Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
AIOHTTP vulnerable to DoS through chunked messages CVE-2025-69229, GHSA-g84x-mcqj-x9qq, PYSEC-2026-1106 | Medium | 0.4% | 05 Jan, 2026 | PyPI aiohttp |
AIOHTTP vulnerable to denial of service through large payloads CVE-2025-69228, GHSA-6jhg-hg63-jvvf, PYSEC-2026-1100 | Medium | 0.4% | 05 Jan, 2026 | PyPI aiohttp |
AIOHTTP vulnerable to DoS when bypassing asserts CVE-2025-69227, GHSA-jj3x-wxrx-4x23, PYSEC-2026-1107 | Medium | 0.4% | 05 Jan, 2026 | PyPI aiohttp |
AIOHTTP vulnerable to brute-force leak of internal static file path components CVE-2025-69226, GHSA-54jq-c3m8-4m76, PYSEC-2026-1097 | Medium | 0.4% | 05 Jan, 2026 | PyPI aiohttp |
AIOHTTP's unicode processing of header values could cause parsing discrepancies CVE-2025-69224, GHSA-69f9-5gxw-wvc2, PYSEC-2026-1099 | Medium | 0.3% | 05 Jan, 2026 | PyPI aiohttp |
evershop allows unauthenticated attackers to force server to initiate HTTP request via "GET /images" API CVE-2025-67427, GHSA-vp8w-wj4m-3r7j | Medium | 0.2% | 05 Jan, 2026 | npm @evershop/evershop |
ERC7984ERC20Wrapper: once a wrapper is filled, subsequent wrap requests do not revert and result in loss of funds. CVE-2026-73645, GHSA-hqf9-8xv5-x8xw | Medium | 0.5% | 05 Jan, 2026 | npm @openzeppelin/confidential-contracts |
Craft CMS vulnerable to potential authenticated Remote Code Execution via Twig SSTI CVE-2025-68454, GHSA-742x-x762-7383 | Medium | 0.9% | 05 Jan, 2026 | Packagist craftcms/cms |
Craft CMS vulnerable to Server-Side Request Forgery (SSRF) via GraphQL Asset Upload Mutation CVE-2025-68437, GHSA-x27p-wfqw-hfcc | Medium | 0.5% | 05 Jan, 2026 | Packagist craftcms/cms |
Craft CMS vulnerable to potential information disclosure via unchecked asset relocation CVE-2025-68436, GHSA-53vf-c43h-j2x9 | Medium | 0.3% | 05 Jan, 2026 | Packagist craftcms/cms |
Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting Vulnerability CVE-2025-66376 | MediumExploited | 20.2% | 05 Jan, 2026 | |
Bagisto has HTML Filter Bypass that Enables Stored XSS CVE-2026-21451, GHSA-2mwc-h2mg-v6p8 | Medium | 0.6% | 02 Jan, 2026 | Packagist bagisto/bagisto |
Signal K Server Vulnerable to Unauthenticated Information Disclosure via Exposed Endpoints CVE-2025-68273, GHSA-fpf5-w967-rr2m | Medium | 0.8% | 01 Jan, 2026 | npm signalk-server |
Trix has a stored XSS vulnerability through its attachment attribute GHSA-g9jg-w8vm-g96v | Medium | Not scored | 31 Dec, 2025 | RubyGems action_text-trix npm trix |
libsodium has Incomplete List of Disallowed Inputs CVE-2025-69277, GHSA-mrfv-m5wm-5w6w, PYSEC-2026-1448, PYSEC-2026-3002 | Medium | 0.2% | 31 Dec, 2025 | Packagist paragonie/sodium_compat PyPI PyNaCl PyPI hdwallet PyPI pynacl |
CBORDecoder reuse can leak shareable values across decode calls CVE-2025-68131, GHSA-wcj4-jw5j-44wh, PYSEC-2025-90 | Medium | 0.5% | 31 Dec, 2025 | PyPI cbor2 |
qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustion CVE-2025-15284, GHSA-6rw7-vpxm-498p | Medium | 0.4% | 29 Dec, 2025 | npm qs |
