Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Drupal Currency allows Cross Site Request Forgery CVE-2025-10930, DRUPAL-CONTRIB-2025-110, GHSA-27fv-rpgj-4c6m | Medium | 0.1% | 24 Sep, 2025 | Packagist drupal/currency Packagist:https://packages.drupal.org/8 drupal/currency |
Drupal Access code allows Brute Force Attempts CVE-2025-10928, DRUPAL-CONTRIB-2025-108, GHSA-27mc-9399-r9mx | Medium | 0.2% | 24 Sep, 2025 | Packagist drupal/access_code Packagist:https://packages.drupal.org/8 drupal/access_code |
Drupal Plausible tracking is vulnerable to XSS CVE-2025-10927, DRUPAL-CONTRIB-2025-107, GHSA-pr6m-qwrr-mrw9 | Medium | 0.2% | 24 Sep, 2025 | Packagist drupal/plausible_tracking Packagist:https://packages.drupal.org/8 drupal/plausible_tracking |
Drupal JSON Field is vulnerable to XSS CVE-2025-10926, DRUPAL-CONTRIB-2025-106, GHSA-m3f2-xjgc-2wp2 | Medium | 0.2% | 24 Sep, 2025 | Packagist drupal/json_field Packagist:https://packages.drupal.org/8 drupal/json_field |
pip's fallback tar extraction doesn't check symbolic links point to extraction directory CVE-2025-8869, GHSA-4xh5-x5gv-qwph, PYSEC-2026-1795 | Medium | 0.5% | 24 Sep, 2025 | PyPI pip |
GP247 and S-Cart have a stored cross-site scripting (XSS) vulnerability CVE-2025-57407, GHSA-46v4-5mc8-q2cf | Medium | 0.2% | 23 Sep, 2025 | Packagist gp247/core Packagist s-cart/core |
Mailgen: HTML injection vulnerability in plaintext e-mails CVE-2025-59526, GHSA-j2xj-h7w5-r7vp | Medium | 0.4% | 22 Sep, 2025 | npm mailgen |
@conventional-changelog/git-client has Argument Injection vulnerability CVE-2025-59433, GHSA-vh25-5764-9wcr | Medium | 0.2% | 22 Sep, 2025 | npm @conventional-changelog/git-client |
Libraesva Email Security Gateway Command Injection Vulnerability CVE-2025-59689 | MediumExploited | 2.0% | 19 Sep, 2025 | |
Grafana-Zabbix ReDoS vulnerability CVE-2025-10630, GHSA-g4rr-88fc-26fj, GO-2025-3976 | Medium | Not scored | 19 Sep, 2025 | Go github.com/alexanderzobnin/grafana-zabbix |
Snipe-IT allows XSS CVE-2025-59712, GHSA-c9wp-pr7f-hfqm | Medium | 0.3% | 19 Sep, 2025 | Packagist snipe/snipe-it |
Lobe Chat Desktop vulnerable to Remote Code Execution via XSS in Chat Messages CVE-2025-59417, GHSA-m79r-r765-5f9j | Medium | 0.4% | 18 Sep, 2025 | npm @lobehub/chat |
@sequa-ai/sequa-mcp has Command Injection vulnerability CVE-2025-10619, GHSA-9pw5-wx67-q964 | Medium | 1.8% | 17 Sep, 2025 | npm @sequa-ai/sequa-mcp |
DragonFly's tiny file download uses hard coded HTTP protocol CVE-2025-59410, GHSA-mcvp-rpgg-9273, GO-2025-3974 | Medium | Not scored | 17 Sep, 2025 | Go d7y.io/dragonfly/v2 Go github.com/dragonflyoss/dragonfly |
DragonFly has weak integrity checks for downloaded files CVE-2025-59354, GHSA-hx2h-vjw2-8r54, GO-2025-3973 | Medium | Not scored | 17 Sep, 2025 | Go d7y.io/dragonfly/v2 Go github.com/dragonflyoss/dragonfly |
DragonFly vulnerable to arbitrary file read and write on a peer machine CVE-2025-59352, GHSA-79hx-3fp8-hj66, GO-2025-3971 | Medium | Not scored | 17 Sep, 2025 | Go d7y.io/dragonfly/v2 Go github.com/dragonflyoss/dragonfly |
