Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Ahsay AhsayCBS Improper Authentication Vulnerability CVE-2026-105133 | MediumExploited | 79.5% | 25 days ago | |
Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability CVE-2026-96655 | MediumExploited | 1.6% | 23 Sep, 2026 | |
Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability CVE-2026-96654 | MediumExploited | 1.9% | 23 Sep, 2026 | |
Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability CVE-2026-96652 | MediumExploited | 1.8% | 23 Sep, 2026 | |
Mikrotik RouterOS Improper Enforcement of Behavioral Workflow Vulnerability CVE-2026-67279 | MediumExploited | 2.3% | 05 Sep, 2026 | |
JFrog Artifactory Improper Limitation of a Pathname to a Restricted Directory Vulnerability CVE-2026-66384 | MediumExploited | 0.7% | 12 Aug, 2026 | |
Cisco Secure Firewall Management Center Use of Hard-coded Password Vulnerability CVE-2026-20316 | MediumExploited | 35.1% | 29 Jul, 2026 | |
WordPress Core SQL Injection Vulnerability CVE-2026-60137 | MediumExploited | 5.3% | 17 Jul, 2026 | |
Cisco Catalyst SD-WAN Manager Directory or Path Traversal Vulnerability CVE-2026-20262 | MediumExploited | 29.1% | 15 Jun, 2026 | |
Arista Extensible Operating System Incomplete Comparison with Missing Factors Vulnerability CVE-2026-7473 | MediumExploited | 1.1% | 05 Jun, 2026 | |
Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks CVE-2026-48710, GHSA-86qp-5c8j-p5mr, PYSEC-2026-161, X41-2026-002 | MediumExploited | 70.3% | 22 May, 2026 | PyPI starlette |
Trend Micro Apex One (On-Premise) Directory Traversal Vulnerability CVE-2026-34926 | MediumExploited | 13.4% | 21 May, 2026 | |
Microsoft Exchange Server Cross-Site Scripting Vulnerability CVE-2026-42897 | MediumExploited | 70.7% | 14 May, 2026 | |
Microsoft Windows Protection Mechanism Failure Vulnerability CVE-2026-32202 | MediumExploited | 70.9% | 14 Apr, 2026 | |
Microsoft SharePoint Server Improper Input Validation Vulnerability CVE-2026-32201 | MediumExploited | 43.4% | 14 Apr, 2026 | |
Fortinet Multiple Products Path Traversal Vulnerability CVE-2025-61624 | MediumExploited | 1.3% | 14 Apr, 2026 | |
Cisco Catalyst SD-WAN Manager Incorrect Use of Privileged APIs Vulnerability CVE-2026-20122 | MediumExploited | 25.8% | 25 Feb, 2026 | |
Microsoft Windows NULL Pointer Dereference Vulnerability CVE-2026-21525 | MediumExploited | 4.9% | 10 Feb, 2026 | |
Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability CVE-2025-68686 | MediumExploited | 29.5% | 10 Feb, 2026 | |
Microsoft Windows Information Disclosure Vulnerability CVE-2026-20805 | MediumExploited | 7.5% | 13 Jan, 2026 | |
Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting Vulnerability CVE-2025-66376 | MediumExploited | 20.2% | 05 Jan, 2026 | |
SonicWall SMA1000 Missing Authorization Vulnerability CVE-2025-40602 | MediumExploited | 2.8% | 18 Dec, 2025 | |
RoundCube Webmail Cross-site Scripting Vulnerability CVE-2025-68461 | MediumExploited | 27.4% | 18 Dec, 2025 | |
Apple Multiple Products Classic Buffer Overflow Vulnerability CVE-2025-43520 | MediumExploited | 0.4% | 12 Dec, 2025 | |
Android Framework Information Disclosure Vulnerability CVE-2025-48633 | MediumExploited | 0.3% | 08 Dec, 2025 | |
