Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Apache Superset Deserialization of Untrusted Data vulnerability BIT-superset-2023-37941, CVE-2023-37941, GHSA-fj4x-m62j-wvwg, PYSEC-2026-1175 | Medium | 35.5% | 06 Sep, 2023 | PyPI apache-superset |
Apache Superset has incorrect authorization check BIT-superset-2023-32672, CVE-2023-32672, GHSA-95ch-p3gw-23qg, PYSEC-2026-1166 | Medium | 1.0% | 06 Sep, 2023 | PyPI apache-superset |
Apache Superset may expose internal traces on REST API endpoints BIT-superset-2023-39264, CVE-2023-39264, GHSA-cpvx-2365-466c, PYSEC-2026-1172 | Medium | 1.1% | 06 Sep, 2023 | PyPI apache-superset |
Apache Superset Server Side Request Forgery vulnerability BIT-superset-2023-36388, CVE-2023-36388, GHSA-4fg9-5w46-xmrj, PYSEC-2026-1159 | Medium | 1.1% | 06 Sep, 2023 | PyPI apache-superset |
Apache Superset has improper default REST API permission for Gamma users BIT-superset-2023-36387, CVE-2023-36387, GHSA-9832-mgg4-3gr6, PYSEC-2026-1168 | Medium | 1.1% | 06 Sep, 2023 | PyPI apache-superset |
Apache Superset users may incorrectly create resources using the import charts feature BIT-superset-2023-27526, CVE-2023-27526, GHSA-9qc3-p9jq-2x27, PYSEC-2026-1170 | Medium | 1.2% | 06 Sep, 2023 | PyPI apache-superset |
Apache Superset vulnerable to improper data authorization BIT-superset-2023-27523, CVE-2023-27523, GHSA-v594-2c97-hx38, PYSEC-2026-1187 | Medium | 1.0% | 06 Sep, 2023 | PyPI apache-superset |
Salt vulnerable to denial of service CVE-2023-20897, GHSA-vpjg-wmf8-29h9, PYSEC-2023-166 | Medium | 1.2% | 05 Sep, 2023 | PyPI salt |
Index out of bounds leading to crash CVE-2023-36307, GHSA-xgmm-3vvr-6c8j | Medium | 0.3% | 05 Sep, 2023 | Go simonwaldherr.de/go/zplgfa |
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in hyper-bump-it CVE-2023-41057, GHSA-xc27-f9q3-4448, PYSEC-2026-1456 | Medium | 0.4% | 04 Sep, 2023 | PyPI hyper-bump-it |
incorrect order of evaluation of side effects for some builtins CVE-2023-41052, GHSA-4hg4-9mf5-wxxq, PYSEC-2023-168 | Medium | 0.5% | 04 Sep, 2023 | PyPI vyper |
Vyper: reversed order of side effects for some operations CVE-2023-40015, GHSA-g2xh-c426-v8mf, PYSEC-2023-167 | Medium | 0.5% | 04 Sep, 2023 | PyPI vyper |
Badaso vulnerable to cross-site scripting CVE-2023-38970, GHSA-7422-7rq6-j4qv | Medium | 0.7% | 30 Aug, 2023 | Packagist uasoft-indonesia/badaso |
GitPython blind local file inclusion CVE-2023-41040, GHSA-cwvm-v4w8-q58c, PYSEC-2023-165 | Medium | 1.1% | 30 Aug, 2023 | PyPI GitPython PyPI gitpython |
Archive spoofing vulnerability in borgbackup CVE-2023-36811, GHSA-8fjr-hghr-4m99, PYSEC-2023-164 | Medium | 0.1% | 30 Aug, 2023 | PyPI borgbackup |
@adobe/css-tools Regular Expression Denial of Service (ReDOS) while Parsing CSS CVE-2023-26364, GHSA-hpx4-r86g-5jrg | Medium | 1.2% | 29 Aug, 2023 | npm @adobe/css-tools |