DragonFly vulnerable to panics due to nil pointer dereference when using variables created alongside an error CVE-2025-59351, GHSA-4mhv-8rh3-4ghw, GO-2025-3970 | Medium | Not scored | 17 Sep, 2025 | Go d7y.io/dragonfly/v2 Go github.com/dragonflyoss/dragonfly |
Dragonfly vulnerable to timing attacks against Proxy’s basic authentication CVE-2025-59350, GHSA-c2fc-9q9c-5486, GO-2025-3972 | Medium | Not scored | 17 Sep, 2025 | Go d7y.io/dragonfly/v2 Go github.com/dragonflyoss/dragonfly |
Dragonfly incorrectly handles a task structure’s usedTrac field CVE-2025-59348, GHSA-2qgr-gfvj-qpcr, GO-2025-3963 | Medium | Not scored | 17 Sep, 2025 | Go d7y.io/dragonfly/v2 Go github.com/dragonflyoss/dragonfly |
Dragonfly's manager makes requests to external endpoints with disabled TLS authentication CVE-2025-59347, GHSA-98x5-jw98-6c97, GO-2025-3966 | Medium | Not scored | 17 Sep, 2025 | Go d7y.io/dragonfly/v2 Go github.com/dragonflyoss/dragonfly |
Parcel has an Origin Validation Error vulnerability CVE-2025-56648, GHSA-qm9p-f9j5-w83w | Medium | 0.2% | 17 Sep, 2025 | npm @parcel/reporter-dev-server |
esm.sh has arbitrary file write via path traversal in `X-Zone-Id` header CVE-2025-59342, GHSA-g2h5-cvvr-7gmw, GO-2025-3967 | Medium | Not scored | 17 Sep, 2025 | Go github.com/esm-dev/esm.sh |
matrix-js-sdk has insufficient validation when considering a room to be upgraded by another CVE-2025-59160, GHSA-mp7c-m3rh-r56v | Medium | 0.2% | 16 Sep, 2025 | npm matrix-js-sdk |
Ghost vulnerable to Server Side Request Forgery (SSRF) via oEmbed Bookmark BIT-ghost-2025-9862, CVE-2025-9862, GHSA-f7qg-xj45-w956 | Medium | 0.5% | 15 Sep, 2025 | npm ghost |
HackMD MCP Server has Server-Side Request Forgery (SSRF) vulnerability CVE-2025-59155, GHSA-g5cg-6c7v-mmpw | Medium | 0.4% | 15 Sep, 2025 | npm hackmd-mcp |
wangxutech MoneyPrinterTurbo 1.2.6 allows path traversal via /api/v1/download/ URIs such as /api/v1/download//etc/passwd. CVE-2025-49089, PYSEC-2025-143 | Medium | 0.3% | 15 Sep, 2025 | PyPI moneyprinterturbo |
Stored XSS in n8n LangChain Chat Trigger Node via initialMessages Parameter CVE-2025-58177, GHSA-mvh4-2cm2-6hpg | Medium | 0.2% | 15 Sep, 2025 | npm n8n |
Open Web Analytics Server is vulnerable to SQL Injection CVE-2025-59397, GHSA-6w8r-xgqq-qg6g | Medium | 0.4% | 15 Sep, 2025 | Packagist open-web-analytics/open-web-analytics |
Temporal OSS Server Vulnerable to Allocation of Resources Without Limits or Throttling CVE-2025-8396, GHSA-p768-c3pr-6459, GO-2025-3953 | Medium | Not scored | 15 Sep, 2025 | Go go.temporal.io/server |
mcp-kubernetes-server has a Command Injection vulnerability CVE-2025-59376, GHSA-hjm5-xgj8-vwj6, PYSEC-2026-1619 | Medium | 0.3% | 15 Sep, 2025 | PyPI mcp-kubernetes-server |
MetaMask SDK indirectly exposed via malicious debug@4.4.2 dependency GHSA-qj3p-xc97-xw74 | Medium | Not scored | 15 Sep, 2025 | npm @metamask/sdk npm @metamask/sdk-communication-layer npm @metamask/sdk-react |
Mattermost makes Use of Weak Hash CVE-2025-9078, GHSA-9p92-x77w-9fw2, GO-2025-3959 | Medium | Not scored | 15 Sep, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost Missing Authorization vulnerability CVE-2025-9076, GHSA-3vcm-c42p-3hhf, GO-2025-3950 | Medium | Not scored | 15 Sep, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
