Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
luigi Arbitrary File Write via Archive Extraction (Zip Slip) CVE-2024-21542, GHSA-8qch-vj6m-2694, PYSEC-2024-159 | High | 1.1% | 10 Dec, 2024 | PyPI luigi |
league/commonmark's quadratic complexity bugs may lead to a denial of service CVE-2024-58382, GHSA-c2pc-g5qf-rfrf | High | 0.5% | 09 Dec, 2024 | Packagist league/commonmark |
Winter CMS Modules allows a sandbox bypass in Twig templates leading to data modification and deletion CVE-2024-54149, GHSA-xhw3-4j3m-hq53 | High | 0.4% | 09 Dec, 2024 | Packagist winter/wn-cms-module |
Directus allows unauthenticated access to WebSocket events and operations CVE-2024-54151, GHSA-849r-qrwj-8rv4 | High | 0.7% | 09 Dec, 2024 | npm @directus/api npm directus |
Apache Superset: Lower privilege users are able to create Role when FAB_ADD_SECURITY_API is enabled BIT-superset-2024-53949, CVE-2024-53949, GHSA-35fc-9hrj-3585, PYSEC-2026-1156 | High | 0.7% | 09 Dec, 2024 | PyPI apache-superset |
phpMyFAQ Generates an Error Message Containing Sensitive Information if database server is not available CVE-2024-54141, GHSA-vrjr-p3xp-xx2x | High | 0.5% | 06 Dec, 2024 | Packagist thorsten/phpmyfaq |
Django denial-of-service in django.utils.html.strip_tags() BIT-django-2024-53907, CVE-2024-53907, GHSA-8498-2h75-472j, PYSEC-2024-156 | High | 1.4% | 06 Dec, 2024 | PyPI Django PyPI django |
path-to-regexp contains a ReDoS CVE-2024-52798, GHSA-rhx6-c78j-4q9w | High | 0.8% | 05 Dec, 2024 | npm path-to-regexp |
pyspider Cross-Site Request Forgery (CSRF) via the Flask endpoints CVE-2024-39163, GHSA-pqj8-xhcx-prxm, PYSEC-2026-1842 | High | 0.2% | 04 Dec, 2024 | PyPI pyspider |
Modified package published to npm, containing malware that exfiltrates private key material CVE-2024-54134, GHSA-jcxm-7wvp-g6p5 | High | 0.5% | 04 Dec, 2024 | npm @solana/web3.js |
Double-Free Vulnerability in uD3TN BPv7 Caused by Malformed Endpoint Identifier allows remote attacker to reliably cause DoS CVE-2024-12107, PYSEC-2024-300 | High | 0.5% | 04 Dec, 2024 | PyPI pyd3tn |
Kolide Agent Privilege Escalation (Windows, Versions >= 1.5.3, < 1.12.3) CVE-2024-54131, GHSA-66q9-2rvx-qfj5, GO-2024-3308 | High | 0.2% | 03 Dec, 2024 | Go github.com/kolide/launcher |
Synapse can be forced to thumbnail unexpected file formats, invoking external, potentially untrustworthy decoders CVE-2024-53863, GHSA-vp6v-whfm-rv3g, PYSEC-2026-1615 | High | 0.6% | 03 Dec, 2024 | PyPI matrix-synapse |
Synapse allows a a malformed invite to break the invitee's `/sync` CVE-2024-52815, GHSA-f3r3-h2mq-hx2h, PYSEC-2026-1611 | High | 0.6% | 03 Dec, 2024 | PyPI matrix-synapse |
Synapse allows unsupported content types to lead to memory exhaustion CVE-2024-52805, GHSA-rfq8-j7rh-8hf2, PYSEC-2026-1613 | High | 0.7% | 03 Dec, 2024 | PyPI matrix-synapse |
Synapse denial of service through media disk space consumption CVE-2024-37302, GHSA-4mhg-xv73-xq2x, PYSEC-2024-286 | High | 0.6% | 03 Dec, 2024 | PyPI matrix-synapse |
