Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Flowise does not Prevent Bypass of Password Confirmation - Unverified Password Change CVE-2025-71328, GHSA-fjh6-8679-9pch | High | 0.5% | 14 Nov, 2025 | npm flowise-ui |
Flowise doesn't Prevent Bypass of Password Confirmation through Unverified Email Change (credentials) CVE-2025-71337, GHSA-x39m-3393-3qp4 | High | 0.4% | 14 Nov, 2025 | npm flowise-ui |
Flowise Fails to Invalidate Existing Sessions After Password Changes CVE-2025-71335, GHSA-x7rp-qj2h-ghgw | High | 0.4% | 14 Nov, 2025 | npm flowise |
@apollo/composition has Improper Enforcement of Access Control on Interface Types and Fields CVE-2025-64530, GHSA-mx7m-j9xf-62hw | High | 0.4% | 13 Nov, 2025 | npm @apollo/composition |
LXD vulnerable to a local privilege escalation through custom storage volumes GHSA-3g2j-vm47-x4mj, GO-2025-4121 | High | Not scored | 13 Nov, 2025 | Go github.com/canonical/lxd |
File Browser is Vulnerable to Insecure Direct Object Reference (IDOR) in Share Deletion Function CVE-2025-64523, GHSA-6cqf-cfhv-659g, GO-2025-4117 | High | 0.5% | 13 Nov, 2025 | Go github.com/filebrowser/filebrowser Go github.com/filebrowser/filebrowser/v2 |
AWS Advanced NodeJS Wrapper: Privilege Escalation in Aurora PostgreSQL instance GHSA-8wj8-cfxr-9374 | High | Not scored | 13 Nov, 2025 | npm aws-advanced-nodejs-wrapper |
AWS Advanced Go Wrapper: Privilege Escalation in Aurora PostgreSQL Instance GHSA-7wq2-32h4-9hc9, GO-2025-4119 | High | Not scored | 13 Nov, 2025 | Go github.com/aws/aws-advanced-go-wrapper/auth-helpers Go github.com/aws/aws-advanced-go-wrapper/aws-secrets-manager Go github.com/aws/aws-advanced-go-wrapper/awssql Go github.com/aws/aws-advanced-go-wrapper/federated-auth +6 more |
golang.org/x/crypto/ssh/agent has a potential denial of service CVE-2025-47913, GHSA-56w8-48fp-6mgv, GO-2025-4116 | High | 0.7% | 13 Nov, 2025 | Go golang.org/x/crypto Go golang.org/x/crypto/ssh/agent |
Vega Cross-Site Scripting (XSS) via expressions abusing toString calls in environments using the VEGA_DEBUG global variable CVE-2025-59840, GHSA-7f2v-3qq3-vvjf | High | 0.4% | 13 Nov, 2025 | npm vega npm vega-expression npm vega-interpreter |
Incus vulnerable to local privilege escalation through custom storage volumes CVE-2025-64507, GHSA-56mx-8g9f-5crf, GO-2025-4115 | High | 0.2% | 13 Nov, 2025 | Go github.com/lxc/incus Go github.com/lxc/incus/v6 |
pgAdmin has vulnerability in LDAP authentication mechanism that allows bypassing TLS certificate verification CVE-2025-12765, GHSA-g4r8-3qmh-pmch, PYSEC-2026-1773 | High | 0.2% | 13 Nov, 2025 | PyPI pgadmin4 |
pgAdmin is affected by an LDAP injection vulnerability CVE-2025-12764, GHSA-cvf4-f829-762v, PYSEC-2026-1772 | High | 0.5% | 13 Nov, 2025 | PyPI pgadmin4 |
pgAdmin 4 has command injection vulnerability on Windows systems CVE-2025-12763, GHSA-rm79-x4g6-hvg5, PYSEC-2026-1776 | High | 0.9% | 13 Nov, 2025 | PyPI pgadmin4 |
Symfony's incorrect parsing of PATH_INFO can lead to limited authorization bypass CVE-2025-64500, GHSA-3rg7-wf37-54rm | High | 1.4% | 12 Nov, 2025 | Packagist symfony/http-foundation Packagist symfony/symfony |
