Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Magento Stored Cross-Site Scripting (XSS) Vulnerability CVE-2025-24415, GHSA-gc27-rvvm-q77r | High | 0.7% | 11 Feb, 2025 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento Stored Cross-Site Scripting (XSS) Vulnerability CVE-2025-24414, GHSA-fhw6-3mj5-w9gv | High | 0.7% | 11 Feb, 2025 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento Stored Cross-Site Scripting (XSS) Vulnerability CVE-2025-24413, GHSA-xwgx-8v72-4j5j | High | 0.7% | 11 Feb, 2025 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento Stored Cross-Site Scripting (XSS) Vulnerability CVE-2025-24412, GHSA-m4rg-mpp2-97px | High | 0.7% | 11 Feb, 2025 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento Improper Access Control vulnerability CVE-2025-24411, GHSA-36hw-x3cc-m258 | High | 0.9% | 11 Feb, 2025 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento Stored Cross-Site Scripting (XSS) Vulnerability CVE-2025-24410, GHSA-gjxp-46rq-wg4q | High | 0.7% | 11 Feb, 2025 | Packagist magento/community-edition Packagist magento/project-community-edition |
Adobe Commerce Improper Authorization vulnerability CVE-2025-24409, GHSA-vw47-79jv-3598 | High | 0.7% | 11 Feb, 2025 | Packagist magento/community-edition Packagist magento/project-community-edition |
Adobe Commerce Path Traversal CVE-2025-24406, GHSA-954p-ff72-327w | High | 1.4% | 11 Feb, 2025 | Packagist magento/community-edition Packagist magento/project-community-edition |
Microsoft Windows Ancillary Function Driver for WinSock Heap-Based Buffer Overflow Vulnerability CVE-2025-21418 | HighExploited | 2.1% | 11 Feb, 2025 | |
Microsoft Windows Storage Link Following Vulnerability CVE-2025-21391 | HighExploited | 2.3% | 11 Feb, 2025 | |
Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability CVE-2025-24472 | HighExploited | 7.2% | 11 Feb, 2025 | |
Authentication bypass in @sap/approuter CVE-2025-24876, GHSA-cpfx-964w-4jvp | High | 0.5% | 11 Feb, 2025 | npm @sap/approuter |
CouchAuth has a Server-Side Template Injection vulnerability in its email functionality CVE-2024-57177, GHSA-r385-c5fc-x56c | High | 0.3% | 10 Feb, 2025 | npm @perfood/couch-auth |
A Local File Inclusion (LFI) vulnerability exists in the /load-workflow endpoint of modelscope/agentscope version v0.0.4. This vulnerability allows an attacker to read arbitrary files from the server, including sensitive files such as API keys, by manipulating the filename parameter. The issue arise CVE-2024-8550, PYSEC-2025-84 | High | 0.5% | 10 Feb, 2025 | PyPI agentscope |
Unknown vulnerability in Coinbase Wallet SDK GHSA-8rgj-285w-qcq4 | High | Not scored | 10 Feb, 2025 | npm @coinbase/wallet-sdk |
Connect-CMS information that is restricted to viewing is visible GHSA-2237-5r9w-vm8j | High | Not scored | 07 Feb, 2025 | Packagist opensource-workshop/connect-cms |
SFTPGo has insufficient sanitization of user provided rsync command CVE-2025-24366, GHSA-vj7w-3m8c-6vpx, GO-2025-3458 | High | 0.7% | 07 Feb, 2025 | Go github.com/drakkan/sftpgo Go github.com/drakkan/sftpgo/v2 |
WhoDB allows parameter injection in DB connection URIs leading to local file inclusion CVE-2025-24787, GHSA-c7w4-9wv8-7x7c, GO-2025-3457 | High | 0.6% | 06 Feb, 2025 | Go github.com/clidey/whodb/core |
Withdrawn Advisory: Sylius allows unrestricted brute-force attacks on user accounts CVE-2024-57610, GHSA-2hjh-495w-hmxc | High | 1.2% | 06 Feb, 2025 | Packagist sylius/sylius |
Mitmweb API Authentication Bypass Using Proxy Server CVE-2025-23217, GHSA-wg33-5h85-7q5p, PYSEC-2026-1630 | High | 0.9% | 06 Feb, 2025 | PyPI mitmproxy |
Trimble Cityworks Deserialization Vulnerability CVE-2025-0994 | HighExploited | 31.3% | 06 Feb, 2025 | |
node-opcua-alarm-condition prototype pollution vulnerability CVE-2024-57086, GHSA-gvwq-6fmx-28xm | High | 0.4% | 05 Feb, 2025 | npm node-opcua-alarm-condition |
