Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Parse Server allows public `explain` queries which may expose sensitive database performance information and schema details BIT-parse-2025-64502, CVE-2025-64502, GHSA-7cx5-254x-cgrq | Medium | 0.4% | 10 Nov, 2025 | npm parse-server |
OpenEXR has use after free in PyObject_StealAttrString CVE-2025-64183, GHSA-57cw-j6vp-2p9m, PYSEC-2026-2844 | Medium | 0.3% | 10 Nov, 2025 | PyPI OpenEXR PyPI openexr |
OpenEXR has buffer overflow in PyOpenEXR_old's channels() and channel() CVE-2025-64182, GHSA-vh63-9mqx-wmjr, PYSEC-2026-2851 | Medium | 0.3% | 10 Nov, 2025 | PyPI OpenEXR PyPI openexr |
changedetection.io: Stored XSS in Watch update via API CVE-2025-62780, GHSA-4c3j-3h7v-22q9, PYSEC-2025-91 | Medium | 0.5% | 10 Nov, 2025 | PyPI changedetection-io PyPI changedetection.io |
AstrBot has an arbitrary file read vulnerability in function _encode_image_bs64 CVE-2025-57697, GHSA-vm2f-46xc-5jc3, PYSEC-2026-1197 | Medium | 0.3% | 07 Nov, 2025 | PyPI AstrBot PyPI astrbot |
Nuxt DevTools vulnerable to cross-site scripting (XSS) CVE-2025-52662, GHSA-xmq3-q5pm-rp26 | Medium | 0.3% | 07 Nov, 2025 | npm @nuxt/devtools |
Vercel’s AI SDK's filetype whitelists can be bypassed when uploading files CVE-2025-48985, GHSA-rwvc-j5jr-mgvh | Medium | 0.3% | 07 Nov, 2025 | npm ai |
Drupal Email TFA allows Functionality Bypass CVE-2025-12760, DRUPAL-CONTRIB-2025-115, GHSA-9jrw-jrrj-p6fr | Medium | 0.2% | 05 Nov, 2025 | Packagist drupal/email_tfa Packagist:https://packages.drupal.org/8 drupal/email_tfa |
Apache Doris-MCP-Server: Improper Access Control results in bypassing a "read-only" mode CVE-2025-58337, GHSA-m35w-xx8c-6xc7, PYSEC-2026-1315 | Medium | 0.4% | 05 Nov, 2025 | PyPI doris-mcp-server |
OctoPrint vulnerable to XSS in Action Commands Notification and Prompt CVE-2025-64187, GHSA-crvm-xjhm-9h29, PYSEC-2026-1714 | Medium | 0.2% | 04 Nov, 2025 | PyPI octoprint |
DSPy does not properly restrict file reads CVE-2025-12695, GHSA-vvw2-h478-xwr3, PYSEC-2026-1318 | Medium | 0.3% | 04 Nov, 2025 | PyPI dspy |
OpenMage vulnerable to XSS in Admin Notifications CVE-2025-64174, GHSA-qv78-c8hc-438r | Medium | 0.2% | 03 Nov, 2025 | Packagist openmage/magento-lts |
MantisBT unauthorized disclosure of private project column configuration CVE-2025-62520, GHSA-g582-8vwr-68h2 | Medium | 0.3% | 03 Nov, 2025 | Packagist mantisbt/mantisbt |
MantisBT lacks verification when changing a user's email address CVE-2025-55155, GHSA-q747-c74m-69pr | Medium | 0.2% | 03 Nov, 2025 | Packagist mantisbt/mantisbt |
node-tar has a race condition leading to uninitialized memory exposure CVE-2025-64118, GHSA-29xp-372q-xqph | Medium | 0.1% | 30 Oct, 2025 | npm tar |
Byaidu PDFMathTranslate vulnerable to open redirect CVE-2025-50736, GHSA-pfrv-63w8-q7rq, PYSEC-2026-1760 | Medium | 0.2% | 30 Oct, 2025 | PyPI pdf2zh |
Apache Airflow's create action can upsert existing Pools/Connections/Variables BIT-airflow-2025-62503, CVE-2025-62503, GHSA-gp5f-cx7h-8q6f, PYSEC-2026-1133 | Medium | 0.4% | 30 Oct, 2025 | PyPI apache-airflow |
