Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
SQL Injection in typo3 extension "LUX - TYPO3 Marketing Automation" CVE-2022-35628, GHSA-rpxg-hg79-h8q9 | Critical | 26.8% | 12 Jul, 2022 | Packagist in2code/lux |
Valinor error messages leading to potential data exfiltration before v0.12.0 CVE-2022-31140, GHSA-5pgm-3j3g-2rc7 | Critical | 1.5% | 11 Jul, 2022 | Packagist cuyz/valinor |
Microweber before 1.2.21 allows attacker to bypass IP detection to brute-force password CVE-2022-2368, GHSA-9wqr-9787-p4rf | Critical | 1.2% | 11 Jul, 2022 | Packagist microweber/microweber |
Deserialization of Untrusted Data in topthink/framework CVE-2022-33107, GHSA-g377-x8rg-c9mf | Critical | 23.9% | 29 Jun, 2022 | Packagist topthink/framework |
Path traversal in Concrete CMS CVE-2022-30117, GHSA-3jxh-6635-6jwp | Critical | 2.1% | 24 Jun, 2022 | Packagist concrete5/core |
Code injection in concrete CMS CVE-2022-21829, GHSA-6xc4-7fmm-65q2 | Critical | 1.8% | 24 Jun, 2022 | Packagist concrete5/core |
SQL Injection in RosarioSIS CVE-2022-2067, GHSA-3pqv-6pm3-g46j | Critical | 1.9% | 13 Jun, 2022 | Packagist francoisjacquet/rosariosis |
Code Injection in SEOmatic CVE-2021-41749, GHSA-g7xr-v82w-qggq | Critical | 16.8% | 12 Jun, 2022 | Packagist nystudio107/craft-seomatic |
Login timing attack in ibexa/core GHSA-2x4v-g8cx-jxrq | Critical | Not scored | 02 Jun, 2022 | Packagist ibexa/core |
Login timing attack in ezsystems/ezpublish-kernel GHSA-xfqg-p48g-hh94 | Critical | Not scored | 02 Jun, 2022 | Packagist ezsystems/ezpublish-kernel |
Login timing attack in ezsystems/ezplatform-kernel GHSA-342c-vcff-2ff2 | Critical | Not scored | 02 Jun, 2022 | Packagist ezsystems/ezplatform-kernel |
Command injection in librenms CVE-2022-29712, GHSA-23f2-vgr6-fwv7 | Critical | 1.7% | 02 Jun, 2022 | Packagist librenms/librenms |
Cross-site Scripting vulnerability in Mautic's tracking pixel functionality CVE-2022-25772, GHSA-pjpc-87mp-4332 | Critical | 63.0% | 25 May, 2022 | Packagist mautic/core |
Incorrect Calculation in moodle BIT-moodle-2022-30600, CVE-2022-30600, GHSA-w37f-pvvx-wcwm | Critical | 5.1% | 18 May, 2022 | Packagist moodle/moodle |
SQL injection in moodle BIT-moodle-2022-30599, CVE-2022-30599, GHSA-69c3-5xxf-58q2 | Critical | 1.4% | 18 May, 2022 | Packagist moodle/moodle |
Laravel Framework Deserialization Vulnerability CVE-2019-9081, GHSA-pfg4-p438-p874 | Critical | Not scored | 14 May, 2022 | Packagist laravel/framework |
Account takeover in facturascripts CVE-2022-1715, GHSA-vjq3-x3f2-fvxq | Critical | 1.4% | 13 May, 2022 | Packagist facturascripts/facturascripts |
Deserialization of Untrusted Data in topthink/framework CVE-2021-23592, GHSA-3fpv-54ff-wqfj, SNYK-PHP-TOPTHINKFRAMEWORK-2385695 | Critical | 1.7% | 06 May, 2022 | Packagist topthink/framework |
Incorrect Permission Assignment for Critical Resource in ShopXO CVE-2022-28056, GHSA-jfph-3hpg-2f65 | Critical | 1.4% | 02 May, 2022 | Packagist shopxo/shopxo |
Object state limitation has no effect GHSA-w8qp-hmh5-4v9v | Critical | Not scored | 29 Apr, 2022 | Packagist ezsystems/ezplatform-kernel |
Object state limitation has no effect GHSA-gvj8-4cj4-h776 | Critical | Not scored | 29 Apr, 2022 | Packagist ibexa/core |
Object state limitation has no effect CVE-2022-48367, GHSA-5x4f-7xgq-r42x, GHSA-h5v2-wrhp-5v35 | Critical | 0.7% | 29 Apr, 2022 | Packagist ezsystems/ezpublish-kernel |
Cross site scripting in FacturaScripts CVE-2022-1514, GHSA-p3w3-4ppm-c3f6 | Critical | 0.8% | 28 Apr, 2022 | Packagist facturascripts/facturascripts |
Command injection in czproject/git-php CVE-2022-25866, GHSA-3xpw-vhmv-cw7h, SNYK-PHP-CZPROJECTGITPHP-2421349 | Critical | 3.6% | 25 Apr, 2022 | Packagist czproject/git-php |
Cross site scripting in facturascripts CVE-2022-1457, GHSA-8wp2-vxpg-xcvp | Critical | 0.8% | 25 Apr, 2022 | Packagist neorazorx/facturascripts |
