Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Gradio's Component Server does not properly consider` _is_server_fn` for functions CVE-2024-34511, GHSA-34rf-p3r3-58x2, PYSEC-2026-1407 | Medium | Not scored | 05 May, 2024 | PyPI gradio |
MediaWiki UnlinkedWikibase Cross-site Scripting vulnerability BIT-mediawiki-2024-34500, CVE-2024-34500, GHSA-wcx3-63mm-h8x6 | Medium | 0.5% | 05 May, 2024 | Packagist samwilson/unlinked-wikibase |
btcd susceptible to consensus failures CVE-2024-34478, GHSA-3jgf-r68h-xfqm, GO-2024-2818 | Medium | 0.6% | 05 May, 2024 | Go github.com/btcsuite/btcd |
Ryu Infinite Loop vulnerability CVE-2024-34484, GHSA-c7w6-33j3-j3mx, PYSEC-2026-1880 | Medium | 0.5% | 05 May, 2024 | PyPI ryu |
ThinkPHP Cross-Site Scripting Vulnerability CVE-2024-34467, GHSA-969f-v7jv-pgj3 | Medium | 0.4% | 04 May, 2024 | Packagist topthink/framework |
Zenario's Tree Explorer tool from Organizer affected by Cross-site Scripting CVE-2024-34460, GHSA-7qwj-gcjf-828f | Medium | 0.6% | 04 May, 2024 | Packagist tribalsystems/zenario |
Pterodactyl Wings vulnerable to Server-Side Request Forgery during remote file pull CVE-2024-34068, GHSA-qq22-jj8x-4wwv, GO-2024-2815 | Medium | 0.4% | 03 May, 2024 | Go github.com/pterodactyl/wings |
kurwov vulnerable to Denial of Service due to improper data sanitization CVE-2024-34075, GHSA-hfrv-h3q8-9jpr | Medium | 0.3% | 03 May, 2024 | npm kurwov |
Pterodactyl panel's admin area vulnerable to Cross-site Scripting CVE-2024-34067, GHSA-384w-wffr-x63q | Medium | 0.5% | 03 May, 2024 | Packagist pterodactyl/panel |
Vditor allows Cross-site Scripting via an attribute of an `A` element CVE-2024-34449, GHSA-m5jf-8crm-r65m | Medium | 0.4% | 03 May, 2024 | npm vditor |
tqdm CLI arguments injection attack CVE-2024-34062, GHSA-g7vv-2v7x-gj9p, PYSEC-2026-1976 | Medium | 0.4% | 03 May, 2024 | PyPI tqdm |
TP-Link TL-WR841N Authentication Bypass by Spoofing Vulnerability CVE-2023-50224 | MediumExploited | 20.0% | 03 May, 2024 | |
kubevirt allows a local attacker to execute arbitrary code via a crafted command CVE-2024-33394, GHSA-4q63-mr2m-57hf, GO-2024-2816 | Medium | 0.3% | 02 May, 2024 | Go kubevirt.io/kubevirt |
Firebase vulnerable to CRSF attack CVE-2024-4128, GHSA-rcm2-22f3-pqv3, GO-2024-2808 | Medium | 0.1% | 02 May, 2024 | Go github.com/firebase/firebase-tools npm firebase-tools |
changedetection.io Cross-site Scripting vulnerability CVE-2024-34061, GHSA-pwgc-w4x9-gw67, PYSEC-2026-1243 | Medium | 1.3% | 02 May, 2024 | PyPI changedetection-io PyPI changedetection.io |
Zitadel exposing internal database user name and host information CVE-2024-32967, GHSA-q5qj-x2h5-3945, GO-2024-2804 | Medium | 0.6% | 01 May, 2024 | Go github.com/zitadel/zitadel |
Navidrome Parameter Tampering vulnerability CVE-2024-32963, GHSA-4jrx-5w4h-3gpm, GO-2024-2803 | Medium | 0.4% | 01 May, 2024 | Go github.com/navidrome/navidrome |