Apache Airflow `/api/v2/dagReports` executes DAG Python in API BIT-airflow-2025-62402, CVE-2025-62402, GHSA-273c-4g26-4jpm, PYSEC-2026-1129 | Medium | 0.5% | 30 Oct, 2025 | PyPI apache-airflow |
Apache Airflow has a command injection vulnerability in "example_dag_decorator" BIT-airflow-2025-54941, CVE-2025-54941, GHSA-v3c9-j6h9-66v4, PYSEC-2026-1135 | Medium | 0.5% | 30 Oct, 2025 | PyPI apache-airflow |
OpenUSD File Parsing Use-After-Free Remote Code Execution Vulnerability GHSA-grjp-54v3-c442 | Medium | Not scored | 29 Oct, 2025 | PyPI usd-core |
uv allows ZIP payload obfuscation through parsing differentials CVE-2025-13327, GHSA-pqhf-p39g-3x64, GHSA-v653-r55g-hcmg, PYSEC-2026-2295 | Medium | 0.2% | 29 Oct, 2025 | PyPI uv |
CKAN vulnerable to fixed session IDs CVE-2025-64100, GHSA-2hvh-cw5c-8q8q, PYSEC-2026-1246 | Medium | 0.3% | 29 Oct, 2025 | PyPI ckan |
CKAN vulnerable to stored XSS in resource description CVE-2025-54384, GHSA-2r4h-8jxv-w2j8, PYSEC-2026-1247 | Medium | 0.2% | 29 Oct, 2025 | PyPI ckan |
NextAuthjs Email misdelivery Vulnerability GHSA-5jpx-9hw9-2fx4 | Medium | Not scored | 29 Oct, 2025 | npm next-auth |
Keras is vulnerable to arbitrary local file loading and Server-Side Request Forgery CVE-2025-12058, GHSA-mq84-hjqx-cwf2, GHSA-qg93-c7p6-gg7f, PYSEC-2026-1487 | Medium | 0.2% | 29 Oct, 2025 | PyPI keras |
FastMCP vulnerable to windows command injection in FastMCP Cursor installer via server_name CVE-2025-62801, GHSA-rj5c-58rq-j5g5, PYSEC-2026-1365 | Medium | 0.2% | 28 Oct, 2025 | PyPI fastmcp |
FastMCP vulnerable to reflected XSS in client's callback page CVE-2025-62800, GHSA-mxxr-jv3v-6pgc, PYSEC-2026-1364 | Medium | 0.3% | 28 Oct, 2025 | PyPI fastmcp |
Sharp user-provided input can be evaluated in a SharpShowTextField with Vue template syntax CVE-2025-62798, GHSA-9f58-4465-23c7 | Medium | 0.2% | 28 Oct, 2025 | Packagist code16/sharp |
PrivateBin is missing HTML sanitization of attached filename in file size hint CVE-2025-62796, GHSA-867c-p784-5q6g | Medium | 0.3% | 28 Oct, 2025 | Packagist privatebin/privatebin |
Hono vulnerable to Vary Header Injection leading to potential CORS Bypass CVE-2025-71381, GHSA-q7jf-gf43-6x6p | Medium | 0.3% | 24 Oct, 2025 | npm hono |
rollbar vulnerable to Prototype Pollution in merge() CVE-2025-62517, GHSA-xcg2-9pp4-j82x | Medium | 0.4% | 23 Oct, 2025 | npm rollbar |
Moodle has a time restriction bypass BIT-moodle-2025-62401, CVE-2025-62401, GHSA-w29j-8phw-ffjf | Medium | 0.2% | 23 Oct, 2025 | Packagist moodle/moodle |
Moodle exposed the names of hidden groups to users BIT-moodle-2025-62400, CVE-2025-62400, GHSA-422v-w6c5-vq42 | Medium | 0.3% | 23 Oct, 2025 | Packagist moodle/moodle |
Moodle does not properly enforce MFA BIT-moodle-2025-62398, CVE-2025-62398, GHSA-25wf-7x6c-wmpf | Medium | 0.2% | 23 Oct, 2025 | Packagist moodle/moodle |
