Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Go package github.com/edgelesssys/marblerun CLI commands susceptible to MITM attacks GHSA-j3rq-4xjw-xg63, GO-2023-2378 | High | Not scored | 04 Dec, 2023 | Go github.com/edgelesssys/marblerun |
ThinkAdmin arbitrary file upload vulnerability CVE-2023-48966, GHSA-7gq9-p94f-g5v9 | High | 1.1% | 04 Dec, 2023 | Packagist zoujingli/thinkadmin |
ASAR Integrity bypass via filetype confusion in electron CVE-2023-44402, GHSA-7m48-wc93-9g85 | High | 0.2% | 01 Dec, 2023 | npm electron |
Cookie leakage between different users in fastapi-proxy-lib GHSA-7vwr-g6pm-9hc8 | High | Not scored | 01 Dec, 2023 | PyPI fastapi-proxy-lib |
Apple Multiple Products WebKit Memory Corruption Vulnerability CVE-2023-42917 | HighExploited | 9.3% | 30 Nov, 2023 | |
@adobe/css-tools Improper Input Validation and Inefficient Regular Expression Complexity CVE-2023-48631, GHSA-prr3-c3m5-p7q2 | High | 1.1% | 30 Nov, 2023 | npm @adobe/css-tools |
Microweber file upload vulnerability CVE-2023-49052, GHSA-2c7x-w3mx-h7p6 | High | 2.5% | 30 Nov, 2023 | Packagist microweber/microweber |
ZITADEL Account Takeover via Malicious Host Header Injection CVE-2023-49097, GHSA-2wmj-46rj-qm2w | High | 0.8% | 29 Nov, 2023 | Go github.com/zitadel/zitadel |
cryptography vulnerable to NULL-dereference when loading PKCS7 certificates CVE-2023-49083, GHSA-jfhm-5ghh-2f97, PYSEC-2023-254 | High | 1.0% | 28 Nov, 2023 | PyPI cryptography |
Validation of SignedInfo CVE-2023-49087, GHSA-ww7x-3gxh-qm6r | High | 0.2% | 28 Nov, 2023 | Packagist simplesamlphp/saml2 Packagist simplesamlphp/xml-security |
Pimcore Admin UI has Two Factor Authentication disabled for non admin security firewalls CVE-2023-49075, GHSA-9wwg-r3c7-4vfg | High | 1.4% | 27 Nov, 2023 | Packagist pimcore/admin-ui-classic-bundle |
Phpseclib needs guardrails on large binaryfield integers CVE-2023-49316, GHSA-2f25-pfq3-c7h8 | High | 0.8% | 27 Nov, 2023 | Packagist phpseclib/phpseclib |
Apache Superset - Elevation of Privilege BIT-superset-2023-40610, CVE-2023-40610, GHSA-f678-j579-4xf5, PYSEC-2026-1173 | High | 1.3% | 27 Nov, 2023 | PyPI apache-superset |
sequelize-typescript Prototype Pollution vulnerability CVE-2023-6293, GHSA-7pvx-4585-hqww | High | 0.6% | 24 Nov, 2023 | npm sequelize-typescript |
Apache DolphinScheduler sensitive information disclosure CVE-2023-48796, GHSA-4vvc-r4p4-qgrr, PYSEC-2023-268 | High | 1.2% | 24 Nov, 2023 | Maven org.apache.dolphinscheduler:dolphinscheduler PyPI apache-dolphinscheduler |
Cross Site Request Forgery in SwiftyEdit CVE-2023-47350, GHSA-2492-xxqf-6h78 | High | 0.4% | 22 Nov, 2023 | Packagist swiftyedit/swiftyedit |
Cross-site Scripting potential in custom links, job buttons, and computed fields CVE-2023-48705, GHSA-cf9f-wmhp-v4pr, PYSEC-2023-285 | High | 0.5% | 22 Nov, 2023 | PyPI nautobot |
