Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
copyparty vulnerable to path traversal attack CVE-2023-37474, GHSA-pxfv-7rr3-2qjg, PYSEC-2023-127 | High | 44.9% | 14 Jul, 2023 | PyPI copyparty |
cryptography mishandles SSH certificates CVE-2023-38325, GHSA-cf7p-gm2m-833m, PYSEC-2023-112 | High | 0.7% | 14 Jul, 2023 | PyPI cryptography |
Pimcore SQL Injection vulnerability CVE-2023-3673, GHSA-rxp5-qwrf-pfv3 | High | 0.9% | 14 Jul, 2023 | Packagist pimcore/pimcore |
webmention.js Cross-site Scripting vulnerability CVE-2023-3672, GHSA-r54g-4qq6-chxg | High | 0.5% | 14 Jul, 2023 | npm webmention.js |
mx-chain-go's relayed transactions always increment nonce CVE-2023-34458, GHSA-j494-7x2v-vvvp, GO-2023-1912 | High | 1.3% | 13 Jul, 2023 | Go github.com/multiversx/mx-chain-go |
Apache Airflow Apache Hive Provider Improper Input Validation vulnerability CVE-2023-37415, GHSA-4q2q-q5pw-2342, PYSEC-2026-1139 | High | 1.6% | 13 Jul, 2023 | PyPI apache-airflow-providers-apache-hive |
Adobe ColdFusion Improper Access Control Vulnerability CVE-2023-29298 | HighExploited | 99.8% | 12 Jul, 2023 | |
Apache Airflow information disclosure vulnerability BIT-airflow-2022-46651, CVE-2022-46651, GHSA-xvw9-3mhm-xjqq, PYSEC-2023-103 | High | 1.2% | 12 Jul, 2023 | PyPI apache-airflow |
Apache Airflow Path Traversal vulnerability BIT-airflow-2023-22887, CVE-2023-22887, GHSA-ggwr-4vr8-g7wv, PYSEC-2023-104 | High | 1.8% | 12 Jul, 2023 | PyPI apache-airflow |
Apache Airflow Improper Input Validation vulnerability BIT-airflow-2023-22888, CVE-2023-22888, GHSA-5946-8p38-vffp, PYSEC-2023-105 | High | 1.4% | 12 Jul, 2023 | PyPI apache-airflow |
Apache Airflow Incorrect Authorization vulnerability BIT-airflow-2023-35908, CVE-2023-35908, GHSA-2h84-3crq-vgfj, PYSEC-2023-119 | High | 1.0% | 12 Jul, 2023 | PyPI apache-airflow |
Apache Airflow Improper Input Validation vulnerability BIT-airflow-2023-36543, CVE-2023-36543, GHSA-3h4m-m55v-gx4m, PYSEC-2023-106 | High | 1.6% | 12 Jul, 2023 | PyPI apache-airflow |
Decidim Cross-site Scripting vulnerability in the processes filter CVE-2023-34089, GHSA-5652-92r9-3fx9 | High | 0.7% | 11 Jul, 2023 | RubyGems decidim RubyGems decidim-core |
Decidim vulnerable to sensitive data disclosure CVE-2023-34090, GHSA-jm79-9pm4-vrw9 | High | 1.3% | 11 Jul, 2023 | RubyGems decidim RubyGems decidim-meetings |
Microsoft Windows Search Remote Code Execution Vulnerability CVE-2023-36884 | HighExploited | 99.4% | 11 Jul, 2023 | |
Microsoft Windows Error Reporting Service Privilege Escalation Vulnerability CVE-2023-36874 | HighExploited | 42.6% | 11 Jul, 2023 | |
Microsoft Outlook Security Feature Bypass Vulnerability CVE-2023-35311 | HighExploited | 15.5% | 11 Jul, 2023 | |
Microsoft Windows Defender SmartScreen Security Feature Bypass Vulnerability CVE-2023-32049 | HighExploited | 4.2% | 11 Jul, 2023 | |
