Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
OpenSlides 4.0.15 was discovered to be using a weak hashing algorithm to store passwords. CVE-2024-22892, PYSEC-2024-99 | High | 0.2% | 25 Sep, 2024 | PyPI openslides |
Denial of service in rocket chat message parser CVE-2024-46935, GHSA-6375-pg5j-8wph | High | 0.6% | 25 Sep, 2024 | npm @rocket.chat/message-parser |
OAuth2 client ID and secret exposed through the web browser CVE-2024-9014, GHSA-jm9x-rx9x-wpqj, PYSEC-2026-1775 | High | 9.7% | 23 Sep, 2024 | PyPI pgadmin4 |
DOM Clobbering Gadget found in rollup bundled scripts that leads to XSS CVE-2024-47068, GHSA-gcx4-mw62-g8wm | High | 0.7% | 23 Sep, 2024 | npm rollup |
lobe-chat implemented an insufficient fix for GHSA-mxhq-xw3g-rphc (CVE-2024-32964) CVE-2024-47066, GHSA-3fc8-2r3f-8wrg | High | 11.9% | 23 Sep, 2024 | npm @lobehub/chat |
HTTP Request Smuggling in ruby webrick CVE-2024-47220, GHSA-6f62-3596-g6w7 | High | Not scored | 22 Sep, 2024 | RubyGems webrick |
Plate allows arbitrary DOM attributes in element.attributes and leaf.attributes CVE-2024-47061, GHSA-73rg-f94j-xvhx | High | 0.5% | 20 Sep, 2024 | npm @udecode/plate-core |
ZITADEL Allows Unauthorized Access After Organization or Project Deactivation CVE-2024-47060, GHSA-jj94-6f5c-65r8, GO-2024-3138 | High | 0.4% | 19 Sep, 2024 | Go github.com/zitadel/zitadel Go github.com/zitadel/zitadel/v2 |
ZITADEL's Service Users Deactivation not Working CVE-2024-47000, GHSA-qr2h-7pwm-h393, GO-2024-3139 | High | 0.4% | 19 Sep, 2024 | Go github.com/zitadel/zitadel Go github.com/zitadel/zitadel/v2 |
ZITADEL's User Grant Deactivation not Working CVE-2024-46999, GHSA-2w5j-qfvw-2hf5, GO-2024-3137 | High | 0.4% | 19 Sep, 2024 | Go github.com/zitadel/zitadel Go github.com/zitadel/zitadel/v2 |
protobuf-java has potential Denial of Service issue CVE-2024-7254, GHSA-735f-pc8j-v9w8 | High | 2.8% | 19 Sep, 2024 | Maven com.google.protobuf:protobuf-java Maven com.google.protobuf:protobuf-javalite Maven com.google.protobuf:protobuf-kotlin Maven com.google.protobuf:protobuf-kotlin-lite +1 more |
Mautic has insufficient authentication in upgrade flow CVE-2022-25770, GHSA-qf6m-6m4g-rmrc | High | 0.3% | 18 Sep, 2024 | Packagist mautic/core Packagist mautic/core-lib |
Mesop has a local file Inclusion via static file serving functionality CVE-2024-45601, GHSA-pmv9-3xqp-8w42, PYSEC-2026-1625 | High | 0.3% | 18 Sep, 2024 | PyPI mesop |
Mautic vulnerable to Improper Access Control in UI upgrade process CVE-2022-25768, GHSA-x3jx-5w6m-q2fc | High | 0.3% | 18 Sep, 2024 | Packagist mautic/core Packagist mautic/core-lib |
find-my-way has a ReDoS vulnerability in multiparametric routes CVE-2024-45813, GHSA-rrr8-f88r-h8q6 | High | 0.7% | 18 Sep, 2024 | npm find-my-way |
