Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
node-qpdf vulnerable to command injection CVE-2023-26155, GHSA-fpr8-4wvx-j9q3 | Critical | 2.2% | 14 Oct, 2023 | npm node-qpdf |
pyminizip affected by zlib's integer overflow/heap based buffer overflow vulnerability due to vulnerable dependency CVE-2023-45853, GHSA-mq29-j5xf-cjwr, PYSEC-2026-501 | Critical | 3.4% | 14 Oct, 2023 | PyPI pyminizip |
Server-Side Request Forgery (SSRF) in vriteio/vrite CVE-2023-5572, GHSA-w35p-wxwj-rcm9 | Critical | 1.0% | 13 Oct, 2023 | npm @vrite/sdk |
Babel vulnerable to arbitrary code execution when compiling specifically crafted malicious code CVE-2023-45133, GHSA-67hx-6x53-jw92 | Critical | 0.5% | 12 Oct, 2023 | npm @babel/traverse npm babel-traverse |
Cachet vulnerable to Authenticated Remote Code Execution CVE-2023-43661, GHSA-hv79-p62r-wg3p | Critical | 51.9% | 11 Oct, 2023 | Packagist cachethq/cachet |
langchain_experimental vulnerable to arbitrary code execution via PALChain in the python exec method CVE-2023-44467, GHSA-gjjr-63x4-v8cq, PYSEC-2023-194 | Critical | 1.0% | 09 Oct, 2023 | PyPI langchain-experimental |
Code injection in fsevents CVE-2023-45311, GHSA-8r6j-v8pm-fqw3 | Critical | 1.7% | 06 Oct, 2023 | npm fsevents |
Atlassian Confluence Data Center and Server Broken Access Control Vulnerability CVE-2023-22515 | CriticalExploited | 99.2% | 04 Oct, 2023 | |
TorchServe Pre-Auth Remote Code Execution GHSA-4mqg-h5jf-j9m7 | Critical | Not scored | 02 Oct, 2023 | PyPI torchserve |
phpMyFAQ Cross-site Scripting vulnerability CVE-2023-5320, GHSA-pp4w-g5p4-85p2 | Critical | 0.6% | 30 Sep, 2023 | Packagist thorsten/phpmyfaq |
phpMyFAQ Cross-site Scripting vulnerability CVE-2023-5316, GHSA-58v7-58c2-qwm9 | Critical | 0.5% | 30 Sep, 2023 | Packagist thorsten/phpmyfaq |
phpMyFAQ allows unrestricted file types in image field CVE-2023-5227, GHSA-qcjg-hvg6-hxcp | Critical | 0.6% | 30 Sep, 2023 | Packagist thorsten/phpmyfaq |
TorchServe Server-Side Request Forgery vulnerability CVE-2023-43654, GHSA-8fxr-qfr9-p34w, PYSEC-2026-553 | Critical | 42.5% | 28 Sep, 2023 | PyPI torchserve |
pydash Command Injection vulnerability CVE-2023-26145, GHSA-8mjr-6c96-39w8, PYSEC-2023-179 | Critical | 3.6% | 28 Sep, 2023 | PyPI pydash |
Searchor CLI's Search vulnerable to Arbitrary Code using Eval CVE-2023-43364, GHSA-66m2-493m-crh2, PYSEC-2023-262 | Critical | 2.9% | 25 Sep, 2023 | PyPI searchor |
Gevent allows remote attacker to escalate privileges CVE-2023-41419, GHSA-x7m3-jprg-wc5g, PYSEC-2023-177 | Critical | 1.8% | 25 Sep, 2023 | PyPI gevent |
FUXA SQL Injection vulnerability CVE-2023-31719, GHSA-p46g-8c3q-89p2 | Critical | 44.1% | 22 Sep, 2023 | npm fuxa-server |
systeminformation SSID Command Injection Vulnerability CVE-2023-42810, GHSA-gx6r-qc2v-3p3v | Critical | 2.2% | 21 Sep, 2023 | npm systeminformation |
Yii2 allows attackers to execute any local .php file via a relative path in the view parameter CVE-2015-5467, GHSA-7cfq-72w2-24q4 | Critical | 0.9% | 21 Sep, 2023 | Packagist yiisoft/yii2 |
Cache poisoning in drupal/core BIT-drupal-2023-5256, CVE-2023-5256, DRUPAL-CORE-2023-006, GHSA-rjqg-3h9m-fx5x | Critical | 0.9% | 20 Sep, 2023 | Packagist drupal/core |
ReportLab vulnerable to remote code execution via paraparser CVE-2019-19450, GHSA-pj98-2xf6-cff5, PYSEC-2026-522 | Critical | 6.0% | 20 Sep, 2023 | PyPI reportlab |
Cross Site Scripting vulnerability in Dolibarr ERP CRM BIT-dolibarr-2023-38888, CVE-2023-38888, GHSA-62wf-h26v-5m57 | Critical | 1.3% | 20 Sep, 2023 | Packagist dolibarr/dolibarr |
JetBrains TeamCity Authentication Bypass Vulnerability CVE-2023-42793 | CriticalExploited | 100.0% | 19 Sep, 2023 | |
blamer vulnerable to Arbitrary Argument Injection via the blameByFile() API CVE-2023-26143, GHSA-6f9p-g466-f8v8 | Critical | 1.1% | 19 Sep, 2023 | npm blamer |
A remote command execution (RCE) vulnerability in the /api/runscript endpoint of FUXA CVE-2023-33831, GHSA-r87q-fq37-pvr6 | Critical | 26.0% | 18 Sep, 2023 | npm @frangoteam/fuxa |
