Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
SQL filter bypass leading to arbitrary write requests using "SQL Manager" CVE-2023-30839, GHSA-p379-cxqh-q822 | Critical | 1.7% | 25 Apr, 2023 | Packagist prestashop/prestashop |
Possible XSS injection through Validate::isCleanHTML method CVE-2023-30838, GHSA-fh7r-996q-gvcp | Critical | 1.0% | 25 Apr, 2023 | Packagist prestashop/prestashop |
Zyxel Multiple Firewalls OS Command Injection Vulnerability CVE-2023-28771 | CriticalExploited | 99.3% | 25 Apr, 2023 | |
Remote code execution in dawnsparks-node-tesseract CVE-2023-29566, GHSA-88qf-5f3v-pm6m | Critical | 2.2% | 24 Apr, 2023 | npm dawnsparks-node-tesseract |
Remote code execution in broccoli-compass CVE-2023-27848, GHSA-wq8f-xmq3-5vq9 | Critical | 1.9% | 24 Apr, 2023 | npm broccoli-compass |
Unrestricted file upload in kiwi TCMS CVE-2023-30613, GHSA-fwcf-753v-fgcj, PYSEC-2026-1498 | Critical | 1.0% | 24 Apr, 2023 | PyPI kiwitcms |
Apache superset missing check for default SECRET_KEY BIT-superset-2023-27524, CVE-2023-27524, GHSA-5cx2-vq3h-x52c, PYSEC-2026-1161 | CriticalExploited | 98.1% | 24 Apr, 2023 | PyPI apache-superset |
Expo SDK has an OAuth vulnerability CVE-2023-28131, GHSA-wr5g-q49g-548w | Critical | 23.2% | 24 Apr, 2023 | npm expo |
Improper Authorization in modoboa CVE-2023-2227, GHSA-67mg-gm8m-ph5r, PYSEC-2023-35 | Critical | 44.0% | 21 Apr, 2023 | PyPI modoboa |
PaperCut MF/NG Improper Access Control Vulnerability CVE-2023-27350 | CriticalExploited | 100.0% | 20 Apr, 2023 | |
Access bypass in Drupal core BIT-drupal-2023-31250, CVE-2023-31250, DRUPAL-CORE-2023-005, GHSA-8849-cv9f-vccm | Critical | 0.5% | 19 Apr, 2023 | Packagist drupal/core |
Strapi plugins vulnerable to Server-Side Template Injection and Remote Code Execution in the Users-Permissions Plugin CVE-2023-22621, GHSA-2h87-4q2w-v4hf | Critical | 70.6% | 19 Apr, 2023 | npm @strapi/plugin-email npm @strapi/plugin-users-permissions |
Google Chrome Skia Integer Overflow Vulnerability CVE-2023-2136 | CriticalExploited | 5.8% | 19 Apr, 2023 | |
Modoboa has Weak Password Requirements CVE-2023-2160, GHSA-9gxx-32p7-ff7m, PYSEC-2023-34 | Critical | 0.6% | 18 Apr, 2023 | PyPI modoboa |
@nuxtlabs/github-module made Use of Hard-coded Credentials CVE-2023-2138, GHSA-fp2w-g92g-fgq4 | Critical | 0.7% | 18 Apr, 2023 | npm @nuxtlabs/github-module |
vm2 Sandbox Escape vulnerability CVE-2023-30547, GHSA-ch3r-j5x3-6q2m | Critical | 73.0% | 17 Apr, 2023 | npm vm2 |
Apache Spark vulnerable to Improper Privilege Management BIT-spark-2023-22946, CVE-2023-22946, GHSA-329j-jfvr-rhr6, PYSEC-2023-44 | Critical | 1.1% | 17 Apr, 2023 | Maven org.apache.spark:spark-core_2.12 Maven org.apache.spark:spark-core_2.13 PyPI pyspark |
Incorrect Authorization vulnerability in Apache Software Foundation Apache IoTDB.This issue affects the iotdb-web-workbench component on 0.13.3. iotdb-web-workbench is an optional component of IoTDB, providing a web console of the database.
