Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Shopware Vulnerable to Blind SQL-injection in DAL aggregations CVE-2025-27892, GHSA-8g35-7rmw-7f59 | High | 12.9% | 08 Apr, 2025 | Packagist shopware/core Packagist shopware/platform |
Shopware allows Denial Of Service via password length CVE-2025-30151, GHSA-cgfj-hj93-rmh2 | High | 0.4% | 08 Apr, 2025 | Packagist shopware/core Packagist shopware/platform |
Picklescan missing detection when calling built-in python library function timeit.timeit() CVE-2025-71351, GHSA-v7x6-rv5q-mhwc, PYSEC-2026-4135 | High | 0.6% | 07 Apr, 2025 | PyPI picklescan |
Apollo Gateway Query Planner Vulnerable to Excessive Resource Consumption via Optimization Bypass CVE-2025-32031, GHSA-p2q6-pwh5-m6jr | High | 0.6% | 07 Apr, 2025 | npm @apollo/gateway |
Apollo Gateway Query Planner Vulnerable to Excessive Resource Consumption via Named Fragment Expansion CVE-2025-32030, GHSA-q2f9-x4p4-7xmh | High | 0.5% | 07 Apr, 2025 | npm @apollo/gateway |
FlowiseDB vulnerable to SQL Injection by authenticated users CVE-2025-71332, GHSA-9c4c-g95m-c8cp | High | 0.5% | 07 Apr, 2025 | npm flowise |
Picklescan failed to detect to some unsafe global function in Numpy library CVE-2025-71355, GHSA-fj43-3qmq-673f | High | 0.6% | 07 Apr, 2025 | PyPI picklescan |
Picklescan Vulnerable to Exfiltration via DNS via linecache and ssl.get_server_certificate CVE-2025-46417, GHSA-93mv-x874-956g, PYSEC-2025-34 | High | 0.2% | 07 Apr, 2025 | PyPI picklescan |
js-object-utilities Vulnerable to Prototype Pollution CVE-2025-28269, GHSA-hpqf-m68j-2pfx | High | Not scored | 07 Apr, 2025 | npm js-object-utilities |
Apache Airflow Common SQL Provider Vulnerable to SQL Injection CVE-2025-30473, GHSA-5r62-mjf5-xwhj, PYSEC-2026-1145 | High | 1.0% | 07 Apr, 2025 | PyPI apache-airflow-providers-common-sql |
MinIO performs incomplete signature validation for unsigned-trailer uploads CVE-2025-31489, GHSA-wg47-6jq2-q2hh, GO-2025-3594 | High | 2.5% | 04 Apr, 2025 | Go github.com/minio/minio |
bigint-buffer Vulnerable to Buffer Overflow via toBigIntLE() Function CVE-2025-3194, GHSA-3gc7-fjrx-p6mg | High | 0.7% | 04 Apr, 2025 | npm bigint-buffer |
Browsershot Server-Side Request Forgery (SSRF) via setURL() Function CVE-2025-3192, GHSA-qw64-6vcc-8ghx | High | 0.4% | 04 Apr, 2025 | Packagist spatie/browsershot |
jupyterlab-git has a command injection vulnerability in "Open Git Repository in Terminal" CVE-2025-30370, GHSA-cj5w-8mjf-r5f8, PYSEC-2026-1483 | High | 0.6% | 03 Apr, 2025 | PyPI jupyterlab-git |
GraphQL grant on a property might be cached with different objects CVE-2025-31485, GHSA-428q-q3vv-3fq3 | High | 0.6% | 03 Apr, 2025 | Packagist api-platform/core Packagist api-platform/graphql |
GraphQL query operations security can be bypassed CVE-2025-31481, GHSA-cg3c-245w-728m | High | 0.5% | 03 Apr, 2025 | Packagist api-platform/core Packagist api-platform/graphql |
