Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Uptime Kuma Server-side Template Injection (SSTI) in Notification Templates Allows Arbitrary File Read GHSA-vffh-c9pq-4crh | Medium | Not scored | 20 Oct, 2025 | npm uptime-kuma |
vite allows server.fs.deny bypass via backslash on Windows CVE-2025-62522, GHSA-93m4-6634-74q7 | Medium | 1.1% | 20 Oct, 2025 | npm vite |
Actual Sync-server Gocardless service is logging sensitive data including bearer tokens and account numbers GHSA-xvp7-8vm8-xfxx | Medium | Not scored | 20 Oct, 2025 | npm @actual-app/sync-server |
Cargo Mediawiki Extension vulnerable to Cross-site Scripting CVE-2025-62671, GHSA-gr6v-3pmp-996p | Medium | 0.5% | 18 Oct, 2025 | Packagist mediawiki/cargo |
Citizen vulnerable to stored XSS in sticky header button messages CVE-2025-62508, GHSA-g955-vw6w-v6pp | Medium | 0.4% | 17 Oct, 2025 | Packagist starcitizentools/citizen-skin |
ibexa/fieldtype-richtext has an XSS vulnerability via acronym custom tag in Rich Text GHSA-8c2g-f8jm-5cr7 | Medium | Not scored | 17 Oct, 2025 | Packagist ibexa/fieldtype-richtext |
ibexa/admin-ui has an XSS vulnerability in Cancel/Reschedule future publication modal GHSA-2mx6-fq24-g2mh | Medium | Not scored | 17 Oct, 2025 | Packagist ibexa/admin-ui |
ezsystems/ezplatform-admin-ui has an XSS vulnerability in Cancel/Reschedule future publication modal GHSA-99c7-c3mw-mxhv | Medium | Not scored | 17 Oct, 2025 | Packagist ezsystems/ezplatform-admin-ui |
ibexa/user login enumerates user accounts GHSA-q3x8-6898-23g3 | Medium | Not scored | 17 Oct, 2025 | Packagist ibexa/user |
Mammoth is vulnerable to Directory Traversal CVE-2025-11849, GHSA-rmjr-87wv-gf87, PYSEC-2026-1603 | Medium | 1.1% | 17 Oct, 2025 | Maven org.zwobble.mammoth:mammoth NuGet Mammoth PyPI mammoth npm mammoth |
bagisto has a Cross Site Scripting (XSS) vulnerability in TinyMCE Image Upload (SVG) CVE-2025-62418, GHSA-fg89-g389-p346 | Medium | 0.3% | 16 Oct, 2025 | Packagist bagisto/bagisto |
bagisto has Server Side Template Injection (SSTI) in Product Description CVE-2025-62416, GHSA-527q-4wqv-g9wj | Medium | 0.4% | 16 Oct, 2025 | Packagist bagisto/bagisto |
bagisto has Cross Site Scripting (XSS) in Create New Customer CVE-2025-62414, GHSA-r9xj-mvqf-jm7w | Medium | 0.3% | 16 Oct, 2025 | Packagist bagisto/bagisto |
LibreNMS alert-rules has a Cross-Site Scripting Vulnerability CVE-2025-62412, GHSA-6g2v-66ch-6xmh | Medium | 0.3% | 16 Oct, 2025 | Packagist librenms/librenms |
PrestaShop Checkout Backoffice directory traversal allows arbitrary file disclosure CVE-2025-61923, GHSA-fpxp-pfqm-x54w | Medium | 0.9% | 16 Oct, 2025 | Packagist prestashop/ps_checkout |
bagisto has Cross Site Scripting (XSS) issue in TinyMCE Image Upload (HTML) CVE-2025-62415, GHSA-67px-r26w-598x | Medium | 0.3% | 16 Oct, 2025 | Packagist bagisto/bagisto |
