Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Magento improper input validation vulnerability BIT-magento-2022-24086, CVE-2022-24086, GHSA-f8fv-f786-9933 | CriticalExploited | 99.2% | 16 Feb, 2022 | Packagist magento/community-edition |
Prototype Pollution in litespeed.js and appwrite/server-ce CVE-2021-23682, GHSA-v9p9-535w-4285 | Critical | 2.1% | 16 Feb, 2022 | Packagist appwrite/server-ce npm litespeed.js |
Path Traversal in ImpressCMS CVE-2022-24977, GHSA-389p-fchr-q2mg | Critical | 6.4% | 14 Feb, 2022 | Packagist impresscms/impresscms |
Possible SQL injection in tablelookupwizard Contao Extension GHSA-v3mr-gp7j-pw5w | Critical | Not scored | 10 Feb, 2022 | Packagist terminal42/contao-tablelookupwizard |
Code injection in Twig CVE-2022-23614, GHSA-5mv2-rx3q-4w2v | Critical | 8.2% | 04 Feb, 2022 | Packagist twig/twig |
Server Side Twig Template Injection CVE-2022-21686, GHSA-mrq4-7ch7-2465 | Critical | 1.8% | 26 Jan, 2022 | Packagist prestashop/prestashop |
SQL Injection in showdoc CVE-2022-0362, GHSA-9cq5-xgg4-x477 | Critical | 1.5% | 26 Jan, 2022 | Packagist showdoc/showdoc |
SQL injection in Moodle BIT-moodle-2022-0332, CVE-2022-0332, GHSA-6jhm-4vmx-mr76 | Critical | 44.0% | 25 Jan, 2022 | Packagist moodle/moodle |
Authentication Bypass in ADOdb/ADOdb CVE-2021-3850, GHSA-65mj-7c86-79jf | Critical | 2.2% | 25 Jan, 2022 | Packagist adodb/adodb-php |
SQL Injection in dolibarr BIT-dolibarr-2022-0224, CVE-2022-0224, GHSA-j545-frh3-r9gq | Critical | 2.0% | 14 Jan, 2022 | Packagist dolibarr/dolibarr |
Deserialization of Untrusted Data in Codeigniter4 BIT-codeigniter-2022-21647, CVE-2022-21647, GHSA-w6jr-wj64-mc9x | Critical | 37.7% | 04 Jan, 2022 | Packagist codeigniter4/framework |
Cross-site Scripting in pimcore CVE-2021-4139, GHSA-8xx9-rxrj-2m2w | Critical | 0.9% | 21 Dec, 2021 | Packagist pimcore/pimcore |
Incorrect Authorization in latte/latte CVE-2021-23803, GHSA-6pj2-5fqq-xvjc, SNYK-PHP-LATTELATTE-1932226 | Critical | 1.6% | 17 Dec, 2021 | Packagist latte/latte |
ThinkPHP5 SQL Injection vulnerability CVE-2021-44350, GHSA-q868-c4vw-qjx3 | Critical | 1.4% | 15 Dec, 2021 | Packagist topthink/framework |
BookStack is vulnerable to Improper Access Control. CVE-2021-4119, GHSA-9c5c-5j4h-8q2c | Critical | 26.9% | 15 Dec, 2021 | Packagist ssddanbrown/bookstack |
SQL injection in prestashop/prestashop CVE-2021-43789, GHSA-6xxj-gcjq-wgf4 | Critical | 4.7% | 07 Dec, 2021 | Packagist prestashop/prestashop |
Deserialization of Untrusted Data in topthink/framework CVE-2021-36567, GHSA-qrvj-274h-hfcg | Critical | 2.5% | 06 Dec, 2021 | Packagist topthink/framework |
Deserialization of Untrusted Data in topthink/framework CVE-2021-36564, GHSA-33gc-6cw9-w3g4 | Critical | 1.9% | 06 Dec, 2021 | Packagist topthink/framework |
Path manipulation in matyhtf/framework CVE-2021-43676, GHSA-mh9j-v6mq-pfch | Critical | 1.4% | 03 Dec, 2021 | Packagist matyhtf/framework |
Path traversal in librenms/librenms CVE-2021-44278, GHSA-7289-chwj-7h86 | Critical | 1.5% | 03 Dec, 2021 | Packagist librenms/librenms |
kimai2 is vulnerable to Cross-site Scripting CVE-2021-3985, GHSA-x68c-4gmm-5g43 | Critical | 1.3% | 01 Dec, 2021 | Packagist kevinpapst/kimai2 |
SQL Injection in rosariosis CVE-2021-44427, GHSA-wf5p-f5xr-c4jj | Critical | 50.6% | 29 Nov, 2021 | Packagist francoisjacquet/rosariosis |
OS Command Injection Vulnerability and Potential Zip Slip Vulnerability in baserCMS CVE-2021-41243, GHSA-7rpc-9m88-cf9w | Critical | 2.2% | 26 Nov, 2021 | Packagist baserproject/basercms |
Webcache Poisoning in shopware/platform and shopware/core GHSA-r64m-qchj-hrjp | Critical | Not scored | 24 Nov, 2021 | Packagist shopware/core Packagist shopware/platform |
Moodle vulnerable to RCE via unsafe deserialization BIT-moodle-2021-3943, CVE-2021-3943, GHSA-8jhp-2gcr-qw96 | Critical | 2.4% | 22 Nov, 2021 | Packagist moodle/moodle |
Incorrect Access Control in Ignition CVE-2021-43996, GHSA-vhrp-8qx4-vr6c | Critical | 1.7% | 17 Nov, 2021 | Packagist facade/ignition |
