Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Horcrux Double Sign Possibility GHSA-6wxf-7784-62fp, GO-2025-3507 | High | Not scored | 07 Mar, 2025 | Go github.com/strangelove-ventures/horcrux Go github.com/strangelove-ventures/horcrux/v3 |
Vue I18n Allows Prototype Pollution in `handleFlatJson` CVE-2025-27597, GHSA-p2ph-7g93-hw3m | High | 0.6% | 07 Mar, 2025 | npm @intlify/core npm @intlify/core-base npm @intlify/message-resolver npm @intlify/vue-i18n-core +2 more |
axios Requests Vulnerable To Possible SSRF and Credential Leakage via Absolute URL CVE-2025-27152, GHSA-jr5f-v2jv-69x6 | High | 0.8% | 07 Mar, 2025 | npm axios |
Django Vulnerable to Allocation of Resources Without Limits or Throttling BIT-django-2025-26699, CVE-2025-26699, GHSA-p3fp-8748-vqfq, PYSEC-2025-13 | High | 0.8% | 06 Mar, 2025 | PyPI Django PyPI django |
dmlc/dgl Vulnerable to Remote Code Execution by Pickle Deserialization via rpc.recv_request() GHSA-3x5x-fw77-g54c | High | Not scored | 05 Mar, 2025 | PyPI dgl |
Drupal Two-factor Authentication (TFA) Vulnerable to Forceful Browsing CVE-2025-31694, DRUPAL-CONTRIB-2025-023, GHSA-hf6c-fgp3-jfch | High | 0.4% | 05 Mar, 2025 | Packagist drupal/tfa Packagist:https://packages.drupal.org/8 drupal/tfa |
Drupal AI Vulnerable to OS Command Injection via Optional Automator Types CVE-2025-31692, DRUPAL-CONTRIB-2025-021, GHSA-pwjq-fx3v-8f9r | High | 0.8% | 05 Mar, 2025 | Packagist drupal/ai Packagist:https://packages.drupal.org/8 drupal/ai |
VMware ESXi Arbitrary Write Vulnerability CVE-2025-22225 | HighExploited | 1.0% | 04 Mar, 2025 | |
VMware ESXi and Workstation TOCTOU Race Condition Vulnerability CVE-2025-22224 | HighExploited | 1.6% | 04 Mar, 2025 | |
NAKIVO Backup and Replication Absolute Path Traversal Vulnerability CVE-2024-48248 | HighExploited | 94.4% | 04 Mar, 2025 | |
Rembg CORS misconfiguration CVE-2025-25302, GHSA-59qh-fmm7-3g9q, PYSEC-2025-25 | High | 0.2% | 03 Mar, 2025 | PyPI rembg |
mavo DOM Clobbering vulnerability CVE-2024-53388, GHSA-3mf5-r4hg-hfx9 | High | 0.6% | 03 Mar, 2025 | npm mavo |
Goroutine Leak in Abacus SSE Implementation CVE-2025-27421, GHSA-vh64-54px-qgf8, GO-2025-3498 | High | 0.4% | 03 Mar, 2025 | Go github.com/jasonlovesdoggo/abacus |
Formwork improperly validates input of User role preventing site and panel availability GHSA-c85w-x26q-ch87 | High | Not scored | 01 Mar, 2025 | Packagist getformwork/formwork |
Rancher does not Properly Validate Account Bindings in SAML Authentication Enables User Impersonation on First Login CVE-2025-23389, GHSA-mq23-vvg7-xfm4, GO-2025-3490 | High | 0.5% | 27 Feb, 2025 | Go github.com/rancher/rancher |
Rancher allows an unauthenticated stack overflow in /v3-public/authproviders API CVE-2025-23388, GHSA-xr9q-h9c7-xw8q, GO-2025-3491 | High | 0.6% | 27 Feb, 2025 | Go github.com/rancher/rancher |
mongosh vulnerable to local privilege escalation CVE-2025-1756, GHSA-f5w3-73h4-jpcm | High | 0.2% | 27 Feb, 2025 | npm mongosh |
