Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
mycli has Inadequate Encryption Strength CVE-2023-44690, GHSA-v9vj-9pxv-mr2w, PYSEC-2023-213 | High | 0.3% | 19 Oct, 2023 | PyPI mycli |
Directus crashes on invalid WebSocket message CVE-2023-45820, GHSA-hmgw-9jrg-hf2m | High | 0.8% | 19 Oct, 2023 | npm directus |
Artifact Hub arbitrary file read vulnerability CVE-2023-45823, GHSA-hmq4-c2r4-5q8h, GO-2023-2136 | High | 0.8% | 19 Oct, 2023 | Go github.com/artifacthub/hub |
Viewing wget extractor output while logged in as an admin allows archived JS to execute in the admins context CVE-2023-45815, GHSA-cr45-98w9-gwqx, PYSEC-2023-229 | High | 0.8% | 19 Oct, 2023 | PyPI archivebox |
NATS.io: Adding accounts for just the system account adds auth bypass CVE-2023-47090, GHSA-fr2g-9hjm-wr23, GO-2023-2133 | High | 0.8% | 19 Oct, 2023 | Go github.com/nats-io/nats-server/v2 |
LangChain Server Side Request Forgery vulnerability CVE-2023-46229, GHSA-655w-fm8m-m478, PYSEC-2023-205 | High | 47.6% | 19 Oct, 2023 | PyPI langchain |
TorBot vulnerable to Inefficient Regular Expression Complexity in validate_link CVE-2023-45813, GHSA-72qw-p7hh-m3ff, PYSEC-2026-1969 | High | 1.0% | 18 Oct, 2023 | PyPI torbot |
OpenFGA DoS vulnerability CVE-2023-45810, GHSA-hr4f-6jh8-f2vq, GO-2023-2121 | High | 0.6% | 18 Oct, 2023 | Go github.com/openfga/openfga |
Arduino Create Agent path traversal - local privilege escalation vulnerability CVE-2023-43802, GHSA-75j7-w798-cwwx | High | 0.4% | 18 Oct, 2023 | Go github.com/arduino/arduino-create-agent |
Arduino Create Agent Insufficient Verification of Data Authenticity vulnerability CVE-2023-43800, GHSA-4x5q-q7wc-q22p | High | 0.2% | 18 Oct, 2023 | Go github.com/arduino/arduino-create-agent |
North Grid Proself Improper Restriction of XML External Entity (XXE) Reference Vulnerability CVE-2023-45727 | HighExploited | 4.8% | 18 Oct, 2023 | |
go-ethereum vulnerable to denial of service via crafted GraphQL query CVE-2023-42319, GHSA-v9jh-j8px-98vq | High | 1.2% | 18 Oct, 2023 | Go github.com/ethereum/go-ethereum |
Synchrony deobfuscator prototype pollution vulnerability leading to arbitrary code execution CVE-2023-45811, GHSA-jg82-xh3w-rhxx | High | 0.4% | 17 Oct, 2023 | npm deobfuscator |
Cross-site Scripting via missing Binding syntax validation CVE-2023-45683, GHSA-267v-3v32-g6q5, GO-2023-2114 | High | 0.5% | 17 Oct, 2023 | Go github.com/crewjam/saml |
github.com/kumahq/kuma affected by CVE-2023-44487 GHSA-9wmc-rg4h-28wv | High | Not scored | 17 Oct, 2023 | Go github.com/kumahq/kuma |
Go Fiber CSRF Token Validation Vulnerability CVE-2023-45141, GHSA-mv73-f69x-444p, GO-2023-2116 | High | 0.3% | 17 Oct, 2023 | Go github.com/gofiber/fiber/v2 |
Traefik vulnerable to HTTP/2 request causing denial of service BIT-golang-2023-54365, CVE-2023-54365, GHSA-7v4p-328v-8v5g | High | 0.8% | 17 Oct, 2023 | Go github.com/traefik/traefik |
