Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
RailsAdmin Cross-site Scripting vulnerability in the list view CVE-2024-39308, GHSA-8qgm-g2vv-vwvc | Medium | 0.6% | 08 Jul, 2024 | RubyGems rails_admin |
ZITADEL Vulnerable to Session Information Leakage CVE-2024-39683, GHSA-cvw9-c57h-3397, GO-2024-2968 | Medium | 0.6% | 05 Jul, 2024 | Go github.com/zitadel/zitadel |
Malicious Matrix homeserver can leak truncated message content of messages it shouldn't have access to CVE-2024-39691, GHSA-w9mh-5x8j-9754 | Medium | 0.5% | 05 Jul, 2024 | npm matrix-appservice-irc |
ShopXO Server-Side Request Forgery Vulnerability CVE-2024-6524, GHSA-c96r-38gv-grp4 | Medium | 0.5% | 05 Jul, 2024 | Packagist shopxo/shopxo |
github.com/google/nftable IP addresses were encoded in the wrong byte order CVE-2024-6284, GHSA-qjvf-8748-9w7h, GO-2024-2977 | Medium | 0.3% | 04 Jul, 2024 | Go github.com/google/nftables |
Information Disclosure Vulnerability in Privacy Center of SERVER_SIDE_FIDES_API_URL CVE-2024-31223, GHSA-53q7-4874-24qg, PYSEC-2026-1334 | Medium | 1.1% | 03 Jul, 2024 | PyPI ethyca-fides |
Rack ReDoS Vulnerability in HTTP Accept Headers Parsing CVE-2024-39316, GHSA-cj83-2ww7-mvq7 | Medium | 0.9% | 03 Jul, 2024 | RubyGems rack |
Pomerium exposed OAuth2 access and ID tokens in user info endpoint response CVE-2024-39315, GHSA-rrqr-7w59-637v, GO-2024-2965 | Medium | 0.4% | 03 Jul, 2024 | Go github.com/pomerium/pomerium |
ai-controller-frontend payment status in basket isn't reset CVE-2024-39325, GHSA-m9gv-6p22-qgmj | Medium | 0.4% | 02 Jul, 2024 | Packagist aimeos/ai-controller-frontend |
aimeos/ai-admin-jsonadm improper access control vulnerability allows editors to remove required records CVE-2024-39322, GHSA-8fj2-587w-5whr | Medium | 0.5% | 02 Jul, 2024 | Packagist aimeos/ai-admin-jsonadm |
Panic in Pipeline when PgConn is busy or closed in github.com/jackc/pgx GHSA-fqpg-rq76-99pq, GO-2024-2567 | Medium | Not scored | 02 Jul, 2024 | Go github.com/jackc/pgx/v5 |
Denial of service via malicious preflight requests in github.com/rs/cors CVE-2025-47908, GHSA-mh55-gqvf-xfwm, GO-2024-2883 | Medium | 0.6% | 02 Jul, 2024 | Go github.com/rs/cors |
Twilio Authy Information Disclosure Vulnerability CVE-2024-39891 | MediumExploited | 1.7% | 02 Jul, 2024 | |
Weblate vulnerable to improper sanitization of project backups CVE-2024-39303, GHSA-jfgp-674x-6q4p, PYSEC-2026-2041 | Medium | 0.3% | 01 Jul, 2024 | PyPI Weblate PyPI weblate |
Flowise Cross-site Scripting in/api/v1/credentials/id CVE-2024-37146, GHSA-wxm4-9f8p-gggv | Medium | 0.4% | 01 Jul, 2024 | npm flowise |
Flowise Cross-site Scripting in /api/v1/chatflows-streaming/id CVE-2024-37145, GHSA-858c-qxvx-rg9v | Medium | 0.5% | 01 Jul, 2024 | npm flowise |
Flowise Cross-site Scripting in /api/v1/public-chatflows/id CVE-2024-36423, GHSA-fccx-2pwj-hrq7 | Medium | 0.4% | 01 Jul, 2024 | npm flowise |
