Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
REDAXO allows Arbitrary File Upload in the mediapool page CVE-2025-27411, GHSA-wppf-gqj5-fc4f | Medium | 0.3% | 05 Mar, 2025 | Packagist redaxo/source |
VMware ESXi, Workstation, and Fusion Information Disclosure Vulnerability CVE-2025-22226 | MediumExploited | 1.6% | 04 Mar, 2025 | |
tsup DOM Clobbering vulnerability CVE-2024-53384, GHSA-3mv9-4h5g-vhg3 | Medium | 0.2% | 03 Mar, 2025 | npm tsup |
seajs Cross-site Scripting vulnerability CVE-2024-51091, GHSA-pfr4-4397-3hg8 | Medium | 0.4% | 03 Mar, 2025 | npm seajs |
Rembg allows SSRF via /api/remove CVE-2025-25301, GHSA-r5gx-c49x-h878, PYSEC-2025-24 | Medium | 0.5% | 03 Mar, 2025 | PyPI rembg |
Flask-AppBuilder Observable Response Discrepancy CVE-2025-24023, GHSA-p8q5-cvwx-wvwp, PYSEC-2025-15 | Medium | 0.3% | 03 Mar, 2025 | PyPI flask-appbuilder |
Apache StreamPipes has improper privilege management in a REST interface CVE-2024-24778, GHSA-vm7w-2724-5m23, PYSEC-2025-66 | Medium | 0.7% | 03 Mar, 2025 | Maven org.apache.streampipes:streampipes-parent PyPI streampipes |
Stage.js DOM Clobbering vulnerabilty CVE-2024-53386, GHSA-fp3m-g5rc-4c28 | Medium | 0.3% | 03 Mar, 2025 | npm stage-js |
PrismJS DOM Clobbering vulnerability CVE-2024-53382, GHSA-x7hr-w5r2-h6wg | Medium | 0.3% | 03 Mar, 2025 | npm prismjs |
Formwork has a cross-site scripting (XSS) vulnerability in Site title GHSA-vf6x-59hh-332f | Medium | Not scored | 01 Mar, 2025 | Packagist getformwork/formwork |
Manifest Uses a One-Way Hash without a Salt CVE-2025-27408, GHSA-h8h6-7752-g28c | Medium | 0.2% | 28 Feb, 2025 | npm manifest |
CodeChecker open redirect when URL contains multiple slashes after the product name CVE-2025-1300, GHSA-g839-x3p3-g5fm, PYSEC-2026-1259 | Medium | 0.3% | 28 Feb, 2025 | PyPI codechecker |
MongoDB Shell may be susceptible to control character Injection via shell output CVE-2025-1693, GHSA-r95j-4jvf-mrrw | Medium | 0.2% | 27 Feb, 2025 | npm mongosh |
Picklescan Allows Remote Code Execution via Malicious Pickle File Bypassing Static Analysis CVE-2025-1716, CVE-2025-1889, GHSA-655q-fx9r-782v, GHSA-769v-p64c-89pr, PYSEC-2025-18, PYSEC-2025-19 | Medium | 1.7% | 26 Feb, 2025 | PyPI picklescan |
Mautic allows Relative Path Traversal in assets file upload CVE-2022-25773, GHSA-4w2w-36vm-c8hf | Medium | 0.6% | 26 Feb, 2025 | Packagist mautic/core |
Matrix IRC Bridge allows IRC command injection to own puppeted user CVE-2025-27146, GHSA-5mvm-89c9-9gm5 | Medium | 0.4% | 25 Feb, 2025 | npm matrix-appservice-irc |
copyparty renders unsanitized filenames as HTML when user uploads empty files CVE-2025-27145, GHSA-m2jw-cj8v-937r, PYSEC-2026-1278 | Medium | 0.5% | 25 Feb, 2025 | PyPI copyparty |
Moodle allows teachers to evade trusttext config when restoring glossary entries BIT-moodle-2025-26532, CVE-2025-26532, GHSA-cw24-f6fq-7j9v | Medium | 0.3% | 24 Feb, 2025 | Packagist moodle/moodle |
