Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
NASA AIT-Core vulnerable to remote code execution CVE-2024-35057, GHSA-jf28-v5f6-cvpr, PYSEC-2026-263 | Critical | 0.4% | 21 May, 2024 | PyPI ait-core |
NASA AIT-Core vulnerable to SQL Injection CVE-2024-35056, GHSA-gpgj-xrgw-8mx2, PYSEC-2026-262 | Critical | 0.6% | 21 May, 2024 | PyPI ait-core |
PyMySQL SQL Injection vulnerability CVE-2024-36039, GHSA-v9hf-5j83-6xpp, PYSEC-2026-502 | Critical | 0.7% | 21 May, 2024 | PyPI pymysql |
propel/propel1 SQL injection possible with limit() on MySQL GHSA-7g7c-qhf3-x59p | Critical | Not scored | 20 May, 2024 | Packagist propel/propel1 |
Propel2 SQL injection possible with limit() on MySQL GHSA-7vw7-qx38-37vr | Critical | Not scored | 20 May, 2024 | Packagist propel/propel |
Blackprint @blackprint/engine Prototype Pollution issue CVE-2024-24294, GHSA-g3q2-vcjq-rgrc | Critical | 0.8% | 20 May, 2024 | npm @blackprint/engine |
litellm passes untrusted data to `eval` function without sanitization CVE-2024-4264, GHSA-7ggm-4rjg-594w, PYSEC-2026-1542 | Critical | 0.9% | 18 May, 2024 | PyPI litellm |
Flow Swift Mailer package Remote code execution GHSA-rq6q-hjvh-5mwh | Critical | Not scored | 17 May, 2024 | Packagist neos/swiftmailer |
namshi/jose - Verification bypass GHSA-4rr6-gf59-ggw5 | Critical | Not scored | 17 May, 2024 | Packagist namshi/jose |
ConsoleMe has an Arbitrary File Read Vulnerability via Limited Git command CVE-2024-5023, GHSA-3783-62vc-jr7x, PYSEC-2026-318 | Critical | 0.9% | 16 May, 2024 | PyPI consoleme |
LoLLMS Command Injection vulnerability CVE-2024-4078, GHSA-pwc9-q4hj-pg8g, PYSEC-2026-1593 | Critical | 0.9% | 16 May, 2024 | PyPI lollms |
Magento RCE,XSS and other vulnerabilities GHSA-8j7c-682x-r9f2 | Critical | Not scored | 15 May, 2024 | Packagist magento/community-edition |
Magento remote code execution (RCE), Cross-Site Scripting (XSS) and other vulnerabilities GHSA-5gmh-85x8-5cx7 | Critical | Not scored | 15 May, 2024 | Packagist magento/community-edition |
Magento Open Source Security Advisory: Patch SUPEE-10975 GHSA-cv25-3pxr-4q7x | Critical | Not scored | 15 May, 2024 | Packagist magento/community-edition |
Magento Patch SUPEE-9652 - Remote Code Execution using mail vulnerability GHSA-26hq-7286-mg8f | Critical | Not scored | 15 May, 2024 | Packagist magento/community-edition |
Magento Security enhancements that help close RCE,XSS,CSRF and other vulnerabilities GHSA-6wm4-3rjj-c8xx | Critical | Not scored | 15 May, 2024 | Packagist magento/community-edition |
Magento Patch SUPEE-10752 - Multiple security enhancements vulnerabilities GHSA-prpf-cj87-hwvr | Critical | Not scored | 15 May, 2024 | Packagist magento/community-edition |
Laravel RCE vulnerability in "cookie" session driver GHSA-qm5c-m76r-2hfr | Critical | Not scored | 15 May, 2024 | Packagist laravel/framework |
Laravel RCE vulnerability in "cookie" session driver GHSA-2ffv-r4r9-r8xr | Critical | Not scored | 15 May, 2024 | Packagist illuminate/cookie |
gree/jose - "None" Algorithm treated as valid in tokens GHSA-9gxv-x7rp-r2hc | Critical | Not scored | 15 May, 2024 | Packagist gree/jose |
firebase/php-jwt: "None" Algorithm treated as valid on tokens GHSA-h533-5v22-8vcp | Critical | Not scored | 15 May, 2024 | Packagist firebase/php-jwt |
Google Chromium V8 Type Confusion Vulnerability CVE-2024-4947 | CriticalExploited | 15.2% | 15 May, 2024 | |
Drupal core Remote Code Execution GHSA-jf8c-36vw-98x4 | Critical | Not scored | 15 May, 2024 | Packagist drupal/drupal |
Drupal Core Insufficient Contextual Links validation leads to Remote Code Execution GHSA-jjx7-8462-w4m4 | Critical | Not scored | 15 May, 2024 | Packagist drupal/drupal |
Drupal Core Insufficient Contextual Links validation leads to Remote Code Execution GHSA-7v68-3pr5-h3cr | Critical | Not scored | 15 May, 2024 | Packagist drupal/core |
Drupal core Remote Code Execution GHSA-6mgp-v5cm-ghg5 | Critical | Not scored | 15 May, 2024 | Packagist drupal/core |
