Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Fortinet FortiWeb SQL Injection Vulnerability CVE-2025-25257 | CriticalExploited | 99.9% | 17 Jul, 2025 | |
Cisco Identity Services Engine Injection Vulnerability CVE-2025-20337 | CriticalExploited | 74.5% | 16 Jul, 2025 | |
Wing FTP Server Improper Neutralization of Null Byte or NUL Character Vulnerability CVE-2025-47812 | CriticalExploited | 93.9% | 10 Jul, 2025 | |
Cisco Identity Services Engine Injection Vulnerability CVE-2025-20281 | CriticalExploited | 97.6% | 25 Jun, 2025 | |
Citrix NetScaler ADC and Gateway Buffer Overflow Vulnerability CVE-2025-6543 | CriticalExploited | 10.4% | 25 Jun, 2025 | |
Quest KACE Systems Management Appliance (SMA) Improper Authentication Vulnerability CVE-2025-32975 | CriticalExploited | 2.5% | 24 Jun, 2025 | |
Citrix NetScaler ADC and Gateway Out-of-Bounds Read Vulnerability CVE-2025-5777 | CriticalExploited | 100.0% | 17 Jun, 2025 | |
Dassault Systèmes DELMIA Apriso Deserialization of Untrusted Data Vulnerability CVE-2025-5086 | CriticalExploited | 97.0% | 02 Jun, 2025 | |
Roundcube Webmail Vulnerable to Authenticated RCE via PHP Object Deserialization CVE-2025-49113, GHSA-8j8w-wwqc-x596 | CriticalExploited | 99.5% | 02 Jun, 2025 | Packagist roundcube/roundcubemail |
Versa Concerto Improper Authentication Vulnerability CVE-2025-34026 | CriticalExploited | 81.8% | 21 May, 2025 | |
Fortinet Multiple Products Stack-Based Buffer Overflow Vulnerability CVE-2025-32756 | CriticalExploited | 30.9% | 13 May, 2025 | |
Samsung MagicINFO 9 Server Path Traversal Vulnerability CVE-2025-4632 | CriticalExploited | 24.1% | 13 May, 2025 | |
SAP NetWeaver Deserialization Vulnerability CVE-2025-42999 | CriticalExploited | 12.9% | 13 May, 2025 | |
SysAid On-Prem Improper Restriction of XML External Entity Reference Vulnerability CVE-2025-2776 | CriticalExploited | 64.7% | 07 May, 2025 | |
Craft CMS Allows Remote Code Execution CVE-2025-32432, GHSA-f3gw-9ww9-jmc3 | CriticalExploited | 99.8% | 25 Apr, 2025 | Packagist craftcms/cms |
SAP NetWeaver Unrestricted File Upload Vulnerability CVE-2025-31324 | CriticalExploited | 99.5% | 24 Apr, 2025 | |
Commvault Command Center Path Traversal Vulnerability CVE-2025-34028 | CriticalExploited | 97.6% | 22 Apr, 2025 | |
Qualitia Active! Mail Stack-Based Buffer Overflow Vulnerability CVE-2025-42599 | CriticalExploited | 3.4% | 18 Apr, 2025 | |
Erlang Erlang/OTP SSH Server Missing Authentication for Critical Function Vulnerability CVE-2025-32433 | CriticalExploited | 98.9% | 16 Apr, 2025 | |
Apple Multiple Products Arbitrary Read and Write Vulnerability CVE-2025-31201 | CriticalExploited | 14.0% | 16 Apr, 2025 | |
Apple Multiple Products Memory Corruption Vulnerability CVE-2025-31200 | CriticalExploited | 20.9% | 16 Apr, 2025 | |
yiisoft/yii2 Mishandles the Attaching of Behavior Defined by a `__class` Array Key CVE-2024-58136, GHSA-ggwg-cmwp-46r5 | CriticalExploited | 87.8% | 10 Apr, 2025 | Packagist yiisoft/yii2 |
Langflow Unauth RCE CVE-2025-3248, GHSA-rvqx-wpfh-mfx7, PYSEC-2025-36, PYSEC-2026-380 | CriticalExploited | 100.0% | 07 Apr, 2025 | PyPI langflow PyPI langflow-base |
CrushFTP Authentication Bypass Vulnerability CVE-2025-31161 | CriticalExploited | 100.0% | 03 Apr, 2025 | |
