Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Google Chromium V8 Out-of-Bounds Memory Access Vulnerability CVE-2024-0519 | HighExploited | 3.8% | 16 Jan, 2024 | |
avo vulnerable to stored cross-site scripting (XSS) in key_value field CVE-2024-22191, GHSA-ghjv-mh6x-7q6h | High | 0.7% | 16 Jan, 2024 | RubyGems avo |
Drupal Denial of Service vulnerability BIT-drupal-2024-22362, CVE-2024-22362, GHSA-62cf-jvpp-48q6 | High | 0.8% | 16 Jan, 2024 | Packagist drupal/core |
Path traversal in flaskcode CVE-2023-52289, GHSA-v3rg-qm46-xrg9, PYSEC-2026-1387 | High | 0.7% | 13 Jan, 2024 | PyPI flaskcode |
Path traversal in flaskcode CVE-2023-52288, GHSA-6h4q-63c5-qfqf, PYSEC-2026-1386 | High | 0.8% | 13 Jan, 2024 | PyPI flaskcode |
EverShop vulnerable to improper authorization in GraphQL endpoints CVE-2023-46942, GHSA-ggpm-9qfx-mhwg | High | 0.7% | 13 Jan, 2024 | npm @evershop/evershop |
Ivanti Connect Secure and Policy Secure Authentication Bypass Vulnerability CVE-2023-46805 | HighExploited | 100.0% | 12 Jan, 2024 | |
Authenticated (user role) arbitrary command execution by modifying `start_cmd` setting (GHSL-2023-268) CVE-2024-22198, GHSA-8r25-68wm-jw35, GO-2024-2462 | High | 4.1% | 11 Jan, 2024 | Go github.com/0xJacky/Nginx-UI |
Authenticated (user role) remote command execution by modifying `nginx` settings (GHSL-2023-269) CVE-2024-22197, GHSA-pxmr-q2x3-9x9m, GO-2024-2464 | High | 1.5% | 11 Jan, 2024 | Go github.com/0xJacky/Nginx-UI |
Authenticated (user role) SQL injection in `OrderAndPaginate` (GHSL-2023-270) CVE-2024-22196, GHSA-h374-mm57-879c, GO-2024-2463 | High | 0.6% | 11 Jan, 2024 | Go github.com/0xJacky/Nginx-UI |
Apple iOS and iPadOS Use-After-Free Vulnerability CVE-2023-41974 | HighExploited | 2.0% | 10 Jan, 2024 | |
WWBN AVideo Improper Restriction of Excessive Authentication Attempts vulnerability CVE-2023-49810, GHSA-v977-h4hm-rrff | High | 0.7% | 10 Jan, 2024 | Packagist wwbn/avideo |
Untrusted search path under some conditions on Windows allows arbitrary code execution CVE-2024-22190, GHSA-2mqj-m65w-jghx, PYSEC-2024-4 | High | 0.3% | 10 Jan, 2024 | PyPI GitPython PyPI gitpython |
Apple Multiple Products Memory Corruption Vulnerability CVE-2022-48618 | HighExploited | 0.5% | 09 Jan, 2024 | |
fonttools XML External Entity Injection (XXE) Vulnerability CVE-2023-45139, GHSA-6673-4983-2vx5, PYSEC-2026-1388 | High | 1.2% | 09 Jan, 2024 | PyPI fonttools |
Linux Kernel Use-After-Free Vulnerability CVE-2022-2586 | HighExploited | 10.2% | 08 Jan, 2024 | |
CIRCL's Kyber: timing side-channel (kyberslash2) GHSA-9763-4f94-gfch, GO-2024-2453 | High | Not scored | 08 Jan, 2024 | Go github.com/cloudflare/circl |
