Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Object Resolver Prototype Pollution CVE-2024-36577, GHSA-qj86-v6m7-4qv2 | High | 0.4% | 17 Jun, 2024 | npm @apphp/object-resolver |
Badger Database Prototype Pollution CVE-2024-36581, GHSA-69r2-2fg7-7hf9 | High | 0.5% | 17 Jun, 2024 | npm @abw/badger-database |
langchain_experimental Code Execution via Python REPL access CVE-2024-38459, GHSA-wmvm-9vqv-5qpp, PYSEC-2024-53 | High | 0.2% | 16 Jun, 2024 | PyPI langchain-experimental |
LNbits improperly handles potential network and payment failures when using Eclair backend CVE-2024-34694, GHSA-3j4h-h3fp-vwww, PYSEC-2026-1580 | High | 0.6% | 14 Jun, 2024 | PyPI lnbits |
Snipe-IT allows users to promote or demote themselves or other users CVE-2024-5685, GHSA-544r-fc65-v832 | High | 0.4% | 14 Jun, 2024 | Packagist snipe/snipe-it |
AdGuardHome privilege escalation vulnerability CVE-2024-36586, GHSA-7jp9-vgmq-c8r5, GO-2024-2924 | High | 0.2% | 13 Jun, 2024 | Go github.com/AdguardTeam/AdGuardHome |
Android Pixel Privilege Escalation Vulnerability CVE-2024-32896 | HighExploited | 3.0% | 13 Jun, 2024 | |
Vulnerabilities with the k8sGPT GHSA-85rg-8m6h-825p, GO-2024-2923 | High | Not scored | 13 Jun, 2024 | Go github.com/k8sgpt-ai/k8sgpt |
Cilium leaks sensitive information in cilium-bugtool BIT-cilium-2024-37307, BIT-cilium-operator-2024-37307, BIT-cilium-proxy-2024-37307, BIT-hubble-2024-37307, BIT-hubble-relay-2024-37307, BIT-hubble-ui-2024-37307, BIT-hubble-ui-backend-2024-37307, CVE-2024-37307, GHSA-wh78-7948-358j, GO-2024-2922 | High | 0.2% | 13 Jun, 2024 | Go github.com/cilium/cilium |
Magento Open Source Server-Side Request Forgery (SSRF) vulnerability BIT-magento-2024-34111, CVE-2024-34111, GHSA-jmqp-r3gg-6jh3 | High | 1.3% | 13 Jun, 2024 | Packagist magento/community-edition |
Magento Open Source Improper Authorization vulnerability BIT-magento-2024-34104, CVE-2024-34104, GHSA-wwj3-573j-rvvm | High | 0.8% | 13 Jun, 2024 | Packagist magento/community-edition |
Globus `identity_provider` restriction ignored when used with `allow_all` in JupyterHub 5.0 CVE-2024-37300, GHSA-gprj-3p75-f996, PYSEC-2026-1711 | High | 0.4% | 12 Jun, 2024 | PyPI oauthenticator |
@strapi/plugin-users-permissions leaks 3rd party authentication tokens and authentication bypass CVE-2024-34065, GHSA-wrvh-rcmr-9qfc | High | 0.7% | 12 Jun, 2024 | npm @strapi/plugin-users-permissions |
document-merge-service vulnerable to Remote Code Execution via Server-Side Template Injection CVE-2024-37301, GHSA-v5gf-r78h-55q6, PYSEC-2026-1314 | High | 1.0% | 11 Jun, 2024 | PyPI document-merge-service |
Microsoft Windows Kernel-Mode Driver Untrusted Pointer Dereference Vulnerability CVE-2024-35250 | HighExploited | 25.2% | 11 Jun, 2024 | |
Microsoft Windows Kernel TOCTOU Race Condition Vulnerability CVE-2024-30088 | HighExploited | 68.2% | 11 Jun, 2024 | |
ghtml Cross-Site Scripting (XSS) vulnerability CVE-2024-37166, GHSA-vvhj-v88f-5gxr | High | 0.4% | 10 Jun, 2024 | npm ghtml |
Composer has a command injection via malicious git branch name BIT-composer-2024-35241, CVE-2024-35241, GHSA-47f6-5gq3-vx9c | High | 1.1% | 10 Jun, 2024 | Packagist composer/composer |
Composer has multiple command injections via malicious git/hg branch names BIT-composer-2024-35242, CVE-2024-35242, GHSA-v9qv-c7wm-wgmf | High | 3.3% | 10 Jun, 2024 | Packagist composer/composer |
go-grpc-compression has a zstd decompression bombing vulnerability GHSA-87m9-rv8p-rgmg, GO-2024-2911 | High | Not scored | 10 Jun, 2024 | Go github.com/mostynb/go-grpc-compression |
nukeviet Deserialization of Untrusted Data vulnerability CVE-2024-36528, GHSA-mhj4-vrcv-x4xc | High | 0.8% | 10 Jun, 2024 | Packagist nukeviet/nukeviet |
Android Kernel Remote Code Execution Vulnerability CVE-2024-36971 | HighExploited | 2.7% | 10 Jun, 2024 | |
lunary-ai/lunary Access Control Vulnerability in Prompt Variation Management CVE-2024-5389, GHSA-3mwc-2cj7-gx8c | High | 0.4% | 09 Jun, 2024 | npm lunary |
Authlib has algorithm confusion with asymmetric public keys CVE-2024-37568, GHSA-5357-c2jx-v7qh, PYSEC-2024-52 | High | 0.4% | 09 Jun, 2024 | PyPI authlib |
