Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
ray vulnerable to Insertion of Sensitive Information into Log File CVE-2025-1979, GHSA-w4rh-fgx7-q63m, PYSEC-2025-23 | Medium | 0.2% | 06 Mar, 2025 | PyPI ray |
Jinja2 vulnerable to sandbox breakout through attr filter selecting format method CVE-2025-27516, GHSA-cpwx-vrp4-4pq7, PYSEC-2026-1471 | Medium | 0.5% | 05 Mar, 2025 | PyPI Jinja2 PyPI jinja2 |
Laravel has a File Validation Bypass BIT-laravel-2025-27515, CVE-2025-27515, GHSA-78fx-h6xr-vch4 | Medium | 0.7% | 05 Mar, 2025 | Packagist laravel/framework |
Drupal AI Vulnerable to OS Command Injection CVE-2025-31693, DRUPAL-CONTRIB-2025-022, GHSA-vx9m-rfxq-gr74 | Medium | 0.8% | 05 Mar, 2025 | Packagist drupal/ai Packagist:https://packages.drupal.org/8 drupal/ai |
REDAXO allows Authenticated Reflected Cross Site Scripting - packages installation CVE-2025-27412, GHSA-8366-xmgf-334f | Medium | 0.3% | 05 Mar, 2025 | Packagist redaxo/source |
REDAXO allows Arbitrary File Upload in the mediapool page CVE-2025-27411, GHSA-wppf-gqj5-fc4f | Medium | 0.3% | 05 Mar, 2025 | Packagist redaxo/source |
In-memory stored Cross-site scripting (XSS) vulnerability in pineconesim CVE-2025-27155, GHSA-fr62-mg2q-7wqv, GO-2025-3500 | Medium | Not scored | 04 Mar, 2025 | Go github.com/matrix-org/pinecone |
Escape Sequence Injection vulnerability in Rack lead to Possible Log Injection CVE-2025-27111, GHSA-8cgq-6mh2-7j6v | Medium | Not scored | 04 Mar, 2025 | RubyGems rack |
VMware ESXi, Workstation, and Fusion Information Disclosure Vulnerability CVE-2025-22226 | MediumExploited | 1.6% | 04 Mar, 2025 | |
CGI has Regular Expression Denial of Service (ReDoS) potential in Util#escapeElement CVE-2025-27220, GHSA-mhwm-jh88-3gjf | Medium | Not scored | 03 Mar, 2025 | RubyGems cgi |
CGI has Denial of Service (DoS) potential in Cookie.parse CVE-2025-27219, GHSA-gh9q-2xrm-x6qv | Medium | Not scored | 03 Mar, 2025 | RubyGems cgi |
MinIO allows an SFTP authentication bypass due to improperly trusted SSH key CVE-2025-27414, GHSA-wc79-7x8x-2p58, GO-2025-3495 | Medium | Not scored | 03 Mar, 2025 | Go github.com/minio/minio |
tsup DOM Clobbering vulnerability CVE-2024-53384, GHSA-3mv9-4h5g-vhg3 | Medium | 0.2% | 03 Mar, 2025 | npm tsup |
seajs Cross-site Scripting vulnerability CVE-2024-51091, GHSA-pfr4-4397-3hg8 | Medium | 0.4% | 03 Mar, 2025 | npm seajs |
Rembg allows SSRF via /api/remove CVE-2025-25301, GHSA-r5gx-c49x-h878, PYSEC-2025-24 | Medium | 0.5% | 03 Mar, 2025 | PyPI rembg |
Flask-AppBuilder Observable Response Discrepancy CVE-2025-24023, GHSA-p8q5-cvwx-wvwp, PYSEC-2025-15 | Medium | 0.3% | 03 Mar, 2025 | PyPI flask-appbuilder |
Apache StreamPipes has improper privilege management in a REST interface CVE-2024-24778, GHSA-vm7w-2724-5m23, PYSEC-2025-66 | Medium | 0.7% | 03 Mar, 2025 | Maven org.apache.streampipes:streampipes-parent PyPI streampipes |
