Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Insecure Jinja2 templates rendered in Haystack Components can lead to RCE CVE-2024-41950, GHSA-hx9v-6r9f-w677, PYSEC-2026-1447 | High | 1.2% | 31 Jul, 2024 | PyPI haystack-ai |
Weave server API vulnerable to arbitrary file leak CVE-2024-7340, GHSA-r49h-6qxq-624f, PYSEC-2026-2035 | High | 5.0% | 31 Jul, 2024 | PyPI weave |
TensorFlow has segfault in array_ops.upper_bound BIT-tensorflow-2023-33976, CVE-2023-33976, GHSA-gjh7-xx4r-x345, PYSEC-2026-1962, PYSEC-2026-3190, PYSEC-2026-3331 | High | 0.4% | 30 Jul, 2024 | PyPI tensorflow PyPI tensorflow-cpu PyPI tensorflow-gpu |
fast-xml-parser vulnerable to ReDOS at currency parsing CVE-2024-41818, GHSA-mpg4-rc92-vx8v | High | 0.8% | 29 Jul, 2024 | npm fast-xml-parser |
twisted.web has disordered HTTP pipeline response CVE-2024-41671, GHSA-c8m8-j448-xjx7, PYSEC-2026-1992 | High | 0.9% | 29 Jul, 2024 | PyPI twisted |
ICEcoder vulnerable to Cross Site Scripting CVE-2024-41375, GHSA-5j47-3m62-7vr3 | High | 0.3% | 26 Jul, 2024 | Packagist icecoder/icecoder |
ICEcoder vulnerable to Cross Site Scripting CVE-2024-41374, GHSA-xcr9-pm5w-gvh2 | High | 0.3% | 26 Jul, 2024 | Packagist icecoder/icecoder |
Craft CMS Allows TOTP Token To Stay Valid After Use CVE-2024-41800, GHSA-wmx7-pw49-88jx | High | 0.5% | 25 Jul, 2024 | Packagist craftcms/cms |
Dolibarr ERP CRM vulnerable to remote code execution (RCE) CVE-2024-40137, GHSA-vprp-94p9-5jp8 | High | 0.7% | 24 Jul, 2024 | Packagist dolibarr/dolibarr |
sniff_csv provides filesystem access even when enable_external_access is disabled in duckdb CVE-2024-41672, GHSA-w2gf-jxc9-pf2q, PYSEC-2024-203 | High | 0.8% | 24 Jul, 2024 | PyPI duckdb |
Sentry vulnerable to stored Cross-Site Scripting (XSS) CVE-2024-41656, GHSA-fm88-hc3v-3www, PYSEC-2026-1914 | High | 0.5% | 23 Jul, 2024 | PyPI sentry |
(ReDoS) Regular Expression Denial of Service in tf2-item-format CVE-2024-41655, GHSA-8h55-q5qq-p685 | High | 0.8% | 23 Jul, 2024 | npm tf2-item-format |
HashiCorp Nomad is vulnerable to path escape through archive unpacking during migration CVE-2024-6717, GHSA-5mqx-rpxv-mvxj, GO-2026-4278 | High | 0.4% | 23 Jul, 2024 | Go github.com/hashicorp/nomad |
Argo CD Unauthenticated Denial of Service (DoS) Vulnerability via /api/webhook Endpoint BIT-argo-cd-2024-40634, CVE-2024-40634, GHSA-jmvp-698c-4x3w, GO-2024-3002 | High | 1.4% | 22 Jul, 2024 | Go github.com/argoproj/argo-cd Go github.com/argoproj/argo-cd/v2 |
Ankitects Anki arbitrary script execution vulnerability CVE-2024-26020, GHSA-9gq7-p5w9-w899, PYSEC-2026-1116 | High | 15.2% | 22 Jul, 2024 | PyPI anki |
Guardrails AI vulnerable to Improper Restriction of XML External Entity Reference CVE-2024-6961, GHSA-f8hx-f4xw-c646, PYSEC-2026-1431 | High | 0.4% | 21 Jul, 2024 | PyPI guardrails-ai |
LoLLMS vulnerable to Expected Behavior Violation CVE-2024-6281, GHSA-8mrm-r7h3-c3hj, PYSEC-2026-1587 | High | 0.3% | 20 Jul, 2024 | PyPI lollms |
