Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
TensorFlow has null dereference on ParallelConcat with XLA BIT-tensorflow-2023-25676, CVE-2023-25676, GHSA-6wfh-89q8-44jq, PYSEC-2026-3123, PYSEC-2026-3287, PYSEC-2026-961 | High | 0.4% | 24 Mar, 2023 | PyPI tensorflow PyPI tensorflow-cpu PyPI tensorflow-gpu |
TensorFlow has double free in Fractional(Max/Avg)Pool BIT-tensorflow-2023-25801, CVE-2023-25801, GHSA-f49c-87jh-g47q, PYSEC-2026-3166, PYSEC-2026-3314, PYSEC-2026-985 | High | 0.1% | 24 Mar, 2023 | PyPI tensorflow PyPI tensorflow-cpu PyPI tensorflow-gpu |
TensorFlow has Floating Point Exception in TFLite in conv kernel BIT-tensorflow-2023-27579, CVE-2023-27579, GHSA-5w96-866f-6rm8, PYSEC-2026-3111, PYSEC-2026-3279, PYSEC-2026-954 | High | 0.4% | 24 Mar, 2023 | PyPI tensorflow PyPI tensorflow-cpu PyPI tensorflow-gpu |
TensorFlow vulnerable to Out-of-Bounds Read in GRUBlockCellGrad BIT-tensorflow-2023-25658, CVE-2023-25658, GHSA-68v3-g9cm-rmm6, PYSEC-2026-3120, PYSEC-2026-3286, PYSEC-2026-960 | High | 0.4% | 24 Mar, 2023 | PyPI tensorflow PyPI tensorflow-cpu PyPI tensorflow-gpu |
Android Framework Privilege Escalation Vulnerability CVE-2023-20963 | HighExploited | 1.5% | 24 Mar, 2023 | |
Moodle vulnerable to Cross-site Request Forgery BIT-moodle-2023-28335, CVE-2023-28335, GHSA-wxmq-v9gx-75pg | High | 0.4% | 23 Mar, 2023 | Packagist moodle/moodle |
Moodle SQL Injection vulnerability BIT-moodle-2023-28329, CVE-2023-28329, GHSA-72w2-j52c-7682 | High | 1.2% | 23 Mar, 2023 | Packagist moodle/moodle |
NotrinosERP vulnerable to SQL Injection CVE-2023-24788, GHSA-4pqp-69m3-f8pp | High | 3.1% | 23 Mar, 2023 | Packagist notrinos/notrinos-erp |
Adobe ColdFusion Deserialization of Untrusted Data Vulnerability CVE-2023-26360 | HighExploited | 97.3% | 23 Mar, 2023 | |
Gophish vulnerable to Denial of Service via crafted payload involving autofocus CVE-2022-45003, GHSA-8gg8-wr4j-v2wr | High | 1.0% | 22 Mar, 2023 | Go github.com/gophish/gophish |
crewjam/saml vulnerable to Denial Of Service Via Deflate Decompression Bomb CVE-2023-28119, GHSA-5mqj-xc49-246p, GO-2023-1664 | High | 1.0% | 22 Mar, 2023 | Go github.com/crewjam/saml |
Pimcore vulnerable to improper quoting of filters in Custom Reports CVE-2023-28438, GHSA-vf7q-g2pv-jxvx | High | 0.9% | 22 Mar, 2023 | Packagist pimcore/pimcore |
Privilege Escalation on Linux/MacOS CVE-2023-28434, GHSA-2pxw-r47w-4p8c | HighExploited | 7.9% | 22 Mar, 2023 | Go github.com/minio/minio |
MinIO Information Disclosure Vulnerability CVE-2023-28432 | HighExploited | 84.0% | 22 Mar, 2023 | |
Linux Kernel Improper Ownership Management Vulnerability CVE-2023-0386 | HighExploited | 7.9% | 22 Mar, 2023 | |
Pimcore Remote Code Execution vulnerability in Search function CVE-2023-1578, GHSA-42c3-wvww-gcqj | High | 62.8% | 22 Mar, 2023 | Packagist pimcore/pimcore |
