Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Bagisto has IDOR in Customer Order Reorder Functionality CVE-2026-21447, GHSA-x5rw-qvvp-5cgm | High | 0.3% | 02 Jan, 2026 | Packagist bagisto/bagisto |
Bagisto Missing Authentication on Installer API Endpoints CVE-2026-21446, GHSA-6h7w-v2xr-mqvw | High | 0.6% | 02 Jan, 2026 | Packagist bagisto/bagisto |
FacturaScripts is Vulnerable to Stored Cross-Site Scripting (XSS) via XML File Upload CVE-2025-69210, GHSA-2267-xqcf-gw2m | High | 1.0% | 30 Dec, 2025 | Packagist facturascripts/facturascripts |
YOURLS is vulnerable to XSS through JSONP and Callback request parameters GHSA-6mp4-q625-mxjp | High | Not scored | 30 Dec, 2025 | Packagist yourls/yourls |
phpMyFAQ has unauthenticated config backup download via /api/setup/backup CVE-2025-69200, GHSA-9cg9-4h4f-j6fg | High | 2.1% | 29 Dec, 2025 | Packagist thorsten/phpmyfaq |
Croogo CMS has a path traversal vulnerability CVE-2024-42718, GHSA-g5p6-3j82-xfm4 | High | 0.6% | 26 Dec, 2025 | Packagist croogo/croogo |
Kimai contains a SameSite cookie vulnerability CVE-2023-53957, GHSA-cv8h-r7r5-vwj9 | High | 0.6% | 19 Dec, 2025 | Packagist kimai/kimai |
Auth0-PHP SDK has Improper Audience Validation CVE-2025-68129, GHSA-j2vm-wrq3-f7gf | High | 0.4% | 17 Dec, 2025 | Packagist auth0/auth0-php |
FoF Pretty Mail has a server-side template injection vulnerability CVE-2024-58303, GHSA-947q-2xw3-gx9c | High | 0.5% | 11 Dec, 2025 | Packagist fof/pretty-mail |
Shopware Storefront Reflected XSS in Storefront Login Page CVE-2025-67648, GHSA-6w82-v552-wjw2 | High | 0.2% | 09 Dec, 2025 | Packagist shopware/shopware Packagist shopware/storefront |
Neuron MySQLSelectTool “read-only” bypass via `SELECT ... INTO OUTFILE` (file write → potential RCE) CVE-2025-67509, GHSA-j8g6-5gqc-mq36 | High | 0.3% | 09 Dec, 2025 | Packagist neuron-core/neuron-ai |
Filament multi-factor authentication (app) recovery codes can be used multiple times CVE-2025-67507, GHSA-pvcv-q3q7-266g | High | 0.3% | 09 Dec, 2025 | Packagist filament/filament |
robrichards/xmlseclibs has an Libxml2 Canonicalization error which can bypass Digest/Signature validation CVE-2025-66578, GHSA-c4cc-x928-vjw9 | High | 0.2% | 08 Dec, 2025 | Packagist robrichards/xmlseclibs |
Aimeos GrapesJS CMS extension has possible stored XSS that's exploitable by authenticated editors CVE-2025-66468, GHSA-424m-fj2q-g7vg | High | 0.3% | 02 Dec, 2025 | Packagist aimeos/ai-cms-grapesjs |
GrapesJsBuilder File Upload allows all file uploads CVE-2025-13827, GHSA-5xw2-57jx-pgjp | High | 0.4% | 02 Dec, 2025 | Packagist mautic/grapes-js-builder-bundle |
Grav vulnerable to Denial of Service via Improper Input Handling in 'Supported' Parameter CVE-2025-66305, GHSA-m8vh-v6r6-w7p6 | High | 0.4% | 01 Dec, 2025 | Packagist getgrav/grav |
Grav Exposes Password Hashes Leading to privilege escalation CVE-2025-66304, GHSA-gq3g-666w-7h85 | High | 0.4% | 01 Dec, 2025 | Packagist getgrav/grav |
