Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
MrSwitch hello.js vulnerable to prototype pollution CVE-2021-26505, GHSA-g3vf-47fv-8f3c | Critical | 1.1% | 11 Aug, 2023 | npm hellojs |
GitPython vulnerable to remote code execution due to insufficient sanitization of input arguments CVE-2023-40267, GHSA-pr76-5cm5-w9cj, PYSEC-2023-137 | Critical | 1.2% | 11 Aug, 2023 | PyPI GitPython PyPI gitpython |
SES's dynamic import and spread operator provides possible path to arbitrary exfiltration and execution CVE-2023-39532, GHSA-9c4h-3f7h-322r | Critical | 1.3% | 08 Aug, 2023 | npm ses |
PrestaShop file deletion via CustomerMessage CVE-2023-39530, GHSA-v4gr-v679-42p7 | Critical | 0.9% | 07 Aug, 2023 | Packagist prestashop/prestashop |
PrestaShop file deletion via attachment API CVE-2023-39529, GHSA-2rf5-3fw8-qm47 | Critical | 0.7% | 07 Aug, 2023 | Packagist prestashop/prestashop |
PrestaShop SQL manager vulnerability CVE-2023-39526, GHSA-gf46-prm4-56pc | Critical | 1.7% | 07 Aug, 2023 | Packagist prestashop/prestashop |
PrestaShop path traversal CVE-2023-39525, GHSA-m9r4-3fg7-pqm2 | Critical | 0.9% | 07 Aug, 2023 | Packagist prestashop/prestashop |
PrestaShop boolean SQL injection CVE-2023-39524, GHSA-75p5-jwx4-qw9h | Critical | 0.7% | 07 Aug, 2023 | Packagist prestashop/prestashop |
import-in-the-middle has unsanitized user controlled input in module generation CVE-2023-38704, GHSA-5r27-rw8r-7967 | Critical | 1.0% | 07 Aug, 2023 | npm import-in-the-middle |
Vyper has incorrectly allocated named re-entrancy locks CVE-2023-39363, GHSA-5824-cm3x-3c38, PYSEC-2023-142 | Critical | 0.8% | 07 Aug, 2023 | PyPI vyper |
Cockpit PHP Remote File Inclusion vulnerability CVE-2023-4195, GHSA-xcq3-7pf3-5jvc | Critical | 1.1% | 06 Aug, 2023 | Packagist cockpit-hq/cockpit |
langchain Code Injection vulnerability CVE-2023-36095, GHSA-gwqq-6vq7-5j86, PYSEC-2023-138 | Critical | 1.2% | 05 Aug, 2023 | PyPI langchain |
matrix-appservice-irc IRC command injection via admin commands containing newlines CVE-2023-38690, GHSA-3pmj-jqqp-2mj3 | Critical | 0.9% | 04 Aug, 2023 | npm matrix-appservice-irc |
PyroCMS remote code execution vulnerability CVE-2023-29689, GHSA-w7vm-4v3j-vgpw | Critical | 53.5% | 04 Aug, 2023 | Packagist pyrocms/pyrocms |
Soketi was exposed to Sandbox Escape vulnerability via vm2 GHSA-g6w6-h933-4rc5 | Critical | Not scored | 03 Aug, 2023 | npm @soketi/soketi |
MindsDB can be made to not verify SSL certificates CVE-2023-38699, GHSA-8hx6-qv6f-xgcw, PYSEC-2023-140 | Critical | 0.3% | 01 Aug, 2023 | PyPI MindsDB PyPI mindsdb |
RaspAP Command Injection vulnerability CVE-2022-39986, GHSA-7c28-wg7r-pg6f | Critical | 99.1% | 01 Aug, 2023 | Packagist billz/raspap-webgui |
pnpm incorrectly parses tar archives relative to specification CVE-2023-37478, GHSA-5r98-f33j-g8h7 | Critical | 1.2% | 01 Aug, 2023 | npm @pnpm/cafs npm @pnpm/exe npm @pnpm/linux-arm64 npm @pnpm/linux-x64 +5 more |
Sydent does not verify email server certificates CVE-2023-38686, GHSA-p6hw-wm59-3g5g, PYSEC-2023-139 | Critical | 0.3% | 31 Jul, 2023 | PyPI matrix-sydent |
phpMyFAQ Improper Neutralization of Formula Elements in a CSV File vulnerability CVE-2023-4006, GHSA-2xvx-368h-qcmv | Critical | 0.8% | 31 Jul, 2023 | Packagist thorsten/phpmyfaq |
Anyone with a share link can RESET all website data in Umami GHSA-8www-cffh-4q98 | Critical | Not scored | 28 Jul, 2023 | npm umami |
XML External Entity (XXE) vulnerability in the XML data handler CVE-2023-38490, GHSA-q386-w6fg-gmgp | Critical | 1.7% | 27 Jul, 2023 | Packagist getkirby/cms |
Command injection in PaddlePaddle CVE-2023-38673, GHSA-9q9v-qgwx-84mr, PYSEC-2023-126 | Critical | 2.3% | 26 Jul, 2023 | PyPI paddlepaddle |
Heap buffer overflow in PaddlePaddle CVE-2023-38671, GHSA-hh7p-hvm3-rg88, PYSEC-2023-124 | Critical | 0.8% | 26 Jul, 2023 | PyPI paddlepaddle |