Woodpecker's custom workspace allow to overwrite plugin entrypoint executable CVE-2024-41121, GHSA-xw35-rrcp-g7xm, GO-2024-2999 | High | 0.7% | 19 Jul, 2024 | Go go.woodpecker-ci.org/woodpecker Go go.woodpecker-ci.org/woodpecker/v2 |
Automad arbitrary file upload vulnerability CVE-2024-40400, GHSA-47mc-qmh2-mqj4 | High | 0.8% | 19 Jul, 2024 | Packagist automad/automad |
TorchServe gRPC Port Exposure CVE-2024-35199, GHSA-hhpg-v63p-wp7w, PYSEC-2026-1971 | High | 0.6% | 18 Jul, 2024 | PyPI torchserve |
Kubernetes sets incorrect permissions on Windows containers logs CVE-2024-5321, GHSA-82m2-cv7p-4m75, GO-2024-2994 | High | 0.3% | 18 Jul, 2024 | Go k8s.io/kubernetes |
Sliver Allows Authenticated Operator-to-Server Remote Code Execution CVE-2024-41111, GHSA-hc5w-gxxr-w8x8, GO-2024-2993 | High | 0.7% | 18 Jul, 2024 | Go github.com/bishopfox/sliver |
openCart Server-Side Template Injection (SSTI) vulnerability BIT-opencart-2024-36694, CVE-2024-36694, GHSA-xrh7-2gfq-4rcq | High | 0.9% | 17 Jul, 2024 | Packagist opencart/opencart |
projectdiscovery/nuclei allows unsigned code template execution through workflows CVE-2024-40641, GHSA-c3q9-c27p-cw9h, GO-2024-2989 | High | 0.3% | 17 Jul, 2024 | Go github.com/projectdiscovery/nuclei Go github.com/projectdiscovery/nuclei/v2 Go github.com/projectdiscovery/nuclei/v3 |
Sylius has a security vulnerability via adjustments API endpoint CVE-2024-40633, GHSA-55rf-8q29-4g43 | High | 0.4% | 17 Jul, 2024 | Packagist sylius/sylius |
Apache StreamPipes has potential remote code execution (RCE) via file upload CVE-2024-31411, GHSA-6523-jf4r-c962, PYSEC-2024-173 | High | 1.1% | 17 Jul, 2024 | Maven org.apache.streampipes:streampipes-parent PyPI streampipes |
Apache Airflow has DAG Author Code Execution possibility in airflow-scheduler BIT-airflow-2024-39877, CVE-2024-39877, GHSA-g5hv-r743-v8pm, PYSEC-2024-190 | High | 1.7% | 17 Jul, 2024 | PyPI apache-airflow |
Skupper uses a static cookie secret for the openshift oauth-proxy CVE-2024-6535, GHSA-w799-v85j-88pg, GO-2024-2987 | High | 0.5% | 17 Jul, 2024 | Go github.com/skupperproject/skupper |
Oracle WebLogic Server Unspecified Vulnerability CVE-2024-21182 | HighExploited | 74.2% | 16 Jul, 2024 | |
dbt has an implicit override for built-in materializations from installed packages CVE-2024-40637, GHSA-p3f3-5ccg-83xq, PYSEC-2024-66 | High | 0.4% | 16 Jul, 2024 | PyPI dbt-core |
Fiona affected by CVE-2020-14152 related to madler-zlib GHSA-g4m4-9q4c-mfw6 | High | Not scored | 16 Jul, 2024 | PyPI fiona |
Plate media plugins has a XSS in media embed element when using custom URL parsers CVE-2024-40631, GHSA-h3pq-667x-r789 | High | 0.5% | 15 Jul, 2024 | npm @udecode/plate-media |
setuptools vulnerable to Command Injection via package URL BIT-setuptools-2024-6345, CVE-2024-6345, GHSA-cx63-2mw6-8hw5, PYSEC-2026-1918 | High | 1.9% | 15 Jul, 2024 | PyPI setuptools |