Microsoft Windows MSHTML Platform Privilege Escalation Vulnerability CVE-2023-32046 | HighExploited | 10.0% | 11 Jul, 2023 | |
TeamPass information exposure vulnerability CVE-2023-3553, GHSA-2rhg-hqq9-8xjh | High | 0.8% | 08 Jul, 2023 | Packagist nilsteampassnet/teampass |
TeamPass vulnerable to Improper Encoding or Escaping of Output CVE-2023-3552, GHSA-2cv5-qvq3-6276 | High | 0.5% | 08 Jul, 2023 | Packagist nilsteampassnet/teampass |
TeamPass Cross-site Scripting vulnerability CVE-2023-3531, GHSA-pwrw-g29q-3mp8 | High | 0.5% | 06 Jul, 2023 | Packagist nilsteampassnet/teampass |
yt-dlp File Downloader cookie leak CVE-2023-35934, GHSA-v8mc-9377-rwjj, PYSEC-2026-2067 | High | 1.0% | 06 Jul, 2023 | PyPI yt-dlp |
Sanitize vulnerable to Cross-site Scripting via insufficient neutralization of `style` element content CVE-2023-36823, GHSA-f5ww-cq3m-q3g7 | High | 0.7% | 06 Jul, 2023 | RubyGems sanitize |
Hashicorp Vault Fails to Verify if Approle SecretID Belongs to Role During a Destroy Operation BIT-vault-2023-24999, CVE-2023-24999, GHSA-wmg5-g953-qqfw, GO-2023-1900 | High | 0.6% | 06 Jul, 2023 | Go github.com/hashicorp/vault |
HashiCorp Boundary Workers Store Rotated Credentials in Plaintext Even When Key Management Service Configured CVE-2023-0690, GHSA-9vrm-v9xv-x3xr, GO-2023-1898 | High | 0.4% | 06 Jul, 2023 | Go github.com/hashicorp/boundary |
league/oauth2-server key exposed in exception message when passing as a string and providing an invalid pass phrase CVE-2023-37260, GHSA-wj7q-gjg8-3cpm | High | 1.0% | 06 Jul, 2023 | Packagist league/oauth2-server |
SQLFluff users with access to config file, using `libary_path` may call arbitrary python code CVE-2023-36830, GHSA-jqhc-m2j3-fjrx, PYSEC-2023-111 | High | 0.4% | 06 Jul, 2023 | PyPI sqlfluff |
langchain SQL Injection vulnerability CVE-2023-36189, GHSA-7q94-qpjr-xpgm, PYSEC-2023-110 | High | 1.2% | 06 Jul, 2023 | PyPI langchain |
Uptime Kuma's authenticated path traversal via plugin repository name may lead to unavailability or data loss CVE-2023-36822, GHSA-vr8x-74pm-6vj7 | High | 1.2% | 05 Jul, 2023 | npm uptime-kuma |
Uptime Kuma vulnerable to authenticated remote code execution via malicious plugin installation CVE-2023-36821, GHSA-7grx-f945-mj96 | High | 2.0% | 05 Jul, 2023 | npm uptime-kuma |
Kiwi TCMS's misconfigured HTTP headers allow stored XSS execution with Firefox CVE-2023-36809, GHSA-jpgw-2r9m-8qfw, PYSEC-2026-1499 | High | 0.7% | 05 Jul, 2023 | PyPI kiwitcms |
ethyca-fides Webserver API Path Traversal vulnerability CVE-2023-36827, GHSA-r25m-cr6v-p9hq, PYSEC-2023-107 | High | 1.5% | 05 Jul, 2023 | PyPI ethyca-fides |
CometBFT may duplicate transactions in the mempool's data structures CVE-2023-34451, GHSA-w24w-wp77-qffm, GO-2023-1883 | High | 0.9% | 05 Jul, 2023 | Go github.com/cometbft/cometbft |