lunasvg v2.3.9 was discovered to contain a segmentation violation via the component composition_solid_source. CVE-2024-33767, PYSEC-2024-284 | Medium | 0.3% | 01 May, 2024 | PyPI lunasvg |
lunasvg v2.3.9 was discovered to contain an FPE (Floating Point Exception) at blend_transformed_tiled_argb.isra.0. CVE-2024-33766, PYSEC-2024-283 | Medium | 0.6% | 01 May, 2024 | PyPI lunasvg |
lunasvg v2.3.9 was discovered to contain a stack-overflow at lunasvg/source/element.h. CVE-2024-33764, PYSEC-2024-282 | Medium | 0.3% | 01 May, 2024 | PyPI lunasvg |
ejs lacks certain pollution protection CVE-2024-33883, GHSA-ghr5-ch3p-vcr6 | Medium | 0.6% | 28 Apr, 2024 | npm ejs |
mdanter/ecc affected by timing vulnerability in cryptographic side-channels CVE-2024-33851, GHSA-3494-cfwf-56hw | Medium | 0.4% | 27 Apr, 2024 | Packagist mdanter/ecc Packagist paragonie/ecc |
dcnnt-py is vulnerable to command injection via Notification Handler CVE-2023-1000, GHSA-8p42-7597-p2f6, PYSEC-2026-1293 | Medium | 1.3% | 27 Apr, 2024 | PyPI dcnnt |
Sidekiq vulnerable to a Reflected XSS in Queues Web Page CVE-2024-32887, GHSA-q655-3pj8-9fxq | Medium | 0.6% | 26 Apr, 2024 | RubyGems sidekiq |
Lavalite CMS Cross Site Scripting vulnerability CVE-2024-31828, GHSA-5hcr-g32p-h74c | Medium | 0.5% | 26 Apr, 2024 | Packagist lavalite/cms |
Argo CD vulnerable to a Denial of Service via malicious jqPathExpressions in ignoreDifferences BIT-argo-cd-2024-32476, CVE-2024-32476, GHSA-9m6p-x4h2-6frq, GO-2024-2792 | Medium | 1.0% | 26 Apr, 2024 | Go github.com/argoproj/argo-cd Go github.com/argoproj/argo-cd/v2 |
Mattermost's detailed error messages reveal the full file path CVE-2024-32046, GHSA-vx97-8q8q-qgq5, GO-2024-2797 | Medium | 0.5% | 26 Apr, 2024 | Go github.com/mattermost/mattermost-server |
Mattermost crashes web clients via a malformed custom status CVE-2024-4182, GHSA-8f99-g2pj-x8w3, GO-2024-2795 | Medium | 0.6% | 26 Apr, 2024 | Go github.com/mattermost/mattermost-server |
Mattermost fails to limit the number of active sessions CVE-2024-4183, GHSA-wj37-mpq9-xrcm, GO-2024-2798 | Medium | 0.6% | 26 Apr, 2024 | Go github.com/mattermost/mattermost-server |
Passbolt API allows HTML injection CVE-2024-33670, GHSA-2pg6-vw9c-qhjv | Medium | 0.5% | 26 Apr, 2024 | Packagist passbolt/passbolt_api |
Passbolt Browser Extension leaks password information CVE-2024-33669, GHSA-xfq4-78j7-v594 | Medium | 0.6% | 26 Apr, 2024 | npm passbolt-browser-extension |
python-jose denial of service via compressed JWE content CVE-2024-33664, GHSA-cjwg-qfpm-7377, PYSEC-2024-233 | Medium | 0.8% | 26 Apr, 2024 | PyPI python-jose |
CoreDNS may return invalid cache entries CVE-2024-0874, GHSA-m9w6-wp3h-vq8g, GO-2024-2785 | Medium | 0.8% | 25 Apr, 2024 | Go github.com/coredns/coredns |
