Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
code injection in phpxmlrpc/phpxmlrpc GHSA-3fgr-xjr6-xqm8 | High | Not scored | 28 Nov, 2022 | Packagist phpxmlrpc/phpxmlrpc |
ghost vulnerable to unauthorized newsletter modification via improper access controls BIT-ghost-2022-41654, CVE-2022-41654, GHSA-9gh8-wp53-ccc6 | High | 18.9% | 28 Nov, 2022 | npm ghost |
XBlock vulnerable to Cross-Site Scripting (XSS) CVE-2022-46147, GHSA-qv6c-367r-3w6q, PYSEC-2022-43175 | High | 0.9% | 28 Nov, 2022 | PyPI xblock-drag-and-drop-v2 |
muhammara and hummus vulnerable to Unchecked Return Value to NULL Pointer Dereference CVE-2022-41957, GHSA-2r7v-cmch-5x26 | High | 1.1% | 28 Nov, 2022 | npm hummus npm muhammara |
decode-uri-component vulnerable to Denial of Service (DoS) CVE-2022-38900, GHSA-w573-4hg7-7wgq | High | 23.6% | 28 Nov, 2022 | npm decode-uri-component |
qs vulnerable to Prototype Pollution CVE-2022-24999, GHSA-hrpp-h998-j3pp | High | 15.7% | 26 Nov, 2022 | npm qs |
Browsershot does not validate URL protocols passed to Browsershot URL method CVE-2022-41706, GHSA-8c2c-jxwj-jqgf | High | 0.7% | 25 Nov, 2022 | Packagist spatie/browsershot |
Browsershot version 3.57.3 vulnerable to improper input validation CVE-2022-43984, GHSA-6q49-35h6-rq2p | High | 0.7% | 25 Nov, 2022 | Packagist spatie/browsershot |
Browsershot vulnerable to Cross-Site Scripting (XSS) CVE-2022-43983, GHSA-82h9-v8vh-mfpq | High | 0.7% | 25 Nov, 2022 | Packagist spatie/browsershot |
Account Takeover Through Password Reset Poisoning CVE-2022-33012, GHSA-rp7f-fhm8-9hpf | High | 1.4% | 22 Nov, 2022 | Packagist microweber/microweber |
OS Command Injection in Apache Airflow BIT-airflow-2022-41131, CVE-2022-41131, GHSA-cm43-f2pv-6v68, PYSEC-2026-772 | High | 1.8% | 22 Nov, 2022 | PyPI apache-airflow-providers-apache-hive |
CKAN contains Improper Authentication leading to account takeover CVE-2022-43685, GHSA-m2xp-jxfg-qq6g, PYSEC-2022-42987 | High | 0.7% | 22 Nov, 2022 | PyPI ckan |
Lancet vulnerable to path traversal when unzipping files CVE-2022-41920, GHSA-pp3f-xrw5-q5j4, GO-2022-1114 | High | 0.9% | 21 Nov, 2022 | Go github.com/duke-git/lancet Go github.com/duke-git/lancet/v2 |
Fastify: Incorrect Content-Type parsing can lead to CSRF attack CVE-2022-41919, GHSA-3fjj-p79j-c9hh | High | 0.4% | 21 Nov, 2022 | npm fastify |
Blind SQL Injection via GridFieldSortableHeader CVE-2022-38148, GHSA-rr8h-f97q-8p9c | High | 0.8% | 21 Nov, 2022 | Packagist silverstripe/framework |
Cross-site Scripting in librenms/librenms CVE-2022-4068, GHSA-f3hw-3h74-wr98 | High | 37.5% | 20 Nov, 2022 | Packagist librenms/librenms |
Deserialization of Untrusted Data in librenms/librenms CVE-2022-3525, GHSA-cv9g-h8mm-xx5h | High | 1.0% | 20 Nov, 2022 | Packagist librenms/librenms |
HTTP response splitting in CGI BIT-ruby-2021-33621, BIT-ruby-min-2021-33621, CVE-2021-33621, GHSA-vc47-6rqg-c7f5 | High | 2.5% | 19 Nov, 2022 | RubyGems cgi |
Free5gc vulnerable to uncontrolled resource consumption CVE-2022-38871, GHSA-m74x-fxjh-3qh9 | High | 0.8% | 19 Nov, 2022 | Go github.com/free5gc/free5gc |
Invalid char to bool conversion when printing a tensor BIT-tensorflow-2022-41911, CVE-2022-41911, GHSA-pf36-r9c6-h97j, PYSEC-2026-1954, PYSEC-2026-3222, PYSEC-2026-939 | High | 0.4% | 18 Nov, 2022 | PyPI tensorflow PyPI tensorflow-cpu PyPI tensorflow-gpu |