cloudflared's Installer has Local Privilege Escalation Vulnerability CVE-2023-1314, GHSA-7mjv-x3jf-545x, GO-2023-1652 | High | 0.3% | 21 Mar, 2023 | Go github.com/cloudflare/cloudflared |
Sentry SDK leaks sensitive session information when `sendDefaultPII` is set to `True` CVE-2023-28117, GHSA-29pr-6jr8-q5jm, PYSEC-2026-920 | High | 0.6% | 21 Mar, 2023 | PyPI sentry-sdk |
Teampass SQL Injection vulnerability CVE-2023-1545, GHSA-ppxm-q2h4-v7mm | High | 8.4% | 21 Mar, 2023 | Packagist nilsteampassnet/teampass |
Answer vulnerable to Insufficient Session Expiration CVE-2023-1543, GHSA-79hx-g43v-xfmr, GO-2023-1655 | High | 0.8% | 21 Mar, 2023 | Go github.com/answerdev/answer |
CairoSVG improperly processes SVG files loaded from external resources CVE-2023-27586, GHSA-rwmf-w63j-p7gv, PYSEC-2023-9 | High | 0.7% | 20 Mar, 2023 | PyPI CairoSVG PyPI cairosvg |
Collection.js vulnerable to Prototype Pollution CVE-2023-26113, GHSA-47pj-q2vm-46xc | High | 1.2% | 18 Mar, 2023 | npm collection.js |
Go-huge-util vulnerable to path traversal when unzipping files CVE-2023-28105, GHSA-5g39-ppwg-6xx8, GO-2023-1640 | High | 0.6% | 16 Mar, 2023 | Go github.com/dablelv/go-huge-util |
Improper quoting of columns when calling methods "getByUuid" & "exists" on UUID Model CVE-2023-28108, GHSA-xc9p-r5qj-8xm9 | High | 0.9% | 16 Mar, 2023 | Packagist pimcore/pimcore |
DDOS attack on graphql endpoints CVE-2023-28104, GHSA-67g8-c724-8mp3 | High | 1.1% | 16 Mar, 2023 | Packagist silverstripe/graphql |
On a compromised node, the virt-handler service account can be used to modify all node specs CVE-2023-26484, GHSA-cp96-jpmq-xrr2 | High | 0.6% | 16 Mar, 2023 | Go kubevirt.io/kubevirt |
TP-Link Archer AX-21 Command Injection Vulnerability CVE-2023-1389 | HighExploited | 100.0% | 15 Mar, 2023 | |
Arbitrary local file read vulnerability during template rendering CVE-2023-25345, GHSA-2rq5-699j-x7p6 | High | 1.1% | 15 Mar, 2023 | npm swig npm swig-templates |
google.golang.org/protobuf vulnerable to panic leading to denial of service CVE-2023-24535, GHSA-hw7c-3rfg-p46j, GO-2023-1631 | High | 1.1% | 14 Mar, 2023 | Go google.golang.org/protobuf |
Nomad Job Submitter Privilege Escalation Using Workload Identity CVE-2023-1299, GHSA-rqm8-q8j9-662f, GO-2023-1633 | High | 0.5% | 14 Mar, 2023 | Go github.com/hashicorp/nomad |
SAP Cloud SDK for AI Python has OS Command Injection when Program Objects Execution is Enabled CVE-2023-25617, GHSA-xxhh-59gh-6ffx, PYSEC-2023-315 | High | 0.9% | 14 Mar, 2023 | PyPI sap-ai-sdk-base |
Possible CSRF token fixation CVE-2023-25170, GHSA-3g43-x7qr-96ph | High | 0.2% | 13 Mar, 2023 | Packagist prestashop/prestashop |
Code Injection in alextselegidis/easyappointments CVE-2023-1367, GHSA-9qvw-fhj2-xqmv | High | 0.4% | 13 Mar, 2023 | Packagist alextselegidis/easyappointments |