This problem is fixed from version 0.13.4 of iotdb-web-wor CVE-2023-30771, PYSEC-2023-8 | Critical | 1.4% | 17 Apr, 2023 | PyPI apache-iotdb |
Apache IoTDB Grafana Connector vulnerable to Improper Authentication CVE-2023-24831, GHSA-pvjv-386f-c8wh, PYSEC-2023-7 | Critical | 1.2% | 17 Apr, 2023 | Maven org.apache.iotdb:iotdb-grafana-connector PyPI apache-iotdb |
Weak Password Requirements in calibreweb CVE-2023-2106, GHSA-mhmp-m6g7-7c24, PYSEC-2026-1233 | Critical | 0.7% | 15 Apr, 2023 | PyPI calibreweb |
Improper Restriction of Excessive Authentication Attempts in calibreweb CVE-2022-2525, GHSA-jg8w-wgx2-g7q4, PYSEC-2026-1231 | Critical | 0.8% | 15 Apr, 2023 | PyPI calibreweb |
froxlor/froxlor vulnerable to unrestricted upload of file with dangerous type CVE-2023-2034, GHSA-qwvp-g9j7-28f6 | Critical | 71.4% | 14 Apr, 2023 | Packagist froxlor/froxlor |
vm2 Sandbox Escape vulnerability CVE-2023-29199, GHSA-xj72-wvfv-8985 | Critical | 3.9% | 12 Apr, 2023 | npm vm2 |
Novi Survey Insecure Deserialization Vulnerability CVE-2023-29492 | CriticalExploited | 2.7% | 11 Apr, 2023 | |
safe-eval vulnerable to Sandbox Bypass due to improper input sanitization CVE-2023-26122, GHSA-79xf-67r4-q2jj | Critical | 2.1% | 11 Apr, 2023 | npm safe-eval |
safe-eval vulnerable to Prototype Pollution via the safeEval function CVE-2023-26121, GHSA-hcg3-56jf-x4vh | Critical | 1.1% | 11 Apr, 2023 | npm safe-eval |
Apache Airflow Hive Provider vulnerable to code injection CVE-2023-28706, GHSA-5cvg-9pp5-mxcj, PYSEC-2026-271 | Critical | 2.8% | 07 Apr, 2023 | PyPI apache-airflow-providers-apache-hive |
vm2 vulnerable to sandbox escape CVE-2023-29017, GHSA-7jxr-cg7f-gpgv | Critical | 63.2% | 06 Apr, 2023 | npm vm2 |
thorsten/phpmyfaq vulnerable to authentication bypass CVE-2023-1886, GHSA-4cr4-x82x-hwm9 | Critical | 0.9% | 05 Apr, 2023 | Packagist thorsten/phpmyfaq |
Microweber vulnerable to command injection CVE-2023-1877, GHSA-582p-2fpg-x226 | Critical | 1.8% | 05 Apr, 2023 | Packagist microweber/microweber |
Firefly III insufficiently expires sessions CVE-2023-1788, GHSA-h7vv-46p5-prmh | Critical | 0.4% | 05 Apr, 2023 | Packagist grumpydictator/firefly-iii |
LangChain vulnerable to code injection CVE-2023-29374, GHSA-fprp-p869-w6q2, PYSEC-2023-18 | Critical | 39.7% | 05 Apr, 2023 | PyPI langchain |
Withdrawn: SQL injection in Yii 2 CVE-2023-26750, GHSA-gq63-p39p-jrjf | Critical | 1.8% | 04 Apr, 2023 | Packagist yiisoft/yii2 |
Sophos Web Appliance Command Injection Vulnerability CVE-2023-1671 | CriticalExploited | 100.0% | 04 Apr, 2023 | |
Hitachi Vantara Pentaho BA Server Authorization Bypass Vulnerability CVE-2022-43939 | CriticalExploited | 92.3% | 03 Apr, 2023 | |