Stage.js DOM Clobbering vulnerabilty CVE-2024-53386, GHSA-fp3m-g5rc-4c28 | Medium | 0.3% | 03 Mar, 2025 | npm stage-js |
PrismJS DOM Clobbering vulnerability CVE-2024-53382, GHSA-x7hr-w5r2-h6wg | Medium | 0.3% | 03 Mar, 2025 | npm prismjs |
Formwork has a cross-site scripting (XSS) vulnerability in Site title GHSA-vf6x-59hh-332f | Medium | Not scored | 01 Mar, 2025 | Packagist getformwork/formwork |
Manifest Uses a One-Way Hash without a Salt CVE-2025-27408, GHSA-h8h6-7752-g28c | Medium | 0.2% | 28 Feb, 2025 | npm manifest |
CodeChecker open redirect when URL contains multiple slashes after the product name CVE-2025-1300, GHSA-g839-x3p3-g5fm, PYSEC-2026-1259 | Medium | 0.3% | 28 Feb, 2025 | PyPI codechecker |
Memos Server-Side Request Forgery (SSRF) CVE-2025-22952, GHSA-wfxg-v3j4-7qmj, GO-2025-3492 | Medium | Not scored | 27 Feb, 2025 | Go github.com/usememos/memos |
Rancher's SAML-based login via CLI can be denied by unauthenticated users CVE-2025-23387, GHSA-5qmp-9x47-92q8, GO-2025-3489 | Medium | Not scored | 27 Feb, 2025 | Go github.com/rancher/rancher |
MongoDB Shell may be susceptible to control character Injection via shell output CVE-2025-1693, GHSA-r95j-4jvf-mrrw | Medium | 0.2% | 27 Feb, 2025 | npm mongosh |
Picklescan Allows Remote Code Execution via Malicious Pickle File Bypassing Static Analysis CVE-2025-1716, CVE-2025-1889, GHSA-655q-fx9r-782v, GHSA-769v-p64c-89pr, PYSEC-2025-18, PYSEC-2025-19 | Medium | 1.7% | 26 Feb, 2025 | PyPI picklescan |
Mautic allows Relative Path Traversal in assets file upload CVE-2022-25773, GHSA-4w2w-36vm-c8hf | Medium | 0.6% | 26 Feb, 2025 | Packagist mautic/core |
Matrix IRC Bridge allows IRC command injection to own puppeted user CVE-2025-27146, GHSA-5mvm-89c9-9gm5 | Medium | 0.4% | 25 Feb, 2025 | npm matrix-appservice-irc |
Navidrome allows an authentication bypass in Subsonic API with non-existent username CVE-2025-27112, GHSA-c3p4-vm8f-386p, GO-2025-3484 | Medium | Not scored | 25 Feb, 2025 | Go github.com/navidrome/navidrome |
copyparty renders unsanitized filenames as HTML when user uploads empty files CVE-2025-27145, GHSA-m2jw-cj8v-937r, PYSEC-2026-1278 | Medium | 0.5% | 25 Feb, 2025 | PyPI copyparty |
DoS in go-jose Parsing CVE-2025-27144, GHSA-c6gw-w398-hv78, GO-2025-3485 | Medium | Not scored | 24 Feb, 2025 | Go github.com/go-jose/go-jose Go github.com/go-jose/go-jose/v3 Go github.com/go-jose/go-jose/v4 Go github.com/square/go-jose |
Moodle allows teachers to evade trusttext config when restoring glossary entries BIT-moodle-2025-26532, CVE-2025-26532, GHSA-cw24-f6fq-7j9v | Medium | 0.3% | 24 Feb, 2025 | Packagist moodle/moodle |
Moodle has an IDOR in badges allows disabling of arbitrary badges BIT-moodle-2025-26531, CVE-2025-26531, GHSA-g88w-v4cq-qgcp | Medium | 0.3% | 24 Feb, 2025 | Packagist moodle/moodle |