Segfault in `CompositeTensorVariantToComponents` BIT-tensorflow-2022-41909, CVE-2022-41909, GHSA-rjx6-v474-2ch9, PYSEC-2026-1034, PYSEC-2026-3238, PYSEC-2026-3368 | High | 0.5% | 18 Nov, 2022 | PyPI tensorflow PyPI tensorflow-cpu PyPI tensorflow-gpu |
`CHECK` fail via inputs in `PyFunc` BIT-tensorflow-2022-41908, CVE-2022-41908, GHSA-mv77-9g28-cwg3, PYSEC-2026-1021, PYSEC-2026-3217, PYSEC-2026-3353 | High | 0.5% | 18 Nov, 2022 | PyPI tensorflow PyPI tensorflow-cpu PyPI tensorflow-gpu |
Overflow in `ResizeNearestNeighborGrad` BIT-tensorflow-2022-41907, CVE-2022-41907, GHSA-368v-7v32-52fx, PYSEC-2026-3091, PYSEC-2026-3268, PYSEC-2026-945 | High | 0.5% | 18 Nov, 2022 | PyPI tensorflow PyPI tensorflow-cpu PyPI tensorflow-gpu |
`CHECK_EQ` fail via input in `SparseMatrixNNZ` BIT-tensorflow-2022-41901, CVE-2022-41901, GHSA-g9fm-r5mm-rf9f, PYSEC-2026-3185, PYSEC-2026-3328, PYSEC-2026-997 | High | 0.5% | 18 Nov, 2022 | PyPI tensorflow PyPI tensorflow-cpu PyPI tensorflow-gpu |
`CHECK` fail via inputs in `SdcaOptimizer` BIT-tensorflow-2022-41899, CVE-2022-41899, GHSA-27rc-728f-x5w2, PYSEC-2026-3086, PYSEC-2026-3264, PYSEC-2026-941 | High | 0.5% | 18 Nov, 2022 | PyPI tensorflow PyPI tensorflow-cpu PyPI tensorflow-gpu |
`CHECK` fail via inputs in `SparseFillEmptyRowsGrad` BIT-tensorflow-2022-41898, CVE-2022-41898, GHSA-hq7g-wwwp-q46h, PYSEC-2026-1008, PYSEC-2026-3201, PYSEC-2026-3340 | High | 0.5% | 18 Nov, 2022 | PyPI tensorflow PyPI tensorflow-cpu PyPI tensorflow-gpu |
`FractionalMaxPoolGrad` Heap out of bounds read BIT-tensorflow-2022-41897, CVE-2022-41897, GHSA-f2w8-jw48-fr7j, PYSEC-2026-3165, PYSEC-2026-3313, PYSEC-2026-984 | High | 0.5% | 18 Nov, 2022 | PyPI tensorflow PyPI tensorflow-cpu PyPI tensorflow-gpu |
`tf.raw_ops.Mfcc` crashes BIT-tensorflow-2022-41896, CVE-2022-41896, GHSA-rmg2-f698-wq35, PYSEC-2026-1035, PYSEC-2026-3239, PYSEC-2026-3369 | High | 0.5% | 18 Nov, 2022 | PyPI tensorflow PyPI tensorflow-cpu PyPI tensorflow-gpu |
`MirrorPadGrad` heap out of bounds read BIT-tensorflow-2022-41895, CVE-2022-41895, GHSA-gq2j-cr96-gvqx, PYSEC-2026-1000, PYSEC-2026-3192, PYSEC-2026-3332 | High | 0.5% | 18 Nov, 2022 | PyPI tensorflow PyPI tensorflow-cpu PyPI tensorflow-gpu |
Buffer overflow in `CONV_3D_TRANSPOSE` on TFLite BIT-tensorflow-2022-41894, CVE-2022-41894, GHSA-h6q3-vv32-2cq5, PYSEC-2026-936 | High | 0.6% | 18 Nov, 2022 | PyPI tensorflow |
`CHECK_EQ` fail in `tf.raw_ops.TensorListResize` BIT-tensorflow-2022-41893, CVE-2022-41893, GHSA-67pf-62xr-q35m, PYSEC-2026-3118, PYSEC-2026-3284, PYSEC-2026-958 | High | 0.5% | 18 Nov, 2022 | PyPI tensorflow PyPI tensorflow-cpu PyPI tensorflow-gpu |
Segfault in `tf.raw_ops.TensorListConcat` BIT-tensorflow-2022-41891, CVE-2022-41891, GHSA-66vq-54fq-6jvv, PYSEC-2026-3117, PYSEC-2026-3283, PYSEC-2026-957 | High | 0.5% | 18 Nov, 2022 | PyPI tensorflow PyPI tensorflow-cpu PyPI tensorflow-gpu |
`CHECK` fail in `BCast` overflow BIT-tensorflow-2022-41890, CVE-2022-41890, GHSA-h246-cgh4-7475, PYSEC-2026-1001, PYSEC-2026-3194, PYSEC-2026-3333 | High | 0.5% | 18 Nov, 2022 | PyPI tensorflow PyPI tensorflow-cpu PyPI tensorflow-gpu |
Segfault via invalid attributes in `pywrap_tfe_src.cc` BIT-tensorflow-2022-41889, CVE-2022-41889, GHSA-xxcj-rhqg-m46g, PYSEC-2026-1050, PYSEC-2026-3262, PYSEC-2026-3384 | High | 0.5% | 18 Nov, 2022 | PyPI tensorflow PyPI tensorflow-cpu PyPI tensorflow-gpu |
