Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
PocketMine-MP `ResourcePackDataInfoPacket` amplification vulnerability due to lack of resource pack sequence status checking CVE-2025-71417, GHSA-fqqv-56h5-f57g | High | 0.4% | 02 Sep, 2025 | Packagist pocketmine/pocketmine-mp |
Easy!Appointments SQL injection vulnerability CVE-2025-50383, GHSA-2f28-69j7-85hf | High | 0.4% | 25 Aug, 2025 | Packagist alextselegidis/easyappointments |
PhpSpreadsheet vulnerable to SSRF when reading and displaying a processed HTML document in the browser CVE-2025-54370, GHSA-rx7m-68vc-ppxh | High | 0.8% | 25 Aug, 2025 | Packagist phpoffice/phpspreadsheet |
Adminer PHP Object Injection issue leads to Denial of Service CVE-2025-43960, GHSA-mqh4-2mm8-g7w9 | High | 0.7% | 25 Aug, 2025 | Packagist vrana/adminer |
UnoPim has Broken Access Control CVE-2025-55741, GHSA-8p2f-fx4q-75cx | High | 0.4% | 22 Aug, 2025 | Packagist unopim/unopim |
UnoPim vulnerable to remote code execution through Arbitrary File upload CVE-2025-55743, GHSA-v22v-xwh7-2vrm | High | 0.5% | 21 Aug, 2025 | Packagist unopim/unopim |
Soosyze CMS's /user/login endpoint missing rate-limiting and lockout mechanisms CVE-2025-52392, GHSA-vq9x-w82r-rhmc | High | 0.9% | 13 Aug, 2025 | Packagist soosyze/soosyze |
Magento Cross-site Scripting vulnerability CVE-2025-49557, GHSA-8mq8-c243-2335 | High | 0.6% | 12 Aug, 2025 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento has incorrect authorization issue that leads to arbitrary file system read CVE-2025-49556, GHSA-7hrj-3c9x-xv5h | High | 0.6% | 12 Aug, 2025 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento Cross-Site Request Forgery (CSRF) vulnerability CVE-2025-49555, GHSA-5777-jj7p-mpqw | High | 0.9% | 12 Aug, 2025 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento vulnerable to denial of service CVE-2025-49554, GHSA-xgfm-992v-h2hr | High | 0.6% | 12 Aug, 2025 | Packagist magento/community-edition Packagist magento/project-community-edition |
Microweber XSS Vulnerability in the homepage Endpoint CVE-2025-51504, GHSA-2x2j-3c2v-g3c2 | High | 0.6% | 01 Aug, 2025 | Packagist microweber/microweber |
Microweber Has Stored XSS Vulnerability in User Profile Fields CVE-2025-51503, GHSA-782f-gxj5-xvqc | High | 0.5% | 31 Jul, 2025 | Packagist microweber/microweber |
Bacula-web SQL Injection Vulnerability CVE-2025-45346, GHSA-hq25-vp56-qr86 | High | 0.7% | 29 Jul, 2025 | Packagist bacula-web/bacula-web |
z-push/z-push-dev SQL Injection Vulnerability CVE-2025-8264, GHSA-w832-w3p8-cw29 | High | 0.4% | 29 Jul, 2025 | Packagist z-push/z-push-dev |
HAX CMS API Lacks Authorization Checks CVE-2025-54378, GHSA-9jr9-8ff3-m894 | High | 0.6% | 25 Jul, 2025 | Packagist elmsln/haxcms npm @haxtheweb/haxcms-nodejs |
LibreNMS has Authenticated Remote File Inclusion in ajax_form.php that Allows RCE CVE-2025-54138, GHSA-gq96-8w38-hhj2 | High | 1.2% | 21 Jul, 2025 | Packagist librenms/librenms |
Dolibarr has Remote Code Execution Vulnerability (Bypass) GHSA-49xw-hw94-fmv2 | High | Not scored | 21 Jul, 2025 | Packagist dolibarr/dolibarr |
