Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Arm Mali GPU Kernel Driver Use-After-Free Vulnerability CVE-2024-4610 | HighExploited | 0.8% | 07 Jun, 2024 | |
onnx allows Arbitrary File Overwrite in download_model_with_test_data CVE-2024-5187, CVE-2025-51480, GHSA-6rq9-53c3-f7vj, PYSEC-2025-148 | High | 1.2% | 06 Jun, 2024 | PyPI onnx |
Withdrawn Advisory: lunary-ai/lunary XSS in SAML metadata endpoint CVE-2024-5478, GHSA-rpx8-fg6w-rm6x | High | 0.3% | 06 Jun, 2024 | npm lunary |
SQL injection in litellm CVE-2024-5225, GHSA-h6m6-jj8v-94jj, PYSEC-2026-1550 | High | 0.4% | 06 Jun, 2024 | PyPI litellm |
Arbitrary file deletion in litellm CVE-2024-4888, GHSA-3xr8-qfvj-9p9j, PYSEC-2026-1540 | High | 0.6% | 06 Jun, 2024 | PyPI litellm |
LoLLMS Path Traversal vulnerability CVE-2024-4881, GHSA-p8h7-c8gw-6x8c, PYSEC-2024-108 | High | 0.9% | 06 Jun, 2024 | PyPI lollms |
Server-Side Request Forgery in langchain-community.retrievers.web_research.WebResearchRetriever CVE-2024-3095, GHSA-q25c-c977-4cmh, PYSEC-2026-1516 | High | 0.7% | 06 Jun, 2024 | PyPI langchain-community |
Local File Inclusion in mlflow BIT-mlflow-2024-2928, CVE-2024-2928, GHSA-j46q-5pxx-8vmw, PYSEC-2024-242 | High | 21.8% | 06 Jun, 2024 | PyPI mlflow |
Contract balance not updating correctly after interchain transaction CVE-2024-37153, GHSA-xgr7-jgq3-mhmc, GO-2024-2903 | High | 0.6% | 06 Jun, 2024 | Go github.com/evmos/evmos Go github.com/evmos/evmos/v10 Go github.com/evmos/evmos/v11 Go github.com/evmos/evmos/v12 +14 more |
Server-Side Request Forgery in gradio CVE-2024-4325, GHSA-973g-55hp-3frw, PYSEC-2026-1413 | High | 37.1% | 06 Jun, 2024 | PyPI gradio |
Local file inclusion in gradio CVE-2024-4941, GHSA-6v6g-j5fq-hpvw, PYSEC-2024-184 | High | 0.8% | 06 Jun, 2024 | PyPI gradio |
Jupyter server on Windows discloses Windows user password hash CVE-2024-35178, GHSA-hrw6-wg82-cm62, PYSEC-2024-165 | High | 0.8% | 06 Jun, 2024 | PyPI jupyter-server PyPI jupyter_server |
Password hash exposed in CraftCMS two factor authentication plugin CVE-2024-5657, GHSA-3p4x-grpm-xw58 | High | 0.8% | 06 Jun, 2024 | Packagist born05/craft-twofactorauthentication |
SolarWinds Serv-U Path Traversal Vulnerability CVE-2024-28995 | HighExploited | 99.6% | 06 Jun, 2024 | |
typo3 Security fix for Flow Swift Mailer package GHSA-xjw3-5r5c-m5ph | High | Not scored | 05 Jun, 2024 | Packagist typo3/swiftmailer |
typo3 Information Disclosure Security Note GHSA-g4xv-r3qw-v3q2 | High | Not scored | 05 Jun, 2024 | Packagist typo3/neos |
Flow Bugfix Releases for Entity Security GHSA-vh6j-wv25-8qxr | High | Not scored | 05 Jun, 2024 | Packagist typo3/flow |
Cross-Site Scripting (XSS) vulnerabilities in Neos GHSA-4542-p56h-8xww | High | Not scored | 05 Jun, 2024 | Packagist typo3/neos |
Observable Timing Discrepancy in pypqc GHSA-hvh4-5qr6-3v7r | High | Not scored | 05 Jun, 2024 | PyPI pypqc |
Denial of Service via Zip/Decompression Bomb sent over HTTP or gRPC BIT-opentelemetry-collector-2024-36129, CVE-2024-36129, GHSA-c74f-6mfw-mm4v, GO-2024-2900 | High | 1.2% | 05 Jun, 2024 | Go go.opentelemetry.io/collector/config/configgrpc Go go.opentelemetry.io/collector/config/confighttp |
Insecure Deserialization & Arbitrary Code Execution in TYPO3 CMS GHSA-ppgf-8745-8pgx | High | Not scored | 05 Jun, 2024 | Packagist typo3/cms |
PyMongo Out-of-bounds Read in the bson module CVE-2024-5629, GHSA-m87m-mmvp-v9qm, PYSEC-2026-1826 | High | 0.7% | 05 Jun, 2024 | PyPI pymongo |
Privilege Escalation & SQL Injection in TYPO3 CMS GHSA-7qwg-fcpw-xg5g | High | Not scored | 05 Jun, 2024 | Packagist typo3/cms |
TYPO3 Remote Code Execution in third party library swiftmailer GHSA-g4pf-3jvq-2gcw | High | Not scored | 05 Jun, 2024 | Packagist typo3/cms |
