Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Chall-Manager's HTTP Gateway is vulnerable to DoS due to missing header timeout CVE-2025-53634, GHSA-ggmv-j932-q89q, GO-2025-3809 | High | 0.5% | 10 Jul, 2025 | Go github.com/ctfer-io/chall-manager |
Chall-Manager's scenario decoding process does not check for zip bombs CVE-2025-53633, GHSA-r7fm-3pqm-ww5w, GO-2025-3810 | High | 0.5% | 10 Jul, 2025 | Go github.com/ctfer-io/chall-manager |
Chall-Manager is vulnerable to Path Traversal when extracting/decoding a zip archive CVE-2025-53632, GHSA-3gv2-v3jx-r9fh, GO-2025-3808 | High | 0.8% | 10 Jul, 2025 | Go github.com/ctfer-io/chall-manager |
DynamicPageList3 vulnerability exposes hidden/suppressed usernames CVE-2025-53625, GHSA-7pgw-q3qp-6pgq | High | 0.5% | 10 Jul, 2025 | Packagist universal-omega/dynamic-page-list3 |
@clerk/backend Performs Insufficient Verification of Data Authenticity CVE-2025-53548, GHSA-9mp4-77wg-rwx9 | High | 0.2% | 09 Jul, 2025 | npm @clerk/astro npm @clerk/backend npm @clerk/express npm @clerk/fastify +5 more |
Juju allows arbitrary executable uploads via authenticated endpoint without authorization CVE-2025-0928, GHSA-4vc8-wvhw-m5gv, GO-2025-3805 | High | 0.7% | 09 Jul, 2025 | Go github.com/juju/juju |
Juju zip slip vulnerability via authenticated endpoint CVE-2025-53513, GHSA-24ch-w38v-xmh8, GO-2025-3804 | High | 0.8% | 09 Jul, 2025 | Go github.com/juju/juju |
Cosmos SDK's Integer Overflow vulnerability in its Validator Rewards pool can cause a chain halt GHSA-p22h-3m2v-cmgh, GO-2025-3803 | High | Not scored | 08 Jul, 2025 | Go github.com/cosmos/cosmos-sdk |
Helm vulnerable to Code Injection through malicious chart.yaml content BIT-helm-2025-53547, CVE-2025-53547, GHSA-557j-xg8c-q2mm, GO-2025-3802 | High | 0.5% | 08 Jul, 2025 | Go helm.sh/helm/v3 |
MCP Server Kubernetes vulnerable to command injection in several tools CVE-2025-53355, GHSA-gjv4-ghm7-q58q | High | 2.2% | 08 Jul, 2025 | npm mcp-server-kubernetes |
Git Link Following Vulnerability CVE-2025-48384 | HighExploited | 4.4% | 08 Jul, 2025 | |
Babylon vulnerable to chain halt when a message modifies the validator set at the epoch boundary GHSA-rj53-j6jw-7f7g, GO-2025-3801 | High | Not scored | 08 Jul, 2025 | Go github.com/babylonlabs-io/babylon Go github.com/babylonlabs-io/babylon/v2 |
Microsoft SharePoint Code Injection Vulnerability CVE-2025-49704 | HighExploited | 100.0% | 08 Jul, 2025 | |
Node.js Sandbox MCP Server vulnerability can lead to Sandbox Escape via Command Injection CVE-2025-53372, GHSA-5w57-2ccq-8w95 | High | 1.0% | 08 Jul, 2025 | npm node-code-sandbox-mcp |
pyLoad is vulnerable to attacks that bypass localhost restrictions, enabling the creation of arbitrary packages CVE-2025-7346, GHSA-x698-5hjm-w2m5, PYSEC-2026-1822 | High | 0.4% | 08 Jul, 2025 | PyPI pyload-ng |
Dagster vulnerable to Path Traversal attack through its /logs endpoint CVE-2023-51232, GHSA-q93c-p2mw-p23f, PYSEC-2026-1287 | High | 0.9% | 07 Jul, 2025 | PyPI dagster |
LlamaIndex vulnerable to Path Traversal attack through its encode_image function CVE-2025-6209, GHSA-2rhq-96q8-4vjq, PYSEC-2025-65, PYSEC-2026-1558 | High | 0.6% | 07 Jul, 2025 | PyPI llama-index PyPI llama-index-core |
