Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting Vulnerability CVE-2025-66376 | MediumExploited | 20.2% | 05 Jan, 2026 | |
SmarterTools SmarterMail Unrestricted Upload of File with Dangerous Type Vulnerability CVE-2025-52691 | CriticalExploited | 85.7% | 29 Dec, 2025 | |
Synacor Zimbra Collaboration Suite (ZCS) PHP Remote File Inclusion Vulnerability CVE-2025-68645 | HighExploited | 48.9% | 22 Dec, 2025 | |
n8n Vulnerable to Remote Code Execution via Expression Injection CVE-2025-68613, GHSA-v98v-ff95-f3cp | CriticalExploited | 99.0% | 19 Dec, 2025 | npm n8n |
MongoDB and MongoDB Server Improper Handling of Length Parameter Inconsistency Vulnerability CVE-2025-14847 | HighExploited | 83.2% | 19 Dec, 2025 | |
WatchGuard Firebox Out of Bounds Write Vulnerability CVE-2025-14733 | CriticalExploited | 29.4% | 19 Dec, 2025 | |
SonicWall SMA1000 Missing Authorization Vulnerability CVE-2025-40602 | MediumExploited | 2.8% | 18 Dec, 2025 | |
RoundCube Webmail Cross-site Scripting Vulnerability CVE-2025-68461 | MediumExploited | 27.4% | 18 Dec, 2025 | |
Apple Multiple Products Use-After-Free WebKit Vulnerability CVE-2025-43529 | HighExploited | 25.7% | 17 Dec, 2025 | |
Cisco Multiple Products Improper Input Validation Vulnerability CVE-2025-20393 | CriticalExploited | 32.4% | 17 Dec, 2025 | |
ASUS Live Update Embedded Malicious Code Vulnerability CVE-2025-59374 | CriticalExploited | 1.2% | 17 Dec, 2025 | |
Hewlett Packard Enterprise (HPE) OneView Code Injection Vulnerability CVE-2025-37164 | CriticalExploited | 90.2% | 16 Dec, 2025 | |
Apple Multiple Products Classic Buffer Overflow Vulnerability CVE-2025-43520 | MediumExploited | 0.4% | 12 Dec, 2025 | |
Apple Multiple Products Improper Locking Vulnerability CVE-2025-43510 | HighExploited | 0.4% | 12 Dec, 2025 | |
Gladinet CentreStack and Triofox Hard Coded Cryptographic Vulnerability CVE-2025-14611 | HighExploited | 53.3% | 12 Dec, 2025 | |
Google Chromium Out of Bounds Memory Access Vulnerability CVE-2025-14174 | HighExploited | 55.3% | 12 Dec, 2025 | |
Gogs Path Traversal Vulnerability CVE-2025-8110 | HighExploited | 85.2% | 10 Dec, 2025 | |
Microsoft Windows Use After Free Vulnerability CVE-2025-62221 | HighExploited | 2.5% | 09 Dec, 2025 | |
Fortinet Multiple Products Improper Verification of Cryptographic Signature Vulnerability CVE-2025-59718 | CriticalExploited | 68.3% | 09 Dec, 2025 | |
Android Framework Information Disclosure Vulnerability CVE-2025-48633 | MediumExploited | 0.3% | 08 Dec, 2025 | |
Android Framework Privilege Escalation Vulnerability CVE-2025-48572 | HighExploited | 0.3% | 08 Dec, 2025 | |
Langflow CORS misconfiguration enables Account Takeover and RCE CVE-2025-34291, GHSA-577h-p2hh-v4mv, PYSEC-2025-78 | CriticalExploited | 92.8% | 05 Dec, 2025 | PyPI langflow |
Array Networks ArrayOS AG OS Command Injection Vulnerability CVE-2025-66644 | CriticalExploited | 3.4% | 05 Dec, 2025 | |
React Server Components are Vulnerable to RCE CVE-2025-55182, GHSA-fv66-9v8q-g76r | CriticalExploited | 99.8% | 03 Dec, 2025 | npm react-server-dom-parcel npm react-server-dom-turbopack npm react-server-dom-webpack |
Ray is vulnerable to Critical RCE via Safari & Firefox Browsers through DNS Rebinding Attack CVE-2025-62593, GHSA-q279-jhrf-cc6v, PYSEC-2026-520 | CriticalExploited | 60.2% | 26 Nov, 2025 | PyPI ray |