axios-cache-interceptor Vulnerable to Cache Poisoning via Ignored HTTP Vary Header CVE-2025-69202, GHSA-x4m5-4cw8-vc44 | Medium | 0.3% | 29 Dec, 2025 | npm axios-cache-interceptor |
Nest has a Fastify URL Encoding Middleware Bypass (TOCTOU) CVE-2025-69211, GHSA-8wpr-639p-ccrj | Medium | 0.4% | 29 Dec, 2025 | npm @nestjs/platform-fastify |
hemmelig allows SSRF Filter bypass via Secret Request functionality CVE-2025-69206, GHSA-vvxf-wj5w-6gj5 | Medium | 0.2% | 29 Dec, 2025 | npm hemmelig |
phpMyFAQ has Stored XSS in user list via admin-managed display_name CVE-2025-68951, GHSA-jv8r-hv7q-p6vc | Medium | 0.3% | 29 Dec, 2025 | Packagist thorsten/phpmyfaq |
Home Assistant Core before is vulnerable to Directory Traversal CVE-2025-65713, GHSA-pp3g-xmm4-5cw9, PYSEC-2026-1454 | Medium | 0.4% | 23 Dec, 2025 | PyPI homeassistant |
Local Deep Research is Vulnerable to Server-Side Request Forgery (SSRF) in Download Service CVE-2025-67743, GHSA-9c54-gxh7-ppjc, PYSEC-2026-1581 | Medium | 0.3% | 23 Dec, 2025 | PyPI local-deep-research |
LibreNMS Alert Rule API Cross-Site Scripting Vulnerability CVE-2025-68614, GHSA-c89f-8g7g-59wj | Medium | 3.9% | 23 Dec, 2025 | Packagist librenms/librenms |
Marshmallow has DoS in Schema.load(many) CVE-2025-68480, GHSA-428g-f7cq-pgp5, PYSEC-2026-1605 | Medium | 0.3% | 22 Dec, 2025 | PyPI marshmallow |
Cowrie has a SSRF vulnerability in wget/curl emulation enabling DDoS amplification CVE-2025-34469, GHSA-83jg-m2pm-4jxj, PYSEC-2026-1280 | Medium | 0.7% | 20 Dec, 2025 | PyPI cowrie |
FastAPI SSP is vulnerable to Cross-site Request Forgery (CSRF) through improper OAuth parameter validation CVE-2025-14546, GHSA-hp6r-r9vc-q8wx, PYSEC-2026-1362 | Medium | 0.4% | 19 Dec, 2025 | PyPI fastapi-sso |
SonicWall SMA1000 Missing Authorization Vulnerability CVE-2025-40602 | MediumExploited | 2.8% | 18 Dec, 2025 | |
Biopython is vulnerable to doctype XML external entity (XXE) injection through Bio.Entrez CVE-2025-68463, GHSA-x3vf-39hj-gxr4, PYSEC-2026-1221 | Medium | 0.3% | 18 Dec, 2025 | PyPI biopython |
RoundCube Webmail Cross-site Scripting Vulnerability CVE-2025-68461 | MediumExploited | 27.4% | 18 Dec, 2025 | |
phpMyFAQ contains a CSV injection vulnerability CVE-2023-53929, GHSA-x2v3-9p22-w3x6 | Medium | 0.5% | 17 Dec, 2025 | Packagist phpmyfaq/phpmyfaq Packagist thorsten/phpmyfaq |
mcp-server-git has missing path validation when using --repository flag CVE-2025-68145, GHSA-j22h-9j4x-23w5, PYSEC-2026-1623 | Medium | 7.0% | 17 Dec, 2025 | PyPI mcp-server-git |
mcp-server-git argument injection in git_diff and git_checkout functions allows overwriting local files CVE-2025-68144, GHSA-9xwc-hfwc-8w59, PYSEC-2026-1622 | Medium | 7.2% | 17 Dec, 2025 | PyPI mcp-server-git |
AWS SDK for PHP's S3 Encryption Client has a Key Commitment Issue CVE-2025-14761, GHSA-x8cp-jf6f-r4xh | Medium | 0.2% | 17 Dec, 2025 | Packagist aws/aws-sdk-php |