generator-jhipster-entity-audit vulnerable to Unsafe Reflection when having Javers selected as Entity Audit Framework CVE-2025-31119, GHSA-7rmp-3g9f-cvq8 | High | 0.5% | 03 Apr, 2025 | npm generator-jhipster-entity-audit |
Unauthenticated Miniflux user can bypass allowed networks check to obtain Prometheus metrics CVE-2023-27591, GHSA-3qjf-qh38-x73v | High | 0.8% | 02 Apr, 2025 | Go miniflux.app Go miniflux.app/v2 |
image-size Denial of Service via Infinite Loop during Image Processing CVE-2025-71319, GHSA-m5qc-5hw7-8vg7 | High | 0.7% | 02 Apr, 2025 | npm image-size |
Django Potential Denial of Service (DoS) on Windows BIT-django-2025-27556, CVE-2025-27556, GHSA-wqfg-m96j-85vm, PYSEC-2025-14 | High | 1.1% | 02 Apr, 2025 | PyPI Django PyPI django |
Remix and React Router allow URL manipulation via Host / X-Forwarded-Host headers CVE-2025-31137, GHSA-4q56-crqp-v477 | High | 1.2% | 01 Apr, 2025 | npm @react-router/express npm @remix-run/express |
Yeswiki Path Traversal vulnerability allows arbitrary read of files CVE-2025-31131, GHSA-w34w-fvp3-68xm | High | 5.6% | 01 Apr, 2025 | Packagist yeswiki/yeswiki |
Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query CVE-2025-31125, GHSA-4r4m-qw57-chr8 | HighExploited | 74.9% | 31 Mar, 2025 | npm vite |
Redoc Prototype Pollution via `Module.mergeObjects` Component CVE-2024-57083, GHSA-9rhg-254w-fh9x | High | 0.6% | 28 Mar, 2025 | npm redoc |
Nethermind Juno Potential Denial of Service (DoS) via Integer Overflow CVE-2025-29072, GHSA-wq32-8rp4-w2mc, GO-2025-3583 | High | 0.5% | 27 Mar, 2025 | Go github.com/NethermindEth/juno |
tar-fs Vulnerable to Link Following and Path Traversal via Extracting a Crafted tar File CVE-2024-12905, GHSA-pq67-2wwv-3xjx | High | 2.3% | 27 Mar, 2025 | npm tar-fs |
Mesop Class Pollution vulnerability leads to DoS and Jailbreak attacks CVE-2025-30358, GHSA-f3mf-hm6v-jfhh, PYSEC-2026-1624 | High | 0.7% | 27 Mar, 2025 | PyPI mesop |
Synapse vulnerable to federation denial of service via malformed events CVE-2025-30355, GHSA-v56r-hwv5-mxg6, PYSEC-2026-1614 | High | 1.2% | 27 Mar, 2025 | PyPI matrix-synapse |
Directus's webhook trigger flows can leak sensitive data CVE-2025-30353, GHSA-fm3h-p9wm-h74h | High | 0.5% | 26 Mar, 2025 | npm directus |
Google Chromium Mojo Sandbox Escape Vulnerability CVE-2025-2783 | HighExploited | 9.2% | 26 Mar, 2025 | |
Frappe vulnerable to information disclosure leading to account takeover CVE-2025-30214, GHSA-qrv3-jc3h-f3m6, PYSEC-2026-1392 | High | 0.4% | 25 Mar, 2025 | PyPI frappe |
D-Link DIR-823X Command Injection Vulnerability CVE-2025-29635 | HighExploited | 87.9% | 25 Mar, 2025 | |
ngress-nginx controller - configuration injection via unsanitized auth-tls-match-cn annotation CVE-2025-1097, GHSA-823x-fv5p-h7hw, GO-2025-3565 | High | 37.0% | 25 Mar, 2025 | Go k8s.io/ingress-nginx |