Cisco NX-OS Command Injection Vulnerability CVE-2024-20399 | MediumExploited | 4.3% | 01 Jul, 2024 | |
Flowise Cross-site Scripting in api/v1/chatflows/id CVE-2024-36422, GHSA-2jch-qc96-9f5g | Medium | 0.4% | 01 Jul, 2024 | npm flowise |
@cat5th/key-serializer Prototype Pollution vulnerability CVE-2024-39018, GHSA-whpx-g542-7c7v | Medium | 0.4% | 01 Jul, 2024 | npm @cat5th/key-serializer |
ag-grid packages vulnerable to Prototype Pollution CVE-2024-39001, GHSA-328p-362g-r48j | Medium | 0.8% | 01 Jul, 2024 | npm @ag-grid-enterprise/charts npm ag-grid-community npm ag-grid-enterprise |
adolph_dudu ratio-swiper was discovered to contain a prototype pollution via the function extendDefaults CVE-2024-38997, GHSA-88vr-hjqx-57qh | Medium | 0.5% | 01 Jul, 2024 | npm @adolph_dudu/ratio-swiper |
@aofl/cli-lib Prototype Pollution vulnerability CVE-2024-38987, GHSA-vg6v-jcg3-5mp7 | Medium | 0.5% | 01 Jul, 2024 | npm @aofl/cli-lib |
Reflected Cross-Site Scripting (XSS) in zenml CVE-2024-5062, GHSA-3434-hc3m-8mmm, PYSEC-2024-176 | Medium | 0.4% | 30 Jun, 2024 | PyPI zenml |
CometBFT is unstability during blocksync when syncing from malicious peer GHSA-hg58-rf2h-6rr7, GO-2024-2951 | Medium | Not scored | 28 Jun, 2024 | Go github.com/cometbft/cometbft |
litellm vulnerable to improper access control in team management CVE-2024-5710, GHSA-qqcv-vg9f-5rr3, PYSEC-2026-1551 | Medium | 0.4% | 27 Jun, 2024 | PyPI litellm |
Directory creation by malicious user in saltstack CVE-2024-22231, GHSA-q27c-j6j9-53w3, PYSEC-2026-1900 | Medium | 0.7% | 27 Jun, 2024 | PyPI salt |
@fastly/js-compute has a use-after-free in some host call implementations CVE-2024-38375, GHSA-mp3g-vpm9-9vqv | Medium | 0.3% | 26 Jun, 2024 | npm @fastly/js-compute |
Cross-site Scripting in ZenUML CVE-2024-38527, GHSA-q6xv-jm4v-349h | Medium | 0.4% | 26 Jun, 2024 | npm @zenuml/core |
October System module has a Reflected XSS via X-October-Request-Handler Header CVE-2024-25637, GHSA-rjw8-v7rr-r563 | Medium | 0.3% | 26 Jun, 2024 | Packagist october/system |
October System module has an Open Redirect for Administrator Accounts CVE-2024-24764, GHSA-v2vf-jv88-3fp5 | Medium | 0.3% | 26 Jun, 2024 | Packagist october/system |
PingCAP TiDB nil pointer dereference CVE-2024-37820, GHSA-9g6g-xqv5-8g5w, GO-2024-3284 | Medium | 0.4% | 25 Jun, 2024 | Go github.com/pingcap/tidb |
go-retryablehttp can leak basic auth credentials to log files CVE-2024-6104, GHSA-v6v8-xj6m-xwqh, GO-2024-2947 | Medium | 0.4% | 24 Jun, 2024 | Go github.com/hashicorp/go-retryablehttp |
CodeChecker has a Path traversal in `CodeChecker server` in the endpoint of `CodeChecker store` CVE-2023-49793, GHSA-h26w-r4m5-8rrf, PYSEC-2024-54 | Medium | 0.7% | 24 Jun, 2024 | PyPI codechecker |
