Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Ivanti Endpoint Manager Mobile (EPMM) Path Traversal Vulnerability CVE-2023-35081 | HighExploited | 63.6% | 03 Aug, 2023 | |
Pimcore Path Traversal Vulnerability in AssetController:importServerFilesAction CVE-2023-38708, GHSA-34hj-v8fm-x887 | High | 0.6% | 03 Aug, 2023 | Packagist pimcore/pimcore |
Answer Missing Authorization vulnerability CVE-2023-4124, GHSA-v9vc-7x69-c2x8, GO-2023-1997 | High | 0.7% | 03 Aug, 2023 | Go github.com/answerdev/answer |
Answer has Weak Password Requirements CVE-2023-4125, GHSA-j63x-f657-2m9g, GO-2023-2001 | High | 0.9% | 03 Aug, 2023 | Go github.com/answerdev/answer |
RaspAP Command Injection vulnerability CVE-2022-39987, GHSA-7r88-wjhj-jr8m | High | 37.3% | 01 Aug, 2023 | Packagist billz/raspap-webgui |
underscore-keypath vulnerable to Prototype Pollution CVE-2023-26139, GHSA-gpvc-mx6g-cchv | High | 0.9% | 01 Aug, 2023 | npm underscore-keypath |
mlflow vulnerable to OS Command Injection BIT-mlflow-2023-4033, CVE-2023-4033, GHSA-ffw3-6378-cqgp, PYSEC-2023-280 | High | 1.3% | 01 Aug, 2023 | PyPI mlflow |
phpMyFAQ Stored Cross-site Scripting vulnerability CVE-2023-4007, GHSA-q9vm-29ph-p7mp | High | 0.5% | 31 Jul, 2023 | Packagist thorsten/phpmyfaq |
Possible image tampering from missing image validation for Packages BIT-crossplane-2023-38495, CVE-2023-38495, GHSA-pj4x-2xr5-w87m, GO-2023-1980 | High | 0.8% | 28 Jul, 2023 | Go github.com/crossplane/crossplane |
Unsafe plugins can be installed via pack import by tenant admins GHSA-wxf3-4fvj-vqqx | High | Not scored | 27 Jul, 2023 | npm @saltcorn/cli |
DoS vulnerability for apps with sockets enabled CVE-2023-38504, GHSA-gpw9-fwm8-7rx7 | High | 0.9% | 27 Jul, 2023 | npm sails |
Denial of service from unlimited password lengths CVE-2023-38492, GHSA-3v6j-v3qc-cxff | High | 1.2% | 27 Jul, 2023 | Packagist getkirby/cms |
Insufficient Session Expiration after a password change CVE-2023-38489, GHSA-5mvj-rvp8-rf45 | High | 0.8% | 27 Jul, 2023 | Packagist getkirby/cms |
Field injection in the KirbyData text storage handler CVE-2023-38488, GHSA-x5mr-p6v4-wp93 | High | 0.9% | 27 Jul, 2023 | Packagist getkirby/cms |
Apple Multiple Products WebKit Code Execution Vulnerability CVE-2023-37450 | HighExploited | 18.9% | 27 Jul, 2023 | |
Float point exception (FPE) in paddlepaddle CVE-2023-38672, GHSA-cv2j-922j-hr56, PYSEC-2023-125 | High | 0.7% | 26 Jul, 2023 | PyPI paddlepaddle |
Null pointer dereference in PaddlePaddle CVE-2023-38670, GHSA-rr46-m366-gm44, PYSEC-2023-123 | High | 0.7% | 26 Jul, 2023 | PyPI paddlepaddle |
Improper authorization on debug and artifact file downloads CVE-2023-36826, GHSA-m4hc-m2v6-hfw8, PYSEC-2023-130 | High | 0.6% | 25 Jul, 2023 | PyPI sentry |