Spotipy's cache file, containing spotify auth token, is created with overly broad permissions CVE-2025-27154, GHSA-pwhh-q4h6-w599, PYSEC-2026-1936 | High | 0.6% | 27 Feb, 2025 | PyPI spotipy |
MongoDB Shell may be susceptible to control character injection via pasting CVE-2025-1692, GHSA-973h-3x6p-qg37 | High | 0.3% | 27 Feb, 2025 | npm mongosh |
MongoDB Shell may be susceptible to Control Character Injection via autocomplete CVE-2025-1691, GHSA-43g5-2wr2-q7vj | High | 0.4% | 27 Feb, 2025 | npm mongosh |
Drupal Cache Utility Cross-Site Request Forgery (CSRF) vulnerability CVE-2025-31690, DRUPAL-CONTRIB-2025-019, GHSA-ccc9-jgj7-hxc7 | High | 0.2% | 26 Feb, 2025 | Packagist drupal/cache_utility Packagist:https://packages.drupal.org/8 drupal/cache_utility |
Drupal General Data Protection Regulation Cross-Site Request Forgery (CSRF) vulnerability CVE-2025-31689, DRUPAL-CONTRIB-2025-018, GHSA-jv6r-mj9p-9xff | High | 0.2% | 26 Feb, 2025 | Packagist drupal/gdpr Packagist:https://packages.drupal.org/8 drupal/gdpr |
Mautic allows Improper Authorization in Reporting API CVE-2024-47053, GHSA-8xv7-g2q3-fqgc | High | 0.7% | 26 Feb, 2025 | Packagist mautic/core |
golang.org/x/oauth2 Improper Validation of Syntactic Correctness of Input vulnerability CVE-2025-22868, GHSA-6v2p-p543-phr9, GO-2025-3488 | High | 0.9% | 26 Feb, 2025 | Go golang.org/x/oauth2 |
golang.org/x/crypto Vulnerable to Denial of Service (DoS) via Slow or Incomplete Key Exchange CVE-2025-22869, GHSA-hcg3-q754-cr77, GO-2025-3487 | High | 0.9% | 26 Feb, 2025 | Go golang.org/x/crypto |
Better Auth allows bypassing the trustedOrigins Protection which leads to ATO CVE-2025-71403, GHSA-vp58-j275-797x | High | 0.3% | 24 Feb, 2025 | npm better-auth |
Moodle allows reflected XSS via question bank filter BIT-moodle-2025-26530, CVE-2025-26530, GHSA-4w32-c9g7-27qx | High | 0.4% | 24 Feb, 2025 | Packagist moodle/moodle |
Moodle has a stored XSS risk in admin live log BIT-moodle-2025-26529, CVE-2025-26529, GHSA-wr88-x8cm-7cgq | High | 0.5% | 24 Feb, 2025 | Packagist moodle/moodle |
Moodle has an arbitrary file read risk through pdfTeX BIT-moodle-2025-26525, CVE-2025-26525, GHSA-4hmr-39vp-xfrr | High | 0.4% | 24 Feb, 2025 | Packagist moodle/moodle |
Leantime allows Stored Cross-Site Scripting (XSS) GHSA-c39w-3pjx-qc7m | High | Not scored | 21 Feb, 2025 | Packagist leantime/leantime |
Leantime allows Cross Site Scripting (XSS) and SQL Injection (SQLi) GHSA-v4q9-437p-mhpg | High | Not scored | 21 Feb, 2025 | Packagist leantime/leantime |
Solid Lacks Escaping of HTML in JSX Fragments allows for Cross-Site Scripting (XSS) CVE-2025-27109, GHSA-3qxh-p7jc-5xh6 | High | 0.3% | 21 Feb, 2025 | npm solid-js |
DOM Expressions has a Cross-Site Scripting (XSS) vulnerability due to improper use of string.replace CVE-2025-27108, GHSA-hw62-58pr-7wc5 | High | 0.3% | 21 Feb, 2025 | npm dom-expressions |
Malciously crafted QPY files can allows Remote Attackers to Cause Denial of Service in Qiskit CVE-2025-1403, GHSA-fpmr-m242-xm7x, PYSEC-2026-1859, PYSEC-2026-3045 | High | 0.7% | 21 Feb, 2025 | PyPI qiskit PyPI qiskit-terra |
