Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Qiskit allows arbitrary code execution decoding QPY format versions < 13 CVE-2025-2000, GHSA-6m2c-76ff-6vrf, PYSEC-2026-510, PYSEC-2026-511 | Critical | 0.8% | 14 Mar, 2025 | PyPI qiskit PyPI qiskit-terra |
Flowise Pre-auth Arbitrary File Upload CVE-2025-71333, GHSA-h42x-xx2q-6v6g | Critical | 0.9% | 13 Mar, 2025 | npm flowise |
Apple Multiple Products WebKit Out-of-Bounds Write Vulnerability CVE-2025-24201 | CriticalExploited | 3.8% | 11 Mar, 2025 | |
AMI MegaRAC SPx Authentication Bypass by Spoofing Vulnerability CVE-2024-54085 | CriticalExploited | 60.7% | 11 Mar, 2025 | |
Apache Tomcat Path Equivalence Vulnerability CVE-2025-24813 | CriticalExploited | 99.9% | 10 Mar, 2025 | |
canvg Prototype Pollution vulnerability CVE-2025-25977, GHSA-v2mw-5mch-w8c5 | Critical | 0.7% | 10 Mar, 2025 | npm canvg |
PlotAI eval vulnerability CVE-2025-1497, GHSA-2hmp-5wqg-f24h, PYSEC-2025-22 | Critical | 1.0% | 10 Mar, 2025 | PyPI plotai |
Spacy-LLM Server-Side Template Injection (SSTI) vulnerability CVE-2025-25362, GHSA-793v-gxfp-9q9h, PYSEC-2026-1934 | Critical | 0.8% | 05 Mar, 2025 | PyPI spacy-llm |
Volt Allows RCE Via User-Crafted Requests CVE-2025-27517, GHSA-v69f-5jxm-hwvv | Critical | 0.6% | 05 Mar, 2025 | Packagist livewire/volt |
Edimax IC-7100 IP Camera OS Command Injection Vulnerability CVE-2025-1316 | CriticalExploited | 74.5% | 05 Mar, 2025 | |
FlowiseAI Flowise arbitrary file upload vulnerability CVE-2025-26319, GHSA-69jq-qr7w-j7qh | Critical | 55.9% | 04 Mar, 2025 | npm flowise |
Drupal OAuth2 Server Missing Authorization vulnerability CVE-2025-31691, DRUPAL-CONTRIB-2025-020, GHSA-4f8q-mwgc-3mwc | Critical | 0.4% | 26 Feb, 2025 | Packagist drupal/oauth2_server Packagist:https://packages.drupal.org/8 drupal/oauth2_server |
Mautic allows Remote Code Execution and File Deletion in Asset Uploads CVE-2024-47051, GHSA-73gx-x7r9-77x2 | Critical | 1.8% | 26 Feb, 2025 | Packagist mautic/core |
LTI JupyterHub Authenticator does not properly validate JWT Signature CVE-2023-25574, GHSA-mcgx-2gcr-p3hp, PYSEC-2025-120 | Critical | 0.4% | 25 Feb, 2025 | PyPI jupyterhub-ltiauthenticator |
Moodle has a SQL injection risk in course search module list filter BIT-moodle-2025-26533, CVE-2025-26533, GHSA-rg56-94j7-hjx9 | Critical | 0.6% | 24 Feb, 2025 | Packagist moodle/moodle |
XWiki Platform Eval Injection Vulnerability CVE-2025-24893 | CriticalExploited | 100.0% | 20 Feb, 2025 | |
DocsGPT Allows Remote Code Execution CVE-2025-0868, GHSA-9gff-5v8w-x922 | Critical | 17.1% | 20 Feb, 2025 | npm docsgpt |
Microsoft Power Pages Improper Access Control Vulnerability CVE-2025-24989 | CriticalExploited | 1.6% | 19 Feb, 2025 | |
Easy!Appointments Improper Restriction of Excessive Authentication Attempts CVE-2024-57602, GHSA-8fc2-fhh6-f6m5 | Critical | 0.8% | 12 Feb, 2025 | Packagist alextselegidis/easyappointments |
Crayfish Allows Remote Code Execution via hypercube X-Islandora-Args Header GHSA-c2p2-hgjg-9r3f | Critical | Not scored | 12 Feb, 2025 | Packagist islandora/crayfish |
Elliptic's private key extraction in ECDSA upon signing a malformed input (e.g. a string) GHSA-vjh7-7g9h-fjfh | Critical | Not scored | 12 Feb, 2025 | npm elliptic |
Inefficient Regular Expression Complexity in koa CVE-2025-25200, GHSA-593f-38f6-jp5m | Critical | 0.8% | 12 Feb, 2025 | npm koa |
Drupal Open Social Missing Authorization vulnerability CVE-2025-31685, DRUPAL-CONTRIB-2025-014, GHSA-gf72-h4cp-wcm4 | Critical | 0.4% | 12 Feb, 2025 | Packagist goalgorilla/open_social Packagist:https://packages.drupal.org/8 drupal/social |
Improper Authorization vulnerability in Magento and Adobe Commerce CVE-2025-24434, GHSA-fppq-f2m6-xv5c | Critical | 17.2% | 11 Feb, 2025 | Packagist magento/community-edition Packagist magento/project-community-edition |
PandasAI interactive prompt function Remote Code Execution (RCE) CVE-2024-12366, GHSA-vv2h-2w3q-3fx7, PYSEC-2026-448 | Critical | 1.2% | 11 Feb, 2025 | PyPI pandasai |
