Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
SSRF in sliver teamserver CVE-2025-27090, GHSA-fh4v-v779-4g2w, GO-2025-3472 | Medium | Not scored | 19 Feb, 2025 | Go github.com/bishopfox/sliver |
OpenFGA Authorization Bypass CVE-2025-25196, GHSA-g4v5-6f5p-m38j, GO-2025-3470 | Medium | Not scored | 19 Feb, 2025 | Go github.com/openfga/openfga |
Directus allows updates to non-allowed fields due to overlapping policies CVE-2025-27089, GHSA-99vm-5v2h-h6r6 | Medium | 0.2% | 19 Feb, 2025 | npm @directus/api npm directus |
Drupal Core Vulnerable to Forceful Browsing BIT-drupal-2025-31673, CVE-2025-31673, DRUPAL-CORE-2025-002, GHSA-wpp8-fjgf-pwc7 | Medium | 0.3% | 19 Feb, 2025 | Packagist drupal/core |
Drupal Core Potential Cross-Site Scripting (XSS) via Error Messages BIT-drupal-2025-3057, CVE-2025-3057, DRUPAL-CORE-2025-001, GHSA-39g6-x4x8-5jcm | Medium | 0.3% | 19 Feb, 2025 | Packagist drupal/core |
Exiv2 allows Use After Free CVE-2025-26623, GHSA-38h4-fx85-qcx7, PYSEC-2026-1353 | Medium | 0.9% | 18 Feb, 2025 | PyPI Exiv2 PyPI exiv2 |
Keylime registrar is vulnerable to Denial-of-Service attack when updated to version 7.12.0 CVE-2025-1057, GHSA-9jxq-5x44-gx23, PYSEC-2026-1488 | Medium | 0.4% | 14 Feb, 2025 | PyPI keylime |
@octokit/request has a Regular Expression in fetchWrapper that Leads to ReDoS Vulnerability Due to Catastrophic Backtracking CVE-2025-25290, GHSA-rmvr-2pp2-xj38 | Medium | 0.8% | 14 Feb, 2025 | npm @octokit/request |
@octokit/request-error has a Regular Expression in index that Leads to ReDoS Vulnerability Due to Catastrophic Backtracking CVE-2025-25289, GHSA-xx4v-prfh-6cgc | Medium | 0.6% | 14 Feb, 2025 | npm @octokit/request-error |
@octokit/plugin-paginate-rest has a Regular Expression in iterator Leads to ReDoS Vulnerability Due to Catastrophic Backtracking CVE-2025-25288, GHSA-h5c3-5r3r-rr8q | Medium | 0.6% | 14 Feb, 2025 | npm @octokit/plugin-paginate-rest |
@octokit/endpoint has a Regular Expression in parse that Leads to ReDoS Vulnerability Due to Catastrophic Backtracking CVE-2025-25285, GHSA-x4c5-c7rf-jjgv | Medium | 0.6% | 14 Feb, 2025 | npm @octokit/endpoint |
Vega allows Cross-site Scripting via the vlSelectionTuples function CVE-2025-25304, GHSA-mp7w-mhcv-673j | Medium | 0.7% | 14 Feb, 2025 | npm vega npm vega-selections |
`gh attestation verify` returns incorrect exit code during verification if no attestations are present CVE-2025-25204, GHSA-fgw4-v983-mgp8, GO-2025-3467 | Medium | Not scored | 14 Feb, 2025 | Go github.com/cli/cli Go github.com/cli/cli/v2 |
Label Studio allows Cross-Site Scripting (XSS) via GET request to `/projects/upload-example` endpoint CVE-2025-25296, GHSA-wpq5-3366-mqw4, PYSEC-2026-1504 | Medium | 1.9% | 14 Feb, 2025 | PyPI label-studio |
DOMPurify allows Cross-site Scripting (XSS) CVE-2025-26791, GHSA-vhxf-7vqr-mrjg | Medium | 0.6% | 14 Feb, 2025 | npm dompurify |
Node Denial of Service via kubelet Checkpoint API CVE-2025-0426, GHSA-jgfp-53c3-624w, GO-2025-3465 | Medium | Not scored | 13 Feb, 2025 | Go k8s.io/kubernetes |
