Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Shopware allows Denial Of Service via password length CVE-2025-30151, GHSA-cgfj-hj93-rmh2 | High | 0.4% | 08 Apr, 2025 | Packagist shopware/core Packagist shopware/platform |
Browsershot Server-Side Request Forgery (SSRF) via setURL() Function CVE-2025-3192, GHSA-qw64-6vcc-8ghx | High | 0.4% | 04 Apr, 2025 | Packagist spatie/browsershot |
GraphQL grant on a property might be cached with different objects CVE-2025-31485, GHSA-428q-q3vv-3fq3 | High | 0.6% | 03 Apr, 2025 | Packagist api-platform/core Packagist api-platform/graphql |
GraphQL query operations security can be bypassed CVE-2025-31481, GHSA-cg3c-245w-728m | High | 0.5% | 03 Apr, 2025 | Packagist api-platform/core Packagist api-platform/graphql |
Yeswiki Path Traversal vulnerability allows arbitrary read of files CVE-2025-31131, GHSA-w34w-fvp3-68xm | High | 5.6% | 01 Apr, 2025 | Packagist yeswiki/yeswiki |
TastyIgniter Has an Incorrect Access Control Vulnerability via `invoice()` Function CVE-2024-44313, GHSA-gg2f-r4jh-vpmh | High | 0.7% | 18 Mar, 2025 | Packagist tastyigniter/tastyigniter |
Froxlor allows Multiple Accounts to Share the Same Email Address Leading to Potential Privilege Escalation or Account Takeover CVE-2025-29773, GHSA-7j6w-p859-464f | High | 0.3% | 11 Mar, 2025 | Packagist froxlor/froxlor |
The SimpleSAMLphp SAML2 library incorrectly verifies signatures for HTTP-Redirect binding CVE-2025-27773, GHSA-46r4-f8gj-xg56 | High | 0.4% | 11 Mar, 2025 | Packagist simplesamlphp/saml2 Packagist simplesamlphp/saml2-legacy |
Drupal Two-factor Authentication (TFA) Vulnerable to Forceful Browsing CVE-2025-31694, DRUPAL-CONTRIB-2025-023, GHSA-hf6c-fgp3-jfch | High | 0.4% | 05 Mar, 2025 | Packagist drupal/tfa Packagist:https://packages.drupal.org/8 drupal/tfa |
Drupal AI Vulnerable to OS Command Injection via Optional Automator Types CVE-2025-31692, DRUPAL-CONTRIB-2025-021, GHSA-pwjq-fx3v-8f9r | High | 0.8% | 05 Mar, 2025 | Packagist drupal/ai Packagist:https://packages.drupal.org/8 drupal/ai |
Formwork improperly validates input of User role preventing site and panel availability GHSA-c85w-x26q-ch87 | High | Not scored | 01 Mar, 2025 | Packagist getformwork/formwork |
Drupal Cache Utility Cross-Site Request Forgery (CSRF) vulnerability CVE-2025-31690, DRUPAL-CONTRIB-2025-019, GHSA-ccc9-jgj7-hxc7 | High | 0.2% | 26 Feb, 2025 | Packagist drupal/cache_utility Packagist:https://packages.drupal.org/8 drupal/cache_utility |
Drupal General Data Protection Regulation Cross-Site Request Forgery (CSRF) vulnerability CVE-2025-31689, DRUPAL-CONTRIB-2025-018, GHSA-jv6r-mj9p-9xff | High | 0.2% | 26 Feb, 2025 | Packagist drupal/gdpr Packagist:https://packages.drupal.org/8 drupal/gdpr |
Mautic allows Improper Authorization in Reporting API CVE-2024-47053, GHSA-8xv7-g2q3-fqgc | High | 0.7% | 26 Feb, 2025 | Packagist mautic/core |
Moodle allows reflected XSS via question bank filter BIT-moodle-2025-26530, CVE-2025-26530, GHSA-4w32-c9g7-27qx | High | 0.4% | 24 Feb, 2025 | Packagist moodle/moodle |