zenml-io/zenml does not expire the session after password reset CVE-2024-4680, GHSA-99hm-86h7-gr3g, PYSEC-2026-2069 | High | 0.4% | 08 Jun, 2024 | PyPI zenml |
zfr authentication adapter did not verify validity of tokens GHSA-rcm4-jv5g-wccm | High | Not scored | 07 Jun, 2024 | Packagist zfr/zfr-oauth2-server-module |
ZendOpenID potential security issue in login mechanism GHSA-3x57-m5p4-rgh4 | High | Not scored | 07 Jun, 2024 | Packagist zendframework/zendopenid |
Zendframework Potential Information Disclosure and Insufficient Entropy vulnerability GHSA-848f-mph5-9pm9 | High | Not scored | 07 Jun, 2024 | Packagist zendframework/zendframework1 |
ZendFramework1 Potential Insufficient Entropy Vulnerability GHSA-8xhv-gqm4-3w99 | High | Not scored | 07 Jun, 2024 | Packagist zendframework/zendframework1 |
Zend-Captcha Information Disclosure and Insufficient Entropy vulnerability GHSA-mg4x-prh7-g4mx | High | Not scored | 07 Jun, 2024 | Packagist zendframework/zend-captcha |
Zendframework potential security issue in login mechanism GHSA-9v78-h226-2rmq | High | Not scored | 07 Jun, 2024 | Packagist zendframework/zendframework1 |
Adminer file disclosure vulnerability GHSA-97h7-mf38-g9mf | High | Not scored | 07 Jun, 2024 | Packagist vrana/adminer |
Zend-Navigation vulnerable to Cross-site Scripting GHSA-6v7p-5qcq-268c | High | Not scored | 07 Jun, 2024 | Packagist zendframework/zend-navigation |
Zend-Feed URL Rewrite vulnerability GHSA-jmmp-vh96-78rm | High | Not scored | 07 Jun, 2024 | Packagist zendframework/zend-feed |
Zend-HTTP URL Rewrite vulnerability GHSA-cg8w-5jrc-675g | High | Not scored | 07 Jun, 2024 | Packagist zendframework/zend-http |
Zendframework Local file disclosure via XXE injection in Zend_XmlRpc GHSA-229x-22xc-2f2w | High | Not scored | 07 Jun, 2024 | Packagist zendframework/zendframework1 |
Zendframework Denial of Service vector via XEE injection GHSA-2jx7-xg83-j2m7 | High | Not scored | 07 Jun, 2024 | Packagist zendframework/zendframework1 |
Zend-Mail remote code execution in zend-mail via Sendmail adapter GHSA-cxf7-m5g2-v594 | High | Not scored | 07 Jun, 2024 | Packagist zendframework/zend-mail |
ZendFramework potential XML eXternal Entity injection vectors GHSA-4j9x-g4x8-vcmf | High | Not scored | 07 Jun, 2024 | Packagist zendframework/zendframework1 |
ZendFramework local file inclusion vector in `Zend_View::setScriptPath()` and `render()` GHSA-hx3m-959f-v849 | High | Not scored | 07 Jun, 2024 | Packagist zendframework/zendframework1 |
ZendFramework SQL injection due to execution of platform-specific SQL containing interpolations GHSA-x2f4-8wxf-w3vf | High | Not scored | 07 Jun, 2024 | Packagist zendframework/zendframework |
ZendFramework Potential Information Disclosure and Insufficient Entropy vulnerabilities GHSA-xg9w-r469-m455 | High | Not scored | 07 Jun, 2024 | Packagist zendframework/zendframework |
ZendFramework Route Parameter Injection Via Query String in `Zend\Mvc` GHSA-jq87-2wxp-8349 | High | Not scored | 07 Jun, 2024 | Packagist zendframework/zendframework |
Zendframework Remote Address Spoofing Vector in `Zend\Http\PhpEnvironment\RemoteAddress` GHSA-xffp-6w68-4775 | High | Not scored | 07 Jun, 2024 | Packagist zendframework/zendframework |
TYPO3 Security Misconfiguration in Install Tool Cookie GHSA-f777-f784-36gm | High | Not scored | 07 Jun, 2024 | Packagist typo3/cms |
ebookmeta XML External Entity vulnerability CVE-2024-36827, GHSA-whf4-fpj8-pgg8, PYSEC-2024-76 | High | 0.5% | 07 Jun, 2024 | PyPI ebookmeta |
TYPO3 Arbitrary Code Execution via File List Module GHSA-8h4m-r4wm-xj7r | High | Not scored | 07 Jun, 2024 | Packagist typo3/cms |
TYPO3 Denial of Service in Frontend Record Registration GHSA-g585-crjf-vhwq | High | Not scored | 07 Jun, 2024 | Packagist typo3/cms |
TYPO3 Security Misconfiguration for Backend User Accounts GHSA-c5mj-39cf-3pp5 | High | Not scored | 07 Jun, 2024 | Packagist typo3/cms |
TYPO3 CMS Possible Insecure Deserialization in Extbase Request Handling GHSA-hh95-5xm5-v8v7 | High | Not scored | 07 Jun, 2024 | Packagist typo3/cms |