Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
pipreqs vulnerable to Dependency Confusion CVE-2023-31543, GHSA-v4f4-23wc-99mh, PYSEC-2023-99 | Critical | 1.2% | 30 Jun, 2023 | PyPI pipreqs |
flatnest Prototype Pollution vulnerability CVE-2023-26135, GHSA-7px2-3c2p-q4v4 | Critical | 0.9% | 30 Jun, 2023 | npm flatnest |
Parse Server vulnerable to remote code execution via MongoDB BSON parser through prototype pollution BIT-parse-2023-36475, CVE-2023-36475, GHSA-462x-c3jw-7vr6 | Critical | 3.2% | 28 Jun, 2023 | npm parse-server |
git-commit-info vulnerable to Command Injection CVE-2023-26134, GHSA-h42j-mrmp-9369 | Critical | 3.6% | 28 Jun, 2023 | npm git-commit-info |
fief-server Server-Side Template Injection vulnerability GHSA-hj8m-9fhf-v7jp | Critical | Not scored | 23 Jun, 2023 | PyPI fief-server |
fuadmin vulnerable to insecure file upload CVE-2023-36097, GHSA-5m3m-q8cq-77g4 | Critical | 0.9% | 22 Jun, 2023 | Packagist funadmin/funadmin |
laravel-s vulnerable to Local File Inclusion CVE-2023-29931, GHSA-q2fp-jw87-86px | Critical | 0.9% | 22 Jun, 2023 | Packagist hhxsv5/laravel-s |
Backstage Scaffolder plugin has insecure sandbox CVE-2023-35926, GHSA-wg6p-jmpc-xjmr | Critical | 1.9% | 21 Jun, 2023 | npm @backstage/plugin-scaffolder-backend |
php-imap vulnerable to RCE through a directory traversal vulnerability CVE-2023-35169, GHSA-47p7-xfcc-4pv9 | Critical | 3.2% | 21 Jun, 2023 | Packagist webklex/laravel-imap Packagist webklex/php-imap |
Liufee CMS File Upload vulnerability CVE-2020-21489, GHSA-6vf2-mfmr-qqqw | Critical | 1.3% | 20 Jun, 2023 | Packagist feehi/cms |
liufee CMS File Upload vulnerability CVE-2020-21174, GHSA-q3q5-qvh5-cmw5 | Critical | 1.3% | 20 Jun, 2023 | Packagist feehi/cms |
Langchain vulnerable to arbitrary code execution CVE-2023-34541, GHSA-6643-h7h5-x9wh, PYSEC-2023-92 | Critical | 0.9% | 20 Jun, 2023 | PyPI langchain |
Zyxel Multiple NAS Devices Command Injection Vulnerability CVE-2023-27992 | CriticalExploited | 82.3% | 19 Jun, 2023 | |
ipandlanguageredirect extension vulnerable to SQL Injection CVE-2023-35782, GHSA-4xf2-7qfv-mgfx | Critical | 0.5% | 16 Jun, 2023 | Packagist in2code/ipandlanguageredirect |
Grav Server Side Template Injection (SSTI) vulnerability CVE-2023-34251, GHSA-f9jf-4cp4-4fq5 | Critical | 2.3% | 14 Jun, 2023 | Packagist getgrav/grav |
Langchain OS Command Injection vulnerability CVE-2023-34540, GHSA-x32c-59v5-h7fg, PYSEC-2023-91 | Critical | 1.7% | 14 Jun, 2023 | PyPI langchain |
Microsoft SharePoint Server Privilege Escalation Vulnerability CVE-2023-29357 | CriticalExploited | 100.0% | 14 Jun, 2023 | |
nuxt Code Injection vulnerability CVE-2023-3224, GHSA-gc34-5v43-h7v8 | Critical | 58.6% | 13 Jun, 2023 | npm nuxt |
Fortinet FortiOS and FortiProxy SSL-VPN Heap-Based Buffer Overflow Vulnerability CVE-2023-27997 | CriticalExploited | 85.7% | 13 Jun, 2023 | |
progressbar.js vulnerable to Prototype Pollution CVE-2023-26133, GHSA-89qm-hm2x-mxm3 | Critical | 1.3% | 12 Jun, 2023 | npm progressbar.js |
Froxlor vulnerable to Improper Restriction of Excessive Authentication Attempts CVE-2023-3173, GHSA-chw4-88xc-79w6 | Critical | 1.1% | 09 Jun, 2023 | Packagist froxlor/froxlor |
Gradio vulnerable to arbitrary file read and proxying of arbitrary URLs CVE-2023-34239, GHSA-3qqg-pgqq-3695, PYSEC-2023-90 | Critical | 0.7% | 08 Jun, 2023 | PyPI gradio |
Vmware Aria Operations for Networks Command Injection Vulnerability CVE-2023-20887 | CriticalExploited | 98.3% | 07 Jun, 2023 | |
TeamPass vulnerable to stored Cross-site Scripting CVE-2023-3086, GHSA-j245-v2mh-5h6f | Critical | 0.9% | 03 Jun, 2023 | Packagist nilsteampassnet/teampass |
Progress MOVEit Transfer SQL Injection Vulnerability CVE-2023-34362 | CriticalExploited | 99.9% | 02 Jun, 2023 | |
