Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
MindsDB Deserialization of Untrusted Data vulnerability CVE-2024-45854, GHSA-7vhh-gfjc-x8rm, PYSEC-2024-84 | High | 0.5% | 12 Sep, 2024 | PyPI mindsdb |
MindsDB Deserialization of Untrusted Data vulnerability CVE-2024-45855, GHSA-fr9q-rgwq-g5r5, PYSEC-2024-85 | High | 0.5% | 12 Sep, 2024 | PyPI mindsdb |
dset Prototype Pollution vulnerability CVE-2024-21529, GHSA-f6v4-cf5j-vf3w | High | 0.8% | 11 Sep, 2024 | npm dset |
Ivanti Cloud Services Appliance OS Command Injection Vulnerability CVE-2024-8190 | HighExploited | 88.5% | 10 Sep, 2024 | |
Session is cached for OpenID and OAuth2 if `redirect` is not used CVE-2024-45596, GHSA-cff8-x7jv-4fm8 | High | 0.7% | 10 Sep, 2024 | npm @directus/api npm directus |
Microsoft Windows MSHTML Platform Spoofing Vulnerability CVE-2024-43461 | HighExploited | 54.5% | 10 Sep, 2024 | |
Microsoft Publisher Protection Mechanism Failure Vulnerability CVE-2024-38226 | HighExploited | 2.7% | 10 Sep, 2024 | |
Microsoft Windows Installer Improper Privilege Management Vulnerability CVE-2024-38014 | HighExploited | 6.3% | 10 Sep, 2024 | |
body-parser vulnerable to denial of service when url encoding is enabled CVE-2024-45590, GHSA-qwcr-r2fm-qrc7 | High | 0.8% | 10 Sep, 2024 | npm body-parser |
node-gettext vulnerable to Prototype Pollution CVE-2024-21528, GHSA-g974-hxvm-x689 | High | 0.6% | 10 Sep, 2024 | npm node-gettext |
path-to-regexp vulnerable to Regular Expression Denial of Service via multiple route parameters CVE-2024-45296, CVE-2026-4867, GHSA-37ch-88jc-xwx2, GHSA-9wv6-86v2-598j | High | 0.9% | 09 Sep, 2024 | npm path-to-regexp |
Twig has a possible sandbox bypass CVE-2024-45411, GHSA-6j75-5wfj-gh66 | High | 0.8% | 09 Sep, 2024 | Packagist twig/twig |
External Secrets Operator vulnerable to privilege escalation CVE-2024-45041, GHSA-qwgc-rr35-h4x9, GO-2024-3126 | High | 0.6% | 09 Sep, 2024 | Go github.com/external-secrets/external-secrets |
Apache Airflow vulnerable to Improper Encoding or Escaping of Output BIT-airflow-2024-45498, CVE-2024-45498, GHSA-c392-whpc-vfpr, PYSEC-2024-266 | High | 1.2% | 07 Sep, 2024 | PyPI apache-airflow |
Apache Airflow vulnerable to Execution with Unnecessary Privileges BIT-airflow-2024-45034, CVE-2024-45034, GHSA-92xg-gmrq-5c3w, PYSEC-2024-212 | High | 1.7% | 07 Sep, 2024 | PyPI apache-airflow |
gnark commitments to private witnesses in Groth16 as implemented break zero-knowledge property CVE-2024-45040, GHSA-9xcg-3q8v-7fq6, GO-2024-3123 | High | 0.4% | 06 Sep, 2024 | Go github.com/consensys/gnark |
Interchain Security: The signers of ICS messages do not need to match the provider address GHSA-7q74-g774-7x3g, GO-2024-3121 | High | Not scored | 05 Sep, 2024 | Go github.com/cosmos/interchain-security Go github.com/cosmos/interchain-security/v2 Go github.com/cosmos/interchain-security/v3 Go github.com/cosmos/interchain-security/v4 +1 more |
Remote Code Execution Vulnerability via SSTI in Fides Webserver Jinja Email Templating Engine CVE-2024-45053, GHSA-c34r-238x-f7qx, PYSEC-2026-1338 | High | 1.3% | 04 Sep, 2024 | PyPI ethyca-fides |
Apache OFBiz Forced Browsing Vulnerability CVE-2024-45195 | HighExploited | 100.0% | 04 Sep, 2024 | |
Hoverfly allows an arbitrary file read in the `/api/v2/simulation` endpoint (`GHSL-2023-274`) CVE-2024-45388, GHSA-6xx4-x46f-f897, GO-2024-3108 | High | 55.6% | 03 Sep, 2024 | Go github.com/SpectoLabs/hoverfly Go github.com/spectolabs/hoverfly |
Pimcore includes vulnerable PHPOffice/PhpSpreadsheet GHSA-hq76-662x-7mw4 | High | Not scored | 03 Sep, 2024 | Packagist pimcore/admin-ui-classic-bundle Packagist pimcore/data-importer Packagist pimcore/pimcore |
Tina search token leak via lock file in TinaCMS CVE-2024-45391, GHSA-4qrm-9h4r-v2fx | High | 0.3% | 03 Sep, 2024 | npm @tinacms/cli |
@actions/artifact has an Arbitrary File Write via artifact extraction CVE-2024-42471, GHSA-6q32-hq47-5qq3 | High | 3.2% | 02 Sep, 2024 | npm @actions/artifact |
`spam` project on PyPI compromised, malicious releases made GHSA-2r6g-7r83-jg72 | High | Not scored | 30 Aug, 2024 | PyPI spam |
opencv-python bundled libwebp binaries in wheels that are vulnerable to CVE-2023-4863 GHSA-qr4w-53vh-m672 | High | Not scored | 30 Aug, 2024 | PyPI opencv-python |