Linux Kernel Race Condition Vulnerability CVE-2025-39964 | MediumExploited | 1.6% | 13 Oct, 2025 | |
Libraesva Email Security Gateway Command Injection Vulnerability CVE-2025-59689 | MediumExploited | 1.9% | 19 Sep, 2025 | |
Meta Platforms WhatsApp Incorrect Authorization Vulnerability CVE-2025-55177 | MediumExploited | 13.1% | 29 Aug, 2025 | |
Wing FTP Server Information Disclosure Vulnerability CVE-2025-47813 | MediumExploited | 62.5% | 10 Jul, 2025 | |
Microsoft SharePoint Improper Authentication Vulnerability CVE-2025-49706 | MediumExploited | 99.1% | 08 Jul, 2025 | |
Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability CVE-2025-48700 | MediumExploited | 1.7% | 23 Jun, 2025 | |
Apple Multiple Products Unspecified Vulnerability CVE-2025-43200 | MediumExploited | 1.2% | 16 Jun, 2025 | |
IGEL OS Use of a Key Past its Expiration Date Vulnerability CVE-2025-47827 | MediumExploited | 4.9% | 05 Jun, 2025 | |
TeleMessage TM SGNL Exposure of Core Dump File to an Unauthorized Control Sphere Vulnerability CVE-2025-48928 | MediumExploited | 0.6% | 28 May, 2025 | |
TeleMessage TM SGNL Initialization of a Resource with an Insecure Default Vulnerability CVE-2025-48927 | MediumExploited | 11.6% | 28 May, 2025 | |
TeleMessage TM SGNL Hidden Functionality Vulnerability CVE-2025-47729 | MediumExploited | 0.4% | 08 May, 2025 | |
Craft CMS stores arbitrary content provided by unauthenticated users in session files CVE-2025-35939, GHSA-7vrx-9684-xrf2 | MediumExploited | 1.3% | 07 May, 2025 | Packagist craftcms/cms |
Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability CVE-2025-27915 | MediumExploited | 4.1% | 12 Mar, 2025 | |
Juniper Junos OS Improper Isolation or Compartmentalization Vulnerability CVE-2025-21590 | MediumExploited | 1.7% | 12 Mar, 2025 | |
Microsoft Windows NTFS Out-Of-Bounds Read Vulnerability CVE-2025-24991 | MediumExploited | 2.0% | 11 Mar, 2025 | |
Microsoft Windows NTFS Information Disclosure Vulnerability CVE-2025-24984 | MediumExploited | 2.0% | 11 Mar, 2025 | |
Microsoft Windows NTLM Hash Disclosure Spoofing Vulnerability CVE-2025-24054 | MediumExploited | 62.3% | 11 Mar, 2025 | |
VMware ESXi, Workstation, and Fusion Information Disclosure Vulnerability CVE-2025-22226 | MediumExploited | 1.6% | 04 Mar, 2025 | |
Apple iOS and iPadOS Incorrect Authorization Vulnerability CVE-2025-24200 | MediumExploited | 4.5% | 10 Feb, 2025 | |
DrayTek Vigor Routers OS Command Injection Vulnerability CVE-2024-12987 | MediumExploited | 98.2% | 27 Dec, 2024 | |
Apple Multiple Products Cross-Site Scripting (XSS) Vulnerability CVE-2024-44309 | MediumExploited | 21.9% | 20 Nov, 2024 | |
Linux Kernel Use of Uninitialized Resource Vulnerability CVE-2024-50302 | MediumExploited | 0.8% | 19 Nov, 2024 | |
Palo Alto Networks PAN-OS Management Interface OS Command Injection Vulnerability CVE-2024-9474 | MediumExploited | 93.8% | 18 Nov, 2024 | |
MDaemon Email Server Cross-Site Scripting (XSS) Vulnerability CVE-2024-11182 | MediumExploited | 33.3% | 15 Nov, 2024 | |
Citrix Session Recording Deserialization of Untrusted Data Vulnerability CVE-2024-8069 | MediumExploited | 21.1% | 12 Nov, 2024 |