Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Joomla Framework Database Package Vulnerable to SQL Injection BIT-joomla-2025-25226, CVE-2025-25226, GHSA-44v2-prcf-pc3m | Critical | 0.5% | 08 Apr, 2025 | Packagist joomla/database |
crud-query-parser SQL Injection vulnerability CVE-2025-32020, GHSA-9r25-rp3p-h2w4 | Critical | 0.4% | 08 Apr, 2025 | npm crud-query-parser |
Langflow Unauth RCE CVE-2025-3248, GHSA-rvqx-wpfh-mfx7, PYSEC-2025-36, PYSEC-2026-380 | CriticalExploited | 100.0% | 07 Apr, 2025 | PyPI langflow PyPI langflow-base |
LNbits Lightning Network Payment System Vulnerable to Server-Side Request Forgery via LNURL Authentication Callback CVE-2025-32013, GHSA-qp8j-p87f-c8cc, PYSEC-2025-16 | Critical | 0.6% | 06 Apr, 2025 | PyPI lnbits |
BentoML Allows Remote Code Execution (RCE) via Insecure Deserialization CVE-2025-27520, GHSA-33xw-247w-6hmc, PYSEC-2026-294 | Critical | 40.6% | 04 Apr, 2025 | PyPI bentoml |
CrushFTP Authentication Bypass Vulnerability CVE-2025-31161 | CriticalExploited | 100.0% | 03 Apr, 2025 | |
Gladinet CentreStack and Triofox Use of Hard-coded Cryptographic Key Vulnerability CVE-2025-30406 | CriticalExploited | 94.3% | 03 Apr, 2025 | |
Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability CVE-2025-22457 | CriticalExploited | 100.0% | 03 Apr, 2025 | |
pgAdmin 4 Vulnerable to Cross-Site Scripting (XSS) via Query Result Rendering CVE-2025-2946, GHSA-2rrx-pphc-qfv9, PYSEC-2026-449 | Critical | 0.3% | 03 Apr, 2025 | PyPI pgadmin4 |
pgAdmin 4 Vulnerable to Remote Code Execution CVE-2025-2945, GHSA-g73c-fw68-pwx3, PYSEC-2026-451 | Critical | 56.3% | 03 Apr, 2025 | PyPI pgadmin4 |
Improper Scope Validation in the `open` Endpoint of `tauri-plugin-shell` CVE-2025-31477, GHSA-c9pr-q8gx-3mgp | Critical | 1.0% | 02 Apr, 2025 | crates.io tauri-plugin-shell npm @tauri-apps/plugin-shell |
Mobile Security Framework (MobSF) has a SSRF Vulnerability fix bypass on assetlinks_check with DNS Rebinding CVE-2025-31116, GHSA-fcfq-m8p6-gw56, PYSEC-2025-48 | Critical | 0.5% | 31 Mar, 2025 | PyPI mobsf |
@alizeait/unflatto Prototype Pollution CVE-2024-38988, GHSA-q8jq-4rm5-4hm5 | Critical | 0.9% | 28 Mar, 2025 | npm @alizeait/unflatto |
depath and cool-path vulnerable to Prototype Pollution via `set()` Method CVE-2024-38985, GHSA-4h4x-4m75-47j4 | Critical | 0.8% | 28 Mar, 2025 | npm cool-path npm depath |
A command injection vulnerability in the Command Dispatcher Service of NASA Fprime v3.4.3 allows attackers to execute arbitrary commands. CVE-2024-55030, PYSEC-2025-116 | Critical | 1.8% | 25 Mar, 2025 | PyPI fprime |
A template injection vulnerability in the Dashboard of NASA Fprime v3.4.3 allows attackers to execute arbitrary code via uploading a crafted Vue file. CVE-2024-55028, PYSEC-2025-114 | Critical | 0.8% | 25 Mar, 2025 | PyPI fprime |
