Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Code Injection, Race Condition, and Execution with Unnecessary Privileges in Ansible CVE-2020-10684, GHSA-p62g-jhg6-v3rq, PYSEC-2020-207 | High | 0.3% | 24 Mar, 2020 | PyPI ansible |
django-nopassword stores secrets in cleartext CVE-2019-10682, GHSA-37cf-r3w2-gjfw, PYSEC-2020-229 | High | 1.2% | 18 Mar, 2020 | PyPI django-nopassword |
2FA bypass through deleting devices in wagtail-2fa CVE-2020-5240, GHSA-9gjv-6qq6-v7qm, PYSEC-2020-219 | High | 1.0% | 13 Mar, 2020 | PyPI wagtail-2fa |
OpenStack Manila Unprivileged users can retrieve, use and manipulate share networks CVE-2020-9543, GHSA-jx7v-gmqc-6xrj, PYSEC-2020-63 | High | 1.3% | 12 Mar, 2020 | PyPI manila |
Path Traversal in Ansible CVE-2020-1737, GHSA-893h-35v4-mxqx, PYSEC-2020-9 | High | 0.4% | 09 Mar, 2020 | PyPI ansible |
Uncontrolled Resource Consumption in urllib3 CVE-2020-7212, GHSA-hmv2-79q8-fv6g, PYSEC-2020-149 | High | 3.4% | 06 Mar, 2020 | PyPI urllib3 |
SQL injection in Django BIT-django-2020-9402, CVE-2020-9402, GHSA-3gh2-xw74-jmcw, PYSEC-2020-345, PYSEC-2020-36 | High | 22.5% | 05 Mar, 2020 | PyPI Django PyPI django |
OS Command Injection in ansible CVE-2020-1734, GHSA-h39q-95q5-9jfp, PYSEC-2020-6 | High | 0.5% | 03 Mar, 2020 | PyPI ansible |
Cross-Site Request Forgery in Webargs CVE-2020-7965, GHSA-fjq3-5pxw-4wj4, PYSEC-2020-156 | High | 0.6% | 29 Jan, 2020 | PyPI webargs |
Feedgen Vulnerable to XML Denial of Service Attacks CVE-2020-5227, GHSA-g8q7-xv52-hf9f, PYSEC-2020-231 | High | 2.2% | 28 Jan, 2020 | PyPI feedgen |
Segmentation faultin TensorFlow when converting a Python string to `tf.float16` BIT-tensorflow-2020-5215, CVE-2020-5215, GHSA-977j-xj7q-2jr9, PYSEC-2020-258, PYSEC-2020-303, PYSEC-2020-338 | High | 0.6% | 28 Jan, 2020 | PyPI tensorflow PyPI tensorflow-cpu PyPI tensorflow-gpu |
pyrad is vulnerable to the use of Insufficiently Random Values CVE-2013-0294, GHSA-q4v3-wmm6-hcrx, PYSEC-2020-211 | High | 2.9% | 28 Jan, 2020 | PyPI pyrad |
Improper Restriction of Excessive Authentication Attempts in py-bcrypt CVE-2013-1895, GHSA-r838-q6jp-58xx, PYSEC-2020-249 | High | 2.8% | 28 Jan, 2020 | PyPI py-bcrypt |
Session key exposure through session list in Django User Sessions CVE-2020-5224, GHSA-5fq8-3q2f-4m5g, PYSEC-2020-230 | High | 0.5% | 24 Jan, 2020 | PyPI django-user-sessions |
Tornado XSRF cookie allows side-channel attack against TLS (BREACH attack) CVE-2014-9720, GHSA-8vpw-mgpf-mpvv, PYSEC-2020-213 | High | 2.5% | 24 Jan, 2020 | PyPI tornado |
Plone Privilege Escallation CVE-2020-7938, GHSA-cjg3-q24h-9qwf, PYSEC-2020-87, PYSEC-2026-2889 | High | 1.5% | 23 Jan, 2020 | PyPI Plone PyPI plone PyPI plone-restapi PyPI plone.restapi |