pyload Unauthenticated Flask Configuration Leakage vulnerability CVE-2024-21644, GHSA-mqpq-2p68-46fv, PYSEC-2026-1820 | High | 42.4% | 08 Jan, 2024 | PyPI pyload-ng |
@fastify/reply-from JSON Content-Type parsing confusion CVE-2023-51701, GHSA-v2v2-hph8-q5xp | High | 0.5% | 08 Jan, 2024 | npm @fastify/reply-from |
D-Tale server-side request forgery through Web uploads CVE-2024-21642, GHSA-7hfx-h3j3-rwq4, PYSEC-2026-1319 | High | 0.7% | 05 Jan, 2024 | PyPI dtale |
PyCryptodome and pycryptodomex side-channel leakage for OAEP decryption CVE-2023-52323, GHSA-j225-cvw7-qrx7, PYSEC-2024-3, PYSEC-2026-1811 | High | 0.6% | 05 Jan, 2024 | PyPI pycryptodome PyPI pycryptodomex |
@backstage/backend-app-api leaks GitLab access tokens CVE-2023-6944, GHSA-86rg-pf4c-5grg | High | 0.6% | 04 Jan, 2024 | npm @backstage/backend-app-api |
Froxlor username/surname AND company field Bypass CVE-2023-50256, GHSA-625g-fm5w-w7w4 | High | 0.7% | 03 Jan, 2024 | Packagist froxlor/froxlor |
Omniauth::MicrosoftGraph Account takeover (nOAuth) CVE-2024-21632, GHSA-5g66-628f-7cvj | High | 0.9% | 03 Jan, 2024 | RubyGems omniauth-microsoft_graph |
Craft CMS Privilege Escalation CVE-2024-21622, GHSA-j5g9-j7r4-6qvx | High | 0.6% | 03 Jan, 2024 | Packagist craftcms/cms |
Insecure random string generator used for sensitive data CVE-2023-46740, GHSA-4248-p65p-hcrm, GO-2024-2431 | High | 0.4% | 03 Jan, 2024 | Go github.com/cubefs/cubefs |
CubeFS timing attack can leak user passwords CVE-2023-46739, GHSA-8579-7p32-f398, GO-2024-2432 | High | 0.4% | 03 Jan, 2024 | Go github.com/cubefs/cubefs |
Authenticated users can crash the CubeFS servers with maliciously crafted requests CVE-2023-46738, GHSA-qc6v-g3xw-grmx, GO-2024-2430 | High | 0.6% | 03 Jan, 2024 | Go github.com/cubefs/cubefs |
PaddlePaddle floating point exception in paddle.nanmedian CVE-2023-38674, GHSA-xjpw-hx47-rccv, PYSEC-2024-129 | High | 0.5% | 03 Jan, 2024 | PyPI PaddlePaddle PyPI paddlepaddle |
PaddlePaddle floating point exception in paddle.linalg.matrix_rank CVE-2023-38675, GHSA-jm68-fpmr-8j2g, PYSEC-2024-130 | High | 0.5% | 03 Jan, 2024 | PyPI PaddlePaddle PyPI paddlepaddle |
PaddlePaddle segfault in paddle.dot CVE-2023-38676, GHSA-x3q9-c788-j7c8, PYSEC-2024-131 | High | 0.5% | 03 Jan, 2024 | PyPI PaddlePaddle PyPI paddlepaddle |
PaddlePaddle floating point exception in paddle.linalg.eig CVE-2023-38677, GHSA-c6ph-m8cw-rfqh, PYSEC-2024-132 | High | 0.5% | 03 Jan, 2024 | PyPI paddlepaddle |
PaddlePaddle segfault in paddle.mode CVE-2023-38678, GHSA-mr78-v55p-7777, PYSEC-2024-133 | High | 0.5% | 03 Jan, 2024 | PyPI PaddlePaddle PyPI paddlepaddle |
PaddlePaddle null pointer dereference in paddle.nextafter CVE-2023-52302, GHSA-547m-23x7-cxg5, PYSEC-2024-134 | High | 0.5% | 03 Jan, 2024 | PyPI PaddlePaddle PyPI paddlepaddle |