Insecure Deserialization in TYPO3 CMS GHSA-8h28-f46f-m87h | High | Not scored | 05 Jun, 2024 | Packagist typo3/cms |
Remote code execution in web server context CVE-2024-37295, GHSA-rhc2-23c2-ww7c | High | 0.6% | 05 Jun, 2024 | Packagist aimeos/aimeos-core |
Jan path traversal vulnerability CVE-2024-36857, GHSA-5jqc-qj57-4hrc | High | 2.1% | 04 Jun, 2024 | npm @janhq/core |
malicious container creates symlink "mtab" on the host External CVE-2024-5154, GHSA-j9hf-98c3-wrm8, GO-2024-2919 | High | 1.2% | 04 Jun, 2024 | Go github.com/cri-o/cri-o |
apko Exposure of HTTP basic auth credentials in log output CVE-2024-36127, GHSA-v6mg-7f7p-qmqp, GO-2024-2899 | High | 0.4% | 04 Jun, 2024 | Go chainguard.dev/apko |
Flooding Server with Thumbnail files CVE-2024-32871, GHSA-277c-5vvj-9pwx | High | 0.8% | 04 Jun, 2024 | Packagist pimcore/pimcore |
XML External Entity (XXE) Processing in TYPO3 Core GHSA-qffc-gwpp-m2xr | High | Not scored | 04 Jun, 2024 | Packagist typo3/cms |
Skops unsafe deserialization CVE-2024-37065, GHSA-q49c-6v6g-wgq3, PYSEC-2026-1928 | High | 0.2% | 04 Jun, 2024 | PyPI skops |
ydata unsafe deserialization CVE-2024-37064, GHSA-cg49-hrj4-3rpr, PYSEC-2026-2061 | High | 0.2% | 04 Jun, 2024 | PyPI ydata-profiling |
ydata cross-site scripting CVE-2024-37063, GHSA-2r57-2mrh-ggjv, PYSEC-2026-2060 | High | 0.3% | 04 Jun, 2024 | PyPI ydata-profiling |
ydata unsafe deserialization CVE-2024-37062, GHSA-fpvj-m2h6-6wc5, PYSEC-2026-2062 | High | 0.2% | 04 Jun, 2024 | PyPI ydata-profiling |
MLFlow improper input validation BIT-mlflow-2024-37061, CVE-2024-37061, GHSA-pqcv-qw2r-r859, PYSEC-2026-1657 | High | 0.9% | 04 Jun, 2024 | PyPI mlflow |
MLFlow unsafe deserialization BIT-mlflow-2024-37060, CVE-2024-37060, GHSA-cv6c-7963-wxcg, PYSEC-2026-1647 | High | 0.8% | 04 Jun, 2024 | PyPI mlflow |
MLFlow unsafe deserialization BIT-mlflow-2024-37059, CVE-2024-37059, GHSA-wf7f-8fxf-xfxc, PYSEC-2026-1660 | High | 0.6% | 04 Jun, 2024 | PyPI mlflow |
MLFlow unsafe deserialization BIT-mlflow-2024-37058, CVE-2024-37058, GHSA-cwgg-w6mp-w9hg, PYSEC-2026-1648 | High | 0.6% | 04 Jun, 2024 | PyPI mlflow |
MLFlow unsafe deserialization BIT-mlflow-2024-37057, CVE-2024-37057, GHSA-j8mg-pqc5-x9gj, PYSEC-2026-1654 | High | 0.6% | 04 Jun, 2024 | PyPI mlflow |
MLFlow unsafe deserialization BIT-mlflow-2024-37056, CVE-2024-37056, GHSA-7p8j-qv6x-f4g4, PYSEC-2026-1644 | High | 0.6% | 04 Jun, 2024 | PyPI mlflow |
MLFlow unsafe deserialization BIT-mlflow-2024-37055, CVE-2024-37055, GHSA-x38x-g6gr-jqff, PYSEC-2026-1663 | High | 0.6% | 04 Jun, 2024 | PyPI mlflow |
MLFlow unsafe deserialization BIT-mlflow-2024-37054, CVE-2024-37054, GHSA-ghv6-9r9j-wh4j, PYSEC-2026-1651 | High | 0.7% | 04 Jun, 2024 | PyPI mlflow |
MLFlow unsafe deserialization BIT-mlflow-2024-37053, CVE-2024-37053, GHSA-43c4-9qgj-x742, PYSEC-2026-1636 | High | 0.6% | 04 Jun, 2024 | PyPI mlflow |
MLFlow unsafe deserialization BIT-mlflow-2024-37052, CVE-2024-37052, GHSA-76cg-cfhx-373f, PYSEC-2026-1643 | High | 0.7% | 04 Jun, 2024 | PyPI mlflow |
TYPO3 SQL Injection in dbal GHSA-9895-53fc-98v2 | High | Not scored | 03 Jun, 2024 | Packagist typo3/cms |
Directus is soft-locked by providing a string value to random string util CVE-2024-36128, GHSA-632p-p495-25m5 | High | 0.6% | 03 Jun, 2024 | npm directus |
activeadmin vulnerable to stored persistent cross-site scripting (XSS) in dynamic form legends CVE-2024-37031, GHSA-9mg6-x45v-hcfm | High | 0.4% | 02 Jun, 2024 | RubyGems activeadmin |
Moodle ReCAPTCHA can be bypassed on the login page BIT-moodle-2024-34009, CVE-2024-34009, GHSA-gwf6-q6c2-94p3 | High | 0.4% | 31 May, 2024 | Packagist moodle/moodle |
Moodle CSRF risk in analytics management of models BIT-moodle-2024-34008, CVE-2024-34008, GHSA-68x5-4jg5-gjgg | High | 0.4% | 31 May, 2024 | Packagist moodle/moodle |