Camaleon CMS vulnerable to remote code execution through code injection (GHSL-2024-185) GHSA-7x4w-cj9r-h4v9 | High | Not scored | 18 Sep, 2024 | RubyGems camaleon_cms |
Camaleon CMS vulnerable to arbitrary path traversal (GHSL-2024-183) CVE-2024-46987, GHSA-cp65-5m9r-vc2c | High | 14.6% | 18 Sep, 2024 | RubyGems camaleon_cms |
CoreDNS vulnerable to TuDoor Attacks CVE-2023-28452, GHSA-hfmw-7g3m-gj6q, GO-2024-3130 | High | 0.6% | 18 Sep, 2024 | Go github.com/coredns/coredns |
Guardrails has an arbitrary code execution vulnerability CVE-2024-45858, GHSA-w392-75q8-vr67, PYSEC-2026-1432 | High | 0.4% | 18 Sep, 2024 | PyPI guardrails-ai |
Camaleon CMS affected by arbitrary file write to RCE (GHSL-2024-182) CVE-2024-46986, GHSA-wmjg-vqhv-q5p5 | High | 37.1% | 18 Sep, 2024 | RubyGems camaleon_cms |
Next.js Cache Poisoning CVE-2024-46982, GHSA-gp8f-8m3g-qvj9 | High | 59.2% | 17 Sep, 2024 | npm next |
PTZOptics PT30X-SDI/NDI Cameras OS Command Injection Vulnerability CVE-2024-8957 | HighExploited | 79.8% | 17 Sep, 2024 | |
@backstage/plugin-techdocs-backend storage bucket Directory Traversal vulnerability CVE-2024-45816, GHSA-39v3-f278-vj3g | High | 0.7% | 17 Sep, 2024 | npm @backstage/plugin-techdocs-backend |
@backstage/plugin-catalog-backend Prototype Pollution vulnerability CVE-2024-45815, GHSA-3x3f-jcp3-g22j | High | 0.5% | 17 Sep, 2024 | npm @backstage/plugin-catalog-backend |
Kimai has an XXE Leading to Local File Read GHSA-534c-hcr7-67jg | High | Not scored | 17 Sep, 2024 | Packagist kimai/kimai |
Sentry improperly authorizes muting of alert rules CVE-2024-45606, GHSA-v345-w9f2-mpm5, PYSEC-2026-1916 | High | 0.4% | 17 Sep, 2024 | PyPI sentry |
Sentry improperly authorizes deletion of user issue alert notifications CVE-2024-45605, GHSA-54m3-95j9-v89j, PYSEC-2026-1910 | High | 0.4% | 17 Sep, 2024 | PyPI sentry |
vLLM denial of service vulnerability CVE-2024-8768, GHSA-w2r7-9579-27hf, PYSEC-2026-2024 | High | 0.7% | 17 Sep, 2024 | PyPI vllm |
Contao affected by remote command execution through file upload CVE-2024-45398, GHSA-vm6r-j788-hjh5 | High | 0.5% | 17 Sep, 2024 | Packagist contao/core-bundle |
czim/file-handling vulnerable to SSRF and directory traversal CVE-2024-47049, GHSA-6rgh-r6j3-3223 | High | 0.6% | 17 Sep, 2024 | Packagist czim/file-handling |
powermail TYPO3 extension has Insecure Direct Object Reference CVE-2024-47047, GHSA-q25c-r482-77p9 | High | 0.5% | 17 Sep, 2024 | Packagist in2code/powermail |
LangChain pickle deserialization of untrusted data CVE-2024-5998, GHSA-f2jm-rw3h-6phg, PYSEC-2024-323, PYSEC-2026-1514 | High | 0.4% | 17 Sep, 2024 | PyPI langchain PyPI langchain-community |