DBAL 3 SQL Injection Security Vulnerability CVE-2021-43608, GHSA-r7cj-8hjg-x622 | Critical | 2.4% | 16 Nov, 2021 | Packagist doctrine/dbal |
Withdrawn: Laravel Framework does not sufficiently block the upload of executable PHP content. CVE-2021-43617, GHSA-364w-9g92-3grq | Critical | 20.0% | 14 Nov, 2021 | Packagist laravel/framework |
Dolibarr remote PHP code execution BIT-dolibarr-2021-33816, CVE-2021-33816, GHSA-vxr9-p2xw-m8cf | Critical | 3.9% | 10 Nov, 2021 | Packagist dolibarr/dolibarr |
Insecure Inherited Permissions in neoan3-apps/template CVE-2021-41170, GHSA-3v56-q6r6-4gcw | Critical | 1.6% | 08 Nov, 2021 | Packagist neoan3-apps/template |
XML External Entity vulnerability in MODX CMS BIT-modx-2020-25911, CVE-2020-25911, GHSA-vhfp-9wvj-gwvg | Critical | 2.4% | 31 Oct, 2021 | Packagist modx/revolution |
Showdoc File Upload Vulnerability CVE-2021-41745, GHSA-4286-h47h-m5v6 | Critical | 1.4% | 22 Oct, 2021 | Packagist showdoc/showdoc |
Froxlor SQL injection vulnerability CVE-2021-42325, GHSA-6fvw-x6gw-4wv8 | Critical | 11.8% | 12 Oct, 2021 | Packagist froxlor/froxlor |
Server-Side Request Forgery vulnerability in concrete5 CVE-2021-22958, GHSA-284f-f2hw-j2gx | Critical | 1.2% | 07 Oct, 2021 | Packagist concrete5/concrete5 |
Improper escaping of command arguments on Windows leading to command injection BIT-composer-2021-41116, CVE-2021-41116, GHSA-frqg-7g38-6gcf | Critical | 2.8% | 05 Oct, 2021 | Packagist composer/composer |
SQL Injection in topthink/thinkphp CVE-2020-20120, GHSA-m7h5-fjjq-559f | Critical | 1.8% | 28 Sep, 2021 | Packagist topthink/thinkphp |
Improper Access Control in Webauthn Framework CVE-2021-38299, GHSA-6whf-q6p5-84wg | Critical | 1.8% | 27 Sep, 2021 | Packagist web-auth/webauthn-framework |
Arbitrary Code Execution in feehi/cms CVE-2020-21322, GHSA-rf3w-29h3-r636 | Critical | 1.8% | 15 Sep, 2021 | Packagist feehi/cms |
Unrestricted Upload of File with Dangerous Type in Drupal core BIT-drupal-2020-13675, CVE-2020-13675, DRUPAL-CONTRIB-2021-029, DRUPAL-CORE-2021-008, GHSA-v8wr-r69p-mmwx | Critical | 1.4% | 15 Sep, 2021 | Packagist drupal/core Packagist:https://packages.drupal.org/8 drupal/graphql |
Unrestricted File Upload in ShowDoc v2.9.5 CVE-2021-36440, GHSA-c442-3278-rhrg | Critical | 4.8% | 08 Sep, 2021 | Packagist showdoc/showdoc |
Magento executes code via the API File Option Upload Extension CVE-2021-36042, GHSA-6cwv-wj7v-73xp | Critical | 2.5% | 01 Sep, 2021 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento has a file extension restrictions bypass CVE-2021-36040, GHSA-2pq5-gpqf-g4r3 | Critical | 2.9% | 01 Sep, 2021 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento XML Injection vulnerability in the Widgets Module CVE-2021-36033, GHSA-p746-qw73-qmmx | Critical | 3.1% | 01 Sep, 2021 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento has an XML Injection vulnerability CVE-2021-36028, GHSA-5pjj-7fq8-9gpf | Critical | 2.9% | 01 Sep, 2021 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento is affected by an improper input validation vulnerability while saving a customer's details CVE-2021-36025, GHSA-gvfx-9m9v-h839 | Critical | 2.8% | 01 Sep, 2021 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento XML Injection vulnerability in the 'City' field CVE-2021-36020, GHSA-xvpx-6hh8-7h72 | Critical | 2.7% | 01 Sep, 2021 | Packagist magento/community-edition Packagist magento/project-community-edition |
Account Takeover in Octobercms CVE-2021-32648, GHSA-mxr5-mc97-63rc | CriticalExploited | 90.4% | 26 Aug, 2021 | Packagist october/system |
SafeCurl before 0.9.2 has a DNS rebinding vulnerability. CVE-2020-36474, GHSA-x2xg-6wcj-6xf9 | Critical | 1.8% | 20 Aug, 2021 | Packagist vanilla/safecurl |
Command injection in mail agent settings CVE-2021-37708, GHSA-xh55-2fqp-p775 | Critical | 2.4% | 16 Aug, 2021 | Packagist shopware/core Packagist shopware/platform |
Dolibarr Cross-site Scripting vulnerability CVE-2021-25955, GHSA-cpv8-6xgr-rmf6 | Critical | 0.9% | 15 Aug, 2021 | Packagist dolibarr/dolibarr |