Kentico Xperience CMS Authentication Bypass Using an Alternate Path or Channel Vulnerability CVE-2025-2747 | CriticalExploited | 97.2% | 24 Mar, 2025 | |
Kentico Xperience CMS Authentication Bypass Using an Alternate Path or Channel Vulnerability CVE-2025-2746 | CriticalExploited | 74.1% | 24 Mar, 2025 | |
Authorization Bypass in Next.js Middleware CVE-2025-29927, GHSA-f82v-jwr5-mffw | Critical | 99.2% | 21 Mar, 2025 | npm next |
vLLM deserialization vulnerability in vllm.distributed.GroupCoordinator.recv_object CVE-2024-9052, GHSA-pgr7-mhp5-fgjp, PYSEC-2026-568 | Critical | Not scored | 20 Mar, 2025 | PyPI vllm |
Kedro deserialization vulnerability CVE-2024-9701, GHSA-747f-ww56-4q4h, PYSEC-2026-367 | Critical | 1.1% | 20 Mar, 2025 | PyPI kedro |
BentoML deserialization vulnerability CVE-2024-9070, GHSA-9g44-gwvm-hc44, PYSEC-2026-295 | Critical | 0.9% | 20 Mar, 2025 | PyPI bentoml |
vLLM allows Remote Code Execution by Pickle Deserialization via AsyncEngineRPCServer() RPC server entrypoints CVE-2024-9053, GHSA-cj47-qj6g-x7r4, PYSEC-2025-222 | Critical | 1.4% | 20 Mar, 2025 | PyPI vllm |
Composio Eval Injection Vulnerability CVE-2024-8953, GHSA-5xg7-5662-8x7j, PYSEC-2026-1264 | Critical | 1.2% | 20 Mar, 2025 | PyPI composio-core |
Aim path traversal in LockManager.release_locks CVE-2024-8769, GHSA-4qcx-jx49-6qrh, PYSEC-2026-258 | Critical | 0.9% | 20 Mar, 2025 | PyPI aim |
AgentScope path traversal vulnerability in save-workflow CVE-2024-8551, GHSA-j9rw-qm5f-r8xm, PYSEC-2026-255 | Critical | 1.0% | 20 Mar, 2025 | PyPI agentscope |
AgentScope path traversal vulnerability CVE-2024-8537, GHSA-c4cc-w454-4634, PYSEC-2026-254 | Critical | 1.0% | 20 Mar, 2025 | PyPI agentscope |
AgentScope Deserialization Vulnerability CVE-2024-8502, GHSA-9w5h-67gf-xvv8, PYSEC-2026-253 | Critical | 1.8% | 20 Mar, 2025 | PyPI agentscope |
AgentScope Cross-Origin Resource Sharing (CORS) vulnerability CVE-2024-8487, GHSA-75v5-6885-59f9, PYSEC-2025-81 | Critical | 0.3% | 20 Mar, 2025 | PyPI agentscope |
PyTorch Lightning path traversal vulnerability CVE-2024-8019, GHSA-4cv3-v7pv-rfhf, PYSEC-2026-3970, PYSEC-2026-507 | Critical | 1.1% | 20 Mar, 2025 | PyPI lightning PyPI pytorch-lightning |
Open Neural Network Exchange (ONNX) Path Traversal Vulnerability CVE-2024-7776, GHSA-h36j-8vv3-cj52, PYSEC-2025-10 | Critical | 1.5% | 20 Mar, 2025 | PyPI onnx |
Aim vulnerable to Cross-Site Request Forgery CVE-2024-7760, GHSA-38r9-3j52-h92v, PYSEC-2026-1082 | Critical | 0.5% | 20 Mar, 2025 | PyPI aim |
Aim External Control of File Name or Path vulnerability CVE-2024-6829, GHSA-75px-35p4-qq6h, PYSEC-2026-259 | Critical | 0.9% | 20 Mar, 2025 | PyPI aim |
