Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Argo CD does not scrub secret values from patch errors BIT-argo-cd-2025-23216, CVE-2025-23216, GHSA-47g2-qmh2-749v, GO-2025-3433 | Medium | Not scored | 30 Jan, 2025 | Go github.com/argoproj/argo-cd Go github.com/argoproj/argo-cd/v2 |
KubeWarden's AdmissionPolicy and AdmissionPolicyGroup policies can be used to alter PolicyReport resources CVE-2025-24376, GHSA-fc89-jghx-8pvg, GO-2025-3434 | Medium | Not scored | 30 Jan, 2025 | Go github.com/kubewarden/kubewarden-controller |
Kubewarden-Controller information leak via AdmissionPolicyGroup Resource CVE-2025-24784, GHSA-756x-m4mj-q96c, GO-2025-3435 | Medium | Not scored | 30 Jan, 2025 | Go github.com/kubewarden/kubewarden-controller |
Go Ethereum vulnerable to DoS via malicious p2p message CVE-2025-24883, GHSA-q26p-9cq4-7fc2, GO-2025-3436 | Medium | Not scored | 30 Jan, 2025 | Go github.com/ethereum/go-ethereum |
Argo CD GitOps Engine does not scrub secret values from patch errors GHSA-274v-mgcv-cm8j, GO-2025-3437 | Medium | Not scored | 30 Jan, 2025 | Go github.com/argoproj/gitops-engine |
DevDojo Voyager Arbitrary File Write CVE-2024-55417, GHSA-35p2-5vrh-m3p6 | Medium | 14.1% | 30 Jan, 2025 | Packagist tcg/voyager |
files.photo.gallery command injection CVE-2024-53615, GHSA-5wjw-qjhm-v43h | Medium | 1.3% | 30 Jan, 2025 | npm files.photo.gallery |
snowflake-connector-python vulnerable to insecure cache files permissions CVE-2025-24795, GHSA-r2x6-cjg7-8r43, PYSEC-2025-28 | Medium | 0.1% | 29 Jan, 2025 | PyPI snowflake-connector-python |
kube-audit-rest's example logging configuration could disclose secret values in the audit log CVE-2025-24884, GHSA-hcr5-wv4p-h2g2, GO-2025-3431 | Medium | Not scored | 29 Jan, 2025 | Go github.com/RichardoC/kube-audit-rest |
Drupal Google Tag Cross-Site Request Forgery (CSRF) CVE-2025-31683, DRUPAL-CONTRIB-2025-012, GHSA-qchr-8m24-7v66 | Medium | 0.2% | 29 Jan, 2025 | Packagist drupal/google_tag Packagist:https://packages.drupal.org/8 drupal/google_tag |
snowflake-sdk may incorrectly validate temporary credential cache file permissions CVE-2025-24791, GHSA-xfhv-wqj6-rx99 | Medium | 0.1% | 29 Jan, 2025 | npm snowflake-sdk |
Drupal Google Tag Cross-Site Scripting (XSS) vulnerability CVE-2025-31682, DRUPAL-CONTRIB-2025-011, GHSA-36vv-q5jv-94cj | Medium | 0.2% | 29 Jan, 2025 | Packagist drupal/google_tag Packagist:https://packages.drupal.org/8 drupal/google_tag |
The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: [https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai...](https://www.drupal CVE-2025-3062, DRUPAL-CONTRIB-2025-010 | Medium | 0.5% | 29 Jan, 2025 | Packagist:https://packages.drupal.org/8 drupal/druadmin_lte_theme |
Twig security issue where escaping was missing when using null coalesce operator CVE-2025-24374, GHSA-3xg3-cgvq-2xwr | Medium | 0.3% | 29 Jan, 2025 | Packagist twig/twig |
Drupal Matomo Analytics Cross-Site Request Forgery (CSRF) vulnerability CVE-2025-31680, DRUPAL-CONTRIB-2025-008, GHSA-jh66-rjx8-8qqc | Medium | 0.2% | 29 Jan, 2025 | Packagist drupal/matomo Packagist:https://packages.drupal.org/8 drupal/matomo |
TYPO3-EXT-SA-2025-001: Account Takeover in extension "OpenID Connect Authentication" (oidc) CVE-2025-24856, GHSA-hj78-p4h7-m5fv | Medium | 0.2% | 28 Jan, 2025 | Packagist causal/oidc |