Doctrine SQL injection vulnerability GHSA-6q9v-4hq6-5m67 | Critical | Not scored | 15 May, 2024 | Packagist doctrine/orm |
contao/core Insufficient input validation allows for code injection and remote execution GHSA-wxxw-5gq6-j2g5 | Critical | Not scored | 15 May, 2024 | Packagist contao/core |
codeigniter/framework SQL injection in ODBC database driver GHSA-27qr-636m-wxg2 | Critical | Not scored | 15 May, 2024 | Packagist codeigniter/framework |
ADOdb SQL injection vulnerability GHSA-h63c-xvpf-264j | Critical | Not scored | 15 May, 2024 | Packagist adodb/adodb-php |
Grav Vulnerable to Arbitrary File Read to Account Takeover CVE-2024-34082, GHSA-f8v5-jmfh-pr69 | Critical | 3.0% | 15 May, 2024 | Packagist getgrav/grav |
PrestaShop cross-site scripting via customer contact form in FO, through file upload CVE-2024-34716, GHSA-45vm-3j38-7p78 | Critical | 56.4% | 14 May, 2024 | Packagist prestashop/prestashop |
OctoPrint has an Authentication Bypass via X-Forwarded-For Header when autologinLocal is enabled CVE-2024-32977, GHSA-2vjq-hg5w-5gm7, PYSEC-2024-237 | Critical | 0.9% | 14 May, 2024 | PyPI OctoPrint PyPI octoprint |
Cockpit CMS contains an arbitrary file upload vulenrability CVE-2024-4825, GHSA-vpj8-xfqc-jcv9 | Critical | 0.7% | 14 May, 2024 | Packagist cockpit-hq/cockpit |
Google Chromium Visuals Use-After-Free Vulnerability CVE-2024-4671 | CriticalExploited | 8.3% | 14 May, 2024 | |
@valtimo/components exposes access token to form.io CVE-2024-34706, GHSA-xcp4-62vj-cq3r | Critical | 1.1% | 13 May, 2024 | npm @valtimo/components |
llama-cpp-python vulnerable to Remote Code Execution by Server-Side Template Injection in Model Metadata CVE-2024-34359, GHSA-56xg-wfcc-g829, PYSEC-2026-392 | Critical | 26.0% | 13 May, 2024 | PyPI llama-cpp-python |
Blind XSS Leading to Froxlor Application Compromise CVE-2024-34070, GHSA-x525-54hf-xr53 | Critical | 1.0% | 10 May, 2024 | Packagist froxlor/froxlor |
lobe-chat `/api/proxy` endpoint Server-Side Request Forgery vulnerability CVE-2024-32964, GHSA-mxhq-xw3g-rphc | Critical | 53.0% | 10 May, 2024 | npm @lobehub/chat |
Malicious Long Unicode filenames may cause a Multiple Application-level Denial of Service CVE-2024-32874, GHSA-w4h6-9wrp-v5jq, PYSEC-2026-342 | Critical | 0.8% | 09 May, 2024 | PyPI frigate |
Apache OFBiz Path Traversal Vulnerability CVE-2024-32113 | CriticalExploited | 99.9% | 08 May, 2024 | |
pywasm3 contains a global buffer overflow which leads to segmentation fault CVE-2024-34252, GHSA-hh39-vjv8-j337, PYSEC-2024-309 | Critical | 0.6% | 06 May, 2024 | PyPI pywasm3 |
pywasm3 contains a heap buffer overflow which leads to segmentation fault CVE-2024-34249, GHSA-mq9p-qw76-q6h7, PYSEC-2024-308 | Critical | 0.7% | 06 May, 2024 | PyPI pywasm3 |
Zenario uses Twig filters insecurely in the Twig Snippet plugin CVE-2024-34461, GHSA-hr2r-w6wc-25pv | Critical | 1.0% | 04 May, 2024 | Packagist tribalsystems/zenario |
libxmljs2 vulnerable to type confusion when parsing specially crafted XML CVE-2024-34394, GHSA-78h3-pg4x-j8cv | Critical | 1.0% | 02 May, 2024 | npm libxmljs2 |
libxmljs2 type confusion vulnerability when parsing specially crafted XML CVE-2024-34393, GHSA-mjr4-7xg5-pfvh | Critical | 1.0% | 02 May, 2024 | npm libxmljs2 |
libxmljs vulnerable to type confusion when parsing specially crafted XML CVE-2024-34392, GHSA-mg49-jqgw-gcj6 | Critical | 1.1% | 02 May, 2024 | npm libxmljs |
libxmljs vulnerable to type confusion when parsing specially crafted XML CVE-2024-34391, GHSA-6433-x5p4-8jc7 | Critical | 1.1% | 02 May, 2024 | npm libxmljs |
CraftBeerPi 4 allows arbitrary code execution CVE-2024-3955, GHSA-4f92-w438-f484, PYSEC-2026-308 | Critical | 1.1% | 02 May, 2024 | PyPI cbpi4 |
xml-crypto vulnerable to XML signature verification bypass due improper verification of signature/signature spoofing CVE-2024-32962, GHSA-2xp3-57p7-qf4v | Critical | 0.8% | 01 May, 2024 | npm xml-crypto |