FPE in `tf.image.generate_bounding_box_proposals` BIT-tensorflow-2022-41888, CVE-2022-41888, GHSA-6x99-gv2v-q76v, PYSEC-2026-3124, PYSEC-2026-3288, PYSEC-2026-962 | High | 0.5% | 18 Nov, 2022 | PyPI tensorflow PyPI tensorflow-cpu PyPI tensorflow-gpu |
Overflow in `tf.keras.losses.poisson` BIT-tensorflow-2022-41887, CVE-2022-41887, GHSA-8fvv-46hw-vpg3, PYSEC-2026-3136, PYSEC-2026-3297, PYSEC-2026-970 | High | 0.5% | 18 Nov, 2022 | PyPI tensorflow PyPI tensorflow-cpu PyPI tensorflow-gpu |
Overflow in `ImageProjectiveTransformV2` BIT-tensorflow-2022-41886, CVE-2022-41886, GHSA-54pp-c6pp-7fpx, PYSEC-2026-3105, PYSEC-2026-3275, PYSEC-2026-951 | High | 0.5% | 18 Nov, 2022 | PyPI tensorflow PyPI tensorflow-cpu PyPI tensorflow-gpu |
Overflow in `FusedResizeAndPadConv2D` BIT-tensorflow-2022-41885, CVE-2022-41885, GHSA-762h-vpvw-3rcx, PYSEC-2026-3126, PYSEC-2026-3290, PYSEC-2026-964 | High | 0.5% | 18 Nov, 2022 | PyPI tensorflow PyPI tensorflow-cpu PyPI tensorflow-gpu |
Seg fault in `ndarray_tensor_bridge` due to zero and large inputs BIT-tensorflow-2022-41884, CVE-2022-41884, GHSA-jq6x-99hj-q636, PYSEC-2026-1013, PYSEC-2026-3208, PYSEC-2026-3345 | High | 0.4% | 18 Nov, 2022 | PyPI tensorflow PyPI tensorflow-cpu PyPI tensorflow-gpu |
Out of bounds segmentation fault due to unequal op inputs in Tensorflow BIT-tensorflow-2022-41883, CVE-2022-41883, GHSA-w58w-79xv-6vcj, PYSEC-2026-1042, PYSEC-2026-3251, PYSEC-2026-3376 | High | 0.4% | 18 Nov, 2022 | PyPI tensorflow PyPI tensorflow-cpu PyPI tensorflow-gpu |
Witness Block Parsing DoS Vulnerability CVE-2022-39389, GHSA-hc82-w9v8-83pr | High | 1.1% | 18 Nov, 2022 | Go github.com/lightningnetwork/lnd |
Dante Discovery Process Control Vulnerability CVE-2022-23748 | HighExploited | 8.3% | 17 Nov, 2022 | |
LIEF heap buffer overflow in the LIEF::MachO::BinaryParser::parse_dyldinfo_generic_bind CVE-2022-43171, GHSA-jvp9-phwp-p738, PYSEC-2022-43140 | High | 0.7% | 17 Nov, 2022 | PyPI lief |
Missing Authorization in HashiCorp Consul BIT-consul-2022-3920, CVE-2022-3920, GHSA-gw2g-hhc9-wgjh, GO-2022-1121 | High | 0.7% | 16 Nov, 2022 | Go github.com/hashicorp/consul |
Concrete CMS vulnerable to Cross-site Request Forgery CVE-2022-43693, GHSA-w8fp-3gwq-gxpw | High | 0.5% | 14 Nov, 2022 | Packagist concrete5/concrete5 |
Apache Airflow subject to Exposure of Sensitive Information BIT-airflow-2022-27949, CVE-2022-27949, GHSA-fvw2-2pf7-77vw, PYSEC-2022-42981 | High | 2.0% | 14 Nov, 2022 | PyPI apache-airflow |
Apache Airflow vulnerable to OS Command Injection via example DAGs BIT-airflow-2022-40127, CVE-2022-40127, GHSA-6pw3-8h9w-32gc, PYSEC-2022-42982 | High | 85.7% | 14 Nov, 2022 | PyPI apache-airflow |
Pillow vulnerable to Data Amplification attack. BIT-pillow-2022-45198, CVE-2022-45198, GHSA-m2vv-5vj5-2hm7, PYSEC-2022-42979 | High | 1.3% | 14 Nov, 2022 | PyPI pillow |
Pillow subject to DoS via SAMPLESPERPIXEL tag BIT-pillow-2022-45199, CVE-2022-45199, GHSA-q4mp-jvh2-76fj, PYSEC-2022-42980 | High | 1.2% | 14 Nov, 2022 | PyPI pillow |
Cross Site Scripting vulnerability in wsgidav when directory browsing is enabled CVE-2022-41905, GHSA-xx6g-jj35-pxjv, PYSEC-2022-43018 | High | 0.4% | 11 Nov, 2022 | PyPI wsgidav |