Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Qualcomm Multiple Chipsets Use-After-Free Vulnerability CVE-2025-27038 | HighExploited | 1.1% | 03 Jun, 2025 | |
Qualcomm Multiple Chipsets Incorrect Authorization Vulnerability CVE-2025-21480 | HighExploited | 0.5% | 03 Jun, 2025 | |
Google Chromium V8 Out-of-Bounds Read and Write Vulnerability CVE-2025-5419 | HighExploited | 7.8% | 03 Jun, 2025 | |
Dassault Systèmes DELMIA Apriso Deserialization of Untrusted Data Vulnerability CVE-2025-5086 | CriticalExploited | 96.9% | 02 Jun, 2025 | |
Roundcube Webmail Vulnerable to Authenticated RCE via PHP Object Deserialization CVE-2025-49113, GHSA-8j8w-wwqc-x596 | CriticalExploited | 99.7% | 02 Jun, 2025 | Packagist roundcube/roundcubemail |
TeleMessage TM SGNL Exposure of Core Dump File to an Unauthorized Control Sphere Vulnerability CVE-2025-48928 | MediumExploited | 0.6% | 28 May, 2025 | |
TeleMessage TM SGNL Initialization of a Resource with an Insecure Default Vulnerability CVE-2025-48927 | MediumExploited | 11.6% | 28 May, 2025 | |
Versa Concerto Improper Authentication Vulnerability CVE-2025-34026 | CriticalExploited | 81.8% | 21 May, 2025 | |
Smartbedded Meteobridge Command Injection Vulnerability CVE-2025-4008 | HighExploited | 93.3% | 21 May, 2025 | |
Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability CVE-2025-32709 | HighExploited | 1.8% | 13 May, 2025 | |
Microsoft Windows Common Log File System (CLFS) Driver Heap-Based Buffer Overflow Vulnerability CVE-2025-32706 | HighExploited | 2.3% | 13 May, 2025 | |
Microsoft Windows Common Log File System (CLFS) Driver Use-After-Free Vulnerability CVE-2025-32701 | HighExploited | 1.4% | 13 May, 2025 | |
Microsoft Windows DWM Core Library Use-After-Free Vulnerability CVE-2025-30400 | HighExploited | 1.9% | 13 May, 2025 | |
Microsoft Windows Scripting Engine Type Confusion Vulnerability CVE-2025-30397 | HighExploited | 27.3% | 13 May, 2025 | |
Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability CVE-2025-4428 | HighExploited | 88.0% | 13 May, 2025 | |
Ivanti Endpoint Manager Mobile (EPMM) Authentication Bypass Vulnerability CVE-2025-4427 | HighExploited | 99.9% | 13 May, 2025 | |
Fortinet Multiple Products Stack-Based Buffer Overflow Vulnerability CVE-2025-32756 | CriticalExploited | 30.9% | 13 May, 2025 | |
Samsung MagicINFO 9 Server Path Traversal Vulnerability CVE-2025-4632 | CriticalExploited | 24.1% | 13 May, 2025 | |
SAP NetWeaver Deserialization Vulnerability CVE-2025-42999 | CriticalExploited | 12.9% | 13 May, 2025 | |
TeleMessage TM SGNL Hidden Functionality Vulnerability CVE-2025-47729 | MediumExploited | 0.4% | 08 May, 2025 | |
Craft CMS stores arbitrary content provided by unauthenticated users in session files CVE-2025-35939, GHSA-7vrx-9684-xrf2 | MediumExploited | 1.3% | 07 May, 2025 | Packagist craftcms/cms |
SysAid On-Prem Improper Restriction of XML External Entity Reference Vulnerability CVE-2025-2776 | CriticalExploited | 64.7% | 07 May, 2025 | |
SysAid On-Prem Improper Restriction of XML External Entity Reference Vulnerability CVE-2025-2775 | HighExploited | 42.6% | 07 May, 2025 | |
Srimax Output Messenger Directory Traversal Vulnerability CVE-2025-27920 | HighExploited | 1.9% | 05 May, 2025 | |
ConnectWise ScreenConnect Improper Authentication Vulnerability CVE-2025-3935 | HighExploited | 3.6% | 25 Apr, 2025 | |