vyper default functions don't respect nonreentrancy keys CVE-2024-32648, GHSA-m2v9-w374-5hj9, PYSEC-2024-163 | Medium | 0.4% | 25 Apr, 2024 | PyPI vyper |
vyper performs multiple eval of `sqrt()` argument built in CVE-2024-32649, GHSA-5jrj-52x8-m64h, PYSEC-2024-209 | Medium | 0.5% | 25 Apr, 2024 | PyPI vyper |
vyper performs incorrect topic logging in raw_log CVE-2024-32645, GHSA-xchq-w5r3-4wg3, PYSEC-2024-206 | Medium | 0.5% | 25 Apr, 2024 | PyPI vyper |
vyper performs double eval of the slice start/length args in certain cases CVE-2024-32646, GHSA-r56x-j438-vw5m, PYSEC-2024-207 | Medium | 0.5% | 25 Apr, 2024 | PyPI vyper |
vyper performs double eval of raw_args in create_from_blueprint CVE-2024-32647, GHSA-3whq-64q2-qfj6, PYSEC-2024-208 | Medium | 0.5% | 25 Apr, 2024 | PyPI vyper |
vyper's range(start, start + N) reverts for negative numbers CVE-2024-32481, GHSA-ppx5-q359-pvwj, PYSEC-2024-246 | Medium | 0.8% | 25 Apr, 2024 | PyPI vyper |
Information disclosure in podman CVE-2020-14370, GHSA-c3wv-qmjj-45r6, GO-2024-2766 | Medium | 1.4% | 24 Apr, 2024 | Go github.com/containers/libpod Go github.com/containers/libpod/v2 Go github.com/containers/podman/v2 |
Kubelet Incorrect Privilege Assignment CVE-2019-11245, GHSA-r76g-g87f-vw8f, GO-2024-2780 | Medium | 0.6% | 24 Apr, 2024 | Go k8s.io/kubernetes Go k8s.io/kubernetes/cmd/kubelet |
Sensitive Information leak via Log File in Kubernetes CVE-2020-8563, GHSA-5xfg-wv98-264m, GO-2024-2755 | Medium | 0.5% | 24 Apr, 2024 | Go github.com/kubernetes/kubernetes Go k8s.io/kubernetes |
Sensitive Information leak via Log File in Kubernetes CVE-2020-8566, GHSA-5x96-j797-5qqw, GO-2024-2754 | Medium | 0.5% | 24 Apr, 2024 | Go github.com/kubernetes/kubernetes Go k8s.io/kubernetes |
Denial of service in Kubernetes CVE-2020-8557, GHSA-55qj-gj3x-jq9r, GO-2024-2753 | Medium | 0.4% | 24 Apr, 2024 | Go k8s.io/kubernetes Go k8s.io/kubernetes/pkg/kubelet |
Privilege Escalation in Kubernetes CVE-2020-8559, GHSA-33c5-9fx5-fvjm, GO-2024-2748 | Medium | 6.1% | 24 Apr, 2024 | Go k8s.io/apimachinery Go k8s.io/kubernetes |
Cisco ASA and FTD Privilege Escalation Vulnerability CVE-2024-20359 | MediumExploited | 18.8% | 24 Apr, 2024 | |
social-auth-app-django affected by Improper Handling of Case Sensitivity CVE-2024-32879, GHSA-2gr8-3wc7-xhj3, PYSEC-2026-1931 | Medium | 0.6% | 24 Apr, 2024 | PyPI social-auth-app-django |
Pimcore TinyMCE Bundle - tinymce CVE-2024-29203, CVE-2024-29881 GHSA-vjwg-28gv-pm8h | Medium | Not scored | 24 Apr, 2024 | Packagist pimcore/pimcore |
Hugo Markdown titles do not escaped in internal render hooks CVE-2024-32875, GHSA-ppf8-hhpp-f5hj, GO-2024-2747 | Medium | 0.5% | 23 Apr, 2024 | Go github.com/gohugoio/hugo |
Synapse V2 state resolution weakness allows Denial of Service (DoS) CVE-2024-31208, GHSA-3h7q-rfh9-xm4v, PYSEC-2024-50 | Medium | 1.5% | 23 Apr, 2024 | PyPI matrix-synapse |