Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Microsoft Windows Improper Access Control Vulnerability CVE-2025-59230 | HighExploited | 2.7% | 14 Oct, 2025 | |
Microsoft Windows Untrusted Pointer Dereference Vulnerability CVE-2025-24990 | HighExploited | 6.5% | 14 Oct, 2025 | |
Home Assistant has Stored XSS vulnerability in Energy dashboard from Energy Entity Name CVE-2025-62172, GHSA-mq77-rv97-285m, PYSEC-2026-1453 | High | 0.4% | 14 Oct, 2025 | PyPI homeassistant |
Omni vulnerable to information leak via API CVE-2025-61688, GHSA-77r9-w39m-9xh5, GO-2025-4022 | High | 0.3% | 13 Oct, 2025 | Go github.com/siderolabs/omni |
llama-index has Insecure Temporary File CVE-2025-7707, GHSA-rg9h-vx28-xxp5, PYSEC-2026-1556 | High | 0.2% | 13 Oct, 2025 | PyPI llama-index |
Oracle E-Business Suite Server-Side Request Forgery (SSRF) Vulnerability CVE-2025-61884 | HighExploited | 95.9% | 12 Oct, 2025 | |
Parallax is vulnerable to DoS via malicious p2p message GHSA-xc79-566c-j4qx, GO-2025-4019 | High | Not scored | 10 Oct, 2025 | Go github.com/microstack-tech/parallax |
Flowise is vulnerable to arbitrary file exposure through its ReadFileTool GHSA-j44m-5v8f-gc9c | High | Not scored | 10 Oct, 2025 | npm flowise npm flowise-components |
Authlib is vulnerable to Denial of Service via Oversized JOSE Segments CVE-2025-61920, GHSA-pq5p-34cr-23v9, PYSEC-2026-1203 | High | 0.6% | 10 Oct, 2025 | PyPI authlib |
Bagisto is vulnerable to XSS through Admin Panel's product creation path CVE-2025-60880, GHSA-29mf-w486-v3vc | High | 0.4% | 10 Oct, 2025 | Packagist bagisto/bagisto |
Rack is vulnerable to a memory-exhaustion DoS through unbounded URL-encoded body parsing CVE-2025-61919, GHSA-6xw4-3v39-52mm | High | 0.6% | 10 Oct, 2025 | RubyGems rack |
quic-go: Panic occurs when queuing undecryptable packets after handshake completion CVE-2025-59530, GHSA-47m2-4cr7-mhcw, GO-2025-4017 | High | 0.5% | 10 Oct, 2025 | Go github.com/quic-go/quic-go |
Gladinet CentreStack and Triofox Files or Directories Accessible to External Parties Vulnerability CVE-2025-11371 | HighExploited | 92.1% | 09 Oct, 2025 | |
n8n: Execute Command Node Allows Authenticated Users to Run Arbitrary Commands on Host CVE-2025-71380, GHSA-365g-vjw2-grx8 | High | 0.6% | 09 Oct, 2025 | npm n8n npm n8n-nodes-base |
pyLoad CNL and captcha handlers allow Code Injection via unsanitized parameters CVE-2025-61773, GHSA-cjjf-27cc-pvmv, PYSEC-2026-1816 | High | 0.5% | 09 Oct, 2025 | PyPI pyload-ng |
Casdoor is vulnerable to Improper Authorization CVE-2025-61524, GHSA-5m9m-j5p7-m7f9, GO-2025-4026 | High | 0.7% | 08 Oct, 2025 | Go github.com/casdoor/casdoor |
vLLM is vulnerable to Server-Side Request Forgery (SSRF) through `MediaConnector` class CVE-2025-6242, GHSA-3f6c-7fw2-ppm4, PYSEC-2026-2011 | High | 0.3% | 07 Oct, 2025 | PyPI vllm |
LLaMA Factory's Chat API Contains Critical SSRF and LFI Vulnerabilities CVE-2025-61784, GHSA-527m-2xhr-j27g, PYSEC-2026-1573 | High | 0.4% | 07 Oct, 2025 | PyPI llamafactory |