Qlik Sense Path Traversal Vulnerability CVE-2023-41266 | MediumExploited | 84.8% | 29 Aug, 2023 | |
Withdrawn Advisory: Username enumeration attack in goauthentik BIT-authentik-2023-39522, CVE-2023-39522, GHSA-vmf9-6pcv-xr87 | Medium | 0.6% | 29 Aug, 2023 | npm @goauthentik/api |
Improper log output when using GitHub Status Notifications in spinnaker CVE-2023-39348, GHSA-rq5c-hvw6-8pr7 | Medium | 0.4% | 29 Aug, 2023 | Go github.com/spinnaker/spinnaker |
Cleartext Signed Message Signature Spoofing in openpgp CVE-2023-41037, GHSA-ch3c-v47x-4pgp | Medium | 0.4% | 29 Aug, 2023 | npm openpgp |
Open Redirect Vulnerability in jupyter-server CVE-2023-39968, GHSA-r726-vmfq-j9j3, PYSEC-2023-155 | Medium | 0.7% | 28 Aug, 2023 | PyPI jupyter-server |
cross-site inclusion (XSSI) of files in jupyter-server CVE-2023-40170, GHSA-64x5-55rw-9974, PYSEC-2023-157 | Medium | 0.6% | 28 Aug, 2023 | PyPI jupyter-server |
Spipu HTML2PDF vulnerable to cross-site scripting CVE-2023-39062, GHSA-99fg-2h75-m92h | Medium | 1.5% | 28 Aug, 2023 | Packagist spipu/html2pdf |
OpenFGA Authorization Bypass CVE-2023-40579, GHSA-jcf2-mxr2-gmqp, GO-2023-2028 | Medium | 0.5% | 25 Aug, 2023 | Go github.com/openfga/openfga |
Pyramid static view path traversal up one directory CVE-2023-40587, GHSA-j8g2-6fc7-q8f8, PYSEC-2026-1840 | Medium | 0.8% | 25 Aug, 2023 | PyPI pyramid |
@webiny/react-rich-text-renderer vulnerable to insecure rendering of rich text content CVE-2023-41167, GHSA-3x59-vrmc-5mx6 | Medium | 0.4% | 24 Aug, 2023 | npm @webiny/react-rich-text-renderer |
Alertmanager UI is vulnerable to stored XSS via the /api/v1/alerts endpoint BIT-alertmanager-2023-40577, CVE-2023-40577, GHSA-v86x-5fm3-5p7j, GO-2023-2020 | Medium | 0.6% | 23 Aug, 2023 | Go github.com/prometheus/alertmanager |
Active Support Possibly Discloses Locally Encrypted Files CVE-2023-38037, GHSA-cr5q-6q9f-rq6q | Medium | 0.3% | 23 Aug, 2023 | RubyGems activesupport |
SilverStripe CMS Cross-site Scripting vulnerabilities inherited from TinyMCE GHSA-jxcx-3h54-qqxx | Medium | Not scored | 23 Aug, 2023 | Packagist silverstripe/admin |
Apache Airflow missing Certificate Validation BIT-airflow-2023-39441, CVE-2023-39441, GHSA-5f35-pq34-c87q, PYSEC-2026-1130, PYSEC-2026-2368, PYSEC-2026-2371 | Medium | 0.8% | 23 Aug, 2023 | PyPI apache-airflow PyPI apache-airflow-providers-imap PyPI apache-airflow-providers-smtp |
hCaptcha for EXT:form Broken Access Control vulnerability CVE-2023-41100, GHSA-93wx-j2qv-49fg | Medium | 0.7% | 23 Aug, 2023 | Packagist waldhacker/hcaptcha |
Horizon Web Dashboard Open Redirect vulnerability CVE-2022-45582, GHSA-5pv6-rprw-82wv, PYSEC-2023-153 | Medium | 0.8% | 22 Aug, 2023 | PyPI horizon |
