Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Salt's file contents overwrite the VirtKey class CVE-2025-22241, GHSA-7f3f-x5f5-79gw, PYSEC-2026-1895 | Medium | 0.2% | 13 Jun, 2025 | PyPI salt |
Salt allows arbitrary directory creation or file deletion CVE-2025-22240, GHSA-xh32-3m67-qjgf, PYSEC-2026-1903 | Medium | 0.2% | 13 Jun, 2025 | PyPI salt |
Salt vulnerable to directory traversal attack in minion file cache creation CVE-2025-22238, GHSA-r546-h3ff-q585, PYSEC-2026-1901 | Medium | 0.3% | 13 Jun, 2025 | PyPI salt |
Salt's on demand pillar functionality vulnerable to arbitrary command injections CVE-2025-22237, GHSA-fcr4-h6c4-rvvp, PYSEC-2026-1898 | Medium | 0.2% | 13 Jun, 2025 | PyPI salt |
Salt's salt.auth.pki module does not properly authenticate callers CVE-2024-38825, GHSA-4j59-vv55-q6h3, PYSEC-2026-1893 | Medium | 0.2% | 13 Jun, 2025 | PyPI salt |
starcitizentools/citizen-skin allows stored XSS in menu heading message CVE-2025-49579, GHSA-g3cp-pq72-hjpv | Medium | 0.4% | 12 Jun, 2025 | Packagist starcitizentools/citizen-skin |
starcitizentools/citizen-skin allows stored XSS in user registration date message CVE-2025-49578, GHSA-2v3v-3whp-953h | Medium | 0.4% | 12 Jun, 2025 | Packagist starcitizentools/citizen-skin |
starcitizentools/citizen-skin allows stored XSS in preference menu heading messages CVE-2025-49577, GHSA-jwr7-992g-68mh | Medium | 0.4% | 12 Jun, 2025 | Packagist starcitizentools/citizen-skin |
starcitizentools/citizen-skin allows stored XSS in search no result messages CVE-2025-49576, GHSA-86xf-2mgp-gv3g | Medium | 0.4% | 12 Jun, 2025 | Packagist starcitizentools/citizen-skin |
uptrace pgdriver SQL injection vulnerability CVE-2024-44906, GHSA-h4h6-vccr-44h2, GO-2025-3765 | Medium | Not scored | 12 Jun, 2025 | Go github.com/uptrace/bun/driver/pgdriver |
go-pg SQL injection vulnerability via the component /types/append_value.go CVE-2024-44905, GHSA-6xp3-p59p-q4fj, GO-2025-3764 | Medium | Not scored | 12 Jun, 2025 | Go github.com/go-pg/pg Go github.com/go-pg/pg/v10 Go github.com/go-pg/pg/v9 |
pg-promise SQL Injection vulnerability CVE-2025-29744, GHSA-ff9h-848c-4xfj | Medium | 0.2% | 12 Jun, 2025 | npm pg-promise |
Citizen skin vulnerable to stored XSS through multiple system messages CVE-2025-49575, GHSA-4c2h-67qq-vm87 | Medium | 0.4% | 11 Jun, 2025 | Packagist starcitizentools/citizen-skin |
Mattermost allows authenticated administrator to execute LDAP search filter injection CVE-2025-4573, GHSA-4r67-4x4p-fprg, GO-2025-3756 | Medium | Not scored | 11 Jun, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Erxes Path Traversal vulnerability CVE-2024-57189, GHSA-2977-5php-6789 | Medium | 0.4% | 10 Jun, 2025 | npm erxes |
Nautobot may allows uploaded media files to be accessible without authentication CVE-2025-49143, GHSA-rh67-4c8j-hjjh, PYSEC-2026-1689 | Medium | 0.4% | 10 Jun, 2025 | PyPI nautobot |
Nautobot vulnerable to secrets exposure and data manipulation through Jinja2 templating CVE-2025-49142, GHSA-wjw6-95h5-4jpx, PYSEC-2025-74, PYSEC-2025-79 | Medium | 0.4% | 10 Jun, 2025 | PyPI nautobot |