Plone SQL Injection Vulnerability CVE-2020-7939, GHSA-hhmf-7rgg-gcw5, PYSEC-2020-88 | High | 1.2% | 23 Jan, 2020 | PyPI Plone PyPI plone |
Plone allows weak passwords CVE-2020-7940, GHSA-cw58-gpgw-hwx2, PYSEC-2020-89 | High | 1.3% | 23 Jan, 2020 | PyPI Plone PyPI plone |
PyAMF vulnerable to XML external entity (XXE) CVE-2015-8549, GHSA-m7m4-4vm8-55wg, PYSEC-2020-339 | High | 1.8% | 15 Jan, 2020 | PyPI pyamf |
Local Privilege Escalation in PyInstaller CVE-2019-16784, GHSA-7fcj-pq9j-wh2r, PYSEC-2020-175 | High | 0.7% | 14 Jan, 2020 | PyPI PyInstaller PyPI pyinstaller |
Improper Verification of Cryptographic Signature in PySAML2 CVE-2020-5390, GHSA-qf7v-8hj3-4xw7, PYSEC-2020-94 | High | 1.2% | 13 Jan, 2020 | PyPI pysaml2 |
Ansible unsafe evaluation of some strings CVE-2014-2686, GHSA-49m5-2838-q2rv, PYSEC-2020-198 | High | 1.2% | 09 Jan, 2020 | PyPI ansible |
Uncontrolled Resource Consumption in Pillow CVE-2019-19911, GHSA-5gm3-px64-rw72, PYSEC-2020-172 | High | 2.2% | 05 Jan, 2020 | PyPI pillow |
Out-of-bounds Write in OpenCV CVE-2019-5064, GHSA-q799-q27x-vp7w, PYSEC-2026-2802, PYSEC-2026-2828, PYSEC-2026-2841, PYSEC-2026-725 | High | 10.7% | 03 Jan, 2020 | PyPI opencv-contrib-python PyPI opencv-contrib-python-headless PyPI opencv-python PyPI opencv-python-headless |
Out-of-bounds Write in OpenCV CVE-2019-5063, GHSA-m6vm-8g8v-xfjh, PYSEC-2026-2801, PYSEC-2026-2826, PYSEC-2026-2840, PYSEC-2026-724 | High | 21.1% | 03 Jan, 2020 | PyPI opencv-contrib-python PyPI opencv-contrib-python-headless PyPI opencv-python PyPI opencv-python-headless |
Out-of-bounds Read in Pillow BIT-pillow-2020-5313, CVE-2020-5313, GHSA-hj69-c76v-86wr, PYSEC-2020-84 | High | 2.8% | 03 Jan, 2020 | PyPI Pillow PyPI pillow |
ovirt-engine-sdk-python improper validation of hostname in x.509 certificate CVE-2014-0161, GHSA-wf9j-m9fv-92gq, PYSEC-2020-245 | High | 0.4% | 02 Jan, 2020 | PyPI ovirt-engine-sdk-python |
HTTP Request Smuggling in Waitress: Invalid whitespace characters in headers (Follow-up) CVE-2019-16789, GHSA-968f-66r5-5v74, PYSEC-2019-138 | High | 2.6% | 26 Dec, 2019 | PyPI waitress |
HTTP Request Smuggling: Invalid whitespace characters in headers in Waitress GHSA-m5ff-3wj3-8ph4 | High | Not scored | 26 Dec, 2019 | PyPI waitress |
HTTP Request Smuggling: Invalid Transfer-Encoding in Waitress CVE-2019-16786, GHSA-g2xc-35jw-c63p, PYSEC-2019-137 | High | 2.4% | 20 Dec, 2019 | PyPI waitress |
HTTP Request Smuggling: LF vs CRLF handling in Waitress CVE-2019-16785, GHSA-pg36-wpm5-g57p, PYSEC-2019-136 | High | 2.5% | 20 Dec, 2019 | PyPI waitress |
Modoboa is vulnerable to an XML External Entity Injection (XXE) CVE-2019-19702, GHSA-vc42-mgr2-w34r, PYSEC-2019-105 | High | 1.5% | 10 Dec, 2019 | PyPI modoboa-dmarc |