Firefly III vulnerable to improper input validation CVE-2023-1789, GHSA-mwxw-hxvp-4r2r | Critical | 0.3% | 01 Apr, 2023 | Packagist grumpydictator/firefly-iii |
X-Forwarded-For header allows brute-forcing autoblocked IP addresses BIT-mediawiki-2023-29141, CVE-2023-29141, GHSA-5vj8-g3qg-4qh6 | Critical | 1.2% | 31 Mar, 2023 | Packagist mediawiki/core |
phpMyFAQ has weak password requirements CVE-2023-1753, GHSA-4p4m-5qp7-479x | Critical | 0.7% | 31 Mar, 2023 | Packagist thorsten/phpmyfaq |
Use of hard-coded, security-relevant constants in deepset-ai/haystack CVE-2023-1712, GHSA-w7qg-j435-78qw, PYSEC-2026-337 | Critical | 0.9% | 30 Mar, 2023 | PyPI farm-haystack |
TensorFlow has Heap-buffer-overflow in AvgPoolGrad BIT-tensorflow-2023-25664, CVE-2023-25664, GHSA-6hg6-5c2q-7rcr, PYSEC-2026-1951, PYSEC-2026-3122 | Critical | 0.4% | 24 Mar, 2023 | PyPI tensorflow PyPI tensorflow-cpu |
TensorFlow has a heap out-of-buffer read vulnerability in the QuantizeAndDequantize operation BIT-tensorflow-2023-25668, CVE-2023-25668, GHSA-gw97-ff7c-9v96, PYSEC-2026-548, PYSEC-2026-549, PYSEC-2026-550 | Critical | 0.8% | 24 Mar, 2023 | PyPI tensorflow PyPI tensorflow-cpu PyPI tensorflow-gpu |
angular-server-side-configuration information disclosure vulnerability in monorepo with node.js backend CVE-2023-28444, GHSA-gwvm-vrp4-4pp5 | Critical | 0.8% | 24 Mar, 2023 | npm angular-server-side-configuration |
mlflow is vulnerable to remote file access in `mlflow server` and `mlflow ui` CLIs BIT-mlflow-2023-1177, CVE-2023-1177, GHSA-xg73-94fp-g449, PYSEC-2023-29 | Critical | 69.7% | 24 Mar, 2023 | PyPI mlflow |
Fortra Cobalt Strike User Interface Remote Code Execution Vulnerability CVE-2022-42948 | CriticalExploited | 2.7% | 24 Mar, 2023 | |
Moodle's Mustache pix helper contained a potential Mustache injection risk if combined with user input BIT-moodle-2023-28333, CVE-2023-28333, GHSA-q2x3-2f9g-h559 | Critical | 1.2% | 23 Mar, 2023 | Packagist moodle/moodle |
Adobe ColdFusion Deserialization of Untrusted Data Vulnerability CVE-2023-26359 | CriticalExploited | 17.0% | 23 Mar, 2023 | |
baserCMS allows any file to be uploaded CVE-2023-25655, GHSA-mfvg-qwcw-qvc8 | Critical | 1.1% | 23 Mar, 2023 | Packagist baserproject/basercms |
baserCMS File Uploader Remote Code Execution (RCE) vulnerability CVE-2023-25654, GHSA-h4cc-fxpp-pgw9 | Critical | 1.5% | 23 Mar, 2023 | Packagist baserproject/basercms |
code-server vulnerable to Missing Origin Validation in WebSockets CVE-2023-26114, GHSA-frjg-g767-7363 | Critical | 0.3% | 23 Mar, 2023 | npm code-server |
weixin-python XML External Entity vulnerability CVE-2018-25082, GHSA-h384-ph77-3699, PYSEC-2026-572 | Critical | 0.8% | 21 Mar, 2023 | PyPI weixin-python |