ingress-nginx controller - configuration injection via unsanitized mirror annotations CVE-2025-1098, GHSA-vg63-w3p9-jc9m, GO-2025-3568 | High | 86.1% | 25 Mar, 2025 | Go k8s.io/ingress-nginx |
ingress-nginx controller - configuration injection via unsanitized auth-url annotation CVE-2025-24514, GHSA-fwwp-xcxw-39vq, GO-2025-3566 | High | 37.3% | 25 Mar, 2025 | Go k8s.io/ingress-nginx |
Kentico Xperience Path Traversal Vulnerability CVE-2025-2749 | HighExploited | 4.0% | 24 Mar, 2025 | |
Vite bypasses server.fs.deny when using ?raw?? CVE-2025-30208, GHSA-x574-m823-4x7w | High | 74.8% | 24 Mar, 2025 | npm vite |
nossrf Server-Side Request Forgery (SSRF) CVE-2025-2691, GHSA-vm77-mr48-27wj | High | 0.4% | 23 Mar, 2025 | npm nossrf |
jwt-go allows excessive memory allocation during header parsing CVE-2025-30204, GHSA-mh63-6h87-95cp, GO-2025-3553 | High | 0.8% | 21 Mar, 2025 | Go github.com/golang-jwt/jwt Go github.com/golang-jwt/jwt/v4 Go github.com/golang-jwt/jwt/v5 |
PipeCD Vulnerable to Privilege Escalation CVE-2024-53351, GHSA-4jhw-c53w-w5r7, GO-2025-3546 | High | 0.5% | 21 Mar, 2025 | Go github.com/pipe-cd/pipecd |
Mattermost Fails to Enforce MFA on Plugin Endpoints BIT-mattermost-2025-25068, CVE-2025-25068, GHSA-72qv-j8vr-xvfv, GO-2025-3551 | High | 0.3% | 21 Mar, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Ollama Denial of Service (DoS) via Null Pointer Dereference CVE-2025-0312, GHSA-p2wh-w96x-w232, GO-2025-3582 | High | 0.6% | 20 Mar, 2025 | Go github.com/ollama/ollama |
Ollama Allocation of Resources Without Limits or Throttling vulnerability CVE-2025-0315, GHSA-fccc-8m69-8r78, GO-2025-3557 | High | 0.7% | 20 Mar, 2025 | Go github.com/ollama/ollama |
Ollama Divide By Zero vulnerability CVE-2025-0317, GHSA-9gcr-28rp-cc24, GO-2025-3559 | High | 14.5% | 20 Mar, 2025 | Go github.com/ollama/ollama |
Open WebUI Unauthenticated Multipart Boundary Denial of Service (DoS) Vulnerability GHSA-5ccf-884p-4jjq | High | Not scored | 20 Mar, 2025 | PyPI open-webui npm open-webui |
Open WebUI stored cross-site scripting (XSS) vulnerability CVE-2024-7990, GHSA-gj27-76gq-5v3p, PYSEC-2026-1734 | High | Not scored | 20 Mar, 2025 | PyPI open-webui |
Open WebUI allows Remote Code Execution via Arbitrary File Upload to /audio/api/v1/transcriptions CVE-2024-8060, GHSA-ff5c-56m7-vc75, PYSEC-2026-1731 | High | Not scored | 20 Mar, 2025 | PyPI open-webui |
Open WebUI Vulnerable to a Session Fixation Attack CVE-2024-7053, GHSA-43g4-487m-5q6m, PYSEC-2026-1720 | High | Not scored | 20 Mar, 2025 | PyPI open-webui |
Open WebUI Cross-Site Request Forgery (CSRF) Vulnerability CVE-2024-7806, GHSA-85jc-8h5p-8vw8, PYSEC-2026-1724 | High | Not scored | 20 Mar, 2025 | PyPI open-webui |
Open WebUI Unauthenticated Multipart Boundary Denial of Service (DoS) Vulnerability in api/chat/file GHSA-6wj5-5pgr-jwq8 | High | Not scored | 20 Mar, 2025 | PyPI open-webui |