llama-index-packs-finchat SQL Injection vulnerability CVE-2024-12909, GHSA-x48g-hm9c-ww42, PYSEC-2026-398 | Critical | 1.4% | 20 Mar, 2025 | PyPI llama-index-packs-finchat |
LlamaIndex Retrievers Integration: DuckDBRetriever SQL Injection CVE-2024-11958, GHSA-339r-cjv9-x78g, PYSEC-2026-399 | Critical | 1.4% | 20 Mar, 2025 | PyPI llama-index-retrievers-duckdb-retriever |
InvokeAI Deserialization of Untrusted Data vulnerability CVE-2024-12029, GHSA-mcrp-whpw-jp68, PYSEC-2025-9 | Critical | 6.0% | 20 Mar, 2025 | PyPI InvokeAI PyPI invokeai |
InvokeAI Arbitrary File Deletion vulnerability CVE-2024-11042, GHSA-227r-w5j2-6243, PYSEC-2026-358 | Critical | 1.6% | 20 Mar, 2025 | PyPI InvokeAI PyPI invokeai |
vLLM Deserialization of Untrusted Data vulnerability CVE-2024-11041, GHSA-5vqr-wprc-cpp7, PYSEC-2026-566 | Critical | 1.7% | 20 Mar, 2025 | PyPI vllm |
DB-GPT vulnerable to Arbitrary File Upload with Path Traversal CVE-2024-10902, GHSA-3xq5-x4fj-rff7, PYSEC-2026-321 | Critical | 1.3% | 20 Mar, 2025 | PyPI dbgpt |
DB-GPT Arbitrary File Write vulnerability CVE-2024-10901, GHSA-7gj6-22m4-qfhx, PYSEC-2026-322 | Critical | 1.1% | 20 Mar, 2025 | PyPI dbgpt |
DB-GPT is vulnerable to SQL Injection attacks from unauthenticated users CVE-2024-10835, GHSA-qccg-9m4q-xfm6, PYSEC-2026-325 | Critical | 1.2% | 20 Mar, 2025 | PyPI dbgpt |
DB-GPT Absolute Path Traversal in knowledge/{space_name}/document/upload CVE-2024-10833, GHSA-j9g7-mqhh-9hxf, PYSEC-2026-324 | Critical | 0.8% | 20 Mar, 2025 | PyPI dbgpt |
DB-GPT Absolute Path Traversal vulnerability CVE-2024-10831, GHSA-hhw5-29f6-hf4x, PYSEC-2026-323 | Critical | 0.8% | 20 Mar, 2025 | PyPI dbgpt |
H2O Deserialization of Untrusted Data Vulnerability CVE-2024-10553, GHSA-h7xg-cmpp-48hf, PYSEC-2026-351 | Critical | 1.6% | 20 Mar, 2025 | Maven ai.h2o:h2o-core PyPI h2o |
Horovod Vulnerable to Command Injection CVE-2024-10190, GHSA-mrhh-3ggq-23p2, PYSEC-2026-355 | Critical | 1.1% | 20 Mar, 2025 | PyPI horovod |
vLLM Allows Remote Code Execution via Mooncake Integration CVE-2025-29783, GHSA-x3m8-f7g5-qhm7, PYSEC-2025-63 | Critical | 0.7% | 19 Mar, 2025 | PyPI vllm |
Flowise allows arbitrary file write to RCE CVE-2025-71338, GHSA-8vvx-qvq9-5948 | Critical | 1.2% | 14 Mar, 2025 | npm flowise |
xml-crypto Vulnerable to XML Signature Verification Bypass via DigestValue Comment CVE-2025-29775, GHSA-x3m8-899r-f7c3 | Critical | 10.1% | 14 Mar, 2025 | npm xml-crypto |
xml-crypto Vulnerable to XML Signature Verification Bypass via Multiple SignedInfo References CVE-2025-29774, GHSA-9p8x-f768-wp2g | Critical | 9.1% | 14 Mar, 2025 | npm xml-crypto |
Qiskit allows arbitrary code execution decoding QPY format versions < 13 CVE-2025-2000, GHSA-6m2c-76ff-6vrf, PYSEC-2026-510, PYSEC-2026-511 | Critical | 0.8% | 14 Mar, 2025 | PyPI qiskit PyPI qiskit-terra |