | 3.2% | 05 Feb, 2021 | PyPI oncall |
Cross-site scripting in Bleach CVE-2021-23980, GHSA-vv2x-vrpj-qqpq, PYSEC-2021-865 | Medium | 0.5% | 02 Feb, 2021 | PyPI bleach |
Django Directory Traversal via archive.extract BIT-django-2021-3281, CVE-2021-3281, GHSA-fvgf-6h6h-3322, PYSEC-2021-9 | Medium | 7.6% | 02 Feb, 2021 | PyPI django |
Regular Expression Denial of Service (ReDoS) in Jinja2 CVE-2020-28493, GHSA-g3rq-g295-4j3m, PYSEC-2021-66, SNYK-PYTHON-JINJA2-1012994 | Medium | 3.6% | 01 Feb, 2021 | PyPI jinja2 |
Improper Verification of Cryptographic Signature in PySAML2 CVE-2021-21239, GHSA-5p3x-r448-pc62, PYSEC-2021-49 | Medium | 1.3% | 21 Jan, 2021 | PyPI pysaml2 |
SAML XML Signature wrapping in PySAML2 CVE-2021-21238, GHSA-f4g9-h89h-jgv9, PYSEC-2021-48 | Medium | 1.1% | 21 Jan, 2021 | PyPI pysaml2 |
bottle HTTP Request smuggling CVE-2020-28473, GHSA-qhx9-7hx7-cp4r, PYSEC-2021-129, SNYK-PYTHON-BOTTLE-1017108 | Medium | 1.8% | 18 Jan, 2021 | PyPI bottle |
Cross-Site Request Forgery in JupyterHub BIT-jupyterhub-2020-36191, CVE-2020-36191, GHSA-7xx3-qp5w-fw96, PYSEC-2021-67 | Medium | 0.5% | 13 Jan, 2021 | PyPI jupyterhub |
Pillow Out-of-bounds Read BIT-pillow-2020-35655, CVE-2020-35655, GHSA-hf64-x4gq-p99h, PYSEC-2021-71 | Medium | 1.7% | 12 Jan, 2021 | PyPI pillow |
Versions of Apache DolphinScheduler prior to 1.3.2 allowed an ordinary user under any tenant to override another users password through the API interface. CVE-2020-13922, GHSA-qhh5-9738-g9mx, PYSEC-2021-876 | Medium | 1.8% | 11 Jan, 2021 | PyPI apache-dolphinscheduler |
Open Redirect in autobahn CVE-2020-35678, GHSA-gwp7-vqr5-h33h, PYSEC-2020-25 | Medium | 1.4% | 27 Dec, 2020 | PyPI autobahn |
Jupyter Server open redirect vulnerability CVE-2020-26275, GHSA-9f66-54xg-pc2c, PYSEC-2020-346, PYSEC-2020-50 | Medium | 1.4% | 21 Dec, 2020 | PyPI jupyter-server |
Apache Airflow logs passwords in plaintext BIT-airflow-2020-17511, CVE-2020-17511, GHSA-cvcq-gmc3-q6m8, PYSEC-2020-262 | Medium | 2.6% | 14 Dec, 2020 | PyPI apache-airflow |
SSRF vulnerability in Apache Airflow BIT-airflow-2020-17513, CVE-2020-17513, GHSA-6r3p-fcvm-xh7c, PYSEC-2020-20 | Medium | 4.4% | 14 Dec, 2020 | PyPI apache-airflow |
Apache Airflow cross-site scripting due to incomplete fix for CVE-2020-13944 BIT-airflow-2020-17515, CVE-2020-17515, GHSA-86vp-x3pr-79rx, PYSEC-2020-21 | Medium | 16.2% | 11 Dec, 2020 | PyPI apache-airflow |
Heap out of bounds access in MakeEdge in TensorFlow BIT-tensorflow-2020-26271, CVE-2020-26271, GHSA-q263-fvxm-m5mw, PYSEC-2020-257, PYSEC-2020-302, PYSEC-2020-337 | Medium | 0.2% | 10 Dec, 2020 | PyPI tensorflow PyPI tensorflow-cpu PyPI tensorflow-gpu |
CHECK-fail in LSTM with zero-length input in TensorFlow BIT-tensorflow-2020-26270, CVE-2020-26270, GHSA-m648-33qf-v3gp, PYSEC-2020-256, PYSEC-2020-301, PYSEC-2020-336 | Medium | 0.2% | 10 Dec, 2020 | PyPI tensorflow PyPI tensorflow-cpu PyPI tensorflow-gpu |
Write to immutable memory region in TensorFlow BIT-tensorflow-2020-26268, CVE-2020-26268, GHSA-hhvc-g5hv-48c6, PYSEC-2020-255, PYSEC-2020-299, PYSEC-2020-334 | Medium | 0.2% | 10 Dec, 2020 | PyPI tensorflow PyPI tensorflow-cpu PyPI tensorflow-gpu |
Uninitialized memory access in TensorFlow BIT-tensorflow-2020-26266, CVE-2020-26266, GHSA-qhxx-j73r-qpm2, PYSEC-2020-254, PYSEC-2020-297, PYSEC-2020-332 | Medium | 0.3% | 10 Dec, 2020 | PyPI tensorflow PyPI tensorflow-cpu PyPI tensorflow-gpu |
Cabot Cross Site Scripting (XSS) vulnerability via Address column CVE-2020-25449, GHSA-8q2h-4mq6-396j, PYSEC-2020-226 | Medium | 1.2% | 04 Dec, 2020 | PyPI cabot |
OpenStack Horizon Open redirect in workflow forms CVE-2020-29565, GHSA-f8fh-xp28-q59m, PYSEC-2020-45 | Medium | 1.4% | 04 Dec, 2020 | PyPI horizon |