Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Apache Submarine Commons Utils has a hard-coded secret CVE-2024-36264, GHSA-jwcg-wv5x-vg3g, PYSEC-2024-97 | Critical | 1.0% | 12 Jun, 2024 | Maven org.apache.submarine:submarine-commons-utils PyPI apache-submarine |
parisneo/lollms Local File Inclusion (LFI) attack CVE-2024-4315, GHSA-vqwr-q6cc-c242, PYSEC-2026-403 | Critical | 1.0% | 12 Jun, 2024 | PyPI lollms |
Jupyter Server Proxy has a reflected XSS issue in host parameter CVE-2024-35225, GHSA-fvcq-4x64-hqxr, PYSEC-2024-236 | Critical | 0.4% | 11 Jun, 2024 | PyPI jupyter-server-proxy |
Langflow remote code execution vulnerability CVE-2024-37014, GHSA-qg33-x2c5-6p44, PYSEC-2024-177 | Critical | 63.7% | 10 Jun, 2024 | PyPI langflow |
PHP-CGI OS Command Injection Vulnerability CVE-2024-4577 | CriticalExploited | 100.0% | 09 Jun, 2024 | |
lunary-ai/lunary allows users unauthorized access to projects CVE-2024-4146, GHSA-w5xm-mx47-v7c8 | Critical | 0.5% | 08 Jun, 2024 | npm lunary |
Zendframework1 Potential SQL injection in ORDER and GROUP functions GHSA-6fqw-j3vm-7f66 | Critical | Not scored | 07 Jun, 2024 | Packagist zendframework/zendframework1 |
Zendframework1 potential SQL injection vector using null byte for PDO (MsSql, SQLite) GHSA-v42g-7q2x-cw32 | Critical | Not scored | 07 Jun, 2024 | Packagist zendframework/zendframework1 |
ZendFramework1 Potential SQL injection in the ORDER implementation of Zend_Db_Select GHSA-2x36-qhx3-7m5f | Critical | Not scored | 07 Jun, 2024 | Packagist zendframework/zendframework1 |
willdurand/js-translation-bundle potential path traversal attack and remote code injection GHSA-x86x-qhf8-f37w | Critical | Not scored | 07 Jun, 2024 | Packagist willdurand/js-translation-bundle |
Zend-JSON vulnerable to XXE/XEE attacks GHSA-8x2v-pcg7-94f4 | Critical | Not scored | 07 Jun, 2024 | Packagist zendframework/zend-json |
ZendFramework potential XML eXternal Entity injection vectors GHSA-mhpx-3rv8-wrjm | Critical | Not scored | 07 Jun, 2024 | Packagist zendframework/zendframework1 |
ZendFramework potential SQL Injection Vector When Using PDO_MySql GHSA-qf36-fx9f-232x | Critical | Not scored | 07 Jun, 2024 | Packagist zendframework/zendframework1 |
ZendFramework vulnerable to XXE/XEE attacks GHSA-f4fj-q6m4-cc52 | Critical | Not scored | 07 Jun, 2024 | Packagist zendframework/zend-xmlrpc |
Zendframework vulnerable to XXE/XEE attacks GHSA-qc7w-4567-84wv | Critical | Not scored | 07 Jun, 2024 | Packagist zendframework/zendframework |
ebookmeta XML External Entity vulnerability CVE-2024-37388, GHSA-hx54-pf28-7xch, PYSEC-2026-1324 | Critical | 0.5% | 07 Jun, 2024 | PyPI ebookmeta |
Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') in tornado CVE-2024-14029, GHSA-753j-mpmx-qq6g | Critical | 0.4% | 06 Jun, 2024 | PyPI tornado |
LoLLMS Path Traversal vulnerability CVE-2024-3429, GHSA-3x47-w4rx-6pm7, PYSEC-2026-1583 | Critical | 28.3% | 06 Jun, 2024 | PyPI lollms |
Authentication bypass in dtale CVE-2024-3408, GHSA-v9q6-fm48-rx74, PYSEC-2024-117 | Critical | 78.0% | 06 Jun, 2024 | PyPI dtale |
Remote code execution in mlflow BIT-mlflow-2024-0520, CVE-2024-0520, GHSA-5q6c-ffvg-xcm9, PYSEC-2024-239 | Critical | 2.4% | 06 Jun, 2024 | PyPI mlflow |
Remote code execution in pytorch lightning CVE-2024-5452, GHSA-cgwc-qvrx-rf7f, PYSEC-2026-385, PYSEC-2026-3974 | Critical | 26.8% | 06 Jun, 2024 | PyPI lightning PyPI pytorch-lightning |
Arbitrary Code Execution in TYPO3 CMS GHSA-67wg-6j7r-mqh8 | Critical | Not scored | 05 Jun, 2024 | Packagist typo3/cms |
Missing Access Check in TYPO3 CMS GHSA-gwfx-p7mr-f92v | Critical | Not scored | 05 Jun, 2024 | Packagist typo3/cms |
Jan path traversal vulnerability CVE-2024-37273, GHSA-878h-rqcq-mv3x | Critical | 1.0% | 04 Jun, 2024 | npm @janhq/core |
Jan path traversal vulnerability CVE-2024-36858, GHSA-qfjh-mvq6-c5p8 | Critical | 3.0% | 04 Jun, 2024 | npm @janhq/core |
