Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Croc sender may place ANSI or CSI escape sequences in filename to attach receiver's terminal device CVE-2023-43620, GHSA-364c-vvqx-446c, GO-2023-2068 | High | 0.4% | 20 Sep, 2023 | Go github.com/schollz/croc Go github.com/schollz/croc/v6 Go github.com/schollz/croc/v8 Go github.com/schollz/croc/v9 |
File Upload vulnerability in Dolibarr ERP CRM BIT-dolibarr-2023-38887, CVE-2023-38887, GHSA-g8h7-mcp6-pf47 | High | 1.5% | 20 Sep, 2023 | Packagist dolibarr/dolibarr |
Dolibarr allows a remote privileged attacker to execute arbitrary code via a crafted command/script BIT-dolibarr-2023-38886, CVE-2023-38886, GHSA-6773-rfjv-c54w | High | 29.6% | 20 Sep, 2023 | Packagist dolibarr/dolibarr |
Trend Micro Apex One and Worry-Free Business Security Remote Code Execution Vulnerability CVE-2023-41179 | HighExploited | 4.2% | 19 Sep, 2023 | |
Cross site scripting in librenms CVE-2023-5060, GHSA-2q8c-gqf4-mg3v | High | 0.6% | 19 Sep, 2023 | Packagist librenms/librenms |
Vyper vulnerable to memory corruption in certain builtins utilizing `msize` CVE-2023-42443, GHSA-c647-pxm2-c52w, PYSEC-2023-306 | High | 0.8% | 18 Sep, 2023 | PyPI vyper |
Cross-Site Request Forgery (CSRF) in usememos/memos CVE-2023-5036, GHSA-2g7r-9xq5-c6hv, GO-2023-2065 | High | 0.3% | 18 Sep, 2023 | Go github.com/usememos/memos |
GeoNode vulnerable to SSRF Bypass to return internal host data CVE-2023-42439, GHSA-pxg5-h34r-7q8p, PYSEC-2023-176 | High | 1.0% | 15 Sep, 2023 | PyPI GeoNode PyPI geonode |
Directus affected by VM2 sandbox escape vulnerability GHSA-22rr-f3p8-5gf8 | High | Not scored | 15 Sep, 2023 | npm directus |
PocketMine-MP server crash with certain invalid JSON payloads in `LoginPacket` due to dependency vulnerability (again) CVE-2023-54390, GHSA-92jh-gwch-jq38 | High | 0.6% | 14 Sep, 2023 | Packagist pocketmine/pocketmine-mp |
PocketMine-MP server crash due to incorrect EC curve used for LoginPacket identityPublicKey CVE-2023-54355, GHSA-79rc-jjh6-rc89 | High | 0.4% | 14 Sep, 2023 | Packagist pocketmine/pocketmine-mp |
Apache HDFS Provider error message suggested CVE-2023-41267, GHSA-5hj9-m76g-xrc8, PYSEC-2026-1138 | High | 0.6% | 14 Sep, 2023 | PyPI apache-airflow-providers-apache-hdfs |
Adobe ColdFusion Improper Access Control Vulnerability CVE-2023-38205 | HighExploited | 99.8% | 14 Sep, 2023 | |
Denial of Service Vulnerability in gRPC TCP Server (Posix-compatible platforms) CVE-2023-4785, GHSA-p25m-jpj4-qcrr, PYSEC-2026-1428 | High | 0.8% | 13 Sep, 2023 | PyPI grpcio RubyGems grpc |
Adobe Acrobat and Reader Out-of-Bounds Write Vulnerability CVE-2023-26369 | HighExploited | 7.5% | 13 Sep, 2023 | |
Microsoft Streaming Service Proxy Privilege Escalation Vulnerability CVE-2023-36802 | HighExploited | 27.9% | 12 Sep, 2023 | |
