Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
SmarterTools SmarterMail Missing Authentication for Critical Function Vulnerability CVE-2026-24423 | CriticalExploited | 88.2% | 23 Jan, 2026 | |
Langflow affected by Remote Code Execution via validate_code() exec() CVE-2026-0770, GHSA-g22f-v6f7-2hrh, PYSEC-2026-1525 | CriticalExploited | 62.6% | 23 Jan, 2026 | PyPI langflow |
SmarterTools SmarterMail Authentication Bypass Using an Alternate Path or Channel Vulnerability CVE-2026-23760 | CriticalExploited | 96.4% | 22 Jan, 2026 | |
Cisco Unified Communications Products Code Injection Vulnerability CVE-2026-20045 | CriticalExploited | 4.5% | 21 Jan, 2026 | |
GNU InetUtils Argument Injection Vulnerability CVE-2026-24061 | CriticalExploited | 99.0% | 21 Jan, 2026 | |
Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability CVE-2026-21962 | CriticalExploited | 73.2% | 20 Jan, 2026 | |
Microsoft SharePoint Deserialization of Untrusted Data Vulnerability CVE-2026-20963 | CriticalExploited | 29.2% | 13 Jan, 2026 | |
Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability CVE-2025-25249 | CriticalExploited | 3.7% | 13 Jan, 2026 | |
SmarterTools SmarterMail Unrestricted Upload of File with Dangerous Type Vulnerability CVE-2025-52691 | CriticalExploited | 85.7% | 29 Dec, 2025 | |
n8n Vulnerable to Remote Code Execution via Expression Injection CVE-2025-68613, GHSA-v98v-ff95-f3cp | CriticalExploited | 99.0% | 19 Dec, 2025 | npm n8n |
WatchGuard Firebox Out of Bounds Write Vulnerability CVE-2025-14733 | CriticalExploited | 29.4% | 19 Dec, 2025 | |
Cisco Multiple Products Improper Input Validation Vulnerability CVE-2025-20393 | CriticalExploited | 32.4% | 17 Dec, 2025 | |
ASUS Live Update Embedded Malicious Code Vulnerability CVE-2025-59374 | CriticalExploited | 1.2% | 17 Dec, 2025 | |
Hewlett Packard Enterprise (HPE) OneView Code Injection Vulnerability CVE-2025-37164 | CriticalExploited | 90.2% | 16 Dec, 2025 | |
Fortinet Multiple Products Improper Verification of Cryptographic Signature Vulnerability CVE-2025-59718 | CriticalExploited | 68.3% | 09 Dec, 2025 | |
Langflow CORS misconfiguration enables Account Takeover and RCE CVE-2025-34291, GHSA-577h-p2hh-v4mv, PYSEC-2025-78 | CriticalExploited | 92.8% | 05 Dec, 2025 | PyPI langflow |
Array Networks ArrayOS AG OS Command Injection Vulnerability CVE-2025-66644 | CriticalExploited | 3.4% | 05 Dec, 2025 | |
React Server Components are Vulnerable to RCE CVE-2025-55182, GHSA-fv66-9v8q-g76r | CriticalExploited | 99.8% | 03 Dec, 2025 | npm react-server-dom-parcel npm react-server-dom-turbopack npm react-server-dom-webpack |
Ray is vulnerable to Critical RCE via Safari & Firefox Browsers through DNS Rebinding Attack CVE-2025-62593, GHSA-q279-jhrf-cc6v, PYSEC-2026-520 | CriticalExploited | 60.2% | 26 Nov, 2025 | PyPI ray |
OSGeo GeoServer Improper Restriction of XML External Entity Reference Vulnerability CVE-2025-58360 | CriticalExploited | 61.2% | 25 Nov, 2025 | |
Fortinet FortiWeb Path Traversal Vulnerability CVE-2025-64446 | CriticalExploited | 91.1% | 14 Nov, 2025 | |
Gladinet Triofox Improper Access Control Vulnerability CVE-2025-12480 | CriticalExploited | 95.7% | 10 Nov, 2025 | |
@react-native-community/cli has arbitrary OS command injection CVE-2025-11953, GHSA-399j-vxmf-hjvr | CriticalExploited | 94.0% | 03 Nov, 2025 | npm @react-native-community/cli npm @react-native-community/cli-server-api |
Oracle Fusion Middleware Missing Authentication for Critical Function Vulnerability CVE-2025-61757 | CriticalExploited | 88.6% | 21 Oct, 2025 | |