Moodle has a stored XSS in ddimageortext question type BIT-moodle-2025-26528, CVE-2025-26528, GHSA-h697-w4ph-7pcx | Medium | 0.3% | 24 Feb, 2025 | Packagist moodle/moodle |
Moodle's non-searchable tags can still be discovered on the tag search page and in the tags block BIT-moodle-2025-26527, CVE-2025-26527, GHSA-5r85-6h7f-rg3r | Medium | 0.4% | 24 Feb, 2025 | Packagist moodle/moodle |
Moodle's feedback response viewing and deletions did not respect Separate Groups mode BIT-moodle-2025-26526, CVE-2025-26526, GHSA-pxg4-xjp7-w9c5 | Medium | 0.3% | 24 Feb, 2025 | Packagist moodle/moodle |
Phusion Passenger denial of service BIT-passenger-2025-26803, BIT-passenger-apache-module-2025-26803, BIT-passenger-nginx-module-2025-26803, CVE-2025-26803, GHSA-2cj2-qqxj-5m3r | Medium | Not scored | 24 Feb, 2025 | RubyGems passenger |
Beter Auth has an Open Redirect via Scheme-Less Callback Parameter CVE-2025-27143, GHSA-hjpm-7mrm-26w8 | Medium | 0.4% | 24 Feb, 2025 | npm better-auth |
Mattermost fails to restrict channel export of archived channels CVE-2025-24526, GHSA-q8p2-2hwc-jw64, GO-2025-3481 | Medium | Not scored | 24 Feb, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Leantime affected by Improper Neutralization of HTML Tags CVE-2025-28254, GHSA-95j3-435g-vjcp | Medium | 0.3% | 21 Feb, 2025 | Packagist leantime/leantime |
Leantime allows Cross-Site Request Forgery (CSRF) GHSA-92xh-6x7v-4rmq | Medium | Not scored | 21 Feb, 2025 | Packagist leantime/leantime |
Leantime allows Stored Cross-Site Scripting (XSS) GHSA-63cr-xg3f-8jvr | Medium | Not scored | 21 Feb, 2025 | Packagist leantime/leantime |
Leantime allows Refelected Cross-Site Scripting (XSS) GHSA-52xf-h226-pfgx | Medium | Not scored | 21 Feb, 2025 | Packagist leantime/leantime |
Leantime has Insufficiently Protected Credentials GHSA-h6w8-27ph-c385 | Medium | Not scored | 21 Feb, 2025 | Packagist leantime/leantime |
Leantime allows Stored Cross-Site Scripting (XSS) GHSA-mg4c-884j-pcq9 | Medium | Not scored | 21 Feb, 2025 | Packagist leantime/leantime |
Leantime has Host Header Injection Vulnerability GHSA-99r5-84gr-59f6 | Medium | Not scored | 21 Feb, 2025 | Packagist leantime/leantime |
lakeFS allows an authenticated user to cause a crash by exhausting server memory CVE-2025-27100, GHSA-j7jw-28jm-whr6, GO-2025-3479 | Medium | Not scored | 21 Feb, 2025 | Go github.com/treeverse/lakefs |
Cross-site scripting (XSS) in the CKEditor 5 real-time collaboration package CVE-2025-25299, GHSA-j3mm-wmfm-mwvh | Medium | 0.6% | 20 Feb, 2025 | npm @ckeditor/ckeditor5-real-time-collaboration npm ckeditor5-premium-features |
SSRF in sliver teamserver CVE-2025-27090, GHSA-fh4v-v779-4g2w, GO-2025-3472 | Medium | Not scored | 19 Feb, 2025 | Go github.com/bishopfox/sliver |
OpenFGA Authorization Bypass CVE-2025-25196, GHSA-g4v5-6f5p-m38j, GO-2025-3470 | Medium | Not scored | 19 Feb, 2025 | Go github.com/openfga/openfga |