Cecil Path Traversal vulnerability CVE-2023-4914, GHSA-q8hr-4w58-985p | High | 0.9% | 12 Sep, 2023 | Packagist cecil/cecil |
libwebp: OOB write in BuildHuffmanTable A-299477569, ASB-A-299477569, CVE-2023-4863, CVE-2023-5129, GHSA-j7hp-h8jx-5ppr, PYSEC-2026-1794, RUSTSEC-2023-0060, RUSTSEC-2023-0061 | HighExploited | 100.0% | 12 Sep, 2023 | Go github.com/chai2010/webp NuGet SkiaSharp NuGet magick.net-q16-anycpu NuGet magick.net-q16-hdri-anycpu +10 more |
Apache Airflow information exposure vulnerability BIT-airflow-2023-40712, CVE-2023-40712, GHSA-mjqh-v5f2-g2mw, PYSEC-2023-171 | High | 2.0% | 12 Sep, 2023 | PyPI apache-airflow |
Magento Open Source affected by Improper Input Validation CVE-2022-24093, GHSA-5xmp-7wg5-x68q | High | 1.7% | 12 Sep, 2023 | Packagist magento/community-edition Packagist magento/project-community-edition |
Apple Multiple Products Code Execution Vulnerability CVE-2023-41990 | HighExploited | 1.4% | 12 Sep, 2023 | |
Android Framework Privilege Escalation Vulnerability CVE-2023-35674 | HighExploited | 2.6% | 11 Sep, 2023 | |
Magento LTS's guest order "protect code" can be brute-forced too easily CVE-2023-41879, GHSA-9358-cpvx-c2qp | High | 1.3% | 11 Sep, 2023 | Packagist openmage/magento-lts |
ASUS RT-AX55 Routers OS Command Injection Vulnerability CVE-2023-39780 | HighExploited | 39.5% | 11 Sep, 2023 | |
RKE2 supervisor port is vulnerable to unauthenticated remote denial-of-service (DoS) attack via TLS SAN stuffing attack CVE-2023-32186, GHSA-p45j-vfv5-wprq | High | 0.7% | 11 Sep, 2023 | Go github.com/rancher/rke2 |
K3s apiserver port is vulnerable to unauthenticated remote denial-of-service (DoS) attack via TLS SAN stuffing attack CVE-2023-32187, GHSA-m4hf-6vgr-75r2 | High | 0.7% | 11 Sep, 2023 | Go github.com/k3s-io/k3s |
Hexo `include_code` has a path traversal CVE-2023-39584, GHSA-x2jc-989c-47q4 | High | 34.5% | 08 Sep, 2023 | npm hexo |
Apple iOS, iPadOS, and macOS ImageIO Buffer Overflow Vulnerability CVE-2023-41064 | HighExploited | 53.4% | 07 Sep, 2023 | |
Apple iOS, iPadOS, and watchOS Wallet Code Execution Vulnerability CVE-2023-41061 | HighExploited | 4.4% | 07 Sep, 2023 | |
Answer Missing Authentication for Critical Function CVE-2023-4815, GHSA-pj2h-85jq-g5vg, GO-2023-2051 | High | 0.8% | 07 Sep, 2023 | Go github.com/answerdev/answer |
Electron context isolation bypass via nested unserializable return value CVE-2023-29198, GHSA-p7v2-p9m8-qqg7 | High | 0.6% | 06 Sep, 2023 | npm electron |
Go-Ethereum vulnerable to denial of service via malicious p2p message CVE-2023-40591, GHSA-ppjg-v974-84cm, GO-2023-2046 | High | 1.1% | 06 Sep, 2023 | Go github.com/ethereum/go-ethereum |
Minio vulnerable to Privilege Escalation on Windows via Path separator manipulation CVE-2023-28433, GHSA-w23q-4hw3-2pp6 | High | 1.0% | 06 Sep, 2023 | Go github.com/minio/minio |
