Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
ZITADEL's Improper Content-Type Validation Leads to Account Takeover via Stored XSS + CSP Bypass CVE-2024-29891, GHSA-hr5w-cwwq-2v4m, GO-2024-2665 | High | 0.8% | 28 Mar, 2024 | Go github.com/zitadel/zitadel |
ZITADEL's actions can overload reserved claims CVE-2024-29892, GHSA-gp8g-f42f-95q2, GO-2024-2664 | High | 0.8% | 28 Mar, 2024 | Go github.com/zitadel/zitadel |
Content-Security-Policy header generation in middleware could be compromised by malicious injections CVE-2024-29896, GHSA-w387-5qqw-7g8m | High | 0.6% | 28 Mar, 2024 | npm @kindspells/astro-shield |
domain-suffix RegEx Denial of Service CVE-2024-25354, GHSA-cqfh-c4c5-c2hg | High | 0.6% | 27 Mar, 2024 | npm domain-suffix |
SQL Injection vulnerability in Reportico Till CVE-2023-47438, GHSA-jjf4-959w-f545 | High | 0.5% | 27 Mar, 2024 | Packagist reportico-web/reportico |
Cross site scripting (XSS) in JupyterHub via Self-XSS leveraged by Cookie Tossing BIT-jupyterhub-2024-28233, CVE-2024-28233, GHSA-7r3h-4ph8-w38g, PYSEC-2026-1480 | High | 0.3% | 27 Mar, 2024 | PyPI jupyterhub |
Gradio's CI vulnerable to Command Injection CVE-2024-1540, GHSA-xcgp-r7r8-2hc9 | High | 2.0% | 27 Mar, 2024 | PyPI gradio |
gradio Server-Side Request Forgery vulnerability CVE-2024-2206, GHSA-r364-m2j9-mf4h, PYSEC-2026-1420 | High | 0.4% | 27 Mar, 2024 | PyPI gradio |
ansys-geometry-core OS Command Injection vulnerability CVE-2024-29189, GHSA-38jr-29fh-w9vm, PYSEC-2026-1127 | High | 0.3% | 25 Mar, 2024 | PyPI ansys-geometry-core |
WP Crontrol vulnerable to possible RCE when combined with a pre-condition CVE-2024-28850, GHSA-9xvf-cjvf-ff5q | High | 0.2% | 25 Mar, 2024 | Packagist johnbillion/wp-crontrol |
phpMyFAQ SQL injections at insertentry & saveentry CVE-2024-28107, GHSA-2grw-mc9r-822r | High | 1.0% | 25 Mar, 2024 | Packagist phpmyfaq/phpmyfaq |
phpMyFAQ's File Upload Bypass at Category Image Leads to RCE CVE-2024-28105, GHSA-pwh2-fpfr-x5gf | High | 1.5% | 25 Mar, 2024 | Packagist phpmyfaq/phpmyfaq |
phpMyFAQ SQL Injection at "Save News" CVE-2024-27299, GHSA-qgxx-4xv5-6hcw | High | 1.2% | 25 Mar, 2024 | Packagist phpmyfaq/phpmyfaq |
web3-utils Prototype Pollution vulnerability CVE-2024-21505, GHSA-2g4c-8fpm-c46v | High | 0.7% | 25 Mar, 2024 | npm web3-utils |
OneUptime Vulnerable to a Privilege Escalation via Local Storage Key Manipulation CVE-2024-29194, GHSA-246p-xmg8-wmcq | High | 0.7% | 24 Mar, 2024 | npm @oneuptime/common-server npm @oneuptime/model |
PaddlePaddle allows arbitrary file read via paddle.vision.ops.read_file CVE-2024-1603, GHSA-jwrc-3v3f-5cq5, PYSEC-2026-1755 | High | 0.6% | 23 Mar, 2024 | PyPI paddlepaddle |
Microsoft .NET Framework Information Disclosure Vulnerability CVE-2024-29059 | HighExploited | 98.6% | 23 Mar, 2024 | |
SSRF Vulnerability on assetlinks_check(act_name, well_knowns) CVE-2024-29190, GHSA-wfgj-wrgh-h3r3, PYSEC-2024-257, PYSEC-2026-1677 | High | 0.7% | 22 Mar, 2024 | PyPI mobsf PyPI mobsfscan |