OSGeo GeoServer Improper Restriction of XML External Entity Reference Vulnerability CVE-2025-58360 | CriticalExploited | 61.2% | 25 Nov, 2025 | |
Fortinet FortiWeb OS Command Injection Vulnerability CVE-2025-58034 | HighExploited | 54.7% | 18 Nov, 2025 | |
Google Chromium V8 Type Confusion Vulnerability CVE-2025-13223 | HighExploited | 4.9% | 17 Nov, 2025 | |
Fortinet FortiWeb Path Traversal Vulnerability CVE-2025-64446 | CriticalExploited | 91.1% | 14 Nov, 2025 | |
Microsoft Windows Race Condition Vulnerability CVE-2025-62215 | HighExploited | 4.5% | 11 Nov, 2025 | |
Microsoft Windows Link Following Vulnerability CVE-2025-60710 | HighExploited | 4.6% | 11 Nov, 2025 | |
Gladinet Triofox Improper Access Control Vulnerability CVE-2025-12480 | CriticalExploited | 95.7% | 10 Nov, 2025 | |
Sangoma FreePBX OS Command Injection Vulnerability CVE-2025-64328 | HighExploited | 84.6% | 07 Nov, 2025 | |
Apple Multiple products Use-After-Free Vulnerability CVE-2023-43000 | HighExploited | 4.0% | 05 Nov, 2025 | |
@react-native-community/cli has arbitrary OS command injection CVE-2025-11953, GHSA-399j-vxmf-hjvr | CriticalExploited | 94.0% | 03 Nov, 2025 | npm @react-native-community/cli npm @react-native-community/cli-server-api |
Oracle Fusion Middleware Missing Authentication for Critical Function Vulnerability CVE-2025-61757 | CriticalExploited | 88.6% | 21 Oct, 2025 | |
Motex LANSCOPE Endpoint Manager Improper Verification of Source of a Communication Channel Vulnerability CVE-2025-61932 | CriticalExploited | 2.8% | 20 Oct, 2025 | |
F5 BIG-IP Stack-Based Buffer Overflow Vulnerability CVE-2025-53521 | CriticalExploited | 2.3% | 15 Oct, 2025 | |
Microsoft Windows Server Update Service (WSUS) Deserialization of Untrusted Data Vulnerability CVE-2025-59287 | CriticalExploited | 100.0% | 14 Oct, 2025 | |
Microsoft Windows Improper Access Control Vulnerability CVE-2025-59230 | HighExploited | 2.7% | 14 Oct, 2025 | |
Microsoft Windows Untrusted Pointer Dereference Vulnerability CVE-2025-24990 | HighExploited | 6.4% | 14 Oct, 2025 | |
Linux Kernel Race Condition Vulnerability CVE-2025-39964 | MediumExploited | 1.6% | 13 Oct, 2025 | |
Oracle E-Business Suite Server-Side Request Forgery (SSRF) Vulnerability CVE-2025-61884 | HighExploited | 95.9% | 12 Oct, 2025 | |
Gladinet CentreStack and Triofox Files or Directories Accessible to External Parties Vulnerability CVE-2025-11371 | HighExploited | 92.1% | 09 Oct, 2025 | |
Oracle E-Business Suite Unspecified Vulnerability CVE-2025-61882 | CriticalExploited | 99.7% | 05 Oct, 2025 | |
Broadcom VMware Aria Operations and VMware Tools Privilege Defined with Unsafe Actions Vulnerability CVE-2025-41244 | HighExploited | 8.6% | 29 Sep, 2025 | |
Cisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Missing Authorization Vulnerability CVE-2025-20362 | HighExploited | 87.1% | 25 Sep, 2025 | |
Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Buffer Overflow Vulnerability CVE-2025-20333 | CriticalExploited | 71.2% | 25 Sep, 2025 | |
Cisco IOS and IOS XE Software SNMP Denial of Service and Remote Code Execution Vulnerability CVE-2025-20352 | HighExploited | 41.5% | 24 Sep, 2025 | |
Google Chromium V8 Type Confusion Vulnerability CVE-2025-10585 | CriticalExploited | 9.0% | 24 Sep, 2025 |