Datasette 1.0 alpha series leaks names of databases and tables to unauthenticated users CVE-2023-40570, GHSA-7ch3-7pp7-7cpq, PYSEC-2023-154 | Medium | 0.6% | 22 Aug, 2023 | PyPI datasette |
@node-saml/node-saml's validatePostRequestAsync does not include checkTimestampsValidityError CVE-2023-40178, GHSA-vx8m-6fhw-pccw | Medium | 0.5% | 21 Aug, 2023 | npm @node-saml/node-saml |
Wallabag user can delete own API client unintentionally CVE-2023-4455, GHSA-gjvc-55fw-v6vq | Medium | 0.3% | 21 Aug, 2023 | Packagist wallabag/wallabag |
Wallabag user can reset data unintentionally CVE-2023-4454, GHSA-p8gp-899c-jvq9 | Medium | 0.3% | 21 Aug, 2023 | Packagist wallabag/wallabag |
Pimcore Cross-site Scripting (XSS) vulnerability in DataObject datetime fields CVE-2023-4453, GHSA-599v-h3q5-g6r9 | Medium | 0.6% | 21 Aug, 2023 | Packagist pimcore/pimcore |
Cockpit Cross-site Scripting vulnerability CVE-2023-4451, GHSA-g3mv-64h3-h482 | Medium | 2.5% | 20 Aug, 2023 | Packagist cockpit-hq/cockpit |
Cockpit Cross-site Scripting vulnerability CVE-2023-4422, GHSA-8m65-qq6g-43rr | Medium | 0.6% | 18 Aug, 2023 | Packagist cockpit-hq/cockpit |
Juniper Junos OS EX Series Missing Authentication for Critical Function Vulnerability CVE-2023-36847 | MediumExploited | 83.5% | 17 Aug, 2023 | |
Juniper Junos OS SRX Series Missing Authentication for Critical Function Vulnerability CVE-2023-36846 | MediumExploited | 93.5% | 17 Aug, 2023 | |
Juniper Junos OS EX Series PHP External Variable Modification Vulnerability CVE-2023-36844 | MediumExploited | 90.0% | 17 Aug, 2023 | |
@excalidraw/excalidraw Cross-site Scripting vulnerability CVE-2023-26140, GHSA-v7v8-gjv7-ffmr | Medium | 0.6% | 16 Aug, 2023 | npm @excalidraw/excalidraw |
Ghost vulnerable to arbitrary file read via symlinks in content import BIT-ghost-2023-40028, CVE-2023-40028, GHSA-9c9v-w225-v5rg | Medium | 69.0% | 15 Aug, 2023 | npm ghost |
When `ui.isAccessAllowed` is `undefined`, the `adminMeta` GraphQL query is publicly accessible CVE-2023-40027, GHSA-9cvc-v7wm-992c | Medium | 0.6% | 15 Aug, 2023 | npm @keystone-6/core |
Svelecte item names vulnerable to execution of arbitrary JavaScript CVE-2023-38687, GHSA-7h45-grc5-89wq | Medium | 0.5% | 14 Aug, 2023 | npm svelecte |
lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files GHSA-9phh-r37v-34wh, GO-2023-2012 | Medium | Not scored | 14 Aug, 2023 | Go github.com/treeverse/lakefs |
Scancode.io Reflected Cross-Site Scripting (XSS) in license endpoint CVE-2023-40024, GHSA-6xcx-gx7r-rccj, PYSEC-2026-1905 | Medium | 0.5% | 14 Aug, 2023 | PyPI scancodeio |
Critters Cross-site Scripting Vulnerability CVE-2023-3481, GHSA-cx3j-qqxj-9597 | Medium | 0.2% | 11 Aug, 2023 | npm critters |
SUCHMOKUO node-worker-threads-pool denial of service Vulnerability CVE-2021-29057, GHSA-7vxc-q7rv-qfj8 | Medium | 0.6% | 11 Aug, 2023 | npm node-worker-threads-pool |