Leaking sensitive user information still possible by filtering on private with prefix fields CVE-2023-34235, GHSA-9xg4-3qfm-9w8f | High | 1.1% | 25 Jul, 2023 | npm @strapi/database npm @strapi/utils |
Making all attributes on a content-type public without noticing it CVE-2023-34093, GHSA-chmr-rg2f-9jmf | High | 0.7% | 25 Jul, 2023 | npm @strapi/database npm @strapi/strapi npm @strapi/utils |
Keylime's registrar vulnerable to Denial-of-service attack via a single open connection CVE-2023-38200, GHSA-pg75-v6fp-8q59, PYSEC-2026-1489 | High | 1.4% | 24 Jul, 2023 | PyPI keylime |
Open Babel has out-of-bounds write in MSI translationVectors[] CVE-2022-46295, GHSA-f8h2-c479-vqxf, PYSEC-2026-2780 | High | 0.9% | 21 Jul, 2023 | PyPI openbabel |
Open Babel has out-of-bounds write in MOPAC IN translationVectors[] (Tv atom) CVE-2022-46294, GHSA-mjmg-352j-f456, PYSEC-2026-2786 | High | 0.9% | 21 Jul, 2023 | PyPI openbabel |
Open Babel has out-of-bounds write in MOPAC translationVectors[] (FINAL POINT) CVE-2022-46293, GHSA-7h6r-6p76-68c9, PYSEC-2026-2775 | High | 0.9% | 21 Jul, 2023 | PyPI openbabel |
Open Babel has out-of-bounds write in MOPAC translationVectors[] (UNIT CELL TRANSLATION) CVE-2022-46292, GHSA-55f6-pf8r-c2f4, PYSEC-2026-2771 | High | 0.8% | 21 Jul, 2023 | PyPI openbabel |
Open Babel has out-of-bounds write in Gaussian translationVectors[] CVE-2022-46291, GHSA-jg3h-pv7c-4f9c, PYSEC-2026-2783 | High | 0.8% | 21 Jul, 2023 | PyPI openbabel |
Open Babel has out-of-bounds write in ORCA nAtoms parser (second variant) CVE-2022-46290, GHSA-5rff-8f7c-8jmw, PYSEC-2026-2773 | High | 0.8% | 21 Jul, 2023 | PyPI openbabel |
Open Babel has out-of-bounds write in ORCA nAtoms parser CVE-2022-46289, GHSA-rj4c-r689-cm87, PYSEC-2026-2790 | High | 0.8% | 21 Jul, 2023 | PyPI openbabel |
Open Babel has uninitialized pointer dereference in PQS pFormat CVE-2022-46280, GHSA-8qxc-57hf-hc9j, PYSEC-2026-2777 | High | 0.8% | 21 Jul, 2023 | PyPI openbabel |
Open Babel has uninitialized pointer dereference in MSI atom parser CVE-2022-44451, GHSA-jr2x-6qf6-q5mc, PYSEC-2026-2784 | High | 0.8% | 21 Jul, 2023 | PyPI openbabel |
Open Babel has out-of-bounds write in MOL2 attribute/value parser CVE-2022-43607, GHSA-vjg6-gm8m-v5g6, PYSEC-2026-2792 | High | 0.8% | 21 Jul, 2023 | PyPI openbabel |
Open Babel has out-of-bounds write in PQS coord_file parser CVE-2022-43467, GHSA-f29h-2h58-48r7, PYSEC-2026-2779 | High | 0.8% | 21 Jul, 2023 | PyPI openbabel |
Open Babel has uninitialized pointer dereference in GRO residue parser CVE-2022-42885, GHSA-mw5r-wq2m-397c, PYSEC-2026-2787 | High | 0.8% | 21 Jul, 2023 | PyPI openbabel |
Open Babel has out-of-bounds write in CSR PadString (title field) CVE-2022-41793, GHSA-p594-7xw4-g76p, PYSEC-2026-2788 | High | 0.8% | 21 Jul, 2023 | PyPI openbabel |