Moodle has an IDOR in badges allows disabling of arbitrary badges BIT-moodle-2025-26531, CVE-2025-26531, GHSA-g88w-v4cq-qgcp | Medium | 0.3% | 24 Feb, 2025 | Packagist moodle/moodle |
Moodle has a stored XSS in ddimageortext question type BIT-moodle-2025-26528, CVE-2025-26528, GHSA-h697-w4ph-7pcx | Medium | 0.3% | 24 Feb, 2025 | Packagist moodle/moodle |
Moodle's non-searchable tags can still be discovered on the tag search page and in the tags block BIT-moodle-2025-26527, CVE-2025-26527, GHSA-5r85-6h7f-rg3r | Medium | 0.4% | 24 Feb, 2025 | Packagist moodle/moodle |
Moodle's feedback response viewing and deletions did not respect Separate Groups mode BIT-moodle-2025-26526, CVE-2025-26526, GHSA-pxg4-xjp7-w9c5 | Medium | 0.3% | 24 Feb, 2025 | Packagist moodle/moodle |
Beter Auth has an Open Redirect via Scheme-Less Callback Parameter CVE-2025-27143, GHSA-hjpm-7mrm-26w8 | Medium | 0.4% | 24 Feb, 2025 | npm better-auth |
Leantime affected by Improper Neutralization of HTML Tags CVE-2025-28254, GHSA-95j3-435g-vjcp | Medium | 0.3% | 21 Feb, 2025 | Packagist leantime/leantime |
Leantime allows Cross-Site Request Forgery (CSRF) GHSA-92xh-6x7v-4rmq | Medium | Not scored | 21 Feb, 2025 | Packagist leantime/leantime |
Leantime allows Stored Cross-Site Scripting (XSS) GHSA-63cr-xg3f-8jvr | Medium | Not scored | 21 Feb, 2025 | Packagist leantime/leantime |
Leantime allows Refelected Cross-Site Scripting (XSS) GHSA-52xf-h226-pfgx | Medium | Not scored | 21 Feb, 2025 | Packagist leantime/leantime |
Leantime has Insufficiently Protected Credentials GHSA-h6w8-27ph-c385 | Medium | Not scored | 21 Feb, 2025 | Packagist leantime/leantime |
Leantime allows Stored Cross-Site Scripting (XSS) GHSA-mg4c-884j-pcq9 | Medium | Not scored | 21 Feb, 2025 | Packagist leantime/leantime |
Leantime has Host Header Injection Vulnerability GHSA-99r5-84gr-59f6 | Medium | Not scored | 21 Feb, 2025 | Packagist leantime/leantime |
Cross-site scripting (XSS) in the CKEditor 5 real-time collaboration package CVE-2025-25299, GHSA-j3mm-wmfm-mwvh | Medium | 0.6% | 20 Feb, 2025 | npm @ckeditor/ckeditor5-real-time-collaboration npm ckeditor5-premium-features |
Directus allows updates to non-allowed fields due to overlapping policies CVE-2025-27089, GHSA-99vm-5v2h-h6r6 | Medium | 0.2% | 19 Feb, 2025 | npm @directus/api npm directus |
Drupal Core Vulnerable to Forceful Browsing BIT-drupal-2025-31673, CVE-2025-31673, DRUPAL-CORE-2025-002, GHSA-wpp8-fjgf-pwc7 | Medium | 0.3% | 19 Feb, 2025 | Packagist drupal/core |
Drupal Core Potential Cross-Site Scripting (XSS) via Error Messages BIT-drupal-2025-3057, CVE-2025-3057, DRUPAL-CORE-2025-001, GHSA-39g6-x4x8-5jcm | Medium | 0.3% | 19 Feb, 2025 | Packagist drupal/core |
Exiv2 allows Use After Free CVE-2025-26623, GHSA-38h4-fx85-qcx7, PYSEC-2026-1353 | Medium | 0.9% | 18 Feb, 2025 | PyPI Exiv2 PyPI exiv2 |