Evervault Go SDK: Incomplete PCR Validation in Enclave Attestation for non-Evervault hosted Enclaves CVE-2025-64186, GHSA-88h9-77c7-p6w4, GO-2025-4112 | High | 0.1% | 12 Nov, 2025 | Go github.com/evervault/evervault-go |
OAuth2-Proxy is vulnerable to header smuggling via underscore leading to potential privilege escalation BIT-oauth2-proxy-2025-64484, CVE-2025-64484, GHSA-vjrc-mh2v-45x6, GO-2025-4113 | High | 0.7% | 12 Nov, 2025 | Go github.com/oauth2-proxy/oauth2-proxy Go github.com/oauth2-proxy/oauth2-proxy/v7 |
Observability Operator is vulnerable to Incorrect Privilege Assignment through its Custom Resource MonitorStack CVE-2025-2843, GHSA-mj6p-p843-x5wc, GO-2025-4125 | High | 0.4% | 12 Nov, 2025 | Go github.com/rhobs/observability-operator |
jose2go is vulnerable to a JWT bomb attack through its decode function CVE-2025-63811, GHSA-9mj6-hxhv-w67j, GO-2025-4123 | High | 0.3% | 12 Nov, 2025 | Go github.com/dvsekhvalnov/jose2go |
TYPO3 Modules Extension has Improper Authentication vulnerability CVE-2025-12998, GHSA-49qv-h8pm-73pf | High | 0.4% | 12 Nov, 2025 | Packagist codingms/modules |
Microsoft Windows Race Condition Vulnerability CVE-2025-62215 | HighExploited | 4.5% | 11 Nov, 2025 | |
Microsoft Windows Link Following Vulnerability CVE-2025-60710 | HighExploited | 4.6% | 11 Nov, 2025 | |
Bugsink is vulnerable to unauthenticated remote DoS via crafted Brotli input (via CPU) CVE-2025-64509, GHSA-rrx3-2x4g-mq2h, PYSEC-2026-1227 | High | 0.3% | 10 Nov, 2025 | PyPI bugsink |
Bugsink is vulnerable to unauthenticated remote DoS via crafted Brotli input CVE-2025-64508, GHSA-fc2v-vcwj-269v, PYSEC-2026-1225 | High | 0.5% | 10 Nov, 2025 | PyPI bugsink |
TorrentPier is Vulnerable to Authenticated SQL Injection through Moderator Control Panel's topic_id parameter CVE-2025-64519, GHSA-4rwr-8c3m-55f6 | High | 0.5% | 10 Nov, 2025 | Packagist torrentpier/torrentpier |
AWS Advanced Python Wrapper: Privilege Escalation in Aurora PostgreSQL instance CVE-2025-12967, GHSA-4jvf-wx3f-2x8q, PYSEC-2026-1205 | High | 0.8% | 10 Nov, 2025 | PyPI aws-advanced-python-wrapper PyPI aws_advanced_python_wrapper |
Cloudinary Node SDK is vulnerable to Arbitrary Argument Injection through parameters that include an ampersand CVE-2025-12613, GHSA-g4mf-96x5-5m2c | High | 0.4% | 10 Nov, 2025 | npm cloudinary |
Insecure Deserialization (pickle) in pdfminer.six CMap Loader — Local Privesc CVE-2025-70559, GHSA-f83h-ghpp-7wcc, PYSEC-2026-1761 | High | 0.3% | 07 Nov, 2025 | PyPI pdfminer-six PyPI pdfminer.six |
Arbitrary Code Execution in pdfminer.six via Crafted PDF Input CVE-2025-64512, GHSA-wf5f-4jwr-ppcp, PYSEC-2026-1762 | High | 0.3% | 07 Nov, 2025 | PyPI pdfminer-six PyPI pdfminer.six |
KubeVirt Vulnerable to Arbitrary Host File Read and Write CVE-2025-64324, GHSA-46xp-26xh-hpqh, GO-2025-4110 | High | 0.2% | 07 Nov, 2025 | Go kubevirt.io/kubevirt |
Open WebUI Affected by an External Model Server (Direct Connections) Code Injection via SSE Events CVE-2025-64496, GHSA-cm35-v4vp-5xvx, PYSEC-2026-1729 | High | 7.2% | 07 Nov, 2025 | PyPI open-webui npm open-webui |
AstrBot contains a directory traversal vulnerability CVE-2025-57698, GHSA-xrj9-mw57-j34v, PYSEC-2026-1198 | High | 0.8% | 07 Nov, 2025 | PyPI AstrBot PyPI astrbot |