Wazuh Server Deserialization of Untrusted Data Vulnerability CVE-2025-24016 | CriticalExploited | 93.8% | 10 Feb, 2025 | |
Parsed HTML anchor links in Markdown provided to parseMarkdown can result in XSS in @nuxtjs/mdc CVE-2025-24981, GHSA-j82m-pc2v-2484 | Critical | 0.7% | 06 Feb, 2025 | npm @nuxtjs/mdc |
Multiple rtmpdump vulnerabilities GHSA-vrpv-vw92-328g | Critical | Not scored | 06 Feb, 2025 | Packagist rudloff/rtmpdump-bin |
utils-extend Prototype Pollution CVE-2024-57077, GHSA-7qgg-vw88-cc99 | Critical | 0.5% | 05 Feb, 2025 | npm utils-extend |
Vitest allows Remote Code Execution when accessing a malicious website while Vitest API server is listening CVE-2025-24964, GHSA-9crc-q9x8-hgqq | Critical | 0.7% | 04 Feb, 2025 | npm vitest |
Django-Unicorn Class Pollution Vulnerability, Leading to XSS, DoS and Authentication Bypass CVE-2025-24370, GHSA-g9wf-5777-gq43, PYSEC-2026-329 | Critical | 0.5% | 03 Feb, 2025 | PyPI django-unicorn |
Drupal Authenticator Login Missing Authorization vulnerability CVE-2025-31681, DRUPAL-CONTRIB-2025-009, GHSA-jwpx-6c4p-q4jq | Critical | 0.4% | 29 Jan, 2025 | Packagist drupal/alogin Packagist:https://packages.drupal.org/8 drupal/alogin |
Apple Multiple Products Use-After-Free Vulnerability CVE-2025-24085 | CriticalExploited | 17.5% | 27 Jan, 2025 | |
Dolibarr Cross-site Scripting vulnerability BIT-dolibarr-2024-55228, CVE-2024-55228, GHSA-x2j8-vjg7-386r | Critical | 0.7% | 27 Jan, 2025 | Packagist dolibarr/dolibarr |
Dolibarr Cross-site Scripting vulnerability BIT-dolibarr-2024-55227, CVE-2024-55227, GHSA-2v3r-gvq5-qqgh | Critical | 0.6% | 27 Jan, 2025 | Packagist dolibarr/dolibarr |
SonicWall SMA1000 Appliances Deserialization Vulnerability CVE-2025-23006 | CriticalExploited | 23.4% | 23 Jan, 2025 | |
SimpleHelp Missing Authorization Vulnerability CVE-2024-57726 | CriticalExploited | 66.4% | 15 Jan, 2025 | |
Crayfish allows Remote Code Execution via Homarus Authorization header CVE-2025-25286, GHSA-mm6v-68qp-f9fw | Critical | 1.0% | 15 Jan, 2025 | Packagist islandora/crayfish |
Sentry's improper authentication on SAML SSO process allows user impersonation CVE-2025-22146, GHSA-7pq6-v88g-wf3w, PYSEC-2026-532 | Critical | 0.6% | 15 Jan, 2025 | PyPI sentry |
Mongoose search injection vulnerability BIT-mongoose-2025-23061, CVE-2025-23061, GHSA-vg7j-7cwx-8wgw | Critical | 7.2% | 15 Jan, 2025 | npm mongoose |
Gradio Blocked Path ACL Bypass Vulnerability CVE-2025-23042, GHSA-j2jg-fq62-7c3h, PYSEC-2025-118 | Critical | 1.0% | 14 Jan, 2025 | PyPI gradio |
Rasa Allows Remote Code Execution via Remote Model Loading CVE-2024-49375, GHSA-cpv4-ggrr-7j9v, PYSEC-2026-513, PYSEC-2026-514 | Critical | 0.9% | 14 Jan, 2025 | PyPI rasa PyPI rasa-pro |
Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability CVE-2024-55591 | CriticalExploited | 94.3% | 14 Jan, 2025 | |
SonicWall SonicOS SSLVPN Improper Authentication Vulnerability CVE-2024-53704 | CriticalExploited | 95.3% | 09 Jan, 2025 | |
Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability CVE-2025-0282 | CriticalExploited | 100.0% | 08 Jan, 2025 | |
Aviatrix Controllers OS Command Injection Vulnerability CVE-2024-50603 | CriticalExploited | 98.5% | 08 Jan, 2025 | |
path-sanitizer allows bypassing the existing filters to achieve path-traversal vulnerability CVE-2024-56198, GHSA-94p5-r7cc-3rpr | Critical | 0.7% | 31 Dec, 2024 | npm path-sanitizer |
TeamPass privileges issue CVE-2024-50703, GHSA-9wmc-988h-2mv2 | Critical | 0.5% | 30 Dec, 2024 | Packagist nilsteampassnet/teampass |
TCPDF missing certificate validation CVE-2024-56521, GHSA-9mgx-552f-59p6 | Critical | 0.8% | 27 Dec, 2024 | Packagist tecnickcom/tcpdf |
Craft CMS has potential RCE when PHP `register_argc_argv` config setting is enabled CVE-2024-56145, GHSA-2p6p-9rc9-62j9 | CriticalExploited | 97.4% | 18 Dec, 2024 | Packagist craftcms/cms |