Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Drupal Core has a SQL Injection issue BIT-drupal-2026-9082, CVE-2026-9082, DRUPAL-CORE-2026-004, GHSA-ghwc-95x2-682j | CriticalExploited | 89.4% | 20 May, 2026 | Packagist drupal/core |
Magento Community Edition Improper Input Validation vulnerability CVE-2025-54236, GHSA-wh92-6q6g-px7j | CriticalExploited | 94.7% | 09 Sep, 2025 | Packagist magento/community-edition Packagist magento/project-community-edition |
Livewire is vulnerable to remote command execution during component property update hydration CVE-2025-54068, GHSA-29cq-5w36-x7w3 | CriticalExploited | 96.3% | 17 Jul, 2025 | Packagist livewire/livewire |
Roundcube Webmail Vulnerable to Authenticated RCE via PHP Object Deserialization CVE-2025-49113, GHSA-8j8w-wwqc-x596 | CriticalExploited | 99.7% | 02 Jun, 2025 | Packagist roundcube/roundcubemail |
Craft CMS Allows Remote Code Execution CVE-2025-32432, GHSA-f3gw-9ww9-jmc3 | CriticalExploited | 99.8% | 25 Apr, 2025 | Packagist craftcms/cms |
yiisoft/yii2 Mishandles the Attaching of Behavior Defined by a `__class` Array Key CVE-2024-58136, GHSA-ggwg-cmwp-46r5 | CriticalExploited | 87.8% | 10 Apr, 2025 | Packagist yiisoft/yii2 |
Craft CMS has potential RCE when PHP `register_argc_argv` config setting is enabled CVE-2024-56145, GHSA-2p6p-9rc9-62j9 | CriticalExploited | 97.4% | 18 Dec, 2024 | Packagist craftcms/cms |
Magento Open Source affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability BIT-magento-2024-34102, CVE-2024-34102, GHSA-m8cj-3v68-3cxj | CriticalExploited | 100.0% | 13 Jun, 2024 | Packagist magento/community-edition |
Magento improper input validation vulnerability BIT-magento-2022-24086, CVE-2022-24086, GHSA-f8fv-f786-9933 | CriticalExploited | 99.2% | 16 Feb, 2022 | Packagist magento/community-edition |
Account Takeover in Octobercms CVE-2021-32648, GHSA-mxr5-mc97-63rc | CriticalExploited | 90.4% | 26 Aug, 2021 | Packagist october/system |
Unauthenticated remote code execution in Ignition CVE-2021-3129, GHSA-4qwp-7c67-jmcc | CriticalExploited | 99.9% | 12 Jan, 2021 | Packagist facade/ignition |
Drupal Core Remote Code Execution Vulnerability CVE-2018-7602, DRUPAL-CORE-2018-004, GHSA-297x-j9pm-xjgg | CriticalExploited | 99.2% | 25 Apr, 2018 | Packagist drupal/core Packagist drupal/drupal |
Drupal Core Remote Code Execution Vulnerability CVE-2018-7600, DRUPAL-CORE-2018-002, GHSA-7fh9-933g-885p | CriticalExploited | 100.0% | 28 Mar, 2018 | Packagist drupal/core Packagist drupal/drupal |
Code Injection in PHPUnit CVE-2017-9841, GHSA-r7c9-c69m-rph8 | CriticalExploited | 100.0% | 27 Jun, 2017 | Packagist phpunit/phpunit |
Remote code execution in PHPMailer CVE-2016-10033, GHSA-5f37-gxvh-23v6 | CriticalExploited | 99.7% | 30 Dec, 2016 | Packagist phpmailer/phpmailer |