Grav has Broken Access Control which allows an Editor to modify the page's YAML Frontmatter to alter form processing actions CVE-2025-66301, GHSA-v8x2-fjv7-8hjh | High | 1.3% | 01 Dec, 2025 | Packagist getgrav/grav |
Grav is vulnerable to Arbitrary File Read CVE-2025-66300, GHSA-p4ww-mcp9-j6f2 | High | 0.5% | 01 Dec, 2025 | Packagist getgrav/grav |
Grav is Vulnerable to Security Sandbox Bypass with SSTI (Server Side Template Injection) CVE-2025-66299, GHSA-gjc5-8cfh-653x | High | 0.6% | 01 Dec, 2025 | Packagist getgrav/grav |
Grav is vulnerable to Server-Side Template Injection (SSTI) via Forms CVE-2025-66298, GHSA-8535-hvm8-2hmv | High | 0.4% | 01 Dec, 2025 | Packagist getgrav/grav |
Grav vulnerable to Privilege Escalation and Authenticated Remote Code Execution via Twig Injection CVE-2025-66297, GHSA-858q-77wx-hhx6 | High | 0.8% | 01 Dec, 2025 | Packagist getgrav/grav |
Grav vulnerable to Privilege Escalation in Grav Admin: Missing Username Uniqueness Check Allows Admin Account Takeover CVE-2025-66296, GHSA-cjcp-qxvg-4rjm | High | 0.3% | 01 Dec, 2025 | Packagist getgrav/grav |
Grav vulnerable to Path traversal / arbitrary YAML write via user creation leading to Account Takeover / System Corruption CVE-2025-66295, GHSA-h756-wh59-hhjv | High | 0.6% | 01 Dec, 2025 | Packagist getgrav/grav |
Grav is vulnerable to RCE via SSTI through Twig Sandbox Bypass CVE-2025-66294, GHSA-662m-56v4-3r8f | High | 2.8% | 01 Dec, 2025 | Packagist getgrav/grav |
REDAXO CMS is vulnerable to RCE attack through its template management component CVE-2025-64050, GHSA-xj9j-gjxg-7jvq | High | 1.0% | 25 Nov, 2025 | Packagist redaxo/source |
OpenSTAManager has Authenticated SQL Injection in API via 'display' parameter CVE-2025-65103, GHSA-2jm2-2p35-rp3j | High | 0.4% | 19 Nov, 2025 | Packagist devcode-it/openstamanager |
phpMyFAQ has Authenticated SQL Injection in Configuration Update Functionality CVE-2025-62519, GHSA-fxm2-cmwj-qvx4 | High | 0.8% | 17 Nov, 2025 | Packagist phpmyfaq/phpmyfaq Packagist thorsten/phpmyfaq |
Symfony's incorrect parsing of PATH_INFO can lead to limited authorization bypass CVE-2025-64500, GHSA-3rg7-wf37-54rm | High | 1.4% | 12 Nov, 2025 | Packagist symfony/http-foundation Packagist symfony/symfony |
TYPO3 Modules Extension has Improper Authentication vulnerability CVE-2025-12998, GHSA-49qv-h8pm-73pf | High | 0.4% | 12 Nov, 2025 | Packagist codingms/modules |
TorrentPier is Vulnerable to Authenticated SQL Injection through Moderator Control Panel's topic_id parameter CVE-2025-64519, GHSA-4rwr-8c3m-55f6 | High | 0.5% | 10 Nov, 2025 | Packagist torrentpier/torrentpier |
MantisBT Vulnerable to Denial-of-Service (DoS) via Excessive Note Length CVE-2025-46556, GHSA-r3jf-hm7q-qfw5 | High | 0.4% | 03 Nov, 2025 | Packagist mantisbt/mantisbt |
MantisBT vulnerable to authentication bypass for some passwords due to PHP type juggling CVE-2025-47776, GHSA-4v8w-gg5j-ph37 | High | 0.3% | 03 Nov, 2025 | Packagist mantisbt/mantisbt |
Statamic Vulnerable to Superadmin Account Takeover via Stored Cross-Site Scripting and Lack of Proper X-CSRF-TOKEN Server-Side Validation CVE-2025-64112, GHSA-g59r-24g3-h7cm | High | 0.3% | 30 Oct, 2025 | Packagist statamic/cms |