pimcore/customer-data-framework vulnerable to SQL Injection CVE-2024-11956, GHSA-q53r-9hh9-w277 | Medium | 0.9% | 28 Jan, 2025 | Packagist pimcore/customer-management-framework-bundle |
CRI-O Path Traversal vulnerability CVE-2025-0750, GHSA-hp5j-2585-qx6g, GO-2025-3426 | Medium | Not scored | 28 Jan, 2025 | Go github.com/cri-o/cri-o |
Insecure Temporary File usage in github.com/golang/glog CVE-2024-45339, GHSA-6wxm-mpqj-6jpf, GO-2025-3372 | Medium | Not scored | 28 Jan, 2025 | Go github.com/golang/glog |
imgproxy is vulnerable to SSRF against 0.0.0.0 CVE-2025-24354, GHSA-j2hp-6m75-v4j4, GO-2025-3422 | Medium | Not scored | 27 Jan, 2025 | Go github.com/imgproxy/imgproxy Go github.com/imgproxy/imgproxy/v2 Go github.com/imgproxy/imgproxy/v3 |
Opening a malicious website while running a Nuxt dev server could allow read-only access to code CVE-2025-24361, GHSA-4gf7-ff8x-hq99 | Medium | 0.3% | 25 Jan, 2025 | npm @nuxt/rspack-builder npm @nuxt/webpack-builder |
Opening a malicious website while running a Nuxt dev server could allow read-only access to code CVE-2025-24360, GHSA-2452-6xj8-jh47 | Medium | 0.6% | 25 Jan, 2025 | npm @nuxt/vite-builder |
NodeBB Cross-site scripting (XSS) vulnerability CVE-2024-57041, GHSA-vqr3-vrrg-f3jh | Medium | 40.1% | 24 Jan, 2025 | npm nodebb |
Cross Site Scripting vulnerability in store2 CVE-2024-57556, GHSA-w5hq-hm5m-4548 | Medium | 0.4% | 23 Jan, 2025 | npm store2 |
Directus allows privilege escalation using Share feature CVE-2025-24353, GHSA-pmf4-v838-29hg | Medium | 0.4% | 23 Jan, 2025 | npm @directus/app npm directus |
phpMyAdmin XSS when checking tables BIT-phpmyadmin-2025-24530, CVE-2025-24530, GHSA-222v-cx2c-q2f5 | Medium | 0.4% | 23 Jan, 2025 | Packagist phpmyadmin/phpmyadmin |
lunasvg v3.0.0 was discovered to contain a segmentation violation via the component gray_record_cell. CVE-2024-57724, PYSEC-2025-133 | Medium | 0.4% | 23 Jan, 2025 | PyPI lunasvg |
lunasvg v3.0.0 was discovered to contain a segmentation violation via the component composition_source_over. CVE-2024-57723, PYSEC-2025-132 | Medium | 0.4% | 23 Jan, 2025 | PyPI lunasvg |
lunasvg v3.0.0 was discovered to contain a segmentation violation via the component plutovg_path_add_path. CVE-2024-57721, PYSEC-2025-130 | Medium | 0.4% | 23 Jan, 2025 | PyPI lunasvg |
lunasvg v3.0.0 was discovered to contain a segmentation violation via the component plutovg_blend. CVE-2024-57720, PYSEC-2025-129 | Medium | 0.4% | 23 Jan, 2025 | PyPI lunasvg |
lunasvg v3.0.0 was discovered to contain a segmentation violation via the component blend_transformed_tiled_argb.isra.0. CVE-2024-57719, PYSEC-2025-128 | Medium | 0.4% | 23 Jan, 2025 | PyPI lunasvg |
Cilium has an information leakage via insecure default Hubble UI CORS header BIT-cilium-2025-23047, BIT-cilium-operator-2025-23047, BIT-hubble-relay-2025-23047, CVE-2025-23047, GHSA-h78m-j95m-5356, GO-2025-3416 | Medium | Not scored | 22 Jan, 2025 | Go github.com/cilium/cilium |
DoS in Cilium agent DNS proxy from crafted DNS responses BIT-cilium-2025-23028, BIT-cilium-operator-2025-23028, BIT-hubble-relay-2025-23028, CVE-2025-23028, GHSA-9m5p-c77c-f9j7, GO-2025-3415 | Medium | Not scored | 22 Jan, 2025 | Go github.com/cilium/cilium |
Drupal Ignition Cross-Site Scripting (XSS) vulnerability CVE-2025-31679, DRUPAL-CONTRIB-2025-007, GHSA-rhxm-r44m-4325 | Medium | 0.3% | 22 Jan, 2025 | Packagist drupal/ignition Packagist:https://packages.drupal.org/8 drupal/ignition |