Silverstripe GraphQL has DDOS Vulnerability due to lack of protection against recursive queries CVE-2023-40180, GHSA-v23w-pppm-jh66 | High | 1.1% | 16 Oct, 2023 | Packagist silverstripe/graphql |
OpenTelemetry-Go Contrib vulnerable to denial of service in otelhttp due to unbound cardinality metrics CVE-2023-45142, GHSA-rcjv-mgp8-qvmr, GO-2023-2113 | High | 1.6% | 16 Oct, 2023 | Go go.opentelemetry.io/contrib/instrumentation/github.com/emicklei/go-restful/otelrestful Go go.opentelemetry.io/contrib/instrumentation/github.com/gin-gonic/gin/otelgin Go go.opentelemetry.io/contrib/instrumentation/github.com/gorilla/mux/otelmux Go go.opentelemetry.io/contrib/instrumentation/github.com/labstack/echo/otelecho +3 more |
SQL injection in librenms/librenms CVE-2023-5591, GHSA-mr6h-7x2m-rgmq | High | 23.8% | 16 Oct, 2023 | Packagist librenms/librenms |
NULL Pointer Dereference in GitHub repository seleniumhq/selenium prior to 4.14.0. CVE-2023-5590, PYSEC-2023-206 | High | 1.0% | 15 Oct, 2023 | PyPI selenium |
Improper Input Validation in vriteio/vrite CVE-2023-5571, GHSA-44ff-9w4f-99w6 | High | 0.8% | 13 Oct, 2023 | npm @vrite/sdk |
Magento Open Source allows Improper Authorization CVE-2023-38220, GHSA-grc6-r6f8-xj7c | High | 0.8% | 13 Oct, 2023 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento Open Source allows Cross-Site Scripting (XSS) CVE-2023-38219, GHSA-3j7w-jp46-9752 | High | 0.8% | 13 Oct, 2023 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento Open Source allows Incorrect Authorization CVE-2023-38218, GHSA-rpc7-gf58-v3x2 | High | 0.9% | 13 Oct, 2023 | Packagist magento/community-edition Packagist magento/project-community-edition |
kOps privilege escalation vulnerability CVE-2023-1943, GHSA-8gwj-m6vh-2g6j, GO-2023-2125 | High | 0.6% | 12 Oct, 2023 | Go k8s.io/kops |
Pickle serialization vulnerable to Deserialization of Untrusted Data CVE-2023-23930, GHSA-5m22-cfq9-86x6, PYSEC-2023-196 | High | 1.1% | 11 Oct, 2023 | PyPI vantage6 |
HTTP/2 rapid reset can cause excessive work in net/http BIT-golang-2023-39325, CVE-2023-39325, GHSA-4374-p667-p6c8, GO-2023-2102 | High | 3.8% | 11 Oct, 2023 | Go golang.org/x/net Go stdlib |
Cross-Site Request Forgery (CSRF) in snipe/snipe-it CVE-2023-5511, GHSA-33vj-r6p6-x4p8 | High | 0.3% | 11 Oct, 2023 | Packagist snipe/snipe-it |
github.com/nghttp2/nghttp2 has HTTP/2 Rapid Reset GHSA-vx74-f528-fxqg | High | Not scored | 10 Oct, 2023 | Go github.com/nghttp2/nghttp2 |
Citrix NetScaler ADC and NetScaler Gateway Buffer Overflow Vulnerability CVE-2023-4966 | HighExploited | 100.0% | 10 Oct, 2023 | |
HTTP/2 Stream Cancellation Attack BIT-apisix-2023-44487, BIT-aspnet-core-2023-44487, BIT-contour-2023-44487, BIT-dotnet-2023-44487, BIT-dotnet-sdk-2023-44487, BIT-envoy-2023-44487, BIT-golang-2023-44487, BIT-jenkins-2023-44487, BIT-kong-2023-44487, BIT-nginx-2023-44487, BIT-nginx-gateway-2023-44487, BIT-node-2023-44487, BIT-node-min-2023-44487, BIT-solr-2023-44487, BIT-tomcat-2023-44487, BIT-varnish-2023-44487, CVE-2023-44487, GHSA-qppj-fm5r-hxr3 | HighExploited | 100.0% | 10 Oct, 2023 | Go golang.org/x/net Maven com.typesafe.akka:akka-http-core Maven com.typesafe.akka:akka-http-core_2.11 Maven com.typesafe.akka:akka-http-core_2.12 +8 more |
