Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Gradio makes the `/file` secure against file traversal and server-side request forgery attacks CVE-2023-51449, GHSA-6qm2-wpxq-7qh2, PYSEC-2023-249 | High | 28.3% | 21 Dec, 2023 | PyPI gradio |
Authenticated Blind SSRF in automad/automad CVE-2023-7037, GHSA-q5q3-qm26-9jwm | High | 0.7% | 21 Dec, 2023 | Packagist automad/automad |
blinksocks has weak encryption algorithms CVE-2023-50481, GHSA-pqj5-37xf-x5gc | High | 0.3% | 21 Dec, 2023 | npm blinksocks |
transformers has a Deserialization of Untrusted Data vulnerability CVE-2023-7018, GHSA-v68g-wm8c-6x7j, PYSEC-2023-301 | High | 0.7% | 20 Dec, 2023 | PyPI transformers |
MainWP Dashboard SQL Command Injection vulnerability CVE-2023-38519, GHSA-87fg-9x5w-j3rm | High | 0.6% | 20 Dec, 2023 | Packagist mainwp/mainwp |
MLflow Local File Disclosure Vulnerability BIT-mlflow-2023-6977, CVE-2023-6977, GHSA-qg8p-32gr-gh6x, PYSEC-2026-1659 | High | 3.9% | 20 Dec, 2023 | PyPI mlflow |
MLflow Path Traversal Vulnerability BIT-mlflow-2023-6976, CVE-2023-6976, GHSA-wv8q-4f85-2p8p, PYSEC-2026-1662 | High | 1.0% | 20 Dec, 2023 | PyPI mlflow |
Authentication bypass vulnerability in navidrome's subsonic endpoint CVE-2023-51442, GHSA-wq59-4q6r-635r, GO-2023-2414 | High | 0.7% | 19 Dec, 2023 | Go github.com/navidrome/navidrome |
Expired tokens can be renewed without validating the account password GHSA-9wgg-m99q-hhfc | High | Not scored | 19 Dec, 2023 | PyPI emailproxy |
Apache Superset SQL injection vulnerability BIT-superset-2023-49736, CVE-2023-49736, GHSA-jfxj-xf67-x723, PYSEC-2026-1184 | High | 1.2% | 19 Dec, 2023 | PyPI apache-superset |
Apache Superset incorrect write permissions vulnerability BIT-superset-2023-49734, CVE-2023-49734, GHSA-g49j-j489-3xpf, PYSEC-2026-1180 | High | 0.9% | 19 Dec, 2023 | PyPI apache-superset |
mlflow Command Injection vulnerability BIT-mlflow-2023-6940, CVE-2023-6940, GHSA-hvc6-42vf-jhf8, PYSEC-2026-1652 | High | 1.2% | 19 Dec, 2023 | PyPI mlflow |
Sentry's Astro SDK vulnerable to ReDoS CVE-2023-50249, GHSA-x3v3-8xg8-8v72 | High | 0.8% | 18 Dec, 2023 | npm @sentry/astro |
yiisoft/yii2-authclient's Oauth2 PKCE implementation is vulnerable CVE-2023-50714, GHSA-rw54-6826-c8j5 | High | 0.5% | 18 Dec, 2023 | Packagist yiisoft/yii2-authclient |
MLflow Path Traversal Vulnerability BIT-mlflow-2023-6909, CVE-2023-6909, GHSA-5r3q-93q3-f978, PYSEC-2023-252 | High | 89.7% | 18 Dec, 2023 | PyPI mlflow |
Potential CSV export data leak CVE-2023-50448, GHSA-356j-hg45-x525 | High | 0.5% | 15 Dec, 2023 | RubyGems activeadmin |
Unauthenticated Denial of Service in the octokit/webhooks library CVE-2023-50728, GHSA-pwfr-8pq7-x9qv | High | 0.9% | 15 Dec, 2023 | npm @octokit/app npm @octokit/webhooks npm octokit npm probot |
Configuration Injection in extension "Direct Mail" (direct_mail) CVE-2023-50461, GHSA-p6xx-fhfw-7mj7 | High | 0.5% | 13 Dec, 2023 | Packagist directmailteam/direct-mail |
Cube API denial of service attack CVE-2023-50709, GHSA-9759-3276-g2pm | High | 0.7% | 13 Dec, 2023 | npm @cubejs-backend/api-gateway |
Denial of service caused by infinite recursion when parsing SVG images CVE-2023-50262, GHSA-3qx2-6f78-w2j2 | High | 1.5% | 13 Dec, 2023 | Packagist dompdf/dompdf |
Improper validation in meraki GHSA-6x4h-9622-fqr6 | High | Not scored | 13 Dec, 2023 | PyPI meraki |
incorrect storage layout for contracts containing large arrays CVE-2023-46247, GHSA-6m97-7527-mh74, PYSEC-2023-307 | High | 0.7% | 13 Dec, 2023 | PyPI vyper |
Path traversal in MLflow BIT-mlflow-2023-6753, CVE-2023-6753, GHSA-v945-r3rc-6fjm, PYSEC-2023-309 | High | 1.1% | 13 Dec, 2023 | PyPI mlflow |
Ansible template injection vulnerability CVE-2023-5764, GHSA-7j69-qfc3-2fq9, PYSEC-2026-1122 | High | 0.6% | 12 Dec, 2023 | PyPI ansible-core |