express-xss-sanitizer has an unbounded recursion depth CVE-2025-59364, GHSA-hvq2-wf92-j4f3 | Medium | 0.4% | 14 Sep, 2025 | npm express-xss-sanitizer |
Hugging Face Transformers library has Regular Expression Denial of Service CVE-2025-6051, GHSA-rcv9-qm8p-9p6j, PYSEC-2026-1988 | Medium | 0.4% | 14 Sep, 2025 | PyPI transformers |
Hono has Body Limit Middleware Bypass CVE-2025-59139, GHSA-92vj-g62v-jqhh | Medium | 0.4% | 12 Sep, 2025 | npm hono |
Subrion CMS: Authenticated administrators are able to gain escalated access through Run SQL Query tool CVE-2025-56556, GHSA-h8wv-vv58-468h | Medium | 0.2% | 11 Sep, 2025 | Packagist intelliants/subrion |
Flask App Builder has an Authentication Bypass vulnerability when using non AUTH_DB methods CVE-2025-58065, GHSA-765j-9r45-w2q2, PYSEC-2026-1378 | Medium | 0.4% | 11 Sep, 2025 | PyPI flask-appbuilder |
jsondiffpatch is vulnerable to Cross-site Scripting (XSS) via HtmlFormatter::nodeBegin CVE-2025-9910, GHSA-33vc-wfww-vjfv | Medium | 0.3% | 11 Sep, 2025 | npm jsondiffpatch |
Decap CMS Cross Site Scripting (XSS) vulnerability CVE-2025-57520, GHSA-xp8g-32qh-mv28 | Medium | 0.3% | 10 Sep, 2025 | npm decap-cms |
Indico vulnerable to Cross-Site Scripting via LaTeX math code CVE-2025-59035, GHSA-7cf7-9wrr-vrf4, PYSEC-2026-1461 | Medium | 0.2% | 10 Sep, 2025 | PyPI indico |
Indico may disclose unauthorized user details access via legacy API CVE-2025-59034, GHSA-4269-mcfh-cp7q, PYSEC-2026-1460 | Medium | 0.3% | 10 Sep, 2025 | PyPI indico |
Infrahub: Deleted and expired API tokens can still authenticate CVE-2025-59036, GHSA-v2p7-4pv4-3wwh, PYSEC-2026-1463 | Medium | 0.2% | 09 Sep, 2025 | PyPI infrahub-server |
TinyEnv: Inline comments not stripped properly in .env values CVE-2025-58759, GHSA-72cm-7236-h43r | Medium | 0.2% | 09 Sep, 2025 | Packagist datahihi1/tiny-env |
SGLang Remote Code Execution Vulnerability via Unsafe Deserialization in update_weights_from_tensor CVE-2025-10164, GHSA-9w53-xr52-mwgj, PYSEC-2026-1919 | Medium | 0.4% | 09 Sep, 2025 | PyPI sglang |
Element Plus Link component (el-link) implements insufficient input validation for the href attribute CVE-2025-57665, GHSA-5m5x-9j46-h678 | Medium | 0.2% | 09 Sep, 2025 | npm element-plus |
YesWiki Cross Site Scripting vulnerability CVE-2025-52277, GHSA-29cj-cxw4-v4j2 | Medium | 0.4% | 09 Sep, 2025 | Packagist yeswiki/yeswiki |
copyparty: Sharing a single file does not fully restrict access to other files in source folder CVE-2025-58753, GHSA-pxvw-4w88-6x95, PYSEC-2026-1279 | Medium | 0.4% | 09 Sep, 2025 | PyPI copyparty |
TYPO3 CSV download feature information disclosure CVE-2025-59019, GHSA-j8vm-7q52-2m2m | Medium | 0.2% | 09 Sep, 2025 | Packagist typo3/cms-backend Packagist typo3/cms-recordlist |
TYPO3 backend modules have Broken Access Control CVE-2025-59017, GHSA-2fhw-2j7m-mr4m | Medium | 0.3% | 09 Sep, 2025 | Packagist typo3/cms-backend Packagist typo3/cms-beuser Packagist typo3/cms-dashboard Packagist typo3/cms-recycler +1 more |