Open WebUI vulnerable to Stored DOM XSS via prompts when 'Insert Prompt as Rich Text' is enabled resulting in ATO/RCE CVE-2025-64495, GHSA-w7xj-8fx7-wfch, PYSEC-2026-1741 | High | 0.5% | 07 Nov, 2025 | PyPI open-webui npm open-webui |
Sangoma FreePBX OS Command Injection Vulnerability CVE-2025-64328 | HighExploited | 84.6% | 07 Nov, 2025 | |
MQTT does not validate hostnames CVE-2025-12790, GHSA-9c5q-w6gr-fxcq | High | 0.4% | 06 Nov, 2025 | RubyGems mqtt |
Cross-Site Scripting (XSS) vulnerability through unescaped HTML attribute values CVE-2025-64501, GHSA-52c5-vh7f-26fx | High | 0.2% | 06 Nov, 2025 | RubyGems prosemirror_to_html |
containerd affected by a local privilege escalation via wide permissions on CRI directory CVE-2024-25621, GHSA-pwhc-rpq9-4c8w, GO-2025-4100 | High | 0.2% | 06 Nov, 2025 | Go github.com/containerd/containerd Go github.com/containerd/containerd/v2 |
LangGraph Checkpoint affected by RCE in "json" mode of JsonPlusSerializer CVE-2025-64439, GHSA-wwqv-p2pp-99h5, PYSEC-2026-1527 | High | 0.9% | 05 Nov, 2025 | PyPI langgraph-checkpoint |
Parse Server Vulnerable to Server-Side Request Forgery (SSRF) in File Upload via URI Format BIT-parse-2025-64430, CVE-2025-64430, GHSA-x4qj-2f4q-r4rx | High | 0.6% | 05 Nov, 2025 | npm parse-server |
IDOR Vulnerabilities in ZITADEL's Organization API allows Cross-Tenant Data Tempering CVE-2025-64431, GHSA-cpf4-pmr4-w6cx, GO-2025-4099 | High | 0.3% | 05 Nov, 2025 | Go github.com/zitadel/zitadel |
Apple Multiple products Use-After-Free Vulnerability CVE-2023-43000 | HighExploited | 4.0% | 05 Nov, 2025 | |
runc container escape and denial of service due to arbitrary write gadgets and procfs write redirects CVE-2025-52881, GHSA-cgrx-mc8f-2prm, GO-2025-4098 | High | 0.8% | 05 Nov, 2025 | Go github.com/opencontainers/runc Go github.com/opencontainers/selinux |
runc container escape with malicious config due to /dev/console mount and related races CVE-2025-52565, GHSA-qw9x-cqr3-wc7r, GO-2025-4097 | High | 0.8% | 05 Nov, 2025 | Go github.com/opencontainers/runc |
runc container escape via "masked path" abuse due to mount race conditions CVE-2025-31133, GHSA-9493-h29p-rfm2, GO-2025-4096 | High | 1.2% | 05 Nov, 2025 | Go github.com/opencontainers/runc |
Django has a denial-of-service vulnerability in HttpResponseRedirect and HttpResponsePermanentRedirect on Windows BIT-django-2025-64458, CVE-2025-64458, GHSA-qw25-v68c-qjf3, PYSEC-2025-107 | High | 1.9% | 05 Nov, 2025 | PyPI django |
MARIN3R: Cross-Namespace Vulnerability in the Operator CVE-2025-64171, GHSA-gf93-xccm-5g6j, GO-2025-4093 | High | 0.2% | 04 Nov, 2025 | Go github.com/3scale-sre/marin3r |
Dosage vulnerable to a Directory Traversal through crafted HTTP responses CVE-2025-64184, GHSA-4vcx-3pj3-44m7, PYSEC-2026-1316 | High | 0.5% | 04 Nov, 2025 | PyPI dosage |
Jellysweep uses uncontrolled data in image cache API endpoint CVE-2025-64178, GHSA-xc93-q32j-cpcg, GO-2025-4091 | High | 0.3% | 04 Nov, 2025 | Go github.com/jon4hz/jellysweep |
MantisBT Vulnerable to Denial-of-Service (DoS) via Excessive Note Length CVE-2025-46556, GHSA-r3jf-hm7q-qfw5 | High | 0.4% | 03 Nov, 2025 | Packagist mantisbt/mantisbt |
MantisBT vulnerable to authentication bypass for some passwords due to PHP type juggling CVE-2025-47776, GHSA-4v8w-gg5j-ph37 | High | 0.3% | 03 Nov, 2025 | Packagist mantisbt/mantisbt |