Cross-Site Request Forgery in Anchor CMS CVE-2024-29499, GHSA-4xw8-9fj7-j58j | High | 0.3% | 22 Mar, 2024 | Packagist anchorcms/anchor-cms |
Server Side Template Injection (SSTI) via Twig escape handler CVE-2024-28119, GHSA-2m7x-c7px-hp58 | High | 1.6% | 21 Mar, 2024 | Packagist getgrav/grav |
Server Side Template Injection (SSTI) CVE-2024-28118, GHSA-r6vw-8v8r-pmp4 | High | 1.2% | 21 Mar, 2024 | Packagist getgrav/grav |
Server Side Template Injection (SSTI) CVE-2024-28117, GHSA-qfv4-q44r-g7rv | High | 1.4% | 21 Mar, 2024 | Packagist getgrav/grav |
Server-Side Template Injection (SSTI) with Grav CMS security sandbox bypass CVE-2024-28116, GHSA-c9gp-64c4-2rrh | High | 5.8% | 21 Mar, 2024 | Packagist getgrav/grav |
Grav File Upload Path Traversal CVE-2024-27921, GHSA-m7hx-hw6h-mqmc | High | 60.6% | 21 Mar, 2024 | Packagist getgrav/grav |
Path traversal in webpack-dev-middleware CVE-2024-29180, GHSA-wr3j-pwj9-hqq6 | High | 1.2% | 21 Mar, 2024 | npm webpack-dev-middleware |
ESPHome vulnerable to Authentication bypass via Cross site request forgery CVE-2024-29019, GHSA-5925-88xh-6h99, PYSEC-2026-1327 | High | 0.3% | 21 Mar, 2024 | PyPI esphome |
Memory leaks in code encrypting and verifying RSA payloads CVE-2024-1394, GHSA-78hx-gp6g-7mj6, GO-2024-2660 | High | 1.5% | 20 Mar, 2024 | Go github.com/golang-fips/go Go github.com/golang-fips/openssl/v2 Go github.com/microsoft/go-crypto-openssl Go github.com/microsoft/go-crypto-openssl/openssl |
`qiskit_ibm_runtime.RuntimeDecoder` can execute arbitrary code CVE-2024-29032, GHSA-x4x5-jv3x-9c7m, PYSEC-2026-1858 | High | 0.4% | 20 Mar, 2024 | PyPI qiskit-ibm-runtime |
Denial of service via regular expression CVE-2024-28865, GHSA-wj85-w4f4-xh8h, PYSEC-2026-2049 | High | 0.6% | 18 Mar, 2024 | PyPI wiki |
Improper HTML sanitization in ZITADEL CVE-2024-28855, GHSA-hfrg-4jwr-jfpj, GO-2024-2655 | High | 0.8% | 18 Mar, 2024 | Go github.com/zitadel/zitadel |
Intermittent HTTP policy bypass BIT-cilium-2024-28248, BIT-cilium-operator-2024-28248, BIT-cilium-proxy-2024-28248, BIT-hubble-2024-28248, BIT-hubble-relay-2024-28248, BIT-hubble-ui-2024-28248, BIT-hubble-ui-backend-2024-28248, CVE-2024-28248, GHSA-68mj-9pjq-mc85, GO-2024-2653 | High | 0.6% | 18 Mar, 2024 | Go github.com/cilium/cilium |
Denial of Service (DoS) Vulnerability Due to Unsafe Array Modification in Multi-threaded Environment BIT-argo-cd-2024-21661, CVE-2024-21661, GHSA-6v85-wr92-q4p7, GO-2024-2654 | High | 1.2% | 18 Mar, 2024 | Go github.com/argoproj/argo-cd Go github.com/argoproj/argo-cd/v2 |
RCE in TranformGraph().to_dot_graph function CVE-2023-41334, GHSA-h2x6-5jx5-46hf, PYSEC-2026-1199 | High | 1.1% | 18 Mar, 2024 | PyPI astropy |
Podman affected by CVE-2024-1753 container escape at build time CVE-2024-1753, GHSA-874v-pj72-92f3, GHSA-pmf3-c36m-g5cf, GO-2024-2658 | High | 0.5% | 18 Mar, 2024 | Go github.com/containers/buildah Go github.com/containers/podman/v4 Go github.com/containers/podman/v5 |