Moodle has a stored XSS risk in admin live log BIT-moodle-2025-26529, CVE-2025-26529, GHSA-wr88-x8cm-7cgq | High | 0.5% | 24 Feb, 2025 | Packagist moodle/moodle |
Moodle has an arbitrary file read risk through pdfTeX BIT-moodle-2025-26525, CVE-2025-26525, GHSA-4hmr-39vp-xfrr | High | 0.4% | 24 Feb, 2025 | Packagist moodle/moodle |
Leantime allows Stored Cross-Site Scripting (XSS) GHSA-c39w-3pjx-qc7m | High | Not scored | 21 Feb, 2025 | Packagist leantime/leantime |
Leantime allows Cross Site Scripting (XSS) and SQL Injection (SQLi) GHSA-v4q9-437p-mhpg | High | Not scored | 21 Feb, 2025 | Packagist leantime/leantime |
Drupal Core Improperly Controlled Modification of Dynamically-Determined Object Attributes Vulnerability BIT-drupal-2025-31674, CVE-2025-31674, DRUPAL-CORE-2025-003, GHSA-2qph-q8xw-gv7q | High | 0.6% | 19 Feb, 2025 | Packagist drupal/core |
Drupal Open Social Missing Authorization vulnerability CVE-2025-31686, DRUPAL-CONTRIB-2025-015, GHSA-m9w8-wxvp-c9gv | High | 0.4% | 12 Feb, 2025 | Packagist goalgorilla/open_social Packagist:https://packages.drupal.org/8 drupal/social |
Magento stored Cross-Site Scripting (XSS) vulnerability CVE-2025-24438, GHSA-8884-7rm9-mrx4 | High | 0.8% | 11 Feb, 2025 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento Stored Cross-Site Scripting (XSS) Vulnerability CVE-2025-24417, GHSA-g3j6-9753-8mp2 | High | 0.7% | 11 Feb, 2025 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento Stored Cross-Site Scripting (XSS) Vulnerability CVE-2025-24416, GHSA-rjjw-g6hw-7pc9 | High | 0.7% | 11 Feb, 2025 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento Stored Cross-Site Scripting (XSS) Vulnerability CVE-2025-24415, GHSA-gc27-rvvm-q77r | High | 0.7% | 11 Feb, 2025 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento Stored Cross-Site Scripting (XSS) Vulnerability CVE-2025-24414, GHSA-fhw6-3mj5-w9gv | High | 0.7% | 11 Feb, 2025 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento Stored Cross-Site Scripting (XSS) Vulnerability CVE-2025-24413, GHSA-xwgx-8v72-4j5j | High | 0.7% | 11 Feb, 2025 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento Stored Cross-Site Scripting (XSS) Vulnerability CVE-2025-24412, GHSA-m4rg-mpp2-97px | High | 0.7% | 11 Feb, 2025 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento Improper Access Control vulnerability CVE-2025-24411, GHSA-36hw-x3cc-m258 | High | 0.9% | 11 Feb, 2025 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento Stored Cross-Site Scripting (XSS) Vulnerability CVE-2025-24410, GHSA-gjxp-46rq-wg4q | High | 0.7% | 11 Feb, 2025 | Packagist magento/community-edition Packagist magento/project-community-edition |
Adobe Commerce Improper Authorization vulnerability CVE-2025-24409, GHSA-vw47-79jv-3598 | High | 0.7% | 11 Feb, 2025 | Packagist magento/community-edition Packagist magento/project-community-edition |
Adobe Commerce Path Traversal CVE-2025-24406, GHSA-954p-ff72-327w | High | 1.4% | 11 Feb, 2025 | Packagist magento/community-edition Packagist magento/project-community-edition |