Malware package cipherbcrypt GHSA-5grr-72f9-678v | High | Not scored | 12 Jul, 2024 | PyPI cipherbcrypt |
Local File Inclusion in Solara CVE-2024-39903, GHSA-9794-pc4r-438w, PYSEC-2026-1933 | High | 2.9% | 12 Jul, 2024 | PyPI solara |
SQL Injection in the KubeClarity REST API CVE-2024-39909, GHSA-5248-h45p-9pgw, GO-2024-2981 | High | 0.4% | 12 Jul, 2024 | Go github.com/openclarity/kubeclarity/backend |
Hashicorp Vault vulnerable to Improper Check or Handling of Exceptional Conditions BIT-vault-2024-6468, CVE-2024-6468, GHSA-2qmw-pvf7-4mw6, GO-2024-2982 | High | 0.5% | 11 Jul, 2024 | Go github.com/hashicorp/vault |
NATS Server and Streaming Server fails to enforce negative user permissions, may allow denied subjects CVE-2022-29946, GHSA-2h2x-8hh2-mfq8, GO-2024-2980 | High | 0.5% | 11 Jul, 2024 | Go github.com/nats-io/nats-server Go github.com/nats-io/nats-server/v2 Go github.com/nats-io/nats-streaming-server |
Wagtail regular expression denial-of-service via search query parsing CVE-2024-39317, GHSA-jmp3-39vp-fwg8, PYSEC-2024-86 | High | 0.6% | 11 Jul, 2024 | PyPI wagtail |
Next.js Denial of Service (DoS) condition CVE-2024-39693, GHSA-fq54-2j52-jc42 | High | 0.5% | 10 Jul, 2024 | npm next |
speaker vulnerable to Denial of Service CVE-2024-21526, GHSA-w5fc-gj3h-26rx | High | 0.6% | 10 Jul, 2024 | npm speaker |
node-twain vulnerable to Improper Check or Handling of Exceptional Conditions CVE-2024-21525, GHSA-wxr3-2hgv-qm8f | High | 0.5% | 10 Jul, 2024 | npm node-twain |
images vulnerable to Denial of Service CVE-2024-21523, GHSA-vjpv-x8p9-7p85 | High | 0.6% | 10 Jul, 2024 | npm images |
audify vulnerable to Improper Validation of Array Index CVE-2024-21522, GHSA-7vhm-fmph-7wxw | High | 0.6% | 10 Jul, 2024 | npm audify |
@discordjs/opus vulnerable to Denial of Service CVE-2024-21521, GHSA-43wq-xrcm-3vgr | High | 0.6% | 10 Jul, 2024 | npm @discordjs/opus |
Django vulnerable to Denial of Service BIT-django-2024-38875, CVE-2024-38875, GHSA-qg2p-9jwr-mmqf, PYSEC-2024-56 | High | 1.2% | 10 Jul, 2024 | PyPI Django PyPI django |
Django Path Traversal vulnerability BIT-django-2024-39330, CVE-2024-39330, GHSA-9jmf-237g-qf46, PYSEC-2024-58 | High | 1.0% | 10 Jul, 2024 | PyPI Django PyPI django |
Django vulnerable to Denial of Service BIT-django-2024-39614, CVE-2024-39614, GHSA-f6f8-9mx6-9mx2, PYSEC-2024-59 | High | 28.6% | 10 Jul, 2024 | PyPI Django PyPI django |
BookStack Incorrect Access Control vulnerability CVE-2024-36676, GHSA-pj36-fcrg-327j | High | 0.6% | 09 Jul, 2024 | Packagist ssddanbrown/bookstack |
Evmos vulnerable to exploit of smart contract account and vesting CVE-2024-39696, GHSA-q6hg-6m9x-5g9c, GO-2024-2974 | High | 0.5% | 09 Jul, 2024 | Go github.com/evmos/evmos Go github.com/evmos/evmos/v10 Go github.com/evmos/evmos/v11 Go github.com/evmos/evmos/v12 +15 more |