Strapi Password Hashing is Missing Maximum Password Length Validation CVE-2025-25298, GHSA-2cjv-6wg9-f4f3 | Medium | 0.4% | 16 Oct, 2025 | npm @strapi/core |
LibreNMS has a Stored XSS vulnerability in its Alert Transport name field CVE-2025-62411, GHSA-frc6-pwgr-c28w | Medium | 12.7% | 16 Oct, 2025 | Packagist librenms/librenms |
Strapi is vulnerable to Insufficient Session Expiration CVE-2025-3930, GHSA-4r8w-3jww-m2rp | Medium | 0.7% | 16 Oct, 2025 | npm @strapi/strapi |
Apache Spark has Inadequate Encryption Strength CVE-2025-55039, GHSA-6p6v-m64v-jx8q, PYSEC-2025-184 | Medium | 0.2% | 15 Oct, 2025 | Maven org.apache.spark:spark-network-common_2.12 Maven org.apache.spark:spark-network-common_2.13 PyPI pyspark |
Magento vulnerable to privilege escalation due to incorrect authorization CVE-2025-54267, GHSA-qvwr-p3hj-j6jf | Medium | 0.4% | 14 Oct, 2025 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento vulnerable to stored Cross-Site Scripting (XSS) CVE-2025-54266, GHSA-pcrx-r49h-x2w5 | Medium | 0.3% | 14 Oct, 2025 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento allows incorrect authorization CVE-2025-54265, GHSA-r355-75hw-r8jf | Medium | 0.6% | 14 Oct, 2025 | Packagist magento/community-edition Packagist magento/project-community-edition |
Parse Javascript SDK vulnerable to prototype pollution in `Parse.Object` and internal APIs CVE-2025-62374, GHSA-9f2h-7v79-mxw3 | Medium | 0.4% | 14 Oct, 2025 | npm parse |
LibreNMS is vulnerable to Reflected-XSS in `report_this` function CVE-2025-62365, GHSA-86rg-8hc8-v82p | Medium | 0.2% | 13 Oct, 2025 | Packagist librenms/librenms |
CommandKit has incorrect command name exposure in context object for message command aliases CVE-2025-62378, GHSA-fhwm-pc6r-4h2f | Medium | 0.2% | 13 Oct, 2025 | npm commandkit |
Linux Kernel Race Condition Vulnerability CVE-2025-39964 | MediumExploited | 1.6% | 13 Oct, 2025 | |
QGIS QWC2 Cross-Site Scripting vulnerability CVE-2025-11183, GHSA-gxp8-m5rq-3m38 | Medium | 0.4% | 13 Oct, 2025 | npm qwc2 |
Authlib : JWE zip=DEF decompression bomb enables DoS CVE-2025-62706, GHSA-g7f3-828f-7h7m, PYSEC-2026-1202 | Medium | 0.5% | 10 Oct, 2025 | PyPI authlib |
python-ldap is Vulnerable to Improper Encoding or Escaping of Output and Improper Null Termination CVE-2025-61912, GHSA-p34h-wq7j-h5v6, PYSEC-2026-1846 | Medium | 0.5% | 10 Oct, 2025 | PyPI python-ldap |
python-ldap has sanitization bypass in ldap.filter.escape_filter_chars CVE-2025-61911, GHSA-r7r6-cc7p-4v5m, PYSEC-2026-1847 | Medium | 0.3% | 10 Oct, 2025 | PyPI python-ldap |
Astro's `X-Forwarded-Host` is reflected without validation CVE-2025-61925, GHSA-5ff5-9fcw-vg88 | Medium | 0.4% | 10 Oct, 2025 | npm astro |
Alt Redirect: Potential Authentication Bypass by Spoofing through query-string stripping logic flaw CVE-2025-60868, GHSA-rpjr-pcmr-9ppw | Medium | 0.2% | 10 Oct, 2025 | Packagist alt-design/alt-redirect |