@stryker-mutator/util vulnerable to Prototype Pollution CVE-2024-57085, GHSA-9j5q-479x-43g2 | High | 0.4% | 05 Feb, 2025 | npm @stryker-mutator/util |
@rpldy/uploader prototype pollution CVE-2024-57082, GHSA-pc47-g7gv-4gpw | High | 0.3% | 05 Feb, 2025 | npm @rpldy/uploader |
vxe-table prototype pollution CVE-2024-57080, GHSA-89fp-f5mx-748x | High | 0.4% | 05 Feb, 2025 | npm vxe-table |
@zag-js/core prototype pollution CVE-2024-57079, GHSA-fg4m-w35q-vfg2 | High | 0.4% | 05 Feb, 2025 | npm @zag-js/core |
eazy-logger prototype pollution CVE-2024-57075, GHSA-r7jx-5m6m-cpg9 | High | 0.6% | 05 Feb, 2025 | npm eazy-logger |
module-from-string prototype pollution CVE-2024-57072, GHSA-q5j8-9m9g-x2jh | High | 0.6% | 05 Feb, 2025 | npm module-from-string |
@tanstack/form-core prototype pollution CVE-2024-57068, GHSA-ggv3-vmgw-xv2q | High | 0.4% | 05 Feb, 2025 | npm @tanstack/form-core |
@ndhoule/defaults prototype pollution CVE-2024-57066, GHSA-79h2-v6hh-wq23 | High | 0.5% | 05 Feb, 2025 | npm @ndhoule/defaults |
Contrast's unauthenticated recovery allows Coordinator impersonation CVE-2025-71426, GHSA-vqv5-385r-2hf8, GO-2025-3455 | High | 0.1% | 05 Feb, 2025 | Go github.com/edgelesssys/contrast |
MobSF Local Privilege Escalation CVE-2025-24805, GHSA-79f6-p65j-3m2m, PYSEC-2026-1667 | High | 0.4% | 05 Feb, 2025 | PyPI mobsf |
MobSF Partial Denial of Service (DoS) CVE-2025-24804, GHSA-jrm8-xgf3-fwqr, PYSEC-2026-1674 | High | 0.5% | 05 Feb, 2025 | PyPI mobsf |
MobSF Stored Cross-Site Scripting (XSS) CVE-2025-24803, GHSA-cxqq-w3x5-7ph3, PYSEC-2026-1673 | High | 0.4% | 05 Feb, 2025 | PyPI mobsf |
CKAN has an XSS vector in user uploaded images in group/org and user profiles CVE-2025-24372, GHSA-7pq5-qcp6-mcww, PYSEC-2026-1250 | High | 0.5% | 05 Feb, 2025 | PyPI ckan |
Cockpit Arbitrary File Upload CVE-2025-1025, GHSA-wp68-xrfg-xvq4 | High | 18.9% | 05 Feb, 2025 | Packagist cockpit-hq/cockpit |
Browsershot Path Traversal CVE-2025-1022, GHSA-j2gw-r24m-j2qw | High | 0.5% | 05 Feb, 2025 | Packagist spatie/browsershot |
MarbleRun unauthenticated recovery allows Coordinator impersonation GHSA-w7wm-2425-7p2h, GO-2025-3450 | High | Not scored | 04 Feb, 2025 | Go github.com/edgelesssys/marblerun |
Vitest browser mode serves arbitrary files CVE-2025-24963, GHSA-8gvc-j273-4wm5 | High | 2.4% | 04 Feb, 2025 | npm @vitest/browser |
Zyxel DSL CPE OS Command Injection Vulnerability CVE-2024-40891 | HighExploited | 22.9% | 04 Feb, 2025 | |
Zyxel DSL CPE OS Command Injection Vulnerability CVE-2024-40890 | HighExploited | 20.7% | 04 Feb, 2025 | |
Digiever DS-2105 Pro Missing Authorization Vulnerability CVE-2023-52163 | HighExploited | 96.9% | 03 Feb, 2025 | |
Advantive VeraCore SQL Injection Vulnerability CVE-2025-25181 | HighExploited | 55.5% | 03 Feb, 2025 | |
Advantive VeraCore Unrestricted File Upload Vulnerability CVE-2024-57968 | HighExploited | 32.3% | 03 Feb, 2025 | |
CometBFT allows a malicious peer to stall the network by disseminating seemingly valid block parts GHSA-r3r4-g7hq-pq4f, GO-2025-3443 | High | Not scored | 03 Feb, 2025 | Go github.com/cometbft/cometbft |
DevDojo Voyager vulnerable to path traversal CVE-2024-55415, GHSA-j63m-2vr6-fv7m | High | 15.7% | 30 Jan, 2025 | Packagist tcg/voyager |
snowflake-connector-python vulnerable to SQL Injection in write_pandas CVE-2025-24793, GHSA-2vpq-fh52-j3wv, PYSEC-2025-26 | High | 0.3% | 29 Jan, 2025 | PyPI snowflake-connector-python |
snowflake-connector-python vulnerable to insecure deserialization of the OCSP response cache CVE-2025-24794, GHSA-m4f6-vcj4-w5mx, PYSEC-2025-27 | High | 0.3% | 29 Jan, 2025 | PyPI snowflake-connector-python |
OpenShift GitOps Operator Namespace Isolation Break CVE-2024-13484, GHSA-58fx-7v9q-3g56, GO-2025-3427 | High | 0.2% | 28 Jan, 2025 | Go github.com/redhat-developer/gitops-operator |
Pimcore Authenticated Stored Cross-Site Scripting (XSS) Via Search Document CVE-2024-11954, GHSA-xr3m-6gq6-22cg | High | 1.1% | 28 Jan, 2025 | Packagist pimcore/pimcore |