OctoPrint Vulnerable to Denial of Service through malformed HTTP request in OctoPrint CVE-2025-48879, GHSA-9wj4-8h85-pgrw, PYSEC-2026-1713 | Medium | 0.3% | 10 Jun, 2025 | PyPI OctoPrint PyPI octoprint |
OctoPrint vulnerable to possible file extraction via upload endpoints CVE-2025-48067, GHSA-m9jh-jf9h-x3h2, PYSEC-2026-1715 | Medium | 0.3% | 10 Jun, 2025 | PyPI OctoPrint PyPI octoprint |
Magento Improper Access Control leads to security feature bypass CVE-2025-27206, GHSA-g2pj-xmxq-3r9q | Medium | 0.5% | 10 Jun, 2025 | Packagist magento/community-edition Packagist magento/project-community-edition |
@vue/cli-plugin-pwa Regular Expression Denial of Service vulnerability CVE-2025-5897, GHSA-79vf-hf9f-j9q8 | Medium | 0.6% | 09 Jun, 2025 | npm @vue/cli-plugin-pwa |
taro-css-to-react-native Regular Expression Denial of Service vulnerability CVE-2025-5896, GHSA-f5xg-cfpj-2mw6 | Medium | 0.6% | 09 Jun, 2025 | npm taro-css-to-react-native |
@haxtheweb/haxcms-nodejs Iframe Phishing vulnerability CVE-2025-49139, GHSA-v3ph-2q5q-cg88 | Medium | 0.4% | 09 Jun, 2025 | npm @haxtheweb/haxcms-nodejs |
Requests vulnerable to .netrc credentials leak via malicious URLs CVE-2024-47081, GHSA-9hjg-9r4m-mvj7, PYSEC-2026-1872 | Medium | 1.0% | 09 Jun, 2025 | PyPI requests |
HAX CMS vulnerable to Local File Inclusion via saveOutline API Location Parameter CVE-2025-49138, GHSA-hxrr-x32w-cg8g | Medium | 0.5% | 09 Jun, 2025 | Packagist elmsln/haxcms |
Laravel Translation Manager Vulnerable to Stored Cross-site Scripting CVE-2025-49130, GHSA-j226-63j7-qrqh | Medium | 0.4% | 09 Jun, 2025 | Packagist barryvdh/laravel-translation-manager |
Authorino Uncontrolled Resource Consumption vulnerability CVE-2025-25208, GHSA-vqvv-2wj5-q34w, GO-2025-3747 | Medium | Not scored | 09 Jun, 2025 | Go github.com/kuadrant/authorino |
Authorino Uncontrolled Resource Consumption vulnerability CVE-2025-25207, GHSA-r8xr-pgv5-gxw3, GO-2025-3746 | Medium | Not scored | 09 Jun, 2025 | Go github.com/kuadrant/authorino |
Yii 2 Redis may expose AUTH parameters in logs in case of connection failure CVE-2025-48493, GHSA-g3p6-82vc-43jh | Medium | 0.3% | 05 Jun, 2025 | Packagist yiisoft/yii2-redis |
IGEL OS Use of a Key Past its Expiration Date Vulnerability CVE-2025-47827 | MediumExploited | 5.2% | 05 Jun, 2025 | |
ReDoS Vulnerability in Rack::Multipart handle_mime_head CVE-2025-49007, GHSA-47m2-26rw-j2jw | Medium | Not scored | 05 Jun, 2025 | RubyGems rack |
Django Improper Output Neutralization for Logs vulnerability BIT-django-2025-48432, CVE-2025-48432, GHSA-7xr5-9hcq-chf9, PYSEC-2025-47 | Medium | 0.8% | 05 Jun, 2025 | PyPI Django PyPI django |
AngularJS Incomplete Filtering of Special Elements vulnerability CVE-2025-2336, GHSA-4p4w-6hg8-63wx | Medium | 0.3% | 04 Jun, 2025 | npm angular-sanitize |
kro Confused Deputy vulnerability CVE-2025-48710, GHSA-7633-x85h-5mqh, GO-2025-3741 | Medium | Not scored | 04 Jun, 2025 | Go github.com/kro-run/kro |