Cross-site Scripting via uploaded assets CVE-2023-48701, GHSA-8jjh-j3c2-cjcv | High | 0.7% | 21 Nov, 2023 | Packagist statamic/cms |
Download to arbitrary folder can lead to RCE CVE-2023-47890, GHSA-h73m-pcfw-25h2, PYSEC-2026-1819 | High | 1.1% | 21 Nov, 2023 | PyPI pyload-ng |
ownCloud graphapi Information Disclosure Vulnerability CVE-2023-49103 | HighExploited | 77.8% | 21 Nov, 2023 | |
upydev has weak encryption padding CVE-2023-48051, GHSA-qc4j-hrj6-cppf, PYSEC-2023-302 | High | 0.2% | 20 Nov, 2023 | PyPI upydev |
Inefficient Regular Expression Complexity in git-urls CVE-2023-46402, GHSA-3f2q-6294-fmq5 | High | 0.9% | 18 Nov, 2023 | Go github.com/whilp/git-urls |
json-web-token library is vulnerable to a JWT algorithm confusion attack CVE-2023-48238, GHSA-4xw9-cx39-r355 | High | 0.3% | 17 Nov, 2023 | npm json-web-token |
LibreNMS vulnerable to rate limiting bypass on login page CVE-2023-46745, GHSA-rq42-58qf-v3qx | High | 0.6% | 17 Nov, 2023 | Packagist librenms/librenms |
Free5gc allows a local attacker to cause a denial of service via the free5gc-compose component CVE-2023-47025, GHSA-q27h-hw2v-x5jm | High | 0.3% | 17 Nov, 2023 | Go github.com/free5gc/free5gc |
HTTPie allows attackers to eavesdrop on communications between the host and server via a man-in-the-middle attack CVE-2023-48052, GHSA-8r96-8889-qg2x, PYSEC-2023-242 | High | 0.3% | 16 Nov, 2023 | PyPI httpie |
Missing SSL certificate validation in localstack CVE-2023-48054, GHSA-8633-g3ph-97rp, PYSEC-2023-243 | High | 0.3% | 16 Nov, 2023 | PyPI localstack |
PyPinkSign uses a non-random or static IV for Cipher Block Chaining (CBC) mode in AES encryption CVE-2023-48056, GHSA-fxff-wxxv-c2jc, PYSEC-2023-245 | High | 0.4% | 16 Nov, 2023 | PyPI pypinksign |
Cross-Site Request Forgery vulnerability in Prefect CVE-2023-6022, GHSA-4hh5-2678-83fx, PYSEC-2026-1799 | High | 0.4% | 16 Nov, 2023 | PyPI prefect |
sharp vulnerability in libwebp dependency CVE-2023-4863 GHSA-54xq-cgqr-rpm3 | High | Not scored | 16 Nov, 2023 | npm sharp |
free5gc Buffer Overflow vulnerability CVE-2023-47345, GHSA-6944-6pmv-6mp2 | High | 0.9% | 16 Nov, 2023 | Go github.com/free5gc/free5gc |
Pimcore SQL Injection in Admin Grid Filter API through Multiselect::getFilterConditionExt() CVE-2023-47637, GHSA-72hh-xf79-429p | High | 1.2% | 15 Nov, 2023 | Packagist pimcore/pimcore |
Attacker can cause Kyverno user to unintentionally consume insecure image BIT-kyverno-2023-47630, CVE-2023-47630, GHSA-3hfq-cx9j-923w, GO-2023-2340 | High | 0.3% | 14 Nov, 2023 | Go github.com/kyverno/kyverno |
Statamic CMS vulnerable to remote code execution via form uploads CVE-2023-48217, GHSA-2r53-9295-3m86 | High | 1.1% | 14 Nov, 2023 | Packagist statamic/cms |