Lord of Large Language Models vulnerable to Observable Discrepancy attack via authenticate_user function CVE-2025-6386, GHSA-j5pr-vrjj-9v4h, PYSEC-2026-1590 | High | 0.4% | 07 Jul, 2025 | PyPI lollms |
Transformers vulnerable to ReDoS attack through its SETTING_RE variable CVE-2025-3262, GHSA-489j-g2vx-39wf, PYSEC-2026-1979 | High | 0.5% | 07 Jul, 2025 | PyPI transformers |
LlamaIndex has an XML Entity Expansion vulnerability in its sitemap parser CVE-2025-3225, GHSA-w42r-mrx7-c633, PYSEC-2025-250, PYSEC-2026-1570 | High | 0.5% | 07 Jul, 2025 | PyPI llama-index PyPI llama-index-readers-papers |
LlamaIndex is vulnerable to Path Traversal attack through its ObsidianReader class CVE-2025-3046, GHSA-fmrf-6jv9-qjc7, PYSEC-2025-248, PYSEC-2026-1568 | High | 0.6% | 07 Jul, 2025 | PyPI llama-index PyPI llama-index-readers-obsidian |
LlamaIndex has Incomplete Documentation of Program Execution related to JsonPickleSerializer component CVE-2025-3108, GHSA-m84c-4c34-28gf, PYSEC-2025-249, PYSEC-2026-1564 | High | 0.5% | 06 Jul, 2025 | PyPI llama-index PyPI llama-index-core |
MCP Python SDK vulnerability in the FastMCP Server causes validation error, leading to DoS CVE-2025-53366, GHSA-3qhf-m339-9g5v, PYSEC-2026-1616 | High | 9.8% | 04 Jul, 2025 | PyPI mcp |
MCP Python SDK has Unhandled Exception in Streamable HTTP Transport, Leading to Denial of Service CVE-2025-53365, GHSA-j975-95f5-7wqh, PYSEC-2026-1618 | High | 0.4% | 04 Jul, 2025 | PyPI mcp |
Next.JS vulnerability can lead to DoS via cache poisoning CVE-2025-49826, GHSA-67rr-84xm-4c7r | High | 1.1% | 03 Jul, 2025 | npm next |
Citizen vulnerable to Stored XSS through short descriptions CVE-2025-53370, GHSA-prmv-7r8c-794g | High | 0.4% | 03 Jul, 2025 | Packagist starcitizentools/citizen-skin |
Citizen Short Description stored XSS vulnerability through wikitext CVE-2025-53369, GHSA-p85q-mww9-gwqf | High | 0.3% | 03 Jul, 2025 | Packagist starcitizentools/short-description |
starcitizentools/citizen-skin is vulnerable to Stored XSS attack in the legacy search bar through page descriptions CVE-2025-53368, GHSA-rq6g-6g94-jfr4 | High | 0.3% | 03 Jul, 2025 | Packagist starcitizentools/citizen-skin |
Bolt CMS vulnerable to authenticated remote code execution CVE-2025-34086, GHSA-p9qc-8jjx-g8cg | High | 4.2% | 03 Jul, 2025 | Packagist bolt/bolt |
eKuiper /config/uploads API arbitrary file writing may lead to RCE GHSA-gj54-gwj9-x2c6, GO-2025-3800 | High | Not scored | 03 Jul, 2025 | Go github.com/lf-edge/ekuiper Go github.com/lf-edge/ekuiper/v2 |
LF Edge eKuiper vulnerable to File Path Traversal leading to file replacement GHSA-fv2p-qj5p-wqq4, GO-2025-3799 | High | Not scored | 03 Jul, 2025 | Go github.com/lf-edge/ekuiper Go github.com/lf-edge/ekuiper/v2 |
@modelcontextprotocol/server-filesystem vulnerability allows for path validation bypass via colliding path prefix CVE-2025-53110, GHSA-hc55-p739-j48w | High | 0.6% | 01 Jul, 2025 | npm @modelcontextprotocol/server-filesystem |
@modelcontextprotocol/server-filesystem allows for path validation bypass via prefix matching and symlink handling CVE-2025-53109, GHSA-q66q-fx2p-7w4m | High | 0.8% | 01 Jul, 2025 | npm @modelcontextprotocol/server-filesystem |