Uptime Kuma has Persistentent User Sessions CVE-2023-44400, GHSA-g9v2-wqcj-j99g | High | 0.3% | 09 Oct, 2023 | npm uptime-kuma |
OctoPrint vulnerable to Improper Neutralization of Special Elements Used in a Template Engine CVE-2023-41047, GHSA-fwfg-vprh-97ph, PYSEC-2023-195 | High | 0.6% | 09 Oct, 2023 | PyPI OctoPrint PyPI octoprint |
MediaWiki Denial of Service vulnerability BIT-mediawiki-2023-45363, CVE-2023-45363, GHSA-w5fx-cx7f-6vr9 | High | 23.8% | 09 Oct, 2023 | Packagist mediawiki/core |
Prototype Pollution in NASA Open MCT CVE-2023-45282, GHSA-4xcx-cwrq-w792 | High | 1.2% | 06 Oct, 2023 | npm openmct |
Bundled libwebp in pywebp vulnerable GHSA-f9pm-4g9p-6vm3 | High | Not scored | 06 Oct, 2023 | PyPI webp |
Decidim has broken access control in templates CVE-2023-36465, GHSA-639h-86hw-qcjq | High | 0.7% | 05 Oct, 2023 | RubyGems decidim RubyGems decidim-templates |
NI MeasurementLink Python Services Improper Access Restriction vulnerability CVE-2023-4570, GHSA-3f48-9j7q-q2gv, PYSEC-2026-1695 | High | 0.3% | 05 Oct, 2023 | PyPI ni-measurementlink-service |
Bundled libwebp in imagecodecs vulnerable GHSA-94vc-p8w7-5p49 | High | Not scored | 05 Oct, 2023 | PyPI imagecodecs |
Apple iOS and iPadOS Kernel Privilege Escalation Vulnerability CVE-2023-42824 | HighExploited | 1.0% | 04 Oct, 2023 | |
Ansible may expose private key CVE-2023-4237, GHSA-ww3m-ffrm-qvqv, PYSEC-2026-1125 | High | 0.3% | 04 Oct, 2023 | PyPI ansible-core |
Zod denial of service vulnerability during email validation GHSA-mvrp-3cvx-c325 | High | Not scored | 04 Oct, 2023 | npm express-zod-api |
GNU C Library Buffer Overflow Vulnerability CVE-2023-4911 | HighExploited | 63.8% | 03 Oct, 2023 | |
static-server Path Traversal vulnerability CVE-2023-26152, GHSA-v834-rhv4-65m3 | High | 1.4% | 03 Oct, 2023 | npm static-server |
asyncua Improper Authentication vulnerability CVE-2023-26150, GHSA-2894-qcqf-g23g, PYSEC-2023-189 | High | 0.5% | 03 Oct, 2023 | PyPI asyncua |
asyncua vulnerable to denial of service via infinite loop CVE-2023-26151, GHSA-gfvq-mxw3-mfq3, PYSEC-2023-190 | High | 1.2% | 03 Oct, 2023 | PyPI asyncua |
Soft Serve Public Key Authentication Bypass Vulnerability when Keyboard-Interactive SSH Authentication is Enabled CVE-2023-43809, GHSA-mc97-99j4-vm2v, GO-2023-2097 | High | 1.2% | 02 Oct, 2023 | Go github.com/charmbracelet/soft-serve |
opentelemetry-instrumentation Denial of Service vulnerability due to unbound cardinality metrics CVE-2023-43810, GHSA-5rv5-6h4r-h22v, PYSEC-2026-1752 | High | 0.8% | 02 Oct, 2023 | PyPI opentelemetry-instrumentation |
`Cookie` HTTP header isn't stripped on cross-origin redirects CVE-2023-43804, GHSA-v845-jxx5-vc9f, PYSEC-2023-192 | High | 1.4% | 02 Oct, 2023 | PyPI urllib3 |