Missing rate limit in MaysWind ezBookkeeping CVE-2024-57603, GHSA-772m-773g-qmhc, GO-2025-3466 | Medium | Not scored | 13 Feb, 2025 | Go github.com/mayswind/ezbookkeeping |
Remote code execution in alextselegidis/easyappointments CVE-2024-57601, GHSA-3wf7-83q3-948c | Medium | 0.5% | 12 Feb, 2025 | Packagist alextselegidis/easyappointments |
Potential Denial-of-Service condition leading to temporary disability in IBC transfers to the native chain GHSA-6fgm-x6ff-w78f, GO-2025-3463 | Medium | Not scored | 12 Feb, 2025 | Go github.com/cosmos/ibc-apps/middleware/packet-forward-middleware/v4 Go github.com/cosmos/ibc-apps/middleware/packet-forward-middleware/v5 Go github.com/cosmos/ibc-apps/middleware/packet-forward-middleware/v6 Go github.com/cosmos/ibc-apps/middleware/packet-forward-middleware/v7 +1 more |
Possible Log Injection in Rack::CommonLogger CVE-2025-25184, GHSA-7g2v-jj9q-g3rg | Medium | Not scored | 12 Feb, 2025 | RubyGems rack |
Drupal Configuration Split Cross-Site Request Forgery (CSRF) vulnerability CVE-2025-31688, DRUPAL-CONTRIB-2025-017, GHSA-qq45-cqhg-jwx5 | Medium | 0.2% | 12 Feb, 2025 | Packagist drupal/config_split Packagist:https://packages.drupal.org/8 drupal/config_split |
Drupal SpamSpan Cross-Site Scripting (XSS) vulnerability CVE-2025-31687, DRUPAL-CONTRIB-2025-016, GHSA-8r2q-865v-wm8j | Medium | 0.3% | 12 Feb, 2025 | Packagist drupal/spamspan Packagist:https://packages.drupal.org/8 drupal/spamspan |
Magento Improper Access Control vulnerability CVE-2025-24437, GHSA-469f-wf4f-3jjv | Medium | 0.4% | 11 Feb, 2025 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento Improper Access Control vulnerability CVE-2025-24436, GHSA-ghpr-6qhr-rpp8 | Medium | 0.5% | 11 Feb, 2025 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento Improper Access Control vulnerability CVE-2025-24435, GHSA-82p4-55gj-956p | Medium | 0.5% | 11 Feb, 2025 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento stored Cross-Site Scripting (XSS) vulnerability CVE-2025-24428, GHSA-mm87-rrqx-94cr | Medium | 0.4% | 11 Feb, 2025 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento Improper Access Control vulnerability CVE-2025-24427, GHSA-v3hq-g424-5mgg | Medium | 0.6% | 11 Feb, 2025 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento Business Logic Error vulnerability CVE-2025-24425, GHSA-6ff8-jrfg-43hh | Medium | 0.6% | 11 Feb, 2025 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento Improper Access Control vulnerability CVE-2025-24424, GHSA-539v-w87w-w62c | Medium | 0.8% | 11 Feb, 2025 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento Incorrect Authorization vulnerability CVE-2025-24421, GHSA-v6r2-425c-hfrr | Medium | 0.5% | 11 Feb, 2025 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento Information Exposure vulnerability CVE-2025-24408, GHSA-3cfg-w257-cgf8 | Medium | 1.0% | 11 Feb, 2025 | Packagist magento/community-edition Packagist magento/project-community-edition |
Vulnerable OpenSSL included in cryptography wheels CVE-2024-12797, GHSA-79v4-65xg-pq4g, PYSEC-2026-1284 | Medium | 2.5% | 11 Feb, 2025 | PyPI cryptography |
