Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Next.js Improper Middleware Redirect Handling Leads to SSRF CVE-2025-57822, GHSA-4342-x723-ch2f | High | 2.6% | 29 Aug, 2025 | npm next |
Rancher Fleet Helm Values are stored inside BundleDeployment in plain text CVE-2024-52284, GHSA-6h9x-9j5v-7w9h, GO-2025-3927 | High | 0.2% | 29 Aug, 2025 | Go github.com/rancher/fleet |
gnark affected by denial of service when computing scalar multiplication using fake-GLV algorithm CVE-2025-58157, GHSA-9fvj-xqr2-xwg8, GO-2025-3929 | High | 0.5% | 29 Aug, 2025 | Go github.com/consensys/gnark |
Cross Site Scripting vulnerability in copyparty before 1.9.2 allows a local attacker to execute arbitrary code via a crafted payload to the WEEKEND-PLANS function. NOTE: this is disputed because WEEKEND-PLANS is accessible only to actors who already have write access to the server, and they can more CVE-2023-41471, PYSEC-2025-240 | High | 0.3% | 29 Aug, 2025 | PyPI copyparty |
TP-Link Archer C7(EU) and TL-WR841N/ND(MS) OS Command Injection Vulnerability CVE-2025-9377 | HighExploited | 41.3% | 29 Aug, 2025 | |
Harness Allows Arbitrary File Write in Gitness LFS server CVE-2025-58158, GHSA-w469-hj2f-jpr5, GO-2025-3926 | High | 0.5% | 29 Aug, 2025 | Go github.com/harness/gitness |
Versity panic induced by AWS chunked data sent to port GHSA-v2ch-c8v8-fgr7, GO-2025-3925 | High | Not scored | 29 Aug, 2025 | Go github.com/versity/versitygw |
Rancher affected by unauthenticated Denial of Service CVE-2024-58259, GHSA-4h45-jpvh-6p5j, GO-2025-3923 | High | 0.5% | 29 Aug, 2025 | Go github.com/rancher/rancher |
HashiCorp Vault Community Edition Denial of Service Though Complex JSON Payloads BIT-vault-2025-6203, CVE-2025-6203, GHSA-8f82-53h8-2p34, GO-2025-3924 | High | 0.7% | 28 Aug, 2025 | Go github.com/hashicorp/vault |
Contrast leaks workload secrets to logs on INFO level CVE-2025-71423, GHSA-vxg3-w9rv-rhr2, GO-2025-3920 | High | 0.2% | 28 Aug, 2025 | Go github.com/edgelesssys/contrast |
Volto affected by possible DoS by invoking specific URL by anonymous user CVE-2025-58047, GHSA-xjhf-7833-3pm5 | High | 0.7% | 28 Aug, 2025 | npm @plone/volto |
simple-admin-core SQL Injection vulnerability CVE-2025-51667, GHSA-f2m2-4q6r-cwc4, GO-2025-3916 | High | 0.3% | 27 Aug, 2025 | Go github.com/suyuan32/simple-admin-core |
NodeBB SQL Injection vulnerability CVE-2025-50979, GHSA-rfh2-8vxq-jqr8 | High | 10.6% | 27 Aug, 2025 | npm nodebb |
This module allows users to setup two-factor authentication (2FA) using authenticator apps for enhanced login security.
The module did not protect all possible login paths provided by core modules.