Python Social Auth - Django has unsafe account association CVE-2025-61783, GHSA-wv4w-6qv2-qqfg, PYSEC-2026-1932 | Medium | 0.5% | 09 Oct, 2025 | PyPI social-auth-app-django |
BBOT's gitlab.py exposes globally configured "gitlab" API key CVE-2025-10282, GHSA-p3v4-c93g-cmhw, PYSEC-2026-1217 | Medium | 0.2% | 09 Oct, 2025 | PyPI bbot |
BBOT's git_clone.py can expose users' GitHub API keys to an attacker-controlled webserver CVE-2025-10281, GHSA-63wh-p5fx-h4vc, PYSEC-2026-1216 | Medium | 0.2% | 09 Oct, 2025 | PyPI bbot |
Synapse's invalid device keys degrade federation functionality CVE-2025-61672, GHSA-fh66-fcv5-jjfr, PYSEC-2026-1612 | Medium | 0.5% | 08 Oct, 2025 | PyPI matrix-synapse |
VaahCMS is vulnerable to XSS through its Avatar Upload endpoint CVE-2025-61183, GHSA-q769-phqg-263r | Medium | 0.3% | 08 Oct, 2025 | Packagist webreinvent/vaahcms |
vLLM: Resource-Exhaustion (DoS) through Malicious Jinja Template in OpenAI-Compatible Server CVE-2025-61620, GHSA-6fvq-23cw-5628, PYSEC-2026-2013 | Medium | Not scored | 07 Oct, 2025 | PyPI vllm |
python-socketio vulnerable to arbitrary Python code execution (RCE) through malicious pickle deserialization in certain multi-server deployments CVE-2025-61765, GHSA-g8c6-8fjj-2r4m, PYSEC-2026-1854 | Medium | 0.5% | 06 Oct, 2025 | PyPI python-socketio |
clearml is vulnerable to Path Traversal through its `safe_extract` function CVE-2025-8917, GHSA-579p-qf78-fqm2, PYSEC-2026-1255 | Medium | 0.5% | 05 Oct, 2025 | PyPI clearml |
MCPHub has an Improper Authorization vulnerability via its handleSseConnection function CVE-2025-11287, GHSA-v7c4-33vf-cqqq | Medium | 0.6% | 05 Oct, 2025 | npm @samanhappy/mcphub |
Flowise Stored XSS vulnerability through logs in chatbot CVE-2025-29192, GHSA-7r4h-vmj9-wg42 | Medium | 0.4% | 03 Oct, 2025 | npm flowise |
Flowise vulnerable to XSS CVE-2025-71331, GHSA-4fr9-3x69-36wv | Medium | 0.3% | 03 Oct, 2025 | npm flowise |
NiceGUI has a Reflected XSS CVE-2025-53354, GHSA-8c95-hpq2-w46f, PYSEC-2026-1699 | Medium | 0.2% | 03 Oct, 2025 | PyPI nicegui |
marimo vulnerable to proxy abuse of /mpl/{port}/ GHSA-xjv7-6w92-42r7 | Medium | Not scored | 01 Oct, 2025 | PyPI marimo |
Django vulnerable to partial directory traversal via archives BIT-django-2025-59682, CVE-2025-59682, GHSA-q95w-c7qg-hrff, PYSEC-2026-1296 | Medium | 0.9% | 01 Oct, 2025 | PyPI django |
Fiora chat user avatar is vulnerable to XSS via SVG files CVE-2025-56514, GHSA-hg3j-6pmh-mvjr | Medium | 0.3% | 01 Oct, 2025 | npm fiora |
SPDK is vulnerable to buffer overflow in the NVMe-oF target component CVE-2025-57275, GHSA-5m5w-w2h2-fqgq, PYSEC-2026-1935 | Medium | 0.3% | 01 Oct, 2025 | PyPI spdk |
validator.js has a URL validation bypass vulnerability in its isURL function CVE-2025-56200, GHSA-9965-vmph-33xx | Medium | 0.3% | 30 Sep, 2025 | npm validator |