Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Code execution in evershop CVE-2023-46498, GHSA-5mmr-9qx3-3pf9 | Critical | 1.3% | 08 Dec, 2023 | npm @evershop/evershop |
Unitronics Vision PLC and HMI Insecure Default Password Vulnerability CVE-2023-6448 | CriticalExploited | 2.1% | 05 Dec, 2023 | |
PHPMemcachedAdmin Path Traversal vulnerability CVE-2023-6026, GHSA-8qfm-h8rh-h3r7 | Critical | 0.9% | 30 Nov, 2023 | Packagist elijaa/phpmemcacheadmin |
October CMS safe mode bypass using Twig sandbox escape CVE-2023-44382, GHSA-p8q3-h652-65vx | Critical | 0.9% | 29 Nov, 2023 | Packagist october/system |
Google Skia Integer Overflow Vulnerability CVE-2023-6345 | CriticalExploited | 16.5% | 29 Nov, 2023 | |
Ray has arbitrary code execution via jobs submission API CVE-2023-48022, GHSA-6wgj-66m2-xxp2, PYSEC-2026-517 | Critical | 83.9% | 28 Nov, 2023 | PyPI ray |
OroPlatform vulnerable to path traversal during temporary file manipulations CVE-2022-41951, GHSA-9v3j-4j64-p937 | Critical | 0.9% | 27 Nov, 2023 | Packagist oro/platform |
openssl npm package vulnerable to command execution CVE-2023-49210, GHSA-75w2-qv55-x7fv | Critical | 1.9% | 23 Nov, 2023 | npm openssl |
SQL injection in Apache Submarine CVE-2023-37924, GHSA-v5gj-fx3g-hcpw, PYSEC-2023-244 | Critical | 7.2% | 22 Nov, 2023 | PyPI apache-submarine |
Eval Injection in fastbots CVE-2023-48699, GHSA-vccg-f4gp-45x9 | Critical | 0.7% | 21 Nov, 2023 | PyPI fastbots |
ownCloud Improper Authentication Vulnerability CVE-2023-49105 | CriticalExploited | 43.2% | 21 Nov, 2023 | |
Deserialization of Untrusted Data in apache-submarine CVE-2023-46302, GHSA-8hcr-5x2g-9f7j, PYSEC-2023-240 | Critical | 1.8% | 20 Nov, 2023 | PyPI apache-submarine |
Ibis PyArrow dependency allows arbitrary code execution when loading a malicious data file GHSA-x563-6hqv-26mr | Critical | Not scored | 17 Nov, 2023 | PyPI ibis-framework |
Concrete CMS allows unauthorized access because directories can be created with insecure permissions CVE-2023-48648, GHSA-m87h-jxr6-f82w | Critical | 1.2% | 17 Nov, 2023 | Packagist concrete5/concrete5 |
Ray Missing Authorization vulnerability CVE-2023-6020, GHSA-6cxr-8q3m-jwrr, PYSEC-2026-516 | Critical | 14.7% | 16 Nov, 2023 | PyPI ray |
MLflow authentication requirement bypass can allow a user to arbitrarily create an account BIT-mlflow-2023-6014, CVE-2023-6014, GHSA-4qq5-mxxx-m6gg, PYSEC-2026-415 | Critical | 1.2% | 16 Nov, 2023 | PyPI mlflow |
Ray Path Traversal vulnerability CVE-2023-6021, GHSA-3pww-qvr8-6mhp, PYSEC-2026-515 | Critical | 37.1% | 16 Nov, 2023 | PyPI ray |
Ray OS Command Injection vulnerability CVE-2023-6019, GHSA-h3xg-wv58-5p43, PYSEC-2026-519 | Critical | 74.6% | 16 Nov, 2023 | PyPI ray |
Remote Code Execution due to Full Controled File Write in mlflow BIT-mlflow-2023-6018, CVE-2023-6018, GHSA-5p3h-7fwh-92rc, PYSEC-2026-417 | Critical | 47.9% | 16 Nov, 2023 | PyPI mlflow |
MLflow allowed arbitrary files to be PUT onto the server BIT-mlflow-2023-6015, CVE-2023-6015, GHSA-f798-qm4r-23r5, PYSEC-2026-420 | Critical | 4.5% | 16 Nov, 2023 | PyPI mlflow |
Qlik Sense HTTP Tunneling Vulnerability CVE-2023-48365 | CriticalExploited | 47.7% | 15 Nov, 2023 | |
Ethyca Fides Cryptographically Weak Generation of One-Time Codes for Identity Verification CVE-2023-48224, GHSA-82vr-5769-6358, PYSEC-2026-1336 | Critical | 1.0% | 15 Nov, 2023 | PyPI ethyca-fides |
yiisoft/yii deserializing untrusted user input can lead to remote code execution CVE-2023-47130, GHSA-mw2w-2hj2-fg8q | Critical | 3.1% | 14 Nov, 2023 | Packagist yiisoft/yii |
Statamic CMS remote code execution via front-end form uploads CVE-2023-47129, GHSA-72hg-5wr5-rmfc | Critical | 1.1% | 10 Nov, 2023 | Packagist statamic/cms |
piccolo SQL Injection via named transaction savepoints CVE-2023-47128, GHSA-xq59-7jf3-rjc6, PYSEC-2023-241 | Critical | 0.8% | 10 Nov, 2023 | PyPI piccolo |