Commvault Web Server Unspecified Vulnerability CVE-2025-3928 | HighExploited | 2.5% | 25 Apr, 2025 | |
Craft CMS Allows Remote Code Execution CVE-2025-32432, GHSA-f3gw-9ww9-jmc3 | CriticalExploited | 99.8% | 25 Apr, 2025 | Packagist craftcms/cms |
SAP NetWeaver Unrestricted File Upload Vulnerability CVE-2025-31324 | CriticalExploited | 99.5% | 24 Apr, 2025 | |
Broadcom Brocade Fabric OS Code Injection Vulnerability CVE-2025-1976 | HighExploited | 0.7% | 24 Apr, 2025 | |
Commvault Command Center Path Traversal Vulnerability CVE-2025-34028 | CriticalExploited | 97.6% | 22 Apr, 2025 | |
Qualitia Active! Mail Stack-Based Buffer Overflow Vulnerability CVE-2025-42599 | CriticalExploited | 3.4% | 18 Apr, 2025 | |
Erlang Erlang/OTP SSH Server Missing Authentication for Critical Function Vulnerability CVE-2025-32433 | CriticalExploited | 98.9% | 16 Apr, 2025 | |
Apple Multiple Products Arbitrary Read and Write Vulnerability CVE-2025-31201 | CriticalExploited | 14.0% | 16 Apr, 2025 | |
Apple Multiple Products Memory Corruption Vulnerability CVE-2025-31200 | CriticalExploited | 20.9% | 16 Apr, 2025 | |
yiisoft/yii2 Mishandles the Attaching of Behavior Defined by a `__class` Array Key CVE-2024-58136, GHSA-ggwg-cmwp-46r5 | CriticalExploited | 87.8% | 10 Apr, 2025 | Packagist yiisoft/yii2 |
Microsoft Windows Common Log File System (CLFS) Driver Use-After-Free Vulnerability CVE-2025-29824 | HighExploited | 19.3% | 08 Apr, 2025 | |
Langflow Unauth RCE CVE-2025-3248, GHSA-rvqx-wpfh-mfx7, PYSEC-2025-36, PYSEC-2026-380 | CriticalExploited | 100.0% | 07 Apr, 2025 | PyPI langflow PyPI langflow-base |
CrushFTP Authentication Bypass Vulnerability CVE-2025-31161 | CriticalExploited | 100.0% | 03 Apr, 2025 | |
Gladinet CentreStack and Triofox Use of Hard-coded Cryptographic Key Vulnerability CVE-2025-30406 | CriticalExploited | 94.3% | 03 Apr, 2025 | |
Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability CVE-2025-22457 | CriticalExploited | 100.0% | 03 Apr, 2025 | |
Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query CVE-2025-31125, GHSA-4r4m-qw57-chr8 | HighExploited | 65.8% | 31 Mar, 2025 | npm vite |
Google Chromium Mojo Sandbox Escape Vulnerability CVE-2025-2783 | HighExploited | 9.2% | 26 Mar, 2025 | |
D-Link DIR-823X Command Injection Vulnerability CVE-2025-29635 | HighExploited | 87.9% | 25 Mar, 2025 | |
Kentico Xperience Path Traversal Vulnerability CVE-2025-2749 | HighExploited | 4.0% | 24 Mar, 2025 | |
Kentico Xperience CMS Authentication Bypass Using an Alternate Path or Channel Vulnerability CVE-2025-2747 | CriticalExploited | 97.2% | 24 Mar, 2025 | |
Kentico Xperience CMS Authentication Bypass Using an Alternate Path or Channel Vulnerability CVE-2025-2746 | CriticalExploited | 74.1% | 24 Mar, 2025 | |
reviewdog/action-setup GitHub Action Embedded Malicious Code Vulnerability CVE-2025-30154 | HighExploited | 2.5% | 19 Mar, 2025 | |
tj-actions/changed-files GitHub Action Embedded Malicious Code Vulnerability CVE-2025-30066 | HighExploited | 72.1% | 15 Mar, 2025 | |
Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability CVE-2025-27915 | MediumExploited | 4.1% | 12 Mar, 2025 | |
Juniper Junos OS Improper Isolation or Compartmentalization Vulnerability CVE-2025-21590 | MediumExploited | 1.7% | 12 Mar, 2025 |