Moodle's error handling leads to sensitive information disclosure BIT-moodle-2025-62396, CVE-2025-62396, GHSA-c5cj-xp43-qcc3 | Medium | 0.3% | 23 Oct, 2025 | Packagist moodle/moodle |
Moodle sends quiz-related messages to inactive/suspended users BIT-moodle-2025-62394, CVE-2025-62394, GHSA-8fcv-4qp9-pg32 | Medium | 0.2% | 23 Oct, 2025 | Packagist moodle/moodle |
Moodle course access permissions are not properly checked in course_output_fragment_course_overview BIT-moodle-2025-62393, CVE-2025-62393, GHSA-rjcm-7v2p-9265 | Medium | 0.2% | 23 Oct, 2025 | Packagist moodle/moodle |
pypdf can exhaust RAM via manipulated LZWDecode streams CVE-2025-62708, GHSA-jfx9-29x2-rv3j, PYSEC-2026-1831 | Medium | 0.4% | 22 Oct, 2025 | PyPI pypdf |
pypdf possibly loops infinitely when reading DCT inline images without EOF marker CVE-2025-62707, GHSA-vr63-x8vc-m265, PYSEC-2026-1833 | Medium | 0.4% | 22 Oct, 2025 | PyPI pypdf |
Scapy Session Loading Vulnerable to Arbitrary Code Execution via Untrusted Pickle Deserialization GHSA-cq46-m9x9-j8w2 | Medium | Not scored | 22 Oct, 2025 | PyPI scapy |
Drupal CivicTheme Design System allows Cross-Site Scripting (XSS) CVE-2025-12083, DRUPAL-CONTRIB-2025-113, GHSA-h72q-cq3w-h3wc | Medium | 0.2% | 22 Oct, 2025 | Packagist drupal/civictheme Packagist:https://packages.drupal.org/8 drupal/civictheme |
Hugging Face Smolagents XPath injection vulnerability in the search_item_ctrl_f function CVE-2025-11844, GHSA-8mf9-rmgw-33qc, PYSEC-2026-1930 | Medium | 0.3% | 22 Oct, 2025 | PyPI smolagents |
Nautobot Single Source of Truth (SSoT) has an unauthenticated ServiceNow configuration URL CVE-2025-62607, GHSA-535g-62r7-cx6v, PYSEC-2026-1690 | Medium | 0.3% | 21 Oct, 2025 | PyPI nautobot-ssot |
code16 Sharp vulnerable to Cross Site Scripting (XSS) CVE-2025-61457, GHSA-9778-v769-qvjf | Medium | 0.3% | 21 Oct, 2025 | Packagist code16/sharp |
ProcessWire CMS vulnerable to resource-exhaustion Denial of Service CVE-2025-60790, GHSA-9p44-q66p-xm6p | Medium | 0.4% | 21 Oct, 2025 | Packagist processwire/processwire |
Shopware Customer Orders can be canceled, even if refunds are disabled GHSA-r2vg-hvjm-fg38 | Medium | Not scored | 21 Oct, 2025 | Packagist shopware/core Packagist shopware/platform |
Shopware exposes sensitive user information via CSV export mapping GHSA-27c9-vp3w-6ww8 | Medium | Not scored | 21 Oct, 2025 | Packagist shopware/core Packagist shopware/platform |
Shopware vulnerable to MediaVisibilityRestrictionSubscriber bypass when reading media entities by aggregating fields individually GHSA-m895-2hj3-8cg9 | Medium | Not scored | 21 Oct, 2025 | Packagist shopware/core Packagist shopware/platform |
Koa Vulnerable to Open Redirect via Trailing Double-Slash (//) in back Redirect Logic CVE-2025-62595, GHSA-g8mr-fgfg-5qpc | Medium | 0.3% | 21 Oct, 2025 | npm koa |
Taguette vulnerable to cross-site scripting via tag name, tag description, document name and document description CVE-2025-62528, GHSA-g9qw-g6rv-3889, PYSEC-2025-188 | Medium | 0.2% | 20 Oct, 2025 | PyPI taguette |