Remote Code Execution in Custom Integration Upload CVE-2023-41319, GHSA-p6p2-qq95-vq5h, PYSEC-2026-1345 | High | 0.9% | 06 Sep, 2023 | PyPI ethyca-fides |
Information disclosure in AccessControl CVE-2023-41050, GHSA-8xv7-89vj-q48c, PYSEC-2026-2075, PYSEC-2026-2325 | High | 0.6% | 06 Sep, 2023 | PyPI AccessControl PyPI Zope PyPI accesscontrol PyPI zope |
Google Chromium V8 Type Confusion Vulnerability CVE-2023-4762 | HighExploited | 41.4% | 05 Sep, 2023 | |
Salt can cause Git Providers to get wrong data CVE-2023-20898, GHSA-qvh6-3j7x-3hq7, PYSEC-2023-169 | High | 0.3% | 05 Sep, 2023 | PyPI salt |
Trigger `beforeFind` not invoked in internal query pipeline when fetching pointer BIT-parse-2023-41058, CVE-2023-41058, GHSA-fcv6-fg5r-jm9q | High | 0.8% | 04 Sep, 2023 | npm parse-server |
Improper Neutralization of Script in Attributes in @dcl/single-sign-on-client CVE-2023-41049, GHSA-vp4f-wxgw-7x8x | High | 0.5% | 01 Sep, 2023 | npm @dcl/single-sign-on-client |
usememos/memos vulnerable to privilege escalation CVE-2023-4697, GHSA-5j6p-59cj-j6cp, GO-2023-2036 | High | 0.8% | 01 Sep, 2023 | Go github.com/usememos/memos |
usememos/memos vulnerable to improper input validation CVE-2023-4698, GHSA-96gq-6ch5-mm54 | High | 0.9% | 01 Sep, 2023 | Go github.com/usememos/memos |
Sandbox escape via various forms of "format". CVE-2023-41039, GHSA-xjw2-6jm9-rf67, PYSEC-2023-159 | High | 0.7% | 30 Aug, 2023 | PyPI RestrictedPython PyPI restrictedpython |
KNX Association KNX Protocol Connection Authorization Option 1 Overly Restrictive Account Lockout Mechanism Vulnerability CVE-2023-4346 | HighExploited | 1.4% | 29 Aug, 2023 | |
MathJax Regular expression Denial of Service (ReDoS) CVE-2023-39663, GHSA-v638-q856-grg8 | High | 0.8% | 29 Aug, 2023 | npm mathjax |
MongoDB Driver may publish events containing authentication-related data CVE-2021-32050, GHSA-vxvm-qww3-2fh7 | High | 0.6% | 29 Aug, 2023 | Packagist mongodb/mongodb SwiftURL github.com/mongodb/mongo-swift-driver npm mongodb |
Code injection in ansible semaphore CVE-2023-39059, GHSA-3r32-cp7v-5wq4 | High | 1.7% | 29 Aug, 2023 | Go github.com/ansible-semaphore/semaphore |
Command injection in pagekit CVE-2023-41005, GHSA-j6mp-hx4g-p3gm | High | 0.6% | 28 Aug, 2023 | Packagist pagekit/pagekit |
GitPython untrusted search path on Windows systems leading to arbitrary code execution CVE-2023-40590, GHSA-wfm5-v35h-vwf4, PYSEC-2023-161 | High | 0.5% | 28 Aug, 2023 | PyPI gitpython |
Airflow Sqoop Provider RCE Vulnerability CVE-2023-27604, GHSA-g3m9-pr5m-4cvp, PYSEC-2026-1142 | High | 1.7% | 28 Aug, 2023 | PyPI apache-airflow-providers-apache-sqoop |
Apache Airflow vulnerable arbitrary code execution via Spark server CVE-2023-40195, GHSA-8q28-pw9g-w82c, PYSEC-2023-156 | High | 1.9% | 28 Aug, 2023 | PyPI apache-airflow-providers-apache-spark |