PaddlePaddle segfault in paddle.put_along_axis CVE-2023-52303, GHSA-2wcj-qr76-9768, PYSEC-2024-135 | High | 0.5% | 03 Jan, 2024 | PyPI paddlepaddle |
PaddlePaddle floating point exception in paddle.topk CVE-2023-52305, GHSA-rx2r-q96c-w5cc, PYSEC-2024-137 | High | 0.5% | 03 Jan, 2024 | PyPI PaddlePaddle PyPI paddlepaddle |
PaddlePaddle floating point exception in paddle.lerp CVE-2023-52306, GHSA-rg9q-m8hv-xxr6, PYSEC-2024-138 | High | 0.5% | 03 Jan, 2024 | PyPI PaddlePaddle PyPI paddlepaddle |
PaddlePaddle floating point exception in paddle.amin CVE-2023-52308, GHSA-v9pg-qw6x-w5r2, PYSEC-2024-140 | High | 0.5% | 03 Jan, 2024 | PyPI PaddlePaddle PyPI paddlepaddle |
PaddlePaddle nullptr dereference in paddle.crop CVE-2023-52312, GHSA-qppw-c37g-xwcc, PYSEC-2024-144 | High | 0.5% | 03 Jan, 2024 | PyPI PaddlePaddle PyPI paddlepaddle |
PaddlePaddle floating point exception in paddle.argmin and paddle.argmax CVE-2023-52313, GHSA-275c-w5mq-v5m2, PYSEC-2024-145 | High | 0.5% | 03 Jan, 2024 | PyPI PaddlePaddle PyPI paddlepaddle |
PrestaShop some attribute not escaped in Validate::isCleanHTML method CVE-2024-21627, GHSA-xgpm-q3mq-46rq | High | 0.5% | 02 Jan, 2024 | Packagist prestashop/prestashop |
Miniflare vulnerable to Server-Side Request Forgery (SSRF) CVE-2023-7078, GHSA-fwvg-2739-22v7 | High | 0.6% | 29 Dec, 2023 | npm miniflare |
msgpackr's conversion of property names to strings can trigger infinite recursion CVE-2023-52079, GHSA-7hpj-7hhx-2fgx | High | 0.7% | 28 Dec, 2023 | npm msgpackr |
Maliciously crafted Git server replies can cause DoS on go-git clients CVE-2023-49568, GHSA-mw99-9chc-xw7r, GO-2024-2466 | High | 0.7% | 27 Dec, 2023 | Go github.com/go-git/go-git/v5 Go gopkg.in/src-d/go-git.v4 |
Spreadsheet::ParseExcel Remote Code Execution Vulnerability CVE-2023-7101 | HighExploited | 19.0% | 24 Dec, 2023 | |
Deis Workflow Manager race condition vulnerability CVE-2016-15036, GHSA-jpfp-xq3p-4h3r, GO-2023-2422 | High | 0.4% | 23 Dec, 2023 | Go github.com/deis/workflow-manager |
free5GC AMF denial of service vulnerability CVE-2023-49391, GHSA-jcrr-rr6w-8c83 | High | 1.0% | 22 Dec, 2023 | Go github.com/free5gc/amf |
Buildkite Elastic CI for AWS symbolic link following vulnerability CVE-2023-43116, GHSA-7c44-7j7v-w554 | High | 0.3% | 22 Dec, 2023 | Go github.com/buildkite/elastic-ci-stack-for-aws/v6 |
Buildkite Elastic CI for AWS time-of-check-time-of-use race condition vulnerability CVE-2023-43741, GHSA-r5hg-349q-mg2q, GO-2024-2440 | High | 0.2% | 22 Dec, 2023 | Go github.com/buildkite/elastic-ci-stack-for-aws Go github.com/buildkite/elastic-ci-stack-for-aws/v5 Go github.com/buildkite/elastic-ci-stack-for-aws/v6 |
Google Chromium WebRTC Heap Buffer Overflow Vulnerability CVE-2023-7024 | HighExploited | 6.7% | 21 Dec, 2023 |