Auth0 WordPress has Improper Audience Validation via Auth0-PHP SDK Dependency GHSA-vvg7-8rmq-92g7 | Medium | Not scored | 17 Dec, 2025 | Packagist auth0/wordpress |
Auth0 Symfony SDK has Improper Audience Validation via Auth0-PHP SDK GHSA-f3r2-88mq-9v4g | Medium | Not scored | 17 Dec, 2025 | Packagist auth0/symfony |
Auth0 Laravel SDK has Improper Audience Validation via Auth0-PHP SDK dependency GHSA-7hh9-gp72-wh7h | Medium | Not scored | 17 Dec, 2025 | Packagist auth0/login |
mcp-server-git's unrestricted git_init tool allows repository creation at arbitrary filesystem locations CVE-2025-68143, GHSA-5cgr-j3jf-jw3v, PYSEC-2026-1621 | Medium | 8.1% | 17 Dec, 2025 | PyPI mcp-server-git |
Duplicate Advisory: python-jose denial of service via compressed JWE content CVE-2024-29370, GHSA-h4pw-wxh7-4vjj, PYSEC-2025-185 | Medium | 0.2% | 17 Dec, 2025 | PyPI python-jose |
filelock has a TOCTOU race condition which allows symlink attacks during lock file creation CVE-2025-68146, GHSA-w853-jp5j-5j7f, PYSEC-2026-1375 | Medium | 0.2% | 16 Dec, 2025 | PyPI filelock |
Parse Server has a Cross-Site Scripting (XSS) vulnerability via Unescaped Mustache Template Variables BIT-parse-2025-68115, CVE-2025-68115, GHSA-jhgf-2h8h-ggxv | Medium | 0.2% | 16 Dec, 2025 | npm parse-server |
ALTCHA Proof-of-Work Vulnerable to Challenge Splicing and Replay CVE-2025-68113, GHSA-6gvq-jcmp-8959, GO-2025-4239, PYSEC-2026-1115 | Medium | 0.5% | 16 Dec, 2025 | Go github.com/altcha-org/altcha-lib-go Hex altcha Maven org.altcha:altcha Packagist altcha-org/altcha +3 more |
Weblate has a Server-Side Request Forgery issue CVE-2025-66407, GHSA-hfpv-mc5v-p9mm, PYSEC-2025-231 | Medium | 0.2% | 16 Dec, 2025 | PyPI Weblate PyPI weblate |
Weblate has Systematic User and Project Enumeration via Broken Authorization in REST API (IDOR) CVE-2025-67715, GHSA-3pmh-24wp-xpf4, PYSEC-2025-233 | Medium | 0.3% | 15 Dec, 2025 | PyPI Weblate PyPI weblate |
Weblate's over‑permissive webhook endpoint enables mass repository updates and component enumeration CVE-2025-67492, GHSA-pj86-258h-qrvf, PYSEC-2025-232 | Medium | 0.3% | 15 Dec, 2025 | PyPI Weblate PyPI weblate |
Misskey has a login rate limit bypass via spoofed X-Forwarded-For header CVE-2025-66482, GHSA-wwrj-3hvj-prpm | Medium | 0.3% | 15 Dec, 2025 | npm misskey-js |
Grav is vulnerable to Stored XSS through authenticated user-edited content CVE-2025-66843, GHSA-mh85-44c2-3m97 | Medium | 0.2% | 15 Dec, 2025 | Packagist getgrav/grav |
django-allauth's Okta and NetIQ implementations used a mutable identifier for authorization decisions CVE-2025-65431, GHSA-8m3c-c723-h4p4, PYSEC-2025-111 | Medium | 0.2% | 15 Dec, 2025 | PyPI django-allauth |
django-allauth does not reject access tokens for inactive users CVE-2025-65430, GHSA-qhmc-3mvr-f2j4, PYSEC-2025-110 | Medium | 0.2% | 15 Dec, 2025 | PyPI django-allauth |
Apache Airflow exposes secret values to authenticated UI users via rendered templates BIT-airflow-2025-66388, CVE-2025-66388, GHSA-fv47-pqh6-wxgq, PYSEC-2025-86 | Medium | 0.5% | 15 Dec, 2025 | PyPI apache-airflow |