Connect-CMS information that is restricted to viewing is visible GHSA-2237-5r9w-vm8j | High | Not scored | 07 Feb, 2025 | Packagist opensource-workshop/connect-cms |
Withdrawn Advisory: Sylius allows unrestricted brute-force attacks on user accounts CVE-2024-57610, GHSA-2hjh-495w-hmxc | High | 1.2% | 06 Feb, 2025 | Packagist sylius/sylius |
Cockpit Arbitrary File Upload CVE-2025-1025, GHSA-wp68-xrfg-xvq4 | High | 18.9% | 05 Feb, 2025 | Packagist cockpit-hq/cockpit |
Browsershot Path Traversal CVE-2025-1022, GHSA-j2gw-r24m-j2qw | High | 0.5% | 05 Feb, 2025 | Packagist spatie/browsershot |
DevDojo Voyager vulnerable to path traversal CVE-2024-55415, GHSA-j63m-2vr6-fv7m | High | 15.7% | 30 Jan, 2025 | Packagist tcg/voyager |
Pimcore Authenticated Stored Cross-Site Scripting (XSS) Via Search Document CVE-2024-11954, GHSA-xr3m-6gq6-22cg | High | 1.1% | 28 Jan, 2025 | Packagist pimcore/pimcore |
Drupal AI Missing Authorization vulnerability CVE-2025-31678, DRUPAL-CONTRIB-2025-004, GHSA-c8q6-wp7v-46r9 | High | 0.4% | 22 Jan, 2025 | Packagist drupal/ai Packagist:https://packages.drupal.org/8 drupal/ai |
Authenticated arbitrary file deletion in YesWiki CVE-2025-24019, GHSA-43c9-gw4x-pcx6 | High | 0.6% | 21 Jan, 2025 | Packagist yeswiki/yeswiki |
Authenticated Stored XSS in YesWiki CVE-2025-24018, GHSA-w59h-3x3q-3p6j | High | 0.4% | 21 Jan, 2025 | Packagist yeswiki/yeswiki |
Unauthenticated DOM Based XSS in YesWiki CVE-2025-24017, GHSA-wphc-5f2j-jhvg | High | 0.4% | 21 Jan, 2025 | Packagist yeswiki/yeswiki |
Craft CMS has a potential RCE with a compromised security key CVE-2025-23209, GHSA-x684-96hh-833x | HighExploited | 21.6% | 18 Jan, 2025 | Packagist craftcms/cms |
Drupal AI Cross-Site Request Forgery (CSRF) vulnerability CVE-2025-31677, DRUPAL-CONTRIB-2025-003, GHSA-9w85-x5hg-fr66 | High | 0.2% | 15 Jan, 2025 | Packagist drupal/ai Packagist:https://packages.drupal.org/8 drupal/ai |
TYPO3 Scheduler Module vulnerable to Cross-Site Request Forgery CVE-2024-55924, GHSA-7835-fcv3-g256 | High | 0.3% | 14 Jan, 2025 | Packagist typo3/cms-scheduler |
TYPO3 Extension Manager Module vulnerable to Cross-Site Request Forgery CVE-2024-55921, GHSA-4g52-pq8j-6qv5 | High | 0.4% | 14 Jan, 2025 | Packagist typo3/cms-extensionmanager |
PHP-Textile has persistent XSS vulnerability in image link handling GHSA-95m2-chm4-mq7m | High | Not scored | 07 Jan, 2025 | Packagist netcarver/textile |
Extension:TabberNeue vulnerable to Cross-site Scripting CVE-2025-21612, GHSA-4x6x-8rm8-c37j | High | 0.5% | 06 Jan, 2025 | Packagist starcitizentools/tabber-neue |
PhpSpreadsheet allows unauthorized Reflected XSS in Currency.php file CVE-2024-56409, GHSA-j2xg-cjcx-4677 | High | 0.3% | 03 Jan, 2025 | Packagist phpoffice/phpexcel Packagist phpoffice/phpspreadsheet |
PhpSpreadsheet allows unauthorized Reflected XSS in the Accounting.php file CVE-2024-56366, GHSA-c6fv-7vh8-2rhr | High | 0.3% | 03 Jan, 2025 | Packagist phpoffice/phpexcel Packagist phpoffice/phpspreadsheet |