Rack's multipart parser buffers unbounded per-part headers, enabling DoS (memory exhaustion) CVE-2025-61772, GHSA-wpv5-97wm-hp9c | High | 0.9% | 07 Oct, 2025 | RubyGems rack |
Rack: Multipart parser buffers large non‑file fields entirely in memory, enabling DoS (memory exhaustion) CVE-2025-61771, GHSA-w9pc-fmgc-vxvw | High | 0.6% | 07 Oct, 2025 | RubyGems rack |
Rack's unbounded multipart preamble buffering enables DoS (memory exhaustion) CVE-2025-61770, GHSA-p543-xpfm-54cp | High | 0.9% | 07 Oct, 2025 | RubyGems rack |
vLLM is vulnerable to timing attack at bearer auth CVE-2025-59425, GHSA-wr9h-g72x-mwhm, PYSEC-2026-2026 | High | 0.6% | 07 Oct, 2025 | PyPI vllm |
Nodemailer: Email to an unintended domain can occur due to Interpretation Conflict CVE-2025-13033, GHSA-mm7p-fcc7-pg87 | High | 0.6% | 07 Oct, 2025 | npm nodemailer |
pdfmake is vulnerable to Throttling via repeatedly redirecting URL in file embedding CVE-2025-11362, GHSA-rj3r-r7hh-jxfq | High | 0.4% | 07 Oct, 2025 | npm pdfmake |
LangChain Text Splitters is vulnerable to XML External Entity (XXE) attacks due to unsafe XSLT parsing CVE-2025-6985, GHSA-m42m-m8cr-8m58, PYSEC-2026-1520 | High | 0.5% | 06 Oct, 2025 | PyPI langchain-text-splitters |
FlowiseAI/Flosise has File Upload vulnerability CVE-2025-61687, GHSA-35g6-rrw3-v6xc | High | 11.8% | 06 Oct, 2025 | npm flowise |
Litestar X-Forwarded-For Header Spoofing Vulnerability Enables Rate Limit Evasion CVE-2025-59152, GHSA-hm36-ffrh-c77c, PYSEC-2026-1553 | High | 0.5% | 06 Oct, 2025 | PyPI litestar |
ZenML is vulnerable to Path Traversal through its `PathMaterializer` class CVE-2025-8406, GHSA-q92x-2x5g-h365, PYSEC-2026-2071 | High | 0.4% | 05 Oct, 2025 | PyPI zenml |
motionEye vulnerable to RCE via unsanitized motion config parameter CVE-2025-60787, GHSA-j945-qm58-4gjx, PYSEC-2026-1680 | High | 18.5% | 03 Oct, 2025 | PyPI motioneye |
Claude Code can execute commands prior to the startup trust dialog CVE-2025-59536, GHSA-4fgq-fpq9-mr3g | High | 24.9% | 03 Oct, 2025 | npm @anthropic-ai/claude-code |
Canonical LXD CSRF Vulnerability When Using Client Certificate Authentication with the LXD-UI CVE-2025-54286, GHSA-p8hw-rfjg-689h, GO-2025-4003 | High | 0.1% | 02 Oct, 2025 | Go github.com/canonical/lxd |
Canonical LXD Arbitrary File Read via Template Injection in Snapshot Patterns CVE-2025-54287, GHSA-w2hg-2v4p-vmh6, GO-2025-4004 | High | 0.4% | 02 Oct, 2025 | Go github.com/lxc/lxd Go github.com/lxc/lxd/v6 |
Canonical LXD Vulnerable to Privilege Escalation via WebSocket Connection Hijacking in Operations API CVE-2025-54289, GHSA-3g72-chj4-2228, GO-2025-3999 | High | 0.2% | 02 Oct, 2025 | Go github.com/canonical/lxd |
Canonical LXD Path Traversal Vulnerability in Instance Log File Retrieval Function CVE-2025-54293, GHSA-472f-vmf2-pr3h, GO-2025-4000 | High | 0.6% | 02 Oct, 2025 | Go github.com/canonical/lxd |
Dolibarr vulnerable to RCE via the computed field parameter CVE-2025-56588, GHSA-27hj-48r9-x2vx | High | 0.5% | 01 Oct, 2025 | Packagist dolibarr/dolibarr |