webpack-dev-server users' source code may be stolen when they access a malicious web site with non-Chromium based browser CVE-2025-30360, GHSA-9jgg-88mc-972h | Medium | 0.4% | 03 Jun, 2025 | npm webpack-dev-server |
webpack-dev-server users' source code may be stolen when they access a malicious web site CVE-2025-30359, GHSA-4v9v-hfq4-rm2v | Medium | 0.6% | 03 Jun, 2025 | npm webpack-dev-server |
Gokapi vulnerable to stored XSS via uploading file with malicious file name CVE-2025-48494, GHSA-95rc-wc32-gm53, GO-2025-3737 | Medium | Not scored | 03 Jun, 2025 | Go github.com/forceu/gokapi |
Gokapi has stored XSS vulnerability in friendly name for API keys CVE-2025-48495, GHSA-4xg4-54hm-9j77, GO-2025-3736 | Medium | Not scored | 03 Jun, 2025 | Go github.com/forceu/gokapi |
Unauthenticated Disclosure of PSU HAX CMS Site Listings via haxPsuUsage API Endpoint CVE-2025-48996, GHSA-fvx2-x7ff-fc56 | Medium | 0.4% | 02 Jun, 2025 | npm @haxtheweb/open-apis |
SignXML's signature verification with HMAC is vulnerable to a timing attack CVE-2025-48995, GHSA-gmhf-gg8w-jw42, PYSEC-2026-1922 | Medium | 0.2% | 02 Jun, 2025 | PyPI signxml |
SignXML's signature verification with HMAC is vulnerable to an algorithm confusion attack CVE-2025-48994, GHSA-6vx8-pcwv-xhf4, PYSEC-2026-1921 | Medium | 0.2% | 02 Jun, 2025 | PyPI signxml |
Grafana's datasource proxy API allows authorization checks to be bypassed BIT-grafana-2025-3454, CVE-2025-3454, GHSA-9j65-rv5x-4vrf, GO-2025-3742 | Medium | Not scored | 02 Jun, 2025 | Go github.com/grafana/grafana |
juzaweb CMS allows cross-site scripting by uploading an SVG file CVE-2025-5420, GHSA-49rr-34j5-r8mw | Medium | 0.4% | 02 Jun, 2025 | Packagist juzaweb/cms |
django-helpdesk Allows Sensitive Data Exposure CVE-2018-25111, GHSA-m4jx-m5hg-qrxx, PYSEC-2025-44 | Medium | 0.2% | 31 May, 2025 | PyPI django-helpdesk |
Prevent GitHub CLI and extensions from executing arbitrary commands from compromised GitHub Enterprise Server CVE-2025-48938, GHSA-g9f5-x53j-h563, GO-2025-3732 | Medium | Not scored | 30 May, 2025 | Go github.com/cli/go-gh/v2 |
Mattermost fails to clear Google OAuth credentials CVE-2025-2571, GHSA-8cgx-9ccj-3gwr, GO-2025-3729 | Medium | Not scored | 30 May, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost fails to properly invalidate personal access tokens upon user deactivation CVE-2025-3230, GHSA-mc2f-jgj6-6cp3, GO-2025-3731 | Medium | Not scored | 30 May, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost improperly allows team administrators to modify team invites CVE-2025-3913, GHSA-4mmr-2w8p-whcr, GO-2025-3724 | Medium | Not scored | 29 May, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Aim Vulnerable to Sandbox Escape Leading to Remote Code Execution CVE-2025-5321, GHSA-gp5h-f9c5-8355, PYSEC-2026-1088 | Medium | 0.6% | 29 May, 2025 | PyPI aim |
Gradio CORS Origin Validation Bypass Vulnerability CVE-2025-5320, GHSA-wmjh-cpqj-4v6x, PYSEC-2026-1423 | Medium | 0.3% | 29 May, 2025 | PyPI gradio |