MechanicalSoup vulnerable to malicious web server reading arbitrary files on client using file input inside HTML form CVE-2023-34457, GHSA-x456-3ccm-m6j4, PYSEC-2023-108 | High | 1.1% | 05 Jul, 2023 | PyPI MechanicalSoup PyPI mechanicalsoup |
@fastify/oauth2 vulnerable to Cross Site Request Forgery due to reused Oauth2 state CVE-2023-31999, GHSA-g8x5-p9qc-cf95 | High | 0.7% | 04 Jul, 2023 | npm @fastify/oauth2 |
Products.CMFCore unauthenticated denial of service and crash via unchecked use of input with Python's marshal module CVE-2023-36814, GHSA-4hpj-8rhv-9x87, PYSEC-2023-113 | High | 0.7% | 03 Jul, 2023 | PyPI Products.CMFCore PyPI products-cmfcore |
Django has regular expression denial of service vulnerability in EmailValidator/URLValidator BIT-django-2023-36053, CVE-2023-36053, GHSA-jh3w-4vvf-mjgr, PYSEC-2023-100 | High | 3.0% | 03 Jul, 2023 | PyPI Django PyPI django |
llhttp vulnerable to HTTP request smuggling BIT-node-2023-30589, BIT-node-min-2023-30589, CVE-2023-30589, GHSA-cggh-pq45-6h9x | High | 3.9% | 01 Jul, 2023 | npm llhttp |
Sealos billing system permission control defect CVE-2023-36815, GHSA-vpxf-q44g-w34w | High | 0.5% | 30 Jun, 2023 | Go github.com/labring/sealos |
requests-xml XML External Entity Injection vulnerability CVE-2020-26708, GHSA-ccrc-9x59-3vc4, PYSEC-2023-96 | High | 0.7% | 29 Jun, 2023 | PyPI requests-xml |
py-xml XML External Entity Injection vulnerability CVE-2020-26709, GHSA-j6v2-mwxm-f952, PYSEC-2023-95 | High | 0.8% | 29 Jun, 2023 | PyPI py-xml |
easy-parse XML External Entity Injection vulnerability CVE-2020-26710, GHSA-vv6q-6hwp-vrgp, PYSEC-2023-97 | High | 0.8% | 29 Jun, 2023 | PyPI easy-parse |
Apache Airflow JDBC Provider Improper Input Validation vulnerability CVE-2023-22886, GHSA-mm87-c3x2-6f89, PYSEC-2026-1149 | High | 1.5% | 29 Jun, 2023 | PyPI apache-airflow-providers-jdbc |
Apache Airflow ODBC Provider Argument Injection vulnerability CVE-2023-34395, GHSA-9766-v29c-4vm7, PYSEC-2026-1152 | High | 0.8% | 27 Jun, 2023 | PyPI apache-airflow-providers-odbc |
Coraza has potential denial of service vulnerability CVE-2023-40586, GHSA-c2pj-v37r-2p6h, GO-2023-1874 | High | 0.7% | 26 Jun, 2023 | Go github.com/corazawaf/coraza/v2 Go github.com/corazawaf/coraza/v3 |
jcvi vulnerable to Configuration Injection due to unsanitized user input CVE-2023-35932, GHSA-x49m-3cw7-gq5q, PYSEC-2026-1470 | High | 1.8% | 23 Jun, 2023 | PyPI jcvi |
Apple Multiple Products WebKit Type Confusion Vulnerability CVE-2023-32439 | HighExploited | 24.0% | 23 Jun, 2023 | |
Apple Multiple Products WebKit Memory Corruption Vulnerability CVE-2023-32435 | HighExploited | 23.0% | 23 Jun, 2023 | |
Apple Multiple Products Integer Overflow Vulnerability CVE-2023-32434 | HighExploited | 51.5% | 23 Jun, 2023 |