Gladinet CentreStack and Triofox Use of Hard-coded Cryptographic Key Vulnerability CVE-2025-30406 | CriticalExploited | 94.3% | 03 Apr, 2025 | |
Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability CVE-2025-22457 | CriticalExploited | 100.0% | 03 Apr, 2025 | |
Kentico Xperience CMS Authentication Bypass Using an Alternate Path or Channel Vulnerability CVE-2025-2747 | CriticalExploited | 97.2% | 24 Mar, 2025 | |
Kentico Xperience CMS Authentication Bypass Using an Alternate Path or Channel Vulnerability CVE-2025-2746 | CriticalExploited | 74.1% | 24 Mar, 2025 | |
Apple Multiple Products WebKit Out-of-Bounds Write Vulnerability CVE-2025-24201 | CriticalExploited | 3.8% | 11 Mar, 2025 | |
AMI MegaRAC SPx Authentication Bypass by Spoofing Vulnerability CVE-2024-54085 | CriticalExploited | 60.7% | 11 Mar, 2025 | |
Apache Tomcat Path Equivalence Vulnerability CVE-2025-24813 | CriticalExploited | 99.9% | 10 Mar, 2025 | |
Edimax IC-7100 IP Camera OS Command Injection Vulnerability CVE-2025-1316 | CriticalExploited | 74.5% | 05 Mar, 2025 | |
XWiki Platform Eval Injection Vulnerability CVE-2025-24893 | CriticalExploited | 100.0% | 20 Feb, 2025 | |
Microsoft Power Pages Improper Access Control Vulnerability CVE-2025-24989 | CriticalExploited | 1.6% | 19 Feb, 2025 | |
Wazuh Server Deserialization of Untrusted Data Vulnerability CVE-2025-24016 | CriticalExploited | 93.8% | 10 Feb, 2025 | |
Apple Multiple Products Use-After-Free Vulnerability CVE-2025-24085 | CriticalExploited | 17.5% | 27 Jan, 2025 | |
SonicWall SMA1000 Appliances Deserialization Vulnerability CVE-2025-23006 | CriticalExploited | 23.4% | 23 Jan, 2025 | |
SimpleHelp Missing Authorization Vulnerability CVE-2024-57726 | CriticalExploited | 66.4% | 15 Jan, 2025 | |
Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability CVE-2024-55591 | CriticalExploited | 94.3% | 14 Jan, 2025 | |
SonicWall SonicOS SSLVPN Improper Authentication Vulnerability CVE-2024-53704 | CriticalExploited | 95.3% | 09 Jan, 2025 | |
Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability CVE-2025-0282 | CriticalExploited | 100.0% | 08 Jan, 2025 | |
Aviatrix Controllers OS Command Injection Vulnerability CVE-2024-50603 | CriticalExploited | 98.5% | 08 Jan, 2025 | |
Craft CMS has potential RCE when PHP `register_argc_argv` config setting is enabled CVE-2024-56145, GHSA-2p6p-9rc9-62j9 | CriticalExploited | 97.4% | 18 Dec, 2024 | Packagist craftcms/cms |
BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) Command Injection Vulnerability CVE-2024-12356 | CriticalExploited | 87.3% | 17 Dec, 2024 | |
Cleo Multiple Products Unauthenticated File Upload Vulnerability CVE-2024-55956 | CriticalExploited | 94.0% | 13 Dec, 2024 | |
Zyxel Multiple Firewalls Path Traversal Vulnerability CVE-2024-11667 | CriticalExploited | 2.9% | 27 Nov, 2024 | |
Microsoft Partner Center Improper Access Control Vulnerability CVE-2024-49035 | CriticalExploited | 1.3% | 26 Nov, 2024 | |
ProjectSend Improper Authentication Vulnerability CVE-2024-11680 | CriticalExploited | 91.8% | 26 Nov, 2024 | |
Palo Alto Networks PAN-OS Management Interface Authentication Bypass Vulnerability CVE-2024-0012 | CriticalExploited | 99.8% | 18 Nov, 2024 | |
GeoVision Devices OS Command Injection Vulnerability CVE-2024-11120 | CriticalExploited | 28.4% | 15 Nov, 2024 |