Strapi Improper Rate Limiting vulnerability CVE-2023-38507, GHSA-24q2-59hm-rh9r | Critical | 1.0% | 13 Sep, 2023 | npm @strapi/admin npm @strapi/plugin-users-permissions |
Craft CMS Remote Code Execution vulnerability CVE-2023-41892, GHSA-4w8r-3xrw-v25g | Critical | 94.2% | 13 Sep, 2023 | Packagist craftcms/cms |
Electron's Content-Secrity-Policy disabling eval not applied consistently in renderers with sandbox disabled CVE-2023-23623, GHSA-gxh7-wv9q-fwfr | Critical | 0.7% | 06 Sep, 2023 | npm electron |
Snappy PHAR deserialization vulnerability CVE-2023-41330, GHSA-92rv-4j2h-8mjj | Critical | 2.3% | 06 Sep, 2023 | Packagist knplabs/knp-snappy |
Cisco Adaptive Security Appliance and Firepower Threat Defense Unauthorized Access Vulnerability CVE-2023-20269 | CriticalExploited | 26.6% | 06 Sep, 2023 | |
Magento improper access control vulnerability within Magento's Media Gallery Upload workflow BIT-magento-2021-36036, CVE-2021-36036, GHSA-wqr6-wv6c-p8fx | Critical | 2.1% | 06 Sep, 2023 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento XML Injection vulnerability in the Widgets Update Layout BIT-magento-2021-36023, CVE-2021-36023, GHSA-8cjg-f53m-8m9q | Critical | 2.4% | 06 Sep, 2023 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento affected by remote code execution vulnerability in the CMS page scheduled update feature BIT-magento-2021-36021, CVE-2021-36021, GHSA-4g27-q2w9-m8m8 | Critical | 2.0% | 06 Sep, 2023 | Packagist magento/community-edition Packagist magento/project-community-edition |
Langchain vulnerable to arbitrary code execution via the evaluate function in the numexpr library CVE-2023-39631, GHSA-f73w-4m7g-ch9x, PYSEC-2023-162, PYSEC-2023-163 | Critical | 1.6% | 01 Sep, 2023 | PyPI langchain PyPI numexpr |
Command Injection Vulnerability in find-exec CVE-2023-40582, GHSA-95rp-6gqp-6622 | Critical | 1.8% | 30 Aug, 2023 | npm find-exec |
Qlik Sense HTTP Tunneling Vulnerability CVE-2023-41265 | CriticalExploited | 88.2% | 29 Aug, 2023 | |
Heap-based buffer overflow in ZBar CVE-2023-40889, GHSA-mhp6-jvpx-2p4m, PYSEC-2026-576 | Critical | 1.7% | 29 Aug, 2023 | PyPI zbar |
langchain vulnerable to arbitrary code execution CVE-2023-36281, GHSA-7gfq-f96f-g85j, PYSEC-2023-151 | Critical | 3.4% | 22 Aug, 2023 | PyPI langchain |
pandasai vulnerable to prompt injection CVE-2023-39660, GHSA-w832-v3c6-m6rg, PYSEC-2026-1757 | Critical | 1.5% | 21 Aug, 2023 | PyPI pandasai |
Ivanti Sentry Authentication Bypass Vulnerability CVE-2023-38035 | CriticalExploited | 100.0% | 21 Aug, 2023 | |
Juniper Junos OS EX Series and SRX Series PHP External Variable Modification Vulnerability CVE-2023-36845 | CriticalExploited | 95.1% | 17 Aug, 2023 | |
tree-kit Prototype Pollution vulnerability CVE-2023-38894, GHSA-5p42-m6f3-hpmj | Critical | 1.7% | 16 Aug, 2023 | npm tree-kit |
PandasAI vulnerable to arbitrary code execution CVE-2023-39661, GHSA-8fp9-43pw-56vw, PYSEC-2026-447 | Critical | 1.4% | 15 Aug, 2023 | PyPI pandasai |
LangChain vulnerable to arbitrary code execution CVE-2023-38860, GHSA-fj32-q626-pjjc, PYSEC-2023-145 | Critical | 1.4% | 15 Aug, 2023 | PyPI langchain |
LangChain vulnerable to arbitrary code execution CVE-2023-38896, GHSA-92j5-3459-qgp4, PYSEC-2023-146 | Critical | 1.8% | 15 Aug, 2023 | PyPI langchain |
LangChain vulnerable to arbitrary code execution CVE-2023-39659, GHSA-prgp-w7vf-ch62, PYSEC-2023-147 | Critical | 1.5% | 15 Aug, 2023 | PyPI langchain |
llama-index vulnerable to arbitrary code execution CVE-2023-39662, GHSA-2xxc-73fv-36f7, PYSEC-2023-148 | Critical | 1.5% | 15 Aug, 2023 | PyPI llama-index |
Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core Authentication Bypass Vulnerability CVE-2023-35082 | CriticalExploited | 100.0% | 15 Aug, 2023 | |
Tornado vulnerable to HTTP request smuggling via improper parsing of `Content-Length` fields and chunk lengths CVE-2023-54397, GHSA-qppv-j76h-2rpx | Critical | 0.4% | 14 Aug, 2023 | PyPI tornado |
external-svg-loader Cross-site Scripting vulnerability CVE-2023-40013, GHSA-xc2r-jf2x-gjr8 | Critical | 0.6% | 14 Aug, 2023 | npm external-svg-loader |