Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Out of bounds read in Pillow BIT-pillow-2021-25291, CVE-2021-25291, GHSA-mvg9-xffr-p774, PYSEC-2021-37 | High | 1.4% | 19 Mar, 2021 | PyPI Pillow PyPI pillow |
Out of bounds read in Pillow BIT-pillow-2021-25293, CVE-2021-25293, GHSA-p43w-g3c5-g5mq, PYSEC-2021-39 | High | 1.6% | 19 Mar, 2021 | PyPI Pillow PyPI pillow |
StackStorm st2 Infinite Loop Condition CVE-2021-28667, GHSA-39mj-fpg2-3jrg | High | 2.5% | 18 Mar, 2021 | PyPI st2client |
Pygments vulnerable to Regular Expression Denial of Service (ReDoS) CVE-2021-27291, GHSA-pq64-v7f5-gqh8, PYSEC-2021-141 | High | 3.9% | 17 Mar, 2021 | PyPI Pygments PyPI pygments |
Execution of untrusted code through config file CVE-2021-21371, GHSA-8278-88vv-x98r, PYSEC-2021-60 | High | 0.5% | 10 Mar, 2021 | PyPI tenable-jira-cloud |
Exposure of Sensitive Information to an Unauthorized Actor in Products.PluggableAuthService ZODBRoleManager CVE-2021-21336, GHSA-p75f-g7gx-2r7p, PYSEC-2021-44 | High | 1.5% | 08 Mar, 2021 | PyPI Products.PluggableAuthService PyPI products-pluggableauthservice |
markdown2 Regular Expression Denial of Service CVE-2021-26813, GHSA-jr9p-r423-9m2r, PYSEC-2021-20 | High | 2.3% | 03 Mar, 2021 | PyPI markdown2 |
Saltstack Salt Unauthenticated Arbitrary Code Execution CVE-2021-25315, GHSA-pmj6-9f8c-8g2m, PYSEC-2021-891 | High | 2.3% | 03 Mar, 2021 | PyPI salt |
Pillow Denial of Service by Uncontrolled Resource Consumption BIT-pillow-2021-27921, CVE-2021-27921, GHSA-f4w8-cv6p-x6r5, PYSEC-2021-40 | High | 3.2% | 03 Mar, 2021 | PyPI Pillow PyPI pillow |
Pillow Uncontrolled Resource Consumption BIT-pillow-2021-27922, CVE-2021-27922, GHSA-3wvg-mj6g-m9cv, PYSEC-2021-41 | High | 4.9% | 03 Mar, 2021 | PyPI pillow |
Pillow Denial of Service by Uncontrolled Resource Consumption BIT-pillow-2021-27923, CVE-2021-27923, GHSA-95q3-8gr9-gm8w, PYSEC-2021-42 | High | 3.0% | 03 Mar, 2021 | PyPI pillow |
SaltStack Salt command injection via a crafted process name CVE-2020-28243, GHSA-phhw-3wc9-8q75, PYSEC-2021-73 | High | 4.3% | 27 Feb, 2021 | PyPI salt |
SaltStack Salt Improper Certificate Validation CVE-2020-28972, GHSA-w589-r335-4f55, PYSEC-2021-74 | High | 3.1% | 27 Feb, 2021 | PyPI salt |
SaltStack Salt Improper SSL Certificate Validation CVE-2020-35662, GHSA-qx72-q6w3-qgc7, PYSEC-2021-75 | High | 3.0% | 27 Feb, 2021 | PyPI salt |
Django Channels leakage of session identifiers using legacy AsgiHandler CVE-2020-35681, GHSA-v542-8q9x-cffc, PYSEC-2021-113 | High | 2.7% | 22 Feb, 2021 | PyPI channels |
Server-side Request Forgery (SSRF) via img tags in reportlab CVE-2020-28463, GHSA-mpvw-25mg-59vx, PYSEC-2021-146, SNYK-PYTHON-REPORTLAB-1022145 | High | 1.3% | 18 Feb, 2021 | PyPI reportlab |
GramAddict bot uses dependency with reverse tcp backdoor CVE-2020-36245, GHSA-q5h6-49gg-2wfg, PYSEC-2021-65 | High | 1.5% | 17 Feb, 2021 | PyPI GramAddict PyPI gramaddict |
Improper Access Control in Apache Airflow BIT-airflow-2021-26559, CVE-2021-26559, GHSA-ffw3-6mp6-jmvj, PYSEC-2021-2 | High | 2.8% | 17 Feb, 2021 | PyPI apache-airflow |