MobSF vulnerability allows SSRF due to the allow_redirects=True parameter CVE-2024-54000, GHSA-m435-9v6r-v5f6, PYSEC-2024-256 | High | 0.4% | 03 Dec, 2024 | PyPI mobsf |
SimpleSAMLphp SAML2 has an XXE in parsing SAML messages CVE-2024-52806, GHSA-pxm4-r5ph-q2m2 | High | 0.4% | 02 Dec, 2024 | Packagist simplesamlphp/saml2 Packagist simplesamlphp/saml2-legacy |
SimpleSAMLphp xml-common XXE vulnerability CVE-2024-52596, GHSA-2x65-fpch-2fcm | High | 1.0% | 02 Dec, 2024 | Packagist simplesamlphp/xml-common |
Denial of service (DoS) via deformation `multipart/form-data` boundary CVE-2024-53981, GHSA-59g5-xgcq-4qw3, PYSEC-2026-1851 | High | 0.6% | 02 Dec, 2024 | PyPI python-multipart |
Linux Kernel Out-of-Bounds Write Vulnerability CVE-2024-53104 | HighExploited | 3.4% | 02 Dec, 2024 | |
Python package "zhmcclient" stores passwords in clear text in its HMC and API logs CVE-2024-53865, GHSA-p57h-3cmc-xpjq, PYSEC-2026-2073 | High | 0.1% | 29 Nov, 2024 | PyPI zhmcclient |
PyJWT Issuer field partial matches allowed CVE-2024-53861, GHSA-75c5-xw7c-p5pm, PYSEC-2026-1814 | High | 0.8% | 29 Nov, 2024 | PyPI PyJWT PyPI pyjwt |
check-jsonschema default caching for remote schemas allows for cache confusion CVE-2024-53848, GHSA-q6mv-284r-mp36, PYSEC-2026-1245 | High | 0.1% | 29 Nov, 2024 | PyPI check-jsonschema |
Withdrawn Advisory: Symfony http-security has authentication bypass CVE-2024-36611, GHSA-7q22-x757-cmgc | High | 0.8% | 29 Nov, 2024 | Packagist symfony/security-http |
Moby Race Condition vulnerability CVE-2024-36621, GHSA-2mj3-vfvx-fc43, GO-2024-3304 | High | 0.6% | 29 Nov, 2024 | Go github.com/moby/moby |
Moby Race Condition vulnerability CVE-2024-36623, GHSA-gh5c-3h97-2f3q, GO-2024-3305 | High | 0.6% | 29 Nov, 2024 | Go github.com/moby/moby |
SPEmailHandler-PHP has Potential Abuse for Sending Arbitrary Emails CVE-2024-53860, GHSA-mj5r-x73q-fjw6 | High | 0.5% | 27 Nov, 2024 | Packagist spencer14420/sp-php-email-handler |
@lobehub/chat Server Side Request Forgery vulnerability CVE-2024-32965, GHSA-2xcc-vm3f-m8rw | High | 26.1% | 26 Nov, 2024 | npm @lobehub/chat |
@dapperduckling/keycloak-connector-server has Reflected XSS Vulnerability in Authentication Flow URL Handling CVE-2024-53843, GHSA-w5rq-g9r6-vrcg | High | 0.5% | 26 Nov, 2024 | npm @dapperduckling/keycloak-connector-server |
aiocpa contains credential harvesting code GHSA-486g-47cc-8wxf | High | Not scored | 25 Nov, 2024 | PyPI aiocpa |
Taurus multi-party-sig has OT-based ECDSA protocol implementation flaws GHSA-7f6p-phw2-8253, GO-2024-3288 | High | Not scored | 25 Nov, 2024 | Go github.com/taurusgroup/multi-party-sig |
MLflow's excessive directory permissions allow local privilege escalation BIT-mlflow-2024-27134, CVE-2024-27134, GHSA-qpgc-w4mg-6v92, PYSEC-2024-224 | High | 0.1% | 25 Nov, 2024 | PyPI mlflow |