Company admin role gives excessive privileges in eZ Platform Ibexa CVE-2022-48365, GHSA-qq2j-9pf8-g58c | High | 0.9% | 12 Mar, 2023 | Packagist ezsystems/ezplatform-kernel Packagist ezsystems/ezpublish-kernel |
Veeam Backup & Replication Cloud Connect Missing Authentication for Critical Function Vulnerability CVE-2023-27532 | HighExploited | 80.6% | 10 Mar, 2023 | |
cockpit-hq/cockpit is vulnerable to unrestricted file uploads CVE-2023-1313, GHSA-6x8f-x6qw-qwx3 | High | 1.0% | 10 Mar, 2023 | Packagist cockpit-hq/cockpit |
WebAssembly v1.0.29 was discovered to contain a heap overflow via the component component wabt::Node::operator. CVE-2023-27117, PYSEC-2023-317 | High | 0.3% | 10 Mar, 2023 | PyPI wabt |
Missing proper state, nonce and PKCE checks for OAuth authentication CVE-2023-27490, GHSA-7r7x-4c4q-c4qf | High | 0.5% | 09 Mar, 2023 | npm next-auth |
Constellation allows Emergency shell access during initramfs boot phase GHSA-6w5f-5wgr-qjg5, GO-2023-1622 | High | Not scored | 09 Mar, 2023 | Go github.com/edgelesssys/constellation Go github.com/edgelesssys/constellation/v2 |
Rack has possible DoS Vulnerability in Multipart MIME parsing CVE-2023-27530, GHSA-3h57-hmj3-gj3p | High | 1.8% | 08 Mar, 2023 | RubyGems rack |
OWSLib vulnerable to XML External Entity (XXE) Injection CVE-2023-27476, GHSA-8h9c-r582-mggc, PYSEC-2023-86 | High | 1.0% | 07 Mar, 2023 | PyPI OWSLib PyPI owslib |
Goutil vulnerable to path traversal when unzipping files CVE-2023-27475, GHSA-fx2v-qfhr-4chv, GO-2023-1611 | High | 0.8% | 07 Mar, 2023 | Go github.com/gookit/goutil |
Fortinet FortiOS Path Traversal Vulnerability CVE-2022-41328 | HighExploited | 10.7% | 07 Mar, 2023 | |
Apache HTTP Server via mod_proxy_uwsgi HTTP response smuggling BIT-apache-2023-27522, CVE-2023-27522, GHSA-vcph-37mh-fqrh, PYSEC-2026-1058 | High | 2.1% | 07 Mar, 2023 | PyPI uWSGI PyPI uwsgi |
WebKitGTK Memory Corruption Vulnerability CVE-2019-8720 | HighExploited | 1.6% | 06 Mar, 2023 | |
Insufficient Session Expiration in pretix CVE-2023-27891, GHSA-r76w-3wwq-jv6v, PYSEC-2023-42 | High | 0.6% | 06 Mar, 2023 | PyPI pretix |
Moodle vulnerable to Server-Side Request Forgery BIT-moodle-2021-36396, CVE-2021-36396, GHSA-4rmj-w58m-fvch | High | 1.4% | 06 Mar, 2023 | Packagist moodle/moodle |
Moodle vulnerable to Uncontrolled Resource Consumption BIT-moodle-2021-36395, CVE-2021-36395, GHSA-273w-7fxj-pcp6 | High | 0.7% | 06 Mar, 2023 | Packagist moodle/moodle |
directus vulnerable to HTML Injection in Password Reset email to custom Reset URL CVE-2023-27474, GHSA-4hmq-ggrm-qfc6 | High | 0.5% | 06 Mar, 2023 | npm directus |
node-static and @nubosoftware/node-static vulnerable to Directory Traversal CVE-2023-26111, GHSA-5g97-whc9-8g7j | High | 1.4% | 06 Mar, 2023 | npm @nubosoftware/node-static npm node-static |