S3-Proxy allows Reflected Cross-site Scripting (XSS) in template implementation CVE-2025-27088, GHSA-pp9m-qf39-hxjc, GO-2025-3477 | High | 0.5% | 20 Feb, 2025 | Go github.com/oxyno-zeta/s3-proxy Go github.com/oxyno-zeta/s3-proxy/cmd/s3-proxy |
Cosmos SDK: Groups module can halt chain when handling a malicious proposal GHSA-x5vx-95h7-rv4p, GO-2025-3476 | High | Not scored | 20 Feb, 2025 | Go github.com/cosmos/cosmos-sdk |
Hermes improperly validates a JWT CVE-2025-1293, GHSA-vxm9-8mfw-vc6g, GO-2025-3475 | High | 0.3% | 20 Feb, 2025 | Go github.com/hashicorp-forge/hermes |
Drupal Core Improperly Controlled Modification of Dynamically-Determined Object Attributes Vulnerability BIT-drupal-2025-31674, CVE-2025-31674, DRUPAL-CORE-2025-003, GHSA-2qph-q8xw-gv7q | High | 0.6% | 19 Feb, 2025 | Packagist drupal/core |
Home Assistant does not correctly validate SSL for outgoing requests in core and used libs CVE-2025-25305, GHSA-m3pm-rpgg-5wj6, PYSEC-2026-1452 | High | 0.3% | 18 Feb, 2025 | PyPI homeassistant |
JSONPath Plus allows Remote Code Execution CVE-2025-1302, GHSA-hw8r-x6gr-5gjp | High | 10.4% | 15 Feb, 2025 | npm jsonpath-plus |
Label Studio allows Server-Side Request Forgery in the S3 Storage Endpoint CVE-2025-25297, GHSA-m238-fmcw-wh58, PYSEC-2026-1503 | High | 0.7% | 14 Feb, 2025 | PyPI label-studio |
Label Studio has a Path Traversal Vulnerability via image Field CVE-2025-25295, GHSA-rgv9-w7jp-m23g, PYSEC-2026-1506 | High | 0.8% | 14 Feb, 2025 | PyPI label-studio-sdk |
Palo Alto Networks PAN-OS File Read Vulnerability CVE-2025-0111 | HighExploited | 2.0% | 12 Feb, 2025 | |
Palo Alto Networks PAN-OS Authentication Bypass Vulnerability CVE-2025-0108 | HighExploited | 98.5% | 12 Feb, 2025 | |
go-crypto-winnative BCryptGenerateSymmetricKey memory leak CVE-2025-25199, GHSA-29c6-3hcj-89cf, GO-2025-3461 | High | 1.4% | 12 Feb, 2025 | Go github.com/microsoft/go-crypto-winnative |
parse-duration has a Regex Denial of Service that results in event loop delay and out of memory CVE-2025-25283, GHSA-hcrg-fc28-fcg5 | High | 0.8% | 12 Feb, 2025 | npm parse-duration |
Drupal Open Social Missing Authorization vulnerability CVE-2025-31686, DRUPAL-CONTRIB-2025-015, GHSA-m9w8-wxvp-c9gv | High | 0.4% | 12 Feb, 2025 | Packagist goalgorilla/open_social Packagist:https://packages.drupal.org/8 drupal/social |
Magento stored Cross-Site Scripting (XSS) vulnerability CVE-2025-24438, GHSA-8884-7rm9-mrx4 | High | 0.8% | 11 Feb, 2025 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento Stored Cross-Site Scripting (XSS) Vulnerability CVE-2025-24417, GHSA-g3j6-9753-8mp2 | High | 0.7% | 11 Feb, 2025 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento Stored Cross-Site Scripting (XSS) Vulnerability CVE-2025-24416, GHSA-rjjw-g6hw-7pc9 | High | 0.7% | 11 Feb, 2025 | Packagist magento/community-edition Packagist magento/project-community-edition |