Drupal Simple OAuth (OAuth2) & OpenID Connect allows Authentication Bypass CVE-2025-12466, DRUPAL-CONTRIB-2025-114, GHSA-jqmq-fpwv-p925 | High | 0.4% | 29 Oct, 2025 | Packagist drupal/simple_oauth Packagist:https://packages.drupal.org/8 drupal/simple_oauth |
Moodle vulnerable to brute-force password guesses BIT-moodle-2025-62399, CVE-2025-62399, GHSA-m58f-9pvv-8mp2 | High | 0.4% | 23 Oct, 2025 | Packagist moodle/moodle |
Admidio Vulnerable to Authenticated SQL Injection in Member Assignment Functionality CVE-2025-62617, GHSA-2v5m-cq9w-fc33 | High | 0.4% | 22 Oct, 2025 | Packagist admidio/admidio |
Drupal CivicTheme Design System allows Forceful Browsing CVE-2025-12082, DRUPAL-CONTRIB-2025-112, GHSA-qxr9-f877-9842 | High | 0.3% | 22 Oct, 2025 | Packagist drupal/civictheme Packagist:https://packages.drupal.org/8 drupal/civictheme |
TastyIgniter vulnerable to Cross-Site Scripting CVE-2025-61417, GHSA-4vrf-42cm-7xfw | High | 0.6% | 20 Oct, 2025 | Packagist tastyigniter/tastyigniter |
Magento vulnerable to stored Cross-Site Scripting (XSS) CVE-2025-54264, GHSA-2768-5wmv-cfff | High | 0.6% | 14 Oct, 2025 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento provides incorrect authorization through a security feature bypass CVE-2025-54263, GHSA-69x9-xp2j-w8g8 | High | 0.6% | 14 Oct, 2025 | Packagist magento/community-edition Packagist magento/project-community-edition |
Bagisto is vulnerable to XSS through Admin Panel's product creation path CVE-2025-60880, GHSA-29mf-w486-v3vc | High | 0.4% | 10 Oct, 2025 | Packagist bagisto/bagisto |
Dolibarr vulnerable to RCE via the computed field parameter CVE-2025-56588, GHSA-27hj-48r9-x2vx | High | 0.5% | 01 Oct, 2025 | Packagist dolibarr/dolibarr |
Star Citizen EmbedVideo Extension Stored XSS through wikitext caused by usage of non-reserved data attributes CVE-2025-59839, GHSA-4j5h-mvj3-m48v | High | 0.3% | 24 Sep, 2025 | Packagist starcitizenwiki/embedvideo |
Snipe-IT allows unsafe deserialization CVE-2025-59713, GHSA-phwj-fgch-xvrj | High | 0.4% | 19 Sep, 2025 | Packagist snipe/snipe-it |
Shopware: Reflective Cross Site-Scripting (XSS) in CMS components GHSA-9v82-vcjx-m76j | High | Not scored | 10 Sep, 2025 | Packagist shopware/core Packagist shopware/shopware |
TinyEnv: Missing .env file not required — may cause unexpected behavior CVE-2025-58758, GHSA-3j7m-5g4q-gfpc | High | 0.2% | 09 Sep, 2025 | Packagist datahihi1/tiny-env |
TYPO3 Workspaces Module Information Disclosure CVE-2025-59018, GHSA-w2pf-7q5w-2cgw | High | 0.3% | 09 Sep, 2025 | Packagist typo3/cms-workspaces |
Maho is Vulnerable to Authenticated Remote Code Execution via File Upload CVE-2025-58449, GHSA-vgmm-27fc-vmgp | High | 0.3% | 08 Sep, 2025 | Packagist mahocommerce/maho |
Drupal Acquia DAM allows Forceful Browsing CVE-2025-9954, DRUPAL-CONTRIB-2025-105, GHSA-x957-32v9-m7vg | High | 0.3% | 03 Sep, 2025 | Packagist drupal/acquia_dam Packagist:https://packages.drupal.org/8 drupal/acquia_dam |