Motex LANSCOPE Endpoint Manager Improper Verification of Source of a Communication Channel Vulnerability CVE-2025-61932 | CriticalExploited | 2.8% | 20 Oct, 2025 | |
F5 BIG-IP Stack-Based Buffer Overflow Vulnerability CVE-2025-53521 | CriticalExploited | 2.3% | 15 Oct, 2025 | |
Microsoft Windows Server Update Service (WSUS) Deserialization of Untrusted Data Vulnerability CVE-2025-59287 | CriticalExploited | 100.0% | 14 Oct, 2025 | |
Oracle E-Business Suite Unspecified Vulnerability CVE-2025-61882 | CriticalExploited | 99.7% | 05 Oct, 2025 | |
Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Buffer Overflow Vulnerability CVE-2025-20333 | CriticalExploited | 71.2% | 25 Sep, 2025 | |
Google Chromium V8 Type Confusion Vulnerability CVE-2025-10585 | CriticalExploited | 9.0% | 24 Sep, 2025 | |
SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability CVE-2025-26399 | CriticalExploited | 90.1% | 23 Sep, 2025 | |
CWP Control Web Panel OS Command Injection Vulnerability CVE-2025-48703 | CriticalExploited | 99.7% | 19 Sep, 2025 | |
Fortra GoAnywhere MFT Deserialization of Untrusted Data Vulnerability CVE-2025-10035 | CriticalExploited | 99.8% | 18 Sep, 2025 | |
WatchGuard Firebox Out-of-Bounds Write Vulnerability CVE-2025-9242 | CriticalExploited | 92.2% | 17 Sep, 2025 | |
Samsung Mobile Devices Out-of-Bounds Write Vulnerability CVE-2025-21043 | CriticalExploited | 2.2% | 12 Sep, 2025 | |
Samsung Mobile Devices Out-of-Bounds Write Vulnerability CVE-2025-21042 | CriticalExploited | 35.6% | 12 Sep, 2025 | |
Magento Community Edition Improper Input Validation vulnerability CVE-2025-54236, GHSA-wh92-6q6g-px7j | CriticalExploited | 94.7% | 09 Sep, 2025 | Packagist magento/community-edition Packagist magento/project-community-edition |
Linux Kernel Improper Check for Unusual or Exceptional Conditions Vulnerability CVE-2025-39682 | CriticalExploited | 3.3% | 05 Sep, 2025 | |
Sitecore Multiple Products Deserialization of Untrusted Data Vulnerability CVE-2025-53690 | CriticalExploited | 60.6% | 03 Sep, 2025 | |
Sangoma FreePBX Authentication Bypass Vulnerability CVE-2025-57819 | CriticalExploited | 95.2% | 28 Aug, 2025 | |
Citrix NetScaler Memory Overflow Vulnerability CVE-2025-7775 | CriticalExploited | 20.7% | 26 Aug, 2025 | |
Apple iOS, iPadOS, and macOS Out-of-Bounds Write Vulnerability CVE-2025-43300 | CriticalExploited | 65.2% | 21 Aug, 2025 | |
N-able N-Central Command Injection Vulnerability CVE-2025-8876 | CriticalExploited | 4.1% | 14 Aug, 2025 | |
N-able N-Central Insecure Deserialization Vulnerability CVE-2025-8875 | CriticalExploited | 2.5% | 14 Aug, 2025 | |
Adobe Experience Manager Forms Code Execution Vulnerability CVE-2025-54253 | CriticalExploited | 88.8% | 05 Aug, 2025 | |
Trend Micro Apex One OS Command Injection Vulnerability CVE-2025-54948 | CriticalExploited | 25.4% | 05 Aug, 2025 | |
Dassault Systèmes DELMIA Apriso Missing Authorization Vulnerability CVE-2025-6205 | CriticalExploited | 73.7% | 04 Aug, 2025 | |
Microsoft SharePoint Deserialization of Untrusted Data Vulnerability CVE-2025-53770 | CriticalExploited | 100.0% | 20 Jul, 2025 | |
CrushFTP Unprotected Alternate Channel Vulnerability CVE-2025-54309 | CriticalExploited | 93.5% | 18 Jul, 2025 | |
Livewire is vulnerable to remote command execution during component property update hydration CVE-2025-54068, GHSA-29cq-5w36-x7w3 | CriticalExploited | 96.3% | 17 Jul, 2025 | Packagist livewire/livewire |