Adobe ColdFusion Improper Access Control Vulnerability CVE-2024-20767 | HighExploited | 98.5% | 18 Mar, 2024 | |
CLI for Vela Insecure Variable Substitution GHSA-4jhj-3gv3-c3gr, GO-2024-2647 | High | Not scored | 15 Mar, 2024 | Go github.com/go-vela/cli |
Golang SDK for Vela Insecure Variable Substitution GHSA-v8mx-hp2q-gw85, GO-2024-2650 | High | Not scored | 15 Mar, 2024 | Go github.com/go-vela/sdk-go |
Server/API for Vela Insecure Variable Substitution GHSA-69p4-j5v5-x234, GO-2024-2648 | High | Not scored | 15 Mar, 2024 | Go github.com/go-vela/server |
Types for Vela Insecure Variable Substitution GHSA-7v38-w32m-wx4m, GO-2024-2649 | High | Not scored | 15 Mar, 2024 | Go github.com/go-vela/types |
Nuclei allows unsigned code template execution through workflows CVE-2024-27920, GHSA-w5wx-6g2r-r78q, GO-2024-2645 | High | 0.4% | 15 Mar, 2024 | Go github.com/projectdiscovery/nuclei Go github.com/projectdiscovery/nuclei/v2 Go github.com/projectdiscovery/nuclei/v3 |
RaspAP Vulnerable to Code Injection via an Unknown Process in File `includes/provider.php` CVE-2024-2497, GHSA-99wg-vmvq-2cp5 | High | 0.9% | 15 Mar, 2024 | Packagist billz/raspap-webgui |
Insecure Variable Substitution in Vela CVE-2024-28236, GHSA-pwx5-6wxg-px5h, GO-2024-2641 | High | 0.7% | 14 Mar, 2024 | Go github.com/go-vela/worker |
greykite v1.0.0 was discovered to contain an arbitrary file upload vulnerability in the load_obj function at /templates/pickle_utils.py. This vulnerability allows attackers to execute arbitrary code via uploading a crafted file. CVE-2024-28425, PYSEC-2024-276 | High | 0.6% | 14 Mar, 2024 | PyPI greykite |
TurboBoost Commands vulnerable to arbitrary method invocation CVE-2024-28181, GHSA-mp76-7w5v-pr75 | High | 0.8% | 14 Mar, 2024 | RubyGems turbo_boost-commands npm @turbo-boost/commands |
Apache Airflow: Ignored Airflow Permission BIT-airflow-2024-28746, CVE-2024-28746, GHSA-h574-6646-vfxx, PYSEC-2024-46 | High | 1.3% | 14 Mar, 2024 | PyPI apache-airflow |
Microsoft Windows Error Reporting Service Improper Privilege Management Vulnerability CVE-2024-26169 | HighExploited | 4.0% | 12 Mar, 2024 | |
Remote Code Execution Vulnerability in Microsoft Django Backend for SQL Server CVE-2024-26164, GHSA-vmqv-47j8-gwv8, PYSEC-2026-1684 | High | 2.1% | 12 Mar, 2024 | PyPI mssql-django |
ASA-2024-006: ValidateVoteExtensions helper function in Cosmos SDK may allow incorrect voting power assumptions GHSA-95rx-m9m5-m94v, GO-2024-2638 | High | Not scored | 12 Mar, 2024 | Go github.com/cosmos/cosmos-sdk |
StimulusReflex arbitrary method call CVE-2024-28121, GHSA-f78j-4w3g-4q65 | High | 1.6% | 12 Mar, 2024 | RubyGems stimulus_reflex npm stimulus_reflex |
Cross-site Scripting (XSS) possible with maliciously formed HTML attribute names and values in Phlex CVE-2024-28199, GHSA-242p-4v39-2v8g | High | 0.6% | 12 Mar, 2024 | RubyGems phlex |