A command injection vulnerability exists in the gradio-app/gradio repository, specifically within the 'test-functional.yml' workflow. The vulnerability arises due to improper neutralization of special elements used in a command, allowing for unauthorized modification of the base repository or secret CVE-2024-4253, PYSEC-2024-321 | Critical | 1.7% | 04 Jun, 2024 | PyPI gradio |
qdrant input validation failure CVE-2024-3829, GHSA-7m75-x27w-r52r, PYSEC-2026-509 | Critical | 0.9% | 03 Jun, 2024 | PyPI qdrant-client |
Unsafe Reflection in base Component class in yiisoft/yii2 CVE-2024-4990, GHSA-cjcc-p67m-7qxm | Critical | 80.1% | 02 Jun, 2024 | Packagist yiisoft/yii2 |
Moodle Improper Input Validation BIT-moodle-2024-33999, CVE-2024-33999, GHSA-r2wx-46gp-rp3h | Critical | 0.5% | 31 May, 2024 | Packagist moodle/moodle |
Vanna prompt injection code execution CVE-2024-5565, GHSA-7735-w2jp-gvg6, PYSEC-2026-561 | Critical | 15.2% | 31 May, 2024 | PyPI vanna |
Rejetto HTTP File Server Improper Neutralization of Special Elements Used in a Template Engine Vulnerability CVE-2024-23692 | CriticalExploited | 99.5% | 31 May, 2024 | |
TYPO3 CMS Insecure Deserialization & Arbitrary Code Execution GHSA-cc97-g92w-jm65 | Critical | Not scored | 30 May, 2024 | Packagist typo3/cms-core |
titon/framework vulnerable to Remote Code Execution via Chosen-Ciphertext Attack GHSA-q3jm-v27q-jfww | Critical | Not scored | 30 May, 2024 | Packagist titon/framework |
Symfony XML decoding attack vector through external entities GHSA-mmcv-fvq8-r9x3 | Critical | Not scored | 30 May, 2024 | Packagist symfony/symfony |
Symfony XML decoding attack vector through external entities GHSA-j68w-pg49-f6vx | Critical | Not scored | 30 May, 2024 | Packagist symfony/serializer |
Drupal REST & JSON API Authentication module restricts and secures unauthorized access to your Drupal site APIs using different authentication methods including Basic Authentication , API Key Authentication , JWT Authentication , OAuth Authentication , External / Third-Party Provider Authentication, CVE-2024-13258, DRUPAL-CONTRIB-2024-022 | Critical | 0.7% | 29 May, 2024 | Packagist:https://packages.drupal.org/8 drupal/rest_api_authentication |
Progress Telerik Report Server Authentication Bypass by Spoofing Vulnerability CVE-2024-4358 | CriticalExploited | 97.5% | 29 May, 2024 | |
Swiftmailer Sendmail transport arbitrary shell execution GHSA-4qpj-gxxg-jqg4 | Critical | Not scored | 29 May, 2024 | Packagist swiftmailer/swiftmailer |
Google Chromium V8 Type Confusion Vulnerability CVE-2024-5274 | CriticalExploited | 7.7% | 28 May, 2024 | |
Mocodo vulnerable to SQL injection in `/web/generate.php` CVE-2024-35374, GHSA-j6cv-98jx-mrwr, PYSEC-2026-426 | Critical | 2.8% | 24 May, 2024 | PyPI mocodo |
Dolibarr vulnerable to SQL Injection BIT-dolibarr-2024-5315, CVE-2024-5315, GHSA-q8x7-jc3h-p8xc | Critical | 34.5% | 24 May, 2024 | Packagist dolibarr/dolibarr |
Dolibarr vulnerable to SQL Injection BIT-dolibarr-2024-5314, CVE-2024-5314, GHSA-c3h9-q3jx-w7fc | Critical | 0.6% | 24 May, 2024 | Packagist dolibarr/dolibarr |
Silverstripe Brute force bypass on default admin GHSA-8v6m-7f5v-hhx6 | Critical | Not scored | 23 May, 2024 | Packagist silverstripe/framework |
VuFind Server-Side Request Forgery (SSRF) vulnerability CVE-2024-25738, GHSA-wx24-vqrg-m6m5 | Critical | 0.7% | 22 May, 2024 | Packagist vufind/vufind |
VuFind Server-Side Request Forgery (SSRF) vulnerability CVE-2024-25737, GHSA-fwhc-mm9q-mqq8 | Critical | 0.4% | 22 May, 2024 | Packagist vufind/vufind |
Shopware Remote Code Execution Vulnerability GHSA-83jv-4prm-34g7 | Critical | Not scored | 21 May, 2024 | Packagist shopware/shopware |
Shopware Remote Code Execution Vulnerability GHSA-7336-ghhp-f2qj | Critical | Not scored | 21 May, 2024 | Packagist shopware/shopware |
NASA AIT-Core vulnerable to remote code execution CVE-2024-35059, GHSA-jqff-8g2v-642h, PYSEC-2026-264 | Critical | 0.5% | 21 May, 2024 | PyPI ait-core |
Shopware Remote Code Execution Vulnerability GHSA-q3g4-2vw9-xv27 | Critical | Not scored | 21 May, 2024 | Packagist shopware/shopware |
NASA AIT-Core vulnerable to remote code execution CVE-2024-35058, GHSA-4gxj-5mmr-7pxq, PYSEC-2026-261 | Critical | 0.4% | 21 May, 2024 | PyPI ait-core |