RCE in Studio-42 elFinder on Windows before 2.1.61 CVE-2022-27115, GHSA-6p96-vfrc-fv32 | Critical | 28.6% | 11 Apr, 2022 | Packagist studio-42/elfinder |
elFinder Unrestricted File Upload vulnerability CVE-2021-43421, GHSA-x4jx-hjwf-gc99 | Critical | 42.8% | 07 Apr, 2022 | Packagist studio-42/elfinder |
Remote code injection in dompdf/dompdf CVE-2022-28368, GHSA-x752-qjv4-c4hc | Critical | 83.9% | 03 Apr, 2022 | Packagist dompdf/dompdf |
SQL injection in pagekit/pagekit CVE-2021-44135, GHSA-45hc-r4fj-qj89 | Critical | 1.5% | 01 Apr, 2022 | Packagist pagekit/pagekit |
Variable Tampering within joomla/input class BIT-joomla-2022-23799, CVE-2022-23799, GHSA-49fj-qp6p-q544 | Critical | 1.2% | 30 Mar, 2022 | Packagist joomla/input |
Firebase PHP-JWT key/algorithm type confusion CVE-2021-46743, GHSA-8xf4-w7qw-pjjw | Critical | 0.8% | 29 Mar, 2022 | Packagist firebase/php-jwt |
Sandbox bypass in fenom CVE-2021-46433, GHSA-674v-3g2w-84gx | Critical | 1.1% | 28 Mar, 2022 | Packagist fenom/fenom |
Type Confusion in ImpressCMS CVE-2021-26600, GHSA-m8xh-cqc2-5q6f | Critical | 5.6% | 28 Mar, 2022 | Packagist impresscms/impresscms |
SQL Injection in ImpressCMS CVE-2021-26599, GHSA-jc4v-vvg6-xg78 | Critical | 21.0% | 28 Mar, 2022 | Packagist impresscms/impresscms |
Path Traversal in Studio-42 elFinder through 2.1.60 CVE-2022-26960, GHSA-7q88-jxvp-9gp2 | Critical | 51.0% | 21 Mar, 2022 | Packagist studio-42/elfinder |
Remote Code Execution in Contao Managed Edition CVE-2022-26265, GHSA-rggc-4g3r-j7ff | Critical | 30.4% | 18 Mar, 2022 | Packagist contao/managed-edition |
Improper Privilege Management in Open Web Analytics CVE-2022-24637, GHSA-pr9q-v585-qv2w | Critical | 99.1% | 18 Mar, 2022 | Packagist open-web-analytics/open-web-analytics |
DQL injection through sorting parameters blocked CVE-2022-24752, GHSA-2xmm-g482-4439 | Critical | 1.4% | 15 Mar, 2022 | Packagist sylius/grid-bundle |
Cross-site Scripting in showdoc/showdoc CVE-2022-0960, GHSA-rphc-h572-2x9f | Critical | 0.9% | 14 Mar, 2022 | Packagist showdoc/showdoc |
SQL Injection in WordPress Zero Spam WordPress plugin CVE-2022-0254, GHSA-pq2f-3fg3-rw99 | Critical | 2.0% | 14 Mar, 2022 | Packagist bmarshall511/wordpress_zero_spam |
Unrestricted Upload of File with Dangerous Type in Zenario CMS CVE-2021-42171, GHSA-rgg3-3wh7-w935 | Critical | 2.5% | 14 Mar, 2022 | Packagist tribalsystems/zenario |
Server-side Template Injection in nystudio107/craft-seomatic CVE-2021-44618, GHSA-m3xv-x3ph-mq22 | Critical | 1.4% | 11 Mar, 2022 | Packagist nystudio107/craft-seomatic |
Static Code Injection in Microweber CVE-2022-0895, GHSA-x28w-hvwc-mp75 | Critical | 1.7% | 10 Mar, 2022 | Packagist microweber/microweber |
Exposure of Private Personal Information to an Unauthorized Actor in alextselegidis/easyappointments CVE-2022-0482, GHSA-r6cm-wg48-rh2r | Critical | 43.7% | 09 Mar, 2022 | Packagist alextselegidis/easyappointments |
Improper regex in htaccess file CVE-2022-25769, GHSA-mj6m-246h-9w56 | Critical | 0.5% | 01 Mar, 2022 | Packagist mautic/core |
Remote CLI Command Execution Vulnerability in CodeIgniter4 BIT-codeigniter-2022-24711, CVE-2022-24711, GHSA-xjp4-6w75-qrj7 | Critical | 1.2% | 28 Feb, 2022 | Packagist codeigniter4/framework |
Server-Side Request Forgery (SSRF) in rudloff/alltube CVE-2022-0768, GHSA-r5hc-wm3g-hjw6 | Critical | 1.6% | 28 Feb, 2022 | Packagist rudloff/alltube |
Arbitrary file delete in ectouch/ectouch CVE-2022-25098, GHSA-ph62-8768-r87v | Critical | 1.0% | 24 Feb, 2022 | Packagist ectouch/ectouch |
SQL injection in francoisjacquet/rosariosis CVE-2021-44567, GHSA-82rr-mq4r-p4r3 | Critical | 23.1% | 24 Feb, 2022 | Packagist francoisjacquet/rosariosis |
Code injection in ezsystems/ezpublish-kernel CVE-2022-25337, GHSA-xwv6-v7qx-f5jc | Critical | 1.1% | 18 Feb, 2022 | Packagist ezsystems/ezpublish-kernel |