Denial of service caused by infinite recursion when parsing SVG document CVE-2023-50251, GHSA-ff5x-7qg5-vwf2 | High | 0.9% | 12 Dec, 2023 | Packagist phenx/php-svg-lib |
Jinja2 template injection in mlflow BIT-mlflow-2023-6709, CVE-2023-6709, GHSA-cxfr-5q3r-2rc2, PYSEC-2023-281 | High | 0.9% | 12 Dec, 2023 | PyPI mlflow |
lakeFS logs S3 credentials in plain text GHSA-4rgc-5g6r-2rjf, GO-2023-2398 | High | Not scored | 12 Dec, 2023 | Go github.com/treeverse/lakefs |
Password Change Vulnerability CVE-2023-49804, GHSA-88j4-pcx8-q4q3 | High | 0.3% | 11 Dec, 2023 | npm uptime-kuma |
Overly permissive origin policy CVE-2023-49803, GHSA-qxrj-hx23-xp82 | High | 0.3% | 11 Dec, 2023 | npm @koa/cors |
PHPEMS Deserialization of Untrusted Data vulnerability CVE-2023-6654, GHSA-5rv2-vvmf-f7w8 | High | 1.7% | 10 Dec, 2023 | Packagist phpems/phpems |
Local Privilege Escalation in Windows CVE-2023-49797, GHSA-9w2p-rh8c-v9g5, PYSEC-2023-292 | High | 0.3% | 09 Dec, 2023 | PyPI pyinstaller |
Memory exhaustion in HashiCorp Vault BIT-vault-2023-6337, CVE-2023-6337, GHSA-6p62-6cg9-f5f5, GO-2023-2399 | High | 0.8% | 09 Dec, 2023 | Go github.com/hashicorp/vault |
DOS by abusing `fetchOptions.retry`. CVE-2023-49800, GHSA-q6hx-3m4p-749h | High | 0.8% | 09 Dec, 2023 | npm nuxt-api-party |
SSRF & Credentials Leak CVE-2023-49799, GHSA-3wfp-253j-5jxv | High | 0.8% | 09 Dec, 2023 | npm nuxt-api-party |
OpenZeppelin Contracts and Contracts Upgradeable duplicated execution of subcalls in v4.9.4 CVE-2023-49798, GHSA-699g-q6qh-q4v8 | High | 0.5% | 09 Dec, 2023 | npm @openzeppelin/contracts npm @openzeppelin/contracts-upgradeable |
Directory Traversal in evershop CVE-2023-46496, GHSA-rwf3-w4jq-f4cm | High | 1.2% | 08 Dec, 2023 | npm @evershop/evershop |
QNAP VioStor NVR OS Command Injection Vulnerability CVE-2023-47565 | HighExploited | 73.3% | 08 Dec, 2023 | |
Magento LTS vulnerable to Stored XSS via TinyMCE WYSIWYG Editor GHSA-9j5w-2cqc-cwj9 | High | Not scored | 08 Dec, 2023 | Packagist openmage/magento-lts |
mockjs vulnerable to Prototype Pollution via the Util.extend function CVE-2023-26158, GHSA-mh8j-9jvh-gjf6 | High | 0.8% | 08 Dec, 2023 | npm mockjs |
Microweber allows a remote attacker to obtain sensitive information via the HTTP GET method CVE-2023-48122, GHSA-p8q6-qrgj-7gx2 | High | 0.8% | 08 Dec, 2023 | Packagist microweber/microweber |
Mattermost Injection vulnerability BIT-mattermost-2023-6458, CVE-2023-6458, GHSA-7664-hcp7-f497 | High | 0.6% | 06 Dec, 2023 | Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server Go github.com/mattermost/mattermost/server/v8 |
FXC AE1021, AE1021PE OS Command Injection Vulnerability CVE-2023-49897 | HighExploited | 50.4% | 06 Dec, 2023 | |
github.com/ecies/go vulnerable to possible private key restoration CVE-2023-49292, GHSA-8j98-cjfr-qx3h, GO-2023-2380 | High | 0.3% | 05 Dec, 2023 | Go github.com/ecies/go/v2 |
SonicWall SMA100 Appliances OS Command Injection Vulnerability CVE-2023-44221 | HighExploited | 76.3% | 05 Dec, 2023 | |
PyDrive2's unsafe YAML deserialization in LoadSettingsFile allows arbitrary code execution CVE-2023-49297, GHSA-v5f6-hjmf-9mc5, PYSEC-2023-291 | High | 0.5% | 05 Dec, 2023 | PyPI PyDrive2 PyPI pydrive2 |
Traefik docker container using 100% CPU CVE-2023-47633, GHSA-6fwg-jrfw-ff7p, GO-2023-2377 | High | 1.3% | 05 Dec, 2023 | Go github.com/traefik/traefik Go github.com/traefik/traefik/v2 Go github.com/traefik/traefik/v3 |
Information exposure in MLflow BIT-mlflow-2023-43472, CVE-2023-43472, GHSA-wqxf-447m-6f5f, PYSEC-2026-1661 | High | 36.6% | 05 Dec, 2023 | PyPI mlflow |
Qualcomm Multiple Chipsets Integer Overflow Vulnerability CVE-2023-33107 | HighExploited | 0.7% | 05 Dec, 2023 | |
Qualcomm Multiple Chipsets Use of Out-of-Range Pointer Offset Vulnerability CVE-2023-33106 | HighExploited | 0.8% | 05 Dec, 2023 | |
Qualcomm Multiple Chipsets Use-After-Free Vulnerability CVE-2023-33063 | HighExploited | 0.7% | 05 Dec, 2023 |