**CVSS risk score ([experimental](https://www.drupal.org/project/securitydrupalorg/issues/3442181)) CVE-2025-8093, DRUPAL-CONTRIB-2025-098 | High | 0.4% | 27 Aug, 2025 | Packagist:https://packages.drupal.org/8 drupal/alogin |
devalue prototype pollution vulnerability CVE-2025-57820, GHSA-vj54-72f3-p5jv | High | 0.4% | 26 Aug, 2025 | npm devalue |
Picklescan is missing detection when calling built-in python library asyncio.unix_events._UnixSubprocessTransport._start CVE-2025-71364, GHSA-q77w-mwjj-7mqx | High | 0.7% | 26 Aug, 2025 | PyPI picklescan |
Picklescan is missing detection when calling built-in python cProfile.run CVE-2025-71363, GHSA-49gj-c84q-6qm9 | High | 0.7% | 26 Aug, 2025 | PyPI picklescan |
Picklescan is missing detection when calling built-in Python cProfile.runctx CVE-2025-71378, GHSA-9w88-8rmg-7g2p, PYSEC-2026-247 | High | 0.5% | 26 Aug, 2025 | PyPI picklescan |
Picklescan is missing detection when calling built-in python doctest.debug_script CVE-2025-71368, GHSA-fqq6-7vqf-w3fg | High | 0.8% | 26 Aug, 2025 | PyPI picklescan |
Picklescan is missing detection when calling built-in python idlelib.pyshell.ModifiedInterpreter.runcode CVE-2025-71340, GHSA-3gf5-cxq9-w223 | High | 0.4% | 26 Aug, 2025 | PyPI picklescan |
Picklescan is missing detection when calling built-in python idlelib.pyshell.ModifiedInterpreter.runcommand CVE-2025-71357, GHSA-j343-8v2j-ff7w, PYSEC-2026-246 | High | 0.4% | 26 Aug, 2025 | PyPI picklescan |
Picklescan is missing detection when calling built-in python idlelib.run.Executive.runcode CVE-2025-71342, GHSA-m869-42cg-3xwr | High | 0.5% | 26 Aug, 2025 | PyPI picklescan |
Picklescan is missing detection when calling built-in python lib2to3.pgen2.pgen.ParserGenerator.make_label CVE-2025-71343, GHSA-p9w7-82w4-7q8m | High | 0.4% | 26 Aug, 2025 | PyPI picklescan |
Picklescan is missing detection when calling built-in python ensurepip._run_pip CVE-2025-71344, GHSA-xp4f-hrf8-rxw7, PYSEC-2026-1792 | High | 0.5% | 26 Aug, 2025 | PyPI picklescan |
Picklescan is missing detection when calling pytorch function torch.utils.bottleneck.__main__.run_autograd_prof CVE-2025-71345, GHSA-4whj-rm5r-c2v8 | High | 0.5% | 26 Aug, 2025 | PyPI picklescan |
Picklescan has a missing detection when calling built-in python library idlelib.calltip.get_entity CVE-2025-71360, GHSA-9xph-j2h6-g47v | High | 0.4% | 26 Aug, 2025 | PyPI picklescan |
Picklescan has a missing detection when calling built-in python idlelib.calltip.Calltip CVE-2025-71361, GHSA-8r4j-24qv-fmq9, PYSEC-2026-1786 | High | 0.4% | 26 Aug, 2025 | PyPI picklescan |
Picklescan has a missing detection when calling built-in python code.InteractiveInterpreter CVE-2025-71371, GHSA-cj3c-v495-4xqh | High | 0.6% | 26 Aug, 2025 | PyPI picklescan |
Picklescan has a missing detection when calling built-in python idlelib.autocomplete.AutoComplete.fetch_completions CVE-2025-71376, GHSA-7cq8-mj8x-j263, PYSEC-2026-4133 | High | 0.4% | 26 Aug, 2025 | PyPI picklescan |
Picklescan has a missing detection when calling built-in python idlelib.autocomplete.AutoComplete.get_entity CVE-2025-71358, GHSA-6w4w-5w54-rjvr, PYSEC-2026-1784 | High | 0.3% | 26 Aug, 2025 | PyPI picklescan |
Picklescan has a missing detection when calling built-in python idlelib.debugobj.ObjectTreeItem CVE-2025-71354, GHSA-3vg9-h568-4w9m, PYSEC-2026-1781 | High | 0.4% | 26 Aug, 2025 | PyPI picklescan |