Keylime registrar is vulnerable to Denial-of-Service attack when updated to version 7.12.0 CVE-2025-1057, GHSA-9jxq-5x44-gx23, PYSEC-2026-1488 | Medium | 0.4% | 14 Feb, 2025 | PyPI keylime |
@octokit/request has a Regular Expression in fetchWrapper that Leads to ReDoS Vulnerability Due to Catastrophic Backtracking CVE-2025-25290, GHSA-rmvr-2pp2-xj38 | Medium | 0.8% | 14 Feb, 2025 | npm @octokit/request |
@octokit/request-error has a Regular Expression in index that Leads to ReDoS Vulnerability Due to Catastrophic Backtracking CVE-2025-25289, GHSA-xx4v-prfh-6cgc | Medium | 0.6% | 14 Feb, 2025 | npm @octokit/request-error |
@octokit/plugin-paginate-rest has a Regular Expression in iterator Leads to ReDoS Vulnerability Due to Catastrophic Backtracking CVE-2025-25288, GHSA-h5c3-5r3r-rr8q | Medium | 0.6% | 14 Feb, 2025 | npm @octokit/plugin-paginate-rest |
@octokit/endpoint has a Regular Expression in parse that Leads to ReDoS Vulnerability Due to Catastrophic Backtracking CVE-2025-25285, GHSA-x4c5-c7rf-jjgv | Medium | 0.6% | 14 Feb, 2025 | npm @octokit/endpoint |
Vega allows Cross-site Scripting via the vlSelectionTuples function CVE-2025-25304, GHSA-mp7w-mhcv-673j | Medium | 0.7% | 14 Feb, 2025 | npm vega npm vega-selections |
Label Studio allows Cross-Site Scripting (XSS) via GET request to `/projects/upload-example` endpoint CVE-2025-25296, GHSA-wpq5-3366-mqw4, PYSEC-2026-1504 | Medium | 1.9% | 14 Feb, 2025 | PyPI label-studio |
DOMPurify allows Cross-site Scripting (XSS) CVE-2025-26791, GHSA-vhxf-7vqr-mrjg | Medium | 0.6% | 14 Feb, 2025 | npm dompurify |
Remote code execution in alextselegidis/easyappointments CVE-2024-57601, GHSA-3wf7-83q3-948c | Medium | 0.5% | 12 Feb, 2025 | Packagist alextselegidis/easyappointments |
Drupal Configuration Split Cross-Site Request Forgery (CSRF) vulnerability CVE-2025-31688, DRUPAL-CONTRIB-2025-017, GHSA-qq45-cqhg-jwx5 | Medium | 0.2% | 12 Feb, 2025 | Packagist drupal/config_split Packagist:https://packages.drupal.org/8 drupal/config_split |
Drupal SpamSpan Cross-Site Scripting (XSS) vulnerability CVE-2025-31687, DRUPAL-CONTRIB-2025-016, GHSA-8r2q-865v-wm8j | Medium | 0.3% | 12 Feb, 2025 | Packagist drupal/spamspan Packagist:https://packages.drupal.org/8 drupal/spamspan |
Magento Improper Access Control vulnerability CVE-2025-24437, GHSA-469f-wf4f-3jjv | Medium | 0.4% | 11 Feb, 2025 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento Improper Access Control vulnerability CVE-2025-24436, GHSA-ghpr-6qhr-rpp8 | Medium | 0.5% | 11 Feb, 2025 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento Improper Access Control vulnerability CVE-2025-24435, GHSA-82p4-55gj-956p | Medium | 0.5% | 11 Feb, 2025 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento stored Cross-Site Scripting (XSS) vulnerability CVE-2025-24428, GHSA-mm87-rrqx-94cr | Medium | 0.4% | 11 Feb, 2025 | Packagist magento/community-edition Packagist magento/project-community-edition |