qlib Deserialization of Untrusted Data vulnerability CVE-2021-23338, GHSA-hjr4-fhgp-23g9, PYSEC-2021-86, SNYK-PYTHON-QLIB-1054635 | High | 3.6% | 15 Feb, 2021 | PyPI pyqlib |
Regular Expression Denial of Service (REDoS) in httplib2 CVE-2021-21240, GHSA-93xj-8mrv-444m, PYSEC-2021-16 | High | 3.6% | 08 Feb, 2021 | PyPI httplib2 |
botframework-connector vulnerable to Improper Authentication CVE-2021-1725, GHSA-cqff-fx2x-p86v, GHSA-fvcj-hvfw-7f2v, PYSEC-2021-422 | High | 1.1% | 12 Jan, 2021 | PyPI botframework-connector npm botframework-connector |
ClusterLabs crmsh vulnerable to shell code injection CVE-2020-35459, GHSA-99xx-83jm-h24m, PYSEC-2026-799 | High | 0.7% | 12 Jan, 2021 | PyPI crmsh |
Pillow Out-of-bounds Read BIT-pillow-2020-35653, CVE-2020-35653, GHSA-f5g8-5qq7-938w, PYSEC-2021-69 | High | 1.6% | 12 Jan, 2021 | PyPI pillow |
Pillow Out-of-bounds Write BIT-pillow-2020-35654, CVE-2020-35654, GHSA-vqcj-wrf2-7v73, PYSEC-2021-70 | High | 1.9% | 12 Jan, 2021 | PyPI Pillow PyPI pillow |
CSRF can expose users authentication token CVE-2021-21241, GHSA-hh7m-rx4f-4vpv, PYSEC-2021-91 | High | 0.9% | 11 Jan, 2021 | PyPI Flask-Security-Too PyPI flask-security-too |
Logic error in authentication in proxy.py CVE-2021-3116, GHSA-cmc7-mfmr-xqrx, PYSEC-2021-46 | High | 1.7% | 11 Jan, 2021 | PyPI proxy-py PyPI proxy.py |
Regular Expression Denial of Service in CairoSVG CVE-2021-21236, GHSA-hq37-853p-g5cf, PYSEC-2021-5 | High | 1.4% | 06 Jan, 2021 | PyPI CairoSVG PyPI cairosvg |
Improper Restriction of XML External Entity Reference in Plone CVE-2020-28734, GHSA-wq6x-g685-w5f2, PYSEC-2020-246, PYSEC-2026-2880, PYSEC-2026-2883, PYSEC-2026-2886, PYSEC-2026-736 | High | 1.5% | 30 Dec, 2020 | PyPI Plone PyPI plone PyPI plone-app-dexterity PyPI plone-app-event +6 more |
SSRF attacks via tracebacks in Plone CVE-2020-28735, GHSA-x7wf-5mjc-6x76, PYSEC-2020-247, PYSEC-2026-2881, PYSEC-2026-2884, PYSEC-2026-2887, PYSEC-2026-737 | High | 1.5% | 30 Dec, 2020 | PyPI Plone PyPI plone PyPI plone-app-dexterity PyPI plone-app-event +6 more |
Improper Restriction of XML External Entity Reference in Plone CVE-2020-28736, GHSA-2c8c-84w2-j38j, PYSEC-2020-248, PYSEC-2026-2879, PYSEC-2026-2882, PYSEC-2026-2885, PYSEC-2026-735 | High | 1.5% | 30 Dec, 2020 | PyPI Plone PyPI plone PyPI plone-app-dexterity PyPI plone-app-event +6 more |
Hyperledger Indy's update process of a DID does not check who signs the request CVE-2020-11093, GHSA-wh2w-39f4-rpv2, PYSEC-2020-48 | High | 1.2% | 24 Dec, 2020 | PyPI indy-node |
Incorrect Session Validation in Apache Airflow BIT-airflow-2020-17526, CVE-2020-17526, GHSA-7mx5-x372-xh87, PYSEC-2020-22 | High | 23.9% | 21 Dec, 2020 | PyPI apache-airflow |
RSA weakness in tslite-ng CVE-2020-26263, GHSA-wvcv-832q-fjg7, PYSEC-2020-143 | High | 1.5% | 21 Dec, 2020 | PyPI tlslite-ng |