SysAid Server Path Traversal Vulnerability CVE-2023-47246 | CriticalExploited | 98.9% | 10 Nov, 2023 | |
Froxlor Improper Input Validation vulnerability CVE-2023-6069, GHSA-4jch-8qq5-hqg6 | Critical | 0.8% | 10 Nov, 2023 | Packagist froxlor/froxlor |
Moodle Code Injection vulnerability BIT-moodle-2023-5550, CVE-2023-5550, GHSA-5cvx-cwpx-9rjh | Critical | 1.6% | 09 Nov, 2023 | Packagist moodle/moodle |
Label Studio has Hardcoded Django `SECRET_KEY` that can be Abused to Forge Session Tokens CVE-2023-43791, GHSA-f475-x83m-rx5m, PYSEC-2023-274 | Critical | 1.2% | 09 Nov, 2023 | PyPI label-studio |
PyArrow: Arbitrary code execution when loading a malicious data file CVE-2023-47248, GHSA-5wvp-7f3h-6wmm, PYSEC-2023-238 | Critical | 14.5% | 09 Nov, 2023 | PyPI pyarrow |
Magnesium-PHP Injection vulnerability CVE-2017-20187, GHSA-8pp6-5qpw-85g3 | Critical | 0.7% | 05 Nov, 2023 | Packagist floriangaerber/magnesium |
Json response for search reveals Solr credentials GHSA-7crc-r3wg-cfgf | Critical | Not scored | 03 Nov, 2023 | Packagist ezsystems/ezplatform-solr-search-engine |
Json response for search reveals Solr credentials GHSA-v6xp-ccvx-w52m | Critical | Not scored | 03 Nov, 2023 | Packagist ibexa/solr |
Prototype Pollution(PP) vulnerability in setByPath CVE-2023-45827, GHSA-9w5f-mw3p-pj47 | Critical | 1.2% | 03 Nov, 2023 | npm @clickbar/dot-diver |
transmute-core unsafe YAML deserialization vulnerability CVE-2023-47204, GHSA-w9cp-3x79-2p8p, PYSEC-2023-223 | Critical | 0.8% | 02 Nov, 2023 | PyPI transmute-core |
Atlassian Confluence Data Center and Server Improper Authorization Vulnerability CVE-2023-22518 | CriticalExploited | 100.0% | 31 Oct, 2023 | |
Insufficient Session Expiration in thorsten/phpmyfaq CVE-2023-5865, GHSA-f728-prhw-2g68 | Critical | 0.6% | 31 Oct, 2023 | Packagist thorsten/phpmyfaq |
Apache ActiveMQ Deserialization of Untrusted Data Vulnerability CVE-2023-46604 | CriticalExploited | 100.0% | 27 Oct, 2023 | |
F5 BIG-IP Configuration Utility Authentication Bypass Vulnerability CVE-2023-46747 | CriticalExploited | 96.7% | 26 Oct, 2023 | |
baserCMS Code Injection Vulnerability in Mail Form Feature CVE-2023-43792, GHSA-vrm6-c878-fpq6 | Critical | 0.7% | 26 Oct, 2023 | Packagist baserproject/basercms |
baserCMS CSRF vulnerability in Content preview Feature CVE-2023-43649, GHSA-fw9x-cqjq-7jx5 | Critical | 0.4% | 26 Oct, 2023 | Packagist baserproject/basercms |
NextGen Healthcare Mirth Connect Deserialization of Untrusted Data Vulnerability CVE-2023-43208 | CriticalExploited | 85.4% | 26 Oct, 2023 | |
crypto-js PBKDF2 1,000 times weaker than specified in 1993 and 1.3M times weaker than current standard CVE-2023-46233, GHSA-xwcq-pm8m-c4vf | Critical | 0.6% | 25 Oct, 2023 | npm crypto-js |
crypto-es PBKDF2 1,000 times weaker than specified in 1993 and 1.3M times weaker than current standard CVE-2023-46133, GHSA-mpj8-q39x-wq5h | Critical | 0.5% | 25 Oct, 2023 | npm crypto-es |
VMware vCenter Server Out-of-Bounds Write Vulnerability CVE-2023-34048 | CriticalExploited | 99.2% | 25 Oct, 2023 | |
dtale vulnerable to Remote Code Execution through the Custom Filter Input CVE-2023-46134, GHSA-jq6c-r9xf-qxjm, PYSEC-2026-1322 | Critical | 0.9% | 25 Oct, 2023 | PyPI dtale |
Langchain SQL Injection vulnerability CVE-2023-32785, GHSA-8h5w-f6q9-wg35, PYSEC-2026-372 | Critical | Not scored | 21 Oct, 2023 | PyPI langchain |
modoboa Cross-site Scripting vulnerability CVE-2023-5688, GHSA-pqgm-9g82-wcm7, PYSEC-2023-215 | Critical | 0.7% | 20 Oct, 2023 | PyPI modoboa |
Prototype Pollution in ali-security/mongoose GHSA-rc4v-99cr-pjcm | Critical | Not scored | 17 Oct, 2023 | npm @seal-security/mongoose-fixed |
Cisco IOS XE Web UI Privilege Escalation Vulnerability CVE-2023-20198 | CriticalExploited | 99.6% | 16 Oct, 2023 |