Improper line feed handling in zenml CVE-2024-4460, GHSA-7gjr-hcc3-xfr4, PYSEC-2026-2068 | Medium | Not scored | 24 Jun, 2024 | PyPI zenml |
Remote Code Execution in create_conda_env function in lollms CVE-2024-3121, GHSA-79h8-gxhq-q3jg, PYSEC-2026-1584 | Medium | 0.4% | 24 Jun, 2024 | PyPI lollms |
Open redirect in gradio CVE-2024-4940, GHSA-g6c9-f4xm-9j4x, PYSEC-2026-1414 | Medium | 1.0% | 22 Jun, 2024 | PyPI gradio |
Cross site scripting in opencart BIT-opencart-2024-21517, CVE-2024-21517, GHSA-qc3q-8rr8-8p5v | Medium | 0.4% | 22 Jun, 2024 | Packagist opencart/opencart |
Cross site scripting in opencart BIT-opencart-2024-21516, CVE-2024-21516, GHSA-pqhq-77pw-763c | Medium | 0.4% | 22 Jun, 2024 | Packagist opencart/opencart |
Cross site scripting in opencart BIT-opencart-2024-21515, CVE-2024-21515, GHSA-qx44-885h-7p56 | Medium | 0.4% | 22 Jun, 2024 | Packagist opencart/opencart |
events2 TYPO3 extension insecure direct object reference (IDOR) vulnerability CVE-2024-38874, GHSA-cchp-3rq6-69wj | Medium | 0.3% | 21 Jun, 2024 | Packagist jweiland/events2 |
FriendlyCaptcha Plugin for TYPO3 Captcha Check Bypass CVE-2024-38873, GHSA-jg62-h7pv-hxgv | Medium | 0.5% | 21 Jun, 2024 | Packagist studiomitte/friendlycaptcha |
SpiceDB exclusions can result in no permission returned when permission expected CVE-2024-38361, GHSA-grjv-gjgr-66g2, GO-2024-2939 | Medium | 0.4% | 20 Jun, 2024 | Go github.com/authzed/spicedb |
ACME DNS: Azure Identity Libraries Elevation of Privilege Vulnerability GHSA-rvj4-q8q5-8grf, GO-2024-2941 | Medium | Not scored | 20 Jun, 2024 | Go github.com/traefik/traefik Go github.com/traefik/traefik/v2 Go github.com/traefik/traefik/v3 |
SFTPGo has insufficient access control for password reset CVE-2024-37897, GHSA-hw5f-6wvv-xcrh, GO-2024-2940 | Medium | 0.3% | 20 Jun, 2024 | Go github.com/drakkan/sftpgo Go github.com/drakkan/sftpgo/v2 |
Apache Superset server arbitrary file read BIT-superset-2024-34693, CVE-2024-34693, GHSA-hcr7-cqwc-q5gq, PYSEC-2026-1183 | Medium | 1.6% | 20 Jun, 2024 | PyPI apache-superset |
TinyMCE Cross-Site Scripting (XSS) vulnerability using noneditable_regexp option CVE-2024-38356, GHSA-9hcv-j9pv-qmph, PYSEC-2026-1301 | Medium | 0.5% | 19 Jun, 2024 | NuGet TinyMCE Packagist tinymce/tinymce PyPI django-tinymce npm tinymce |
TinyMCE Cross-Site Scripting (XSS) vulnerability using noscript elements CVE-2024-38357, GHSA-w9jx-4g6g-rp7x, PYSEC-2026-1302 | Medium | 0.5% | 19 Jun, 2024 | NuGet TinyMCE Packagist tinymce/tinymce PyPI django-tinymce npm tinymce |
PocketBase performs password auth and OAuth2 unverified email linking CVE-2024-38351, GHSA-m93w-4fxv-r35v, GO-2024-2936 | Medium | 0.3% | 18 Jun, 2024 | Go github.com/pocketbase/pocketbase |
Moodle uses the same key for QR login and auto-login BIT-moodle-2024-38277, CVE-2024-38277, GHSA-r82w-3phg-qvr4 | Medium | 0.2% | 18 Jun, 2024 | Packagist moodle/moodle |