Pillow vulnerability can cause write buffer overflow on BCn encoding BIT-pillow-2025-48379, CVE-2025-48379, GHSA-xg8h-j46f-w952, PYSEC-2025-61 | High | 0.3% | 01 Jul, 2025 | PyPI pillow |
Google Chromium V8 Type Confusion Vulnerability CVE-2025-6554 | HighExploited | 14.1% | 30 Jun, 2025 | |
Sudo Inclusion of Functionality from Untrusted Control Sphere Vulnerability CVE-2025-32463 | HighExploited | 56.3% | 30 Jun, 2025 | |
@cyanheads/git-mcp-server vulnerable to command injection in several tools CVE-2025-53107, GHSA-3q26-f695-pp76 | High | 24.5% | 30 Jun, 2025 | npm @cyanheads/git-mcp-server |
electron ASAR Integrity bypass by just modifying the content CVE-2024-46992, GHSA-xw5q-g62x-2qjc | High | 0.1% | 30 Jun, 2025 | npm electron |
Babylon vulnerable to chain half when transaction has fees different than `ubbn` GHSA-56j4-446m-qrf6, GO-2025-3791 | High | Not scored | 30 Jun, 2025 | Go github.com/babylonlabs-io/babylon Go github.com/babylonlabs-io/babylon/v2 |
File Browser vulnerable to command execution allowlist bypass CVE-2025-52995, GHSA-w7qc-6grj-w7r8, GO-2025-3795 | High | 0.6% | 30 Jun, 2025 | Go github.com/filebrowser/filebrowser Go github.com/filebrowser/filebrowser/v2 |
File Browser: Command Execution not Limited to Scope CVE-2025-52904, GHSA-hc8f-m8g5-8362, GO-2025-3793 | High | 1.1% | 30 Jun, 2025 | Go github.com/filebrowser/filebrowser Go github.com/filebrowser/filebrowser/v2 |
tiny-secp256k1 allows for verify() bypass when running in bundled environment CVE-2024-49365, GHSA-5vhg-9xg4-cv9m | High | 0.2% | 30 Jun, 2025 | npm tiny-secp256k1 |
tiny-secp256k1 vulnerable to private key extraction when signing a malicious JSON-stringifyable message in bundled environment CVE-2024-49364, GHSA-7mc2-6phr-23xc | High | 0.4% | 30 Jun, 2025 | npm tiny-secp256k1 |
string-math's string-math.js vulnerability can cause Regex Denial of Service (ReDoS) CVE-2025-45143, GHSA-994j-5c83-r424 | High | 0.4% | 30 Jun, 2025 | npm string-math |
TabberNeue vulnerable to Stored XSS through wikitext CVE-2025-53093, GHSA-jfj7-249r-7j2m | High | 0.4% | 27 Jun, 2025 | Packagist starcitizentools/tabber-neue |
filebrowser Allows Shell Commands to Spawn Other Commands CVE-2025-52903, GHSA-3q2w-42mv-cph4, GO-2025-3786 | High | 1.2% | 27 Jun, 2025 | Go github.com/filebrowser/filebrowser Go github.com/filebrowser/filebrowser/v2 |
filebrowser allows Stored Cross-Site Scripting through the Markdown preview function CVE-2025-52902, GHSA-4wx8-5gm2-2j97, GO-2025-3784 | High | 0.3% | 27 Jun, 2025 | Go github.com/filebrowser/filebrowser Go github.com/filebrowser/filebrowser/v2 |
raspap-webgui has a Directory Traversal vulnerability CVE-2025-44163, GHSA-277f-37gw-9gmq | High | 0.6% | 27 Jun, 2025 | Packagist billz/raspap-webgui |
Incus creates nftables rules that partially bypass security options CVE-2025-52890, GHSA-p7fw-vjjm-2rwp, GO-2025-3782 | High | 0.2% | 26 Jun, 2025 | Go github.com/lxc/incus Go github.com/lxc/incus/v6 |
Octo STS Unauthenticated SSRF by abusing fields in OpenID Connect tokens CVE-2025-52477, GHSA-h3qp-hwvr-9xcq, GO-2025-3779 | High | 0.5% | 26 Jun, 2025 | Go github.com/octo-sts/app |