DynamicPageList3 vulnerability exposes hidden/suppressed usernames CVE-2025-53625, GHSA-7pgw-q3qp-6pgq | High | 0.5% | 10 Jul, 2025 | Packagist universal-omega/dynamic-page-list3 |
Citizen vulnerable to Stored XSS through short descriptions CVE-2025-53370, GHSA-prmv-7r8c-794g | High | 0.4% | 03 Jul, 2025 | Packagist starcitizentools/citizen-skin |
Citizen Short Description stored XSS vulnerability through wikitext CVE-2025-53369, GHSA-p85q-mww9-gwqf | High | 0.3% | 03 Jul, 2025 | Packagist starcitizentools/short-description |
starcitizentools/citizen-skin is vulnerable to Stored XSS attack in the legacy search bar through page descriptions CVE-2025-53368, GHSA-rq6g-6g94-jfr4 | High | 0.3% | 03 Jul, 2025 | Packagist starcitizentools/citizen-skin |
Bolt CMS vulnerable to authenticated remote code execution CVE-2025-34086, GHSA-p9qc-8jjx-g8cg | High | 4.2% | 03 Jul, 2025 | Packagist bolt/bolt |
TabberNeue vulnerable to Stored XSS through wikitext CVE-2025-53093, GHSA-jfj7-249r-7j2m | High | 0.4% | 27 Jun, 2025 | Packagist starcitizentools/tabber-neue |
raspap-webgui has a Directory Traversal vulnerability CVE-2025-44163, GHSA-277f-37gw-9gmq | High | 0.6% | 27 Jun, 2025 | Packagist billz/raspap-webgui |
Magento Improper Authorization leading to security feature bypass CVE-2025-43585, GHSA-r487-9vv5-75gg | High | 0.5% | 10 Jun, 2025 | Packagist magento/community-edition Packagist magento/project-community-edition |
Hax CMS Stored Cross-Site Scripting vulnerability CVE-2025-49137, GHSA-2vc4-3hx7-v7v7 | High | 0.3% | 09 Jun, 2025 | Packagist elmsln/haxcms |
PHPOffice Math allows XXE when processing an XML file in the MathML format CVE-2025-48882, GHSA-42hm-pq2f-3r7m | High | 0.5% | 29 May, 2025 | Packagist phpoffice/math |
Drupal Lightgallery Cross-site Scripting vulnerability CVE-2025-48447, DRUPAL-CONTRIB-2025-069, GHSA-w5px-5878-m9x4 | High | 0.3% | 21 May, 2025 | Packagist drupal/lightgallery Packagist:https://packages.drupal.org/8 drupal/lightgallery |
Drupal Admin Audit Trail Allocation of Resources Without Limits or Throttling vulnerability CVE-2025-48448, DRUPAL-CONTRIB-2025-068, GHSA-pwj7-5c7c-mwjc | High | 0.3% | 21 May, 2025 | Packagist drupal/admin_audit_trail Packagist:https://packages.drupal.org/8 drupal/admin_audit_trail |
Drupal Commerce Alphabank Redirect Incorrect Authorization vulnerability CVE-2025-48446, DRUPAL-CONTRIB-2025-067, GHSA-48wx-8736-jgx2 | High | 0.3% | 21 May, 2025 | Packagist drupal/commerce_alphabank_redirect Packagist:https://packages.drupal.org/8 drupal/commerce_alphabank_redirect |
Drupal Commerce Eurobank (Redirect) Incorrect Authorization vulnerability CVE-2025-48445, DRUPAL-CONTRIB-2025-066, GHSA-q9h3-r6wr-p3j3 | High | 0.3% | 21 May, 2025 | Packagist drupal/commerce_eurobank_redirect Packagist:https://packages.drupal.org/8 drupal/commerce_eurobank_redirect |
reint_downloadmanager TYPO3 Extension is susceptible to Insecure Direct Object Reference CVE-2025-48207, GHSA-jjwh-4x89-7f5w | High | 0.4% | 21 May, 2025 | Packagist renolit/reint-downloadmanager |