OpenStack Neutron can use an incorrect ID during policy enforcement CVE-2024-53916, GHSA-f27h-g923-68hw, PYSEC-2026-1693 | High | 0.7% | 25 Nov, 2024 | PyPI neutron |
virtualenv allows command injection through activation scripts for a virtual environment BIT-virtualenv-2024-53899, CVE-2024-53899, GHSA-rqc4-2hc7-8c8v, PYSEC-2024-187 | High | 1.6% | 24 Nov, 2024 | PyPI virtualenv |
Deserialization of Untrusted Data in Hugging Face Transformers CVE-2024-11393, GHSA-wrfc-pvp9-mr9g, PYSEC-2024-228 | High | 3.3% | 22 Nov, 2024 | PyPI transformers |
Deserialization of Untrusted Data in Hugging Face Transformers CVE-2024-11394, GHSA-hxxf-235m-72v3, PYSEC-2024-229 | High | 2.7% | 22 Nov, 2024 | PyPI transformers |
Deserialization of Untrusted Data in Hugging Face Transformers CVE-2024-11392, GHSA-qxrp-vhvm-j765, PYSEC-2024-227 | High | 7.7% | 22 Nov, 2024 | PyPI transformers |
Kubernetes kubelet arbitrary command execution CVE-2024-10220, GHSA-27wf-5967-98gx, GO-2024-3286 | High | 3.0% | 22 Nov, 2024 | Go k8s.io/kubernetes |
Tornado has an HTTP cookie parsing DoS vulnerability CVE-2024-52804, GHSA-8w49-h785-mj3c, PYSEC-2026-1975 | High | 1.0% | 22 Nov, 2024 | PyPI tornado |
Litestar allows unbounded resource consumption (DoS vulnerability) CVE-2024-52581, GHSA-gjcc-jvgw-wvwj, PYSEC-2024-178, PYSEC-2026-1944 | High | 0.8% | 20 Nov, 2024 | PyPI litestar PyPI starlite |
ASA-2024-010: cosmossdk.io/math: Mismatched bit-length validation in sdk.Int and sdk.Dec can lead to panic GHSA-7225-m954-23v7, GO-2024-3279 | High | Not scored | 20 Nov, 2024 | Go cosmossdk.io/math |
github.com/rancher/steve's users can issue watch commands for arbitrary resources CVE-2024-52280, GHSA-j5hq-5jcr-xwx7, GO-2024-3281 | High | 0.5% | 20 Nov, 2024 | Go github.com/rancher/steve |
Drupal core Access bypass BIT-drupal-2024-55634, CVE-2024-55634, DRUPAL-CORE-2024-004, GHSA-7cwc-fjqm-8vh8 | High | 0.4% | 20 Nov, 2024 | Packagist drupal/core Packagist drupal/core-recommended Packagist drupal/drupal |
Moodle IDOR when deleting OAuth2 linked accounts BIT-moodle-2024-45690, CVE-2024-45690, GHSA-fhg2-r2h9-h7q8 | High | 0.4% | 20 Nov, 2024 | Packagist moodle/moodle |
Apple Multiple Products Code Execution Vulnerability CVE-2024-44308 | HighExploited | 9.9% | 20 Nov, 2024 | |
HTML Cleaner allows crafted scripts in special contexts like svg or math to pass through CVE-2024-52595, GHSA-5jfw-gq64-q45f, PYSEC-2024-160 | High | 0.5% | 19 Nov, 2024 | PyPI lxml-html-clean |
Oracle Agile Product Lifecycle Management (PLM) Incorrect Authorization Vulnerability CVE-2024-21287 | HighExploited | 1.7% | 18 Nov, 2024 | |
aiohttp has a memory leak when middleware is enabled when requesting a resource with a non-allowed method CVE-2024-52303, GHSA-27mf-ghqm-j3j8, PYSEC-2026-1096 | High | 0.6% | 18 Nov, 2024 | PyPI aiohttp |
XXE in PHPSpreadsheet's XLSX reader CVE-2024-48917, GHSA-7cc9-j4mv-vcjp | High | 0.7% | 18 Nov, 2024 | Packagist phpoffice/phpexcel Packagist phpoffice/phpspreadsheet |