antfu/utils vulnerable to prototype pollution CVE-2023-2972, GHSA-p2fh-2h23-6grg | Critical | 1.0% | 30 May, 2023 | npm @antfu/utils |
Barracuda Networks ESG Appliance Improper Input Validation Vulnerability CVE-2023-2868 | CriticalExploited | 86.8% | 24 May, 2023 | |
toui allows user-specific variables to be shared between users CVE-2023-33175, GHSA-hh7j-pg39-q563, PYSEC-2026-555 | Critical | 0.7% | 24 May, 2023 | PyPI toui |
Ckan remote code execution and private information access via crafted resource ids CVE-2023-32321, GHSA-446m-hmmm-hm8m, PYSEC-2026-312 | Critical | 1.7% | 24 May, 2023 | PyPI ckan |
Malware in pre-build binaries of bignum GHSA-7cgc-fjv4-52x6 | Critical | Not scored | 24 May, 2023 | npm bignum |
Apache RocketMQ Command Execution Vulnerability CVE-2023-33246 | CriticalExploited | 96.6% | 24 May, 2023 | |
Zyxel Multiple Firewalls Buffer Overflow Vulnerability CVE-2023-33010 | CriticalExploited | 29.0% | 24 May, 2023 | |
Zyxel Multiple Firewalls Buffer Overflow Vulnerability CVE-2023-33009 | CriticalExploited | 28.1% | 24 May, 2023 | |
Remote Code Execution Vulnerability in Validation Placeholders in CodeIgniter4 BIT-codeigniter-2023-32692, CVE-2023-32692, GHSA-m6m8-6gq8-c9fj | Critical | 1.1% | 22 May, 2023 | Packagist codeigniter4/framework |
mlflow Path Traversal vulnerability BIT-mlflow-2023-2780, CVE-2023-2780, GHSA-wjq3-7jxx-whj9, PYSEC-2023-69 | Critical | 6.4% | 17 May, 2023 | PyPI mlflow |
vm2 Sandbox Escape vulnerability CVE-2023-32314, GHSA-whpj-8f3w-67p5 | Critical | 8.1% | 15 May, 2023 | npm vm2 |
LavaLite vulnerable to web cache poisoning CVE-2023-27238, GHSA-6vcf-cfjp-qxcw | Critical | 0.9% | 12 May, 2023 | Packagist lavalite/cms |
Vyper vulnerable to OOB DynArray access when array is on both LHS and RHS of an assignment CVE-2023-31146, GHSA-3p37-3636-q8wv, PYSEC-2023-77 | Critical | 1.3% | 11 May, 2023 | PyPI vyper |
jsreport vulnerable to code injection CVE-2023-2583, GHSA-g7rj-q722-245g | Critical | 1.1% | 08 May, 2023 | npm jsreport |
Apache Airflow vulnerable to Privilege Context Switching Error BIT-airflow-2023-25754, CVE-2023-25754, GHSA-jchm-fm4q-c2fp, PYSEC-2023-59 | Critical | 2.3% | 08 May, 2023 | PyPI apache-airflow |
Django bypasses validation when using one form field to upload multiple files BIT-django-2023-31047, CVE-2023-31047, GHSA-r3xc-prgr-mg9p, PYSEC-2023-61 | Critical | 1.4% | 07 May, 2023 | PyPI Django PyPI django |
Mage-ai missing user authentication CVE-2023-31143, GHSA-c6mm-2g84-v4m7, PYSEC-2023-64 | Critical | 0.7% | 05 May, 2023 | PyPI mage-ai |
AzuraCast missing brute force prevention CVE-2023-2531, GHSA-4m7v-wr6v-2mw5 | Critical | 0.8% | 05 May, 2023 | Packagist azuracast/azuracast |
appium-desktop OS Command Injection vulnerability CVE-2023-2479, GHSA-xq6j-x8pq-g3gr | Critical | 22.0% | 02 May, 2023 | npm appium-desktop |
Remote file access vulnerability in `mlflow server` and `mlflow ui` CLIs GHSA-83fm-w79m-64r5 | Critical | Not scored | 01 May, 2023 | PyPI mlflow |
phpMyFAQ Improper Access Control vulnerability CVE-2023-2429, GHSA-r69v-q48g-3966 | Critical | 0.5% | 30 Apr, 2023 | Packagist thorsten/phpmyfaq |
Concrete CMS (previously concrete5) is vulnerable to possible auth bypass in the jobs section CVE-2023-28473, GHSA-pj76-75cm-3552 | Critical | 0.8% | 28 Apr, 2023 | Packagist concrete5/concrete5 |
Potential leak of authentication data to 3rd parties CVE-2023-30846, GHSA-558p-m34m-vpmq | Critical | 2.2% | 26 Apr, 2023 | npm typed-rest-client |
Prototype Pollution in vConsole CVE-2023-30363, GHSA-f737-3fh6-jf6w | Critical | 1.0% | 26 Apr, 2023 | npm vconsole |
Remote code execution in Voyager CVE-2020-36070, GHSA-2x3r-7jgm-gh8x | Critical | 1.1% | 26 Apr, 2023 | Packagist tcg/voyager |