OpenStack Keystone Credential Leakage CVE-2019-19687, GHSA-2j23-fwqm-mgwr, PYSEC-2019-29 | High | 1.8% | 09 Dec, 2019 | PyPI keystone |
Uncontrolled resource consumption in validators Python package CVE-2019-19588, GHSA-5qcg-w2cc-xffw, PYSEC-2019-134 | High | 1.5% | 05 Dec, 2019 | PyPI validators |
SaltStack RSA Key Generation allows remote users to decrypt communications CVE-2013-2228, GHSA-gq26-cpq6-w85r, PYSEC-2026-748 | High | 2.0% | 03 Dec, 2019 | PyPI salt |
Django allows unintended model editing CVE-2019-19118, GHSA-hvmf-r92r-27hr, PYSEC-2019-15 | High | 1.7% | 02 Dec, 2019 | PyPI Django PyPI django |
2FA bypass in Wagtail through new device path CVE-2019-16766, GHSA-89px-ww3j-g2mm, PYSEC-2019-135 | High | 1.5% | 29 Nov, 2019 | PyPI wagtail-2fa |
Code injection in FreeIPA CVE-2019-14867, GHSA-7hpj-hfcr-5qwm, PYSEC-2019-28, PYSEC-2026-636 | High | 7.4% | 27 Nov, 2019 | PyPI freeipa PyPI ipa |
typed-ast Out-of-bounds Read CVE-2019-19274, GHSA-m3jw-62m7-jjcm, PYSEC-2019-130 | High | 3.3% | 26 Nov, 2019 | PyPI typed-ast |
typed-ast Out-of-bounds Read CVE-2019-19275, GHSA-7xxv-wpxj-mx5v, PYSEC-2019-131 | High | 3.3% | 26 Nov, 2019 | PyPI typed-ast |
Ansible password prompts could expose passwords CVE-2019-14856, GHSA-6fq2-x65v-v9h7, PYSEC-2019-146 | High | 1.7% | 26 Nov, 2019 | PyPI ansible |
Exposure of Sensitive Information to an Unauthorized Actor in ansible CVE-2019-10217, GHSA-p75j-wc34-527c, PYSEC-2019-3 | High | 1.9% | 25 Nov, 2019 | PyPI ansible |
Incorrect Default Permissions in keyring CVE-2012-5578, GHSA-8867-vpm3-g98g, PYSEC-2019-182 | High | 0.4% | 25 Nov, 2019 | PyPI keyring |
Ansible password prompts could expose passwords CVE-2019-10206, GHSA-cqmr-rcpr-cxh3, PYSEC-2019-145 | High | 1.5% | 22 Nov, 2019 | PyPI ansible |
trytond Incorrect Authorization vulnerability CVE-2012-2238, GHSA-jfgc-5vh4-8rh5, PYSEC-2019-211 | High | 1.8% | 21 Nov, 2019 | PyPI trytond |
Cobbler Web Interface Lacks CSRF Protection CVE-2011-4952, GHSA-9fqr-pqc9-f7pj, PYSEC-2026-624 | High | 0.6% | 19 Nov, 2019 | PyPI cobbler |
Python Twisted trustRoot is not respected in HTTP client CVE-2014-7143, GHSA-3c45-wgjp-7v9r, PYSEC-2019-212 | High | 2.6% | 12 Nov, 2019 | PyPI twisted |
Double Free in psutil CVE-2019-18874, GHSA-qfc5-mcwq-26q8, PYSEC-2019-41 | High | 3.5% | 12 Nov, 2019 | PyPI psutil |
Missing Initialization of Resource in Apache Arrow CVE-2019-12408, GHSA-8cw2-jv5c-c825, PYSEC-2019-195 | High | 3.3% | 08 Nov, 2019 | PyPI pyarrow RubyGems red-arrow |
Missing Initialization of Resource in Apache Arrow CVE-2019-12410, GHSA-cjw4-2w9r-r8mv, PYSEC-2019-196 | High | 4.6% | 08 Nov, 2019 | PyPI pyarrow RubyGems red-arrow |