Apple iOS and iPadOS Incorrect Authorization Vulnerability CVE-2025-24200 | MediumExploited | 4.5% | 10 Feb, 2025 | |
esbuild enables any website to send any requests to the development server and read the response GHSA-67mh-4wv8-2f99 | Medium | Not scored | 10 Feb, 2025 | npm esbuild |
Possible DoS by memory exhaustion in net-imap CVE-2025-25186, GHSA-7fc5-f82f-cx69 | Medium | Not scored | 10 Feb, 2025 | RubyGems net-imap |
Cross-site Scripting (XSS) in serialize-javascript CVE-2024-11831, GHSA-76p7-773f-r4q5 | Medium | 1.1% | 10 Feb, 2025 | npm serialize-javascript |
Connect-CMS Access control vulnerability GHSA-5rjc-jc28-cwgg | Medium | Not scored | 07 Feb, 2025 | Packagist opensource-workshop/connect-cms |
xml2rfc has file inclusion irregularities GHSA-432c-wxpg-m4q3 | Medium | Not scored | 07 Feb, 2025 | PyPI xml2rfc |
Pimcore Admin Classic Bundle allows user enumeration CVE-2025-24980, GHSA-vr5f-php7-rg24 | Medium | 0.5% | 07 Feb, 2025 | Packagist pimcore/admin-ui-classic-bundle |
Better Auth URL parameter HTML Injection (Reflected Cross-Site scripting) CVE-2025-71404, GHSA-9x4v-xfq5-m8x5 | Medium | 0.7% | 05 Feb, 2025 | npm better-auth |
Plenti - Code Injection - Denial of Services CVE-2025-26260, GHSA-mj4v-hp69-27x5, GO-2025-3454, GO-2025-3515 | Medium | Not scored | 05 Feb, 2025 | Go github.com/plentico/plenti |
Drupal OAuth2 Client Cross-Site Request Forgery (CSRF) CVE-2025-31684, DRUPAL-CONTRIB-2025-013, GHSA-6chf-hhqf-749c | Medium | 0.2% | 05 Feb, 2025 | Packagist drupal/oauth2_client Packagist:https://packages.drupal.org/8 drupal/oauth2_client |
Browsershot Local File Inclusion CVE-2025-1026, GHSA-f2q5-6mx7-q9qq | Medium | 0.5% | 05 Feb, 2025 | Packagist spatie/browsershot |
wasmvm: Malicious smart contract can slow down block production GHSA-mx2j-7cmv-353c, GO-2025-3449 | Medium | Not scored | 04 Feb, 2025 | Go github.com/CosmWasm/wasmvm Go github.com/CosmWasm/wasmvm/v2 crates.io cosmwasm-vm |
wasmvm: Malicious smart contract can crash the chain GHSA-23qp-3c2m-xx6w, GO-2025-3448 | Medium | Not scored | 04 Feb, 2025 | Go github.com/CosmWasm/wasmvm Go github.com/CosmWasm/wasmvm/v2 |
ZX Allows Environment Variable Injection for dotenv API CVE-2025-24959, GHSA-qwp8-x4ff-5h87 | Medium | 0.2% | 03 Feb, 2025 | npm zx |
lunasvg v3.0.1 was discovered to contain a segmentation violation via the component gray_find_cell CVE-2024-55456, PYSEC-2025-127 | Medium | 0.4% | 03 Feb, 2025 | PyPI lunasvg |
CometBFT allows a malicious peer to make node stuck in blocksync CVE-2025-24371, GHSA-22qq-3xwm-r5x4, GO-2025-3442 | Medium | Not scored | 03 Feb, 2025 | Go github.com/cometbft/cometbft |
PhpSpreadsheet allows bypassing of XSS sanitizer using the javascript protocol and special characters CVE-2025-23210, GHSA-r57h-547h-w24f | Medium | 0.4% | 03 Feb, 2025 | Packagist phpoffice/phpexcel Packagist phpoffice/phpspreadsheet |
Grafana Alerting VictorOps integration could be exposed to users with Viewer permission BIT-grafana-2024-11741, CVE-2024-11741, GHSA-wxcc-2f3q-4h58, GO-2025-3438 | Medium | Not scored | 31 Jan, 2025 | Go github.com/grafana/grafana |