Open Babel has out-of-bounds write in Gaussian coords_type orientation parser CVE-2022-37331, GHSA-vr3p-gg26-45v9, PYSEC-2026-2793 | High | 0.7% | 21 Jul, 2023 | PyPI openbabel |
Pimcore vulnerable to SQL Injection in Dataobjects sorting CVE-2023-3820, GHSA-c9hw-557q-f8hq | High | 1.2% | 21 Jul, 2023 | Packagist pimcore/pimcore |
Pimcore vulnerable to Exposure of Sensitive Information to an Unauthorized Actor CVE-2023-3819, GHSA-r87r-982q-2c3q | High | 0.7% | 21 Jul, 2023 | Packagist pimcore/pimcore |
Cockpit CMS Cross-Site Request Forgery vulnerability CVE-2023-37650, GHSA-45g2-r339-pjwf | High | 0.5% | 20 Jul, 2023 | Packagist cockpit-hq/cockpit |
Cockpit CMS vulnerable to incorrect access control CVE-2023-37649, GHSA-9r25-4j77-9wc7 | High | 0.9% | 20 Jul, 2023 | Packagist cockpit-hq/cockpit |
Feathers socket handler allows abusing implicit toString CVE-2023-37899, GHSA-hhr9-rh25-hvf9 | High | 1.2% | 19 Jul, 2023 | npm @feathersjs/socketio npm @feathersjs/transport-commons |
aiohttp.web.Application vulnerable to HTTP request smuggling via llhttp HTTP request parser CVE-2023-37276, GHSA-45c4-8wx5-qw6w, PYSEC-2023-120 | High | 1.3% | 19 Jul, 2023 | PyPI aiohttp |
goproxy Denial of Service vulnerability CVE-2023-37788, GHSA-4r8x-2p26-976p, GO-2023-1941 | High | 1.0% | 18 Jul, 2023 | Go github.com/elazarl/goproxy |
grav Server-side Template Injection (SSTI) mitigation bypass CVE-2023-37897, GHSA-9436-3gmp-4f53 | High | 2.8% | 18 Jul, 2023 | Packagist getgrav/grav |
1Panel command injection vulnerability in Firewall ip functionality CVE-2023-37477, GHSA-p9xf-74xh-mhw5, GO-2023-1940 | High | 5.8% | 18 Jul, 2023 | Go github.com/1Panel-dev/1Panel |
avro vulnerable to denial of service via attacker-controlled parameter CVE-2023-37475, GHSA-9x44-9pgq-cf45, GO-2023-1930 | High | 1.0% | 17 Jul, 2023 | Go github.com/hamba/avro Go github.com/hamba/avro/v2 |
Admidio vulnerable to Unrestricted Upload of File with Dangerous Type CVE-2023-3692, GHSA-q347-jrx8-5pw9 | High | 1.0% | 16 Jul, 2023 | Packagist admidio/admidio |
rswag vulnerable to arbitrary JSON and YAML file read via directory traversal CVE-2023-38337, GHSA-vc79-65pr-q82v | High | 1.3% | 15 Jul, 2023 | RubyGems rswag |
Weave GitOps Terraform Controller Information Disclosure Vulnerability CVE-2023-34236, GHSA-6hvv-j432-23cv, GO-2023-1925 | High | 1.0% | 14 Jul, 2023 | Go github.com/weaveworks/tf-controller |
PocketMine-MP vulnerable to server crash using badly formatted sign NBT in BlockActorDataPacket CVE-2023-54392, GHSA-7wrv-6h42-w54f | High | 0.5% | 14 Jul, 2023 | Packagist pocketmine/pocketmine-mp |
zenstruck/collection passing callable string to EntityRepository::find() and query() CVE-2023-37473, GHSA-7xr2-8ff7-6fjq | High | 0.9% | 14 Jul, 2023 | Packagist zenstruck/collection |