OpenSlides is a free, Web-based presentation and assembly system for managing and projecting agenda, motions, and elections of assemblies. OpenSlides version 3.2, due to unsufficient user input validation and escaping, it is vulnerable to persistant cross-site scripting (XSS). In the web application CVE-2020-26280, GHSA-w5wr-98qm-jx92, PYSEC-2020-72 | High | 1.4% | 18 Dec, 2020 | PyPI openslides |
TensorFlow vulnerable to heap out of bounds read in filesystem glob matching BIT-tensorflow-2020-26269, CVE-2020-26269, GHSA-9jjw-hf72-3mxw, PYSEC-2020-141, PYSEC-2020-300, PYSEC-2020-335 | High | 0.7% | 10 Dec, 2020 | PyPI tensorflow PyPI tensorflow-cpu PyPI tensorflow-gpu |
Lack of validation in data format attributes in TensorFlow BIT-tensorflow-2020-26267, CVE-2020-26267, GHSA-c9f3-9wfr-wgh7, PYSEC-2020-140, PYSEC-2020-298, PYSEC-2020-333 | High | 0.2% | 10 Dec, 2020 | PyPI tensorflow PyPI tensorflow-cpu PyPI tensorflow-gpu |
Denial of service attack via incorrect parameters in Matrix Synapse CVE-2020-26257, GHSA-hxmp-pqch-c8mm, PYSEC-2020-236 | High | 2.4% | 09 Dec, 2020 | PyPI matrix-synapse |
user-readable api tokens in systemd units for JupyterHub CVE-2020-26261, GHSA-cg54-gpgr-4rm6, PYSEC-2020-52 | High | 0.5% | 09 Dec, 2020 | PyPI jupyterhub-systemdspawner |
py vulnerable to Regular Expression Denial of Service CVE-2020-29651, GHSA-hj5v-574p-mj7c, PYSEC-2020-92 | High | 4.7% | 09 Dec, 2020 | PyPI py |
Remote Code Execution (RCE) Exploit on Cross Site Scripting (XSS) Vulnerability CVE-2020-26249, GHSA-hm45-mgqm-gjm4, PYSEC-2020-98 | High | 1.3% | 08 Dec, 2020 | PyPI red-dashboard |
Multiple cryptographic issues in Python oic CVE-2020-26244, GHSA-4fjv-pmhg-3rfg, PYSEC-2020-69 | High | 0.8% | 02 Dec, 2020 | PyPI oic |
Base class whitelist configuration ignored in OAuthenticator CVE-2020-26250, GHSA-384w-5v3f-q499, PYSEC-2020-68 | High | 1.1% | 01 Dec, 2020 | PyPI oauthenticator |
blosc2 heap-based buffer overflow CVE-2020-29367, GHSA-8c7c-2c8j-3xfp, PYSEC-2020-343 | High | 1.2% | 27 Nov, 2020 | PyPI blosc2 |
Memory leak in Nanopb CVE-2020-26243, GHSA-85rr-4rh9-hhwh, PYSEC-2026-684 | High | 2.7% | 25 Nov, 2020 | PyPI nanopb |
Denial of service attack due to invalid JSON CVE-2020-26890, GHSA-4mp3-385r-v63f, PYSEC-2020-237 | High | 3.0% | 24 Nov, 2020 | PyPI matrix-synapse |
scikit-learn Denial of Service CVE-2020-28975, GHSA-jxfp-4rvq-9h9m, PYSEC-2020-108 | High | 3.5% | 21 Nov, 2020 | PyPI scikit-learn |
Security issues in AWS KMS and AWS Encryption SDKs: in-band protocol negotiation and robustness CVE-2020-8897, GHSA-wqgp-vphw-hphf, PYSEC-2020-261 | High | 0.4% | 16 Nov, 2020 | Maven com.amazonaws:aws-encryption-sdk-java PyPI aws-encryption-sdk |
Timing attacks in python-rsa CVE-2020-25658, GHSA-xrx6-fmxq-rjj2, PYSEC-2020-100 | High | 1.7% | 12 Nov, 2020 | PyPI rsa |
Improper Certificate Validation in blackduck CVE-2020-27589, GHSA-f248-v4qh-x2r6, PYSEC-2020-26 | High | 1.1% | 06 Nov, 2020 | PyPI blackduck |
RSA decryption vulnerable to Bleichenbacher timing vulnerability CVE-2020-25659, GHSA-hggm-jpg3-v476, PYSEC-2021-62 | High | 2.5% | 27 Oct, 2020 | PyPI cryptography |