The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: [https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai...](https://www.drupal CVE-2025-3061, DRUPAL-CONTRIB-2025-006 | Medium | 0.5% | 22 Jan, 2025 | Packagist:https://packages.drupal.org/8 drupal/material_admin |
The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: [https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai...](https://www.drupal CVE-2025-3060, DRUPAL-CONTRIB-2025-005 | Medium | 0.5% | 22 Jan, 2025 | Packagist:https://packages.drupal.org/8 drupal/flattern |
ps_contactinfo has a potential XSS due to usage of the nofilter tag in template CVE-2025-24027, GHSA-35pq-7pv2-2rfw | Medium | 0.4% | 22 Jan, 2025 | Packagist prestashop/ps_contactinfo |
MathLive's Lack of Escaping of HTML allows for XSS CVE-2025-29049, GHSA-qwj6-q94f-8425 | Medium | 0.6% | 21 Jan, 2025 | npm mathlive |
Excessive Platform Resource Consumption within a Loop when unmarshalling Compose file having recursive loop CVE-2024-10846, GHSA-36gq-35j3-p9r9, GO-2025-3412 | Medium | Not scored | 21 Jan, 2025 | Go github.com/compose-spec/compose-go/v2 |
Use of Insufficiently Random Values in undici CVE-2025-22150, GHSA-c76h-2ccp-4975 | Medium | 0.8% | 21 Jan, 2025 | npm undici |
XSS/HTML Injection Vulnerability in Umbraco Backoffice Components CVE-2025-24012, GHSA-wv8v-rmw2-25wc | Medium | 0.3% | 21 Jan, 2025 | NuGet Umbraco.Cms.StaticAssets npm @umbraco-cms/backoffice |
Infinite loop and Blind SSRF found inside the Webfinger mechanism in @fedify/fedify CVE-2025-23221, GHSA-c59p-wq67-24wx | Medium | 0.6% | 20 Jan, 2025 | npm @fedify/fedify |
Missing validation of header name and value in codeigniter4/framework CVE-2025-24013, GHSA-x5mq-jjr3-vmx6 | Medium | 0.5% | 20 Jan, 2025 | Packagist codeigniter4/framework |
Websites were able to send any requests to the development server and read the response in vite CVE-2025-24010, GHSA-vg6x-rcgg-rjx6 | Medium | 0.3% | 20 Jan, 2025 | npm vite |
Cross-Site Scripting (XSS) vulnerability in generateNavigation() function in PhpSpreadsheet CVE-2025-22131, GHSA-79xx-vf93-p7cx | Medium | 0.4% | 20 Jan, 2025 | Packagist phpoffice/phpexcel Packagist phpoffice/phpspreadsheet |
Gomatrixserverlib Server-Side Request Forgery (SSRF) on redirects and federation CVE-2024-52594, GHSA-4ff6-858j-r822, GO-2025-3396 | Medium | Not scored | 16 Jan, 2025 | Go github.com/matrix-org/gomatrixserverlib |
Mattermost webapp crash via a crafted post CVE-2025-20621, GHSA-w6xh-c82w-h997, GO-2025-3407 | Medium | Not scored | 16 Jan, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Matrix Media Repo (MMR) allows untrusted file formats can be thumbnailed, invoking potentially further untrusted decoders CVE-2024-56515, GHSA-rcxc-wjgw-579r, GO-2025-3400 | Medium | Not scored | 16 Jan, 2025 | Go github.com/t2bot/matrix-media-repo |
Matrix Media Repo (MMR) allows Server-Side Request Forgery (SSRF) on redirects and federation CVE-2024-52602, GHSA-r6jg-jfv6-2fjv, GO-2025-3399 | Medium | Not scored | 16 Jan, 2025 | Go github.com/t2bot/matrix-media-repo |
matrix-media-repo (MMR) allows a denial of service through memory exhaustion CVE-2024-52791, GHSA-gp86-q8hg-fpxj, GO-2025-3398 | Medium | Not scored | 16 Jan, 2025 | Go github.com/t2bot/matrix-media-repo |