DOMPurify allows tampering by prototype pollution CVE-2024-45801, GHSA-mmhx-hmjr-r674 | High | 0.9% | 16 Sep, 2024 | npm dompurify |
Mattermost Desktop App Uncontrolled Search Path Vulnerability CVE-2024-39613, GHSA-wj4j-qc2m-fgh7 | High | 0.3% | 16 Sep, 2024 | npm mattermost-desktop |
Ansible vulnerable to Insertion of Sensitive Information into Log File CVE-2024-8775, GHSA-jpxc-vmjf-9fcj, PYSEC-2026-1124 | High | 0.3% | 14 Sep, 2024 | PyPI ansible-core |
Withdrawn Advisory: Lunary Cross-Site Request Forgery (CSRF) vulnerability CVE-2024-6862, GHSA-v6x6-4v4x-2fx9 | High | 0.3% | 13 Sep, 2024 | npm @lunary/backend npm lunary |
Withdrawn Advisory: Lunary Improper Authentication vulnerability CVE-2024-6582, GHSA-w73r-8mm4-cfvf | High | 0.4% | 13 Sep, 2024 | npm lunary |
Withdrawn Advisory: Lunary improper access control vulnerability CVE-2024-6087, GHSA-6p2q-8qfq-wq7x | High | 0.4% | 13 Sep, 2024 | npm lunary |
LiteLLM Server-Side Request Forgery (SSRF) vulnerability CVE-2024-6587, GHSA-g26j-5385-hhw3, PYSEC-2026-1547 | High | 34.4% | 13 Sep, 2024 | PyPI litellm |
Cleanlab Deserialization of Untrusted Data vulnerability CVE-2024-45857, GHSA-8cm9-rrgc-4pcj, PYSEC-2026-1254 | High | 0.2% | 12 Sep, 2024 | PyPI cleanlab |
MindsDB Eval Injection vulnerability CVE-2024-45847, GHSA-crmg-rp64-5cm3, PYSEC-2026-1629 | High | 0.9% | 12 Sep, 2024 | PyPI mindsdb |
Refuel Autolab Eval Injection vulnerability CVE-2024-27321, GHSA-4fgp-7vvm-m4jf, PYSEC-2026-1869 | High | 0.3% | 12 Sep, 2024 | PyPI refuel-autolabel |
Refuel Autolab Eval Injection vulnerability CVE-2024-27320, GHSA-g2m8-f3x2-qprw, PYSEC-2026-1870 | High | 0.4% | 12 Sep, 2024 | PyPI refuel-autolabel |
MindsDB Eval Injection vulnerability CVE-2024-45846, GHSA-wcjw-3v6p-4v3r, PYSEC-2024-77 | High | 2.1% | 12 Sep, 2024 | PyPI mindsdb |
MindsDB Eval Injection vulnerability CVE-2024-45848, GHSA-9gq6-6936-885w, PYSEC-2024-78 | High | 0.9% | 12 Sep, 2024 | PyPI mindsdb |
MindsDB Eval Injection vulnerability CVE-2024-45849, GHSA-c85f-pcx6-2ghm, PYSEC-2024-79 | High | 0.9% | 12 Sep, 2024 | PyPI mindsdb |
MindsDB Eval Injection vulnerability CVE-2024-45850, GHSA-v6g6-3cm3-vf6c, PYSEC-2024-80 | High | 0.9% | 12 Sep, 2024 | PyPI mindsdb |
MindsDB Eval Injection vulnerability CVE-2024-45851, GHSA-wf9g-c67g-h4ch, PYSEC-2024-81 | High | 0.9% | 12 Sep, 2024 | PyPI mindsdb |
MindsDB Deserialization of Untrusted Data vulnerability CVE-2024-45852, GHSA-7vhj-pfwv-hx3w, PYSEC-2024-82 | High | 0.7% | 12 Sep, 2024 | PyPI mindsdb |
MindsDB Deserialization of Untrusted Data vulnerability CVE-2024-45853, GHSA-q9r8-89xr-4xv4, PYSEC-2024-83 | High | 0.5% | 12 Sep, 2024 | PyPI mindsdb |