Fiora chat group avatar is vulnerable to XSS via SVG files CVE-2025-56515, GHSA-2c6j-vw6r-mfch | High | 0.5% | 01 Oct, 2025 | npm fiora |
@plone/volto vulnerable to potential DoS by invoking specific URL by anonymous user CVE-2025-61668, GHSA-m8rj-ppph-mj33 | High | 0.4% | 01 Oct, 2025 | npm @plone/volto |
github.com/MANTRA-Chain/mantrachain/x/tokenfactory tx gas limit is not enforced in send hooks CVE-2025-61595, GHSA-qwvm-wqq8-8j69, GO-2025-3997 | High | 0.3% | 30 Sep, 2025 | Go github.com/MANTRA-Chain/mantrachain Go github.com/MANTRA-Chain/mantrachain/v2 Go github.com/MANTRA-Chain/mantrachain/v3 Go github.com/MANTRA-Chain/mantrachain/v4 |
Argo CD Unauthenticated Remote DoS via malformed Azure DevOps git.push webhook BIT-argo-cd-2025-59538, CVE-2025-59538, GHSA-gpx4-37g2-c8pv, GO-2025-3995 | High | 9.4% | 30 Sep, 2025 | Go github.com/argoproj/argo-cd Go github.com/argoproj/argo-cd/v2 Go github.com/argoproj/argo-cd/v3 |
argo-cd vulnerable unauthenticated DoS via malformed Gogs webhook payload BIT-argo-cd-2025-59537, CVE-2025-59537, GHSA-wp4p-9pxh-cgx2, GO-2025-3996 | High | 0.6% | 30 Sep, 2025 | Go github.com/argoproj/argo-cd Go github.com/argoproj/argo-cd/v2 Go github.com/argoproj/argo-cd/v3 |
Unauthenticated argocd-server panic via a malicious Bitbucket-Server webhook payload BIT-argo-cd-2025-59531, CVE-2025-59531, GHSA-f9gq-prrc-hrhc, GO-2025-3993 | High | 0.6% | 30 Sep, 2025 | Go github.com/argoproj/argo-cd Go github.com/argoproj/argo-cd/v2 Go github.com/argoproj/argo-cd/v3 |
figma-developer-mcp vulnerable to command injection in get_figma_data tool CVE-2025-15061, CVE-2025-53967, GHSA-gxw4-4fc5-9gr5 | High | 6.1% | 30 Sep, 2025 | npm figma-developer-mcp |
Finance.js vulnerable to DoS via the seekZero() parameter CVE-2025-56572, GHSA-5q7q-p8pc-782h | High | 0.5% | 30 Sep, 2025 | npm financejs |
Finance.js vulnerable to DoS via the IRR function’s depth parameter CVE-2025-56571, GHSA-f8r4-mf27-rf7m | High | 0.4% | 30 Sep, 2025 | npm financejs |
@nubosoftware/node-static failure to catch exception can result in server crash CVE-2025-11149, GHSA-27w5-gj5q-82fv | High | 0.5% | 30 Sep, 2025 | npm @nubosoftware/node-static |
go-f3 module vulnerable to integer overflow leading to panic CVE-2025-59942, GHSA-g99p-47x7-mq88, GO-2025-3990 | High | 0.3% | 29 Sep, 2025 | Go github.com/filecoin-project/go-f3 |
Broadcom VMware Aria Operations and VMware Tools Privilege Defined with Unsafe Actions Vulnerability CVE-2025-41244 | HighExploited | 8.6% | 29 Sep, 2025 | |
go-mail has insufficient address encoding when passing mail addresses to the SMTP client CVE-2025-59937, GHSA-wpwj-69cm-q9c5, GO-2025-3988 | High | 0.5% | 29 Sep, 2025 | Go github.com/wneessen/go-mail |
llama-index-core insecurely handles temporary files CVE-2025-7647, GHSA-cr7q-2w66-hjcm, PYSEC-2026-1562 | High | 0.1% | 27 Sep, 2025 | PyPI llama-index-core |
algoliasearch-helper is vulnerable to Prototype Pollution in _merge() CVE-2025-3193, GHSA-529q-4j3p-7c5r | High | 0.5% | 27 Sep, 2025 | npm algoliasearch-helper |