The Front End User Registration extension for TYPO3 (sr_feuser_register) allows Insecure Direct Object Reference CVE-2025-48205, GHSA-cvgc-mx2w-h3w8 | High | 0.4% | 21 May, 2025 | Packagist sjbr/sr-feuser-register |
The Backup Plus extension for TYPO3 (ns_backup) has a Predictable Resource Location CVE-2025-48201, GHSA-hq4f-5qjv-fwrg | High | 0.4% | 21 May, 2025 | Packagist nitsan/ns-backup |
The TYPO3 CMS Backend has Broken Authentication in Backend MFA CVE-2025-47941, GHSA-744g-7qm9-hjh9 | High | 0.5% | 20 May, 2025 | Packagist typo3/cms-backend |
TYPO3 Allows Privilege Escalation to System Maintainer CVE-2025-47940, GHSA-6frx-j292-c844 | High | 0.5% | 20 May, 2025 | Packagist typo3/cms-core |
OXID eShop May Display User Information CVE-2024-56526, GHSA-qqcr-9jfc-35c4 | High | 0.4% | 13 May, 2025 | Packagist oxid-esales/oxideshop-ce Packagist oxid-esales/oxideshop-metapackage-ce Packagist oxid-esales/smarty-component |
Easy!Appointments Denial of Service (DoS) CVE-2025-29448, GHSA-hcjv-982c-5f29 | High | 0.6% | 07 May, 2025 | Packagist alextselegidis/easyappointments |
Craft CMS Contains a Potential Remote Code Execution Vulnerability via Twig SSTI CVE-2025-46731, GHSA-7c58-g782-9j38 | High | 1.5% | 05 May, 2025 | Packagist craftcms/cms |
YesWiki Remote Code Execution via Arbitrary PHP File Write and Execution CVE-2025-46347, GHSA-88xg-v53p-fpvf | High | 1.0% | 29 Apr, 2025 | Packagist yeswiki/yeswiki |
YesWiki Vulnerable to Unauthenticated Reflected Cross-site Scripting CVE-2025-46349, GHSA-2f8p-qqx2-gwr2 | High | 0.6% | 29 Apr, 2025 | Packagist yeswiki/yeswiki |
Moodle has an authenticated remote code execution risk in the Moodle LMS EQUELLA repository BIT-moodle-2025-3642, CVE-2025-3642, GHSA-m367-445c-2xqr | High | 1.1% | 25 Apr, 2025 | Packagist moodle/moodle |
Moodle has an authenticated remote code execution risk in the Moodle LMS Dropbox repository BIT-moodle-2025-3641, CVE-2025-3641, GHSA-c8v6-vxhf-wcrr | High | 1.0% | 25 Apr, 2025 | Packagist moodle/moodle |
Moodle has a CSRF risk in Brickfield tool's analysis request action BIT-moodle-2025-3638, CVE-2025-3638, GHSA-m8qh-hx4c-h9hr | High | 0.3% | 25 Apr, 2025 | Packagist moodle/moodle |
Moodle allows unauthenticated REST API user data exposure BIT-moodle-2025-32044, CVE-2025-32044, GHSA-345q-9jmq-g9q4 | High | 0.5% | 25 Apr, 2025 | Packagist moodle/moodle |
ibexa/fieldtype-richtext allows access to external entities in XML GHSA-cj3w-g42v-wcj6 | High | Not scored | 10 Apr, 2025 | Packagist ibexa/fieldtype-richtext |
ezsystems/ezplatform-richtext allows access to external entities in XML GHSA-2jqj-5qv2-xvcg | High | Not scored | 10 Apr, 2025 | Packagist ezsystems/ezplatform-richtext |
Joomla CMS Multi-Factor Authentication Bypass BIT-joomla-2025-25227, CVE-2025-25227, GHSA-6423-85cc-8gf6 | High | 0.4% | 08 Apr, 2025 | Packagist joomla/joomla-cms |
Shopware Vulnerable to Blind SQL-injection in DAL aggregations CVE-2025-27892, GHSA-8g35-7rmw-7f59 | High | 12.9% | 08 Apr, 2025 | Packagist shopware/core Packagist shopware/platform |