opencv-contrib-python bundled libwebp binaries in wheels that are vulnerable to CVE-2023-4863 GHSA-cxjf-x6jp-p7mc | High | Not scored | 30 Aug, 2024 | PyPI opencv-contrib-python |
opencv-python-headless bundled libwebp binaries in wheels that are vulnerable to CVE-2023-4863 GHSA-jh2j-j4j9-crg3 | High | Not scored | 30 Aug, 2024 | PyPI opencv-python-headless |
opencv-contrib-python-headless bundled libwebp binaries in wheels that are vulnerable to CVE-2023-4863 GHSA-w2pj-9cgh-mq2c | High | Not scored | 30 Aug, 2024 | PyPI opencv-contrib-python-headless |
gratient 0.5 contains credential harvesting code GHSA-xm4r-5rj9-2pg3 | High | Not scored | 30 Aug, 2024 | PyPI gratient |
`exotel` project on PyPI compromised, malicious release made GHSA-x6xg-3fj2-4pq3 | High | Not scored | 30 Aug, 2024 | PyPI exotel |
Kirby has insufficient permission checks in the language settings CVE-2024-41964, GHSA-jm9m-rqr3-wfmh | High | 0.5% | 29 Aug, 2024 | Packagist getkirby/cms |
Ollama can extract members of a ZIP archive outside of the parent directory CVE-2024-45436, GHSA-846m-99qv-67mg, GO-2024-3104 | High | 2.6% | 29 Aug, 2024 | Go github.com/ollama/ollama |
XXE in PHPSpreadsheet encoding is returned CVE-2024-45048, GHSA-ghg6-32f9-2jp7 | High | 0.6% | 28 Aug, 2024 | Packagist phpoffice/phpexcel Packagist phpoffice/phpspreadsheet |
HTML injection in Jupyter Notebook and JupyterLab leading to DOM Clobbering BIT-jupyter-base-notebook-2024-43805, BIT-jupyter-notebook-2024-43805, BIT-jupyterlab-2024-43805, CVE-2024-43805, GHSA-9q39-rmj3-p4r2, PYSEC-2026-1481, PYSEC-2026-2536 | High | 0.4% | 28 Aug, 2024 | PyPI jupyterlab PyPI notebook |
Taipy 3.1.1 affected by CVEs on flask-core and pymongo GHSA-pp84-v3mw-gg4w | High | Not scored | 27 Aug, 2024 | PyPI taipy |
Chisel's AUTH environment variable not respected in server entrypoint CVE-2024-43798, GHSA-38jh-8h67-m7mj, GO-2024-3100 | High | 0.4% | 27 Aug, 2024 | Go github.com/jpillora/chisel |
Apollo Query Planner and Apollo Gateway may infinitely loop on sufficiently complex queries CVE-2024-43414, GHSA-fmj9-77q8-g6c4 | High | 1.0% | 27 Aug, 2024 | crates.io apollo-router npm @apollo/gateway npm @apollo/query-planner |
Flowise Unauthenticated Denial of Service (DoS) vulnerability CVE-2024-8182, GHSA-48x4-mx8f-gr4h | High | 13.9% | 27 Aug, 2024 | npm flowise |
Flowise Authentication Bypass vulnerability CVE-2024-8181, GHSA-2q4w-x8h2-2fvh | High | 45.1% | 27 Aug, 2024 | npm flowise |
unzip-stream allows Arbitrary File Write via artifact extraction GHSA-6jrj-vc65-c983 | High | Not scored | 26 Aug, 2024 | npm unzip-stream |
Mage AI incorrectly gives privileges to users with deleted accounts CVE-2024-45187, GHSA-jg95-r9xh-xw9c, PYSEC-2026-1600 | High | 0.5% | 23 Aug, 2024 | PyPI mage-ai |
Froxlor: /etc/pure-ftpd/db/mysql.conf is chmod 644 but contains <SQL_UNPRIVILEGED_PASSWORD> CVE-2024-58383, GHSA-34qg-65m4-f23m | High | 0.2% | 23 Aug, 2024 | Packagist froxlor/froxlor |
pretix Stored Cross-site Scripting vulnerability CVE-2024-8113, GHSA-45rp-q25w-4426, PYSEC-2024-180 | High | 0.3% | 23 Aug, 2024 | PyPI pretix |
Versa Director Dangerous File Type Upload Vulnerability CVE-2024-39717 | HighExploited | 4.0% | 22 Aug, 2024 | |
Mattermost allows user with systems manager role with read-only access to teams to perform write operations on teams BIT-mattermost-2024-42497, CVE-2024-42497, GHSA-fxq9-6946-34q7, GO-2024-3091 | High | 0.3% | 22 Aug, 2024 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
memos CORS Misconfiguration in server.go (GHSL-2024-034) CVE-2024-41659, GHSA-p4fx-qf2h-jpmj, GO-2024-3088 | High | 0.6% | 22 Aug, 2024 | Go github.com/usememos/memos |
Casdoor CORS misconfiguration (GHSL-2024-035) CVE-2024-41657, GHSA-mchx-7j67-8mcf, GO-2024-3087 | High | 0.8% | 22 Aug, 2024 | Go github.com/casdoor/casdoor |
REXML denial of service vulnerability CVE-2024-43398, GHSA-vmwr-mc7x-5vc3 | High | 1.2% | 22 Aug, 2024 | RubyGems rexml |
Google Chromium V8 Inappropriate Implementation Vulnerability CVE-2024-7965 | HighExploited | 18.5% | 21 Aug, 2024 | |
CWA-2024-005: Stackoverflow in wasmd GHSA-g8w7-7vgg-x7xg, GO-2024-3082 | High | Not scored | 21 Aug, 2024 | Go github.com/CosmWasm/wasmd |