Picklescan has a missing detection when calling built-in python lib2to3.pgen2.grammar.Grammar.loads CVE-2025-71359, GHSA-f54q-57x4-jg88 | High | 0.6% | 26 Aug, 2025 | PyPI picklescan |
Picklescan has a missing detection when calling built-in python profile.Profile.runctx CVE-2025-71341, GHSA-6vqj-c2q5-j97w, PYSEC-2026-4132 | High | 0.6% | 26 Aug, 2025 | PyPI picklescan |
Picklescan has a missing detection when calling built-in python profile.Profile.run CVE-2025-71374, GHSA-x696-vm39-cp64 | High | 0.7% | 26 Aug, 2025 | PyPI picklescan |
Picklescan has a missing detection when calling built-in python trace.Trace.runctx CVE-2025-71352, GHSA-g344-hcph-8vgg | High | 0.7% | 26 Aug, 2025 | PyPI picklescan |
Picklescan has a missing detection when calling built-in python trace.Trace.run CVE-2025-71349, GHSA-5qwp-399c-mjwf | High | 0.6% | 26 Aug, 2025 | PyPI picklescan |
xml2rfc has an arbitrary file read vulnerability CVE-2025-11058, GHSA-cfmv-h8fx-85m7, PYSEC-2026-2058 | High | Not scored | 26 Aug, 2025 | PyPI xml2rfc |
jsPDF Denial of Service (DoS) CVE-2025-57810, GHSA-8mvj-3j78-4qmw | High | 0.7% | 26 Aug, 2025 | npm jspdf |
XGrammar affected by Denial of Service by infinite recursion grammars CVE-2025-57809, GHSA-5cmr-4px5-23pc, PYSEC-2026-2054 | High | 0.5% | 25 Aug, 2025 | PyPI xgrammar |
Easy!Appointments SQL injection vulnerability CVE-2025-50383, GHSA-2f28-69j7-85hf | High | 0.4% | 25 Aug, 2025 | Packagist alextselegidis/easyappointments |
Langflow Vulnerable to Privilege Escalation via CLI Superuser Creation (Post-RCE) CVE-2025-57760, GHSA-4gv9-mp8m-592r, PYSEC-2025-243, PYSEC-2026-1526 | High | 0.5% | 25 Aug, 2025 | PyPI langflow PyPI langflow-base |
LlamaIndex affected by a Denial of Service (DOS) in JSONReader CVE-2025-5302, GHSA-7753-xrfw-ch36, PYSEC-2026-1561 | High | 0.3% | 25 Aug, 2025 | PyPI llama-index-core |
PhpSpreadsheet vulnerable to SSRF when reading and displaying a processed HTML document in the browser CVE-2025-54370, GHSA-rx7m-68vc-ppxh | High | 0.8% | 25 Aug, 2025 | Packagist phpoffice/phpspreadsheet |
Adminer PHP Object Injection issue leads to Denial of Service CVE-2025-43960, GHSA-mqh4-2mm8-g7w9 | High | 0.7% | 25 Aug, 2025 | Packagist vrana/adminer |
gnark is vulnerable to signature malleability in EdDSA and ECDSA due to missing scalar checks CVE-2025-57801, GHSA-95v9-hv42-pwrj, GO-2025-3912 | High | 0.2% | 22 Aug, 2025 | Go github.com/consensys/gnark |
Picklescan is missing detection when calling pytorch function torch.utils._config_module.load_config CVE-2025-71348, GHSA-vv6j-3g6g-2pvj, PYSEC-2026-245 | High | 0.6% | 22 Aug, 2025 | PyPI picklescan |
Picklescan missing detection when calling pytorch function torch.jit.unsupported_tensor_ops.execWrapper CVE-2025-71370, GHSA-vr7h-p6mm-wpmh, PYSEC-2026-4136 | High | 0.5% | 22 Aug, 2025 | PyPI picklescan |
Picklescan missing detection when calling pytorch function torch.utils.data.datapipes.utils.decoder.basichandlers CVE-2025-71369, GHSA-h3qp-7fh3-f8h4 | High | 0.6% | 22 Aug, 2025 | PyPI picklescan |
Picklescan missing detection when calling pytorch function torch.utils.collect_env.run CVE-2025-71350, GHSA-f745-w6jp-hpxx | High | 0.4% | 22 Aug, 2025 | PyPI picklescan |
Picklescan missing detection when calling pytorch function torch.fx.experimental.symbolic_shapes.ShapeEnv.evaluate_guards_expression CVE-2025-71356, GHSA-f4x7-rfwp-v3xw | High | 0.4% | 22 Aug, 2025 | PyPI picklescan |