Use after free in PaddlePaddle CVE-2023-38669, GHSA-8wfh-qxxv-3q8c, PYSEC-2023-122 | Critical | 0.8% | 26 Jul, 2023 | PyPI paddlepaddle |
Removal of e-Tugra root certificate CVE-2023-37920, GHSA-xqr8-7jwr-rhp7, PYSEC-2023-135 | Critical | 0.6% | 25 Jul, 2023 | PyPI certifi |
Ivanti Endpoint Manager Mobile Authentication Bypass Vulnerability CVE-2023-35078 | CriticalExploited | 100.0% | 25 Jul, 2023 | |
Path traversal and code execution via prototype vulnerability CVE-2023-26045, GHSA-vh2g-6c4x-5hmp | Critical | 1.0% | 24 Jul, 2023 | npm nodebb |
Adobe ColdFusion Deserialization of Untrusted Data Vulnerability CVE-2023-38203 | CriticalExploited | 97.1% | 20 Jul, 2023 | |
Citrix NetScaler ADC and NetScaler Gateway Code Injection Vulnerability CVE-2023-3519 | CriticalExploited | 99.7% | 19 Jul, 2023 | |
MLflow Path Traversal vulnerability BIT-mlflow-2023-3765, CVE-2023-3765, GHSA-fmxj-6h9g-6vw3, PYSEC-2023-308 | Critical | 67.5% | 19 Jul, 2023 | PyPI mlflow |
postgraas-server vulnerable to SQL injection CVE-2018-25088, GHSA-vghm-8cjp-hjw6, PYSEC-2026-460 | Critical | 0.7% | 18 Jul, 2023 | PyPI postgraas-server |
Mongoose Prototype Pollution vulnerability BIT-mongoose-2023-3696, CVE-2023-3696, GHSA-9m93-w8w6-76hh | Critical | 1.2% | 17 Jul, 2023 | npm mongoose |
CleverTap Cordova plugin vulnerable to Cross-site Scripting CVE-2023-2507, GHSA-x2ph-qqwm-9cc6 | Critical | 0.9% | 15 Jul, 2023 | npm clevertap-cordova |
Froxlor vulnerable to Improper Encoding or Escaping of Output CVE-2023-3668, GHSA-c6v5-pf66-xfq8 | Critical | 1.0% | 14 Jul, 2023 | Packagist froxlor/froxlor |
vm2 Sandbox Escape vulnerability CVE-2023-37466, GHSA-cchq-frgv-rjh5 | Critical | 3.9% | 13 Jul, 2023 | npm vm2 |
vm2 Sandbox Escape vulnerability CVE-2023-37903, GHSA-g644-9gfx-q4q4 | Critical | 4.2% | 13 Jul, 2023 | npm vm2 |
Adobe ColdFusion Deserialization of Untrusted Data Vulnerability CVE-2023-29300 | CriticalExploited | 100.0% | 12 Jul, 2023 | |
Orchid Deserialization of Untrusted Data vulnerability leads to Remote Code Execution CVE-2023-36825, GHSA-ph6g-p72v-pc3p | Critical | 1.1% | 11 Jul, 2023 | Packagist orchid/platform |
xalpha vulnerable to Remote Code Execution CVE-2023-37659, GHSA-jx3q-5rgf-vrrr, PYSEC-2023-116 | Critical | 1.7% | 11 Jul, 2023 | PyPI xalpha |
Citrix Content Collaboration ShareFile Improper Access Control Vulnerability CVE-2023-24489 | CriticalExploited | 97.3% | 10 Jul, 2023 | |
RestrictedPython vulnerable to arbitrary code execution via stack frame sandbox escape CVE-2023-37271, GHSA-wqc8-x2pr-7jqh, PYSEC-2023-118 | Critical | 0.8% | 10 Jul, 2023 | PyPI RestrictedPython PyPI restrictedpython |
TeamPass Code Injection vulnerability CVE-2023-3551, GHSA-97hm-2mfr-2p97 | Critical | 1.1% | 08 Jul, 2023 | Packagist nilsteampassnet/teampass |
Withdrawn: Use after free in SciPy CVE-2023-29824, GHSA-jrfm-2h82-xg28, PYSEC-2023-114 | Critical | 1.3% | 06 Jul, 2023 | PyPI scipy |
Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability CVE-2023-34192 | CriticalExploited | 77.3% | 06 Jul, 2023 | |
langchain vulnerable to arbitrary code execution CVE-2023-36188, GHSA-57fc-8q82-gfp3, PYSEC-2023-109 | Critical | 1.9% | 06 Jul, 2023 | PyPI langchain |
protobufjs Prototype Pollution vulnerability CVE-2023-36665, GHSA-h755-8qp9-cq85 | Critical | 1.7% | 05 Jul, 2023 | npm protobufjs |
langchain arbitrary code execution vulnerability CVE-2023-36258, GHSA-2qmj-7962-cjq8, PYSEC-2023-98 | Critical | 1.1% | 03 Jul, 2023 | PyPI langchain |
Apache Airflow Hive Provider Beeline remote code execution with Principal CVE-2023-35797, GHSA-hg6c-qqcm-r79r, PYSEC-2026-273 | Critical | 2.8% | 03 Jul, 2023 | PyPI apache-airflow-providers-apache-hive |
tough-cookie Prototype Pollution vulnerability CVE-2023-26136, GHSA-72xf-g2v4-qvf3 | Critical | 2.6% | 01 Jul, 2023 | npm tough-cookie |