Kubernetes Improper Input Validation vulnerability CVE-2023-5528, GHSA-hq6q-c2x6-hmch, GO-2023-2341 | High | 4.1% | 14 Nov, 2023 | Go k8s.io/kubernetes |
AIOHTTP has problems in HTTP parser (the python one, not llhttp) CVE-2023-47627, GHSA-gfw2-4jvh-wgfg, PYSEC-2023-246 | High | 0.9% | 14 Nov, 2023 | PyPI aiohttp |
vantage6-server node accepts non-whitelisted algorithms from malicious server CVE-2023-47631, GHSA-vc3v-ppc7-v486, PYSEC-2023-303, PYSEC-2023-304 | High | 0.4% | 14 Nov, 2023 | PyPI vantage6-node PyPI vantage6-server |
Fabric vulnerable to crosslinking transaction attack BIT-hyperledger-fabric-orderer-2023-46132, BIT-hyperledger-fabric-peer-2023-46132, BIT-hyperledger-fabric-tools-2023-46132, CVE-2023-46132, GHSA-v9w2-543f-h69m | High | 0.5% | 14 Nov, 2023 | Go github.com/hyperledger/fabric |
Microsoft Windows Out-of-Bounds Read Vulnerability CVE-2023-36424 | HighExploited | 12.1% | 14 Nov, 2023 | |
Microsoft Windows Cloud Files Mini Filter Driver Privilege Escalation Vulnerability CVE-2023-36036 | HighExploited | 16.7% | 14 Nov, 2023 | |
Microsoft Windows Desktop Window Manager (DWM) Core Library Privilege Escalation Vulnerability CVE-2023-36033 | HighExploited | 10.9% | 14 Nov, 2023 | |
Microsoft Windows SmartScreen Security Feature Bypass Vulnerability CVE-2023-36025 | HighExploited | 88.2% | 14 Nov, 2023 | |
Label Studio Object Relational Mapper Leak Vulnerability in Filtering Task CVE-2023-47117, GHSA-6hjj-gq77-j4qw, PYSEC-2023-275 | High | 4.1% | 13 Nov, 2023 | PyPI label-studio |
Guest Entries Remote code execution via file uploads CVE-2023-47621, GHSA-rw82-mhmx-grmj | High | 1.0% | 13 Nov, 2023 | Packagist doublethreedigital/guest-entries Packagist duncanmcclean/guest-entries |
Remarshal expands YAML alias nodes unlimitedly, hence Remarshal is vulnerable to Billion Laughs Attack CVE-2023-47163, GHSA-gw7g-qr8w-3448, PYSEC-2023-236 | High | 1.0% | 13 Nov, 2023 | PyPI remarshal |
otelgrpc DoS vulnerability due to unbound cardinality metrics CVE-2023-47108, GHSA-8pgv-569h-w5rw, GO-2023-2331 | High | 2.0% | 12 Nov, 2023 | Go go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc |
Apache Airflow vulnerable to Exposure of Sensitive Information to an Unauthorized Actor BIT-airflow-2023-42781, CVE-2023-42781, GHSA-r7x6-xfcm-3mxv, PYSEC-2023-231 | High | 1.7% | 12 Nov, 2023 | PyPI apache-airflow |
Headscale writes bearer tokens to info-level logs CVE-2023-47390, GHSA-wp76-cf2j-rqq7 | High | 0.7% | 11 Nov, 2023 | Go github.com/juanfont/headscale |
HashiCorp Vault Missing Release of Memory after Effective Lifetime vulnerability BIT-vault-2023-5954, CVE-2023-5954, GHSA-4qhc-v8r6-8vwm, GO-2023-2329 | High | 0.7% | 09 Nov, 2023 | Go github.com/hashicorp/vault |
Moodle Code Injection vulnerability BIT-moodle-2023-5540, CVE-2023-5540, GHSA-w8x2-w4qr-v3x4 | High | 2.3% | 09 Nov, 2023 | Packagist moodle/moodle |