Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
ALTCHA Proof-of-Work Vulnerable to Challenge Splicing and Replay CVE-2025-68113, GHSA-6gvq-jcmp-8959, GO-2025-4239, PYSEC-2026-1115 | Medium | 0.5% | 16 Dec, 2025 | Go github.com/altcha-org/altcha-lib-go Hex altcha Maven org.altcha:altcha Packagist altcha-org/altcha +3 more |
Grav is vulnerable to Stored XSS through authenticated user-edited content CVE-2025-66843, GHSA-mh85-44c2-3m97 | Medium | 0.2% | 15 Dec, 2025 | Packagist getgrav/grav |
alexusmai laravel-file-manager is vulnerable to Directory Traversal CVE-2025-65345, GHSA-rr44-8j7r-jg2q | Medium | 0.6% | 03 Dec, 2025 | Packagist alexusmai/laravel-file-manager |
FeehiCMS Has a Remote Code Execution via Unrestricted File Upload in Ad Management CVE-2025-65657, GHSA-mcxq-54f4-mmx5 | Medium | 0.4% | 02 Dec, 2025 | Packagist feehi/cms |
Grav CMS is vulnerable to Cross Site Scripting (XSS) in the page editor CVE-2025-65186, GHSA-cchq-397m-q2qm | Medium | 0.2% | 02 Dec, 2025 | Packagist getgrav/grav |
Grav Admin Plugin is vulnerable to Cross-Site Scripting (XSS) Stored endpoint `/admin/accounts/groups/[group]` parameter `data[readableName]` CVE-2025-66312, GHSA-rmw5-f87r-w988 | Medium | 0.2% | 01 Dec, 2025 | Packagist getgrav/grav |
Grav vulnerable to Cross-Site Scripting (XSS) Stored endpoint `/admin/pages/[page]` in Multiples parameters CVE-2025-66311, GHSA-mpjj-4688-3fxg | Medium | 0.2% | 01 Dec, 2025 | Packagist getgrav/grav |
Grav vulnerable to Cross-Site Scripting (XSS) Stored endpoint `/admin/pages/[page]` parameter `data[header][template]` in Advanced Tab CVE-2025-66310, GHSA-7g78-5g5g-mvfj | Medium | 0.2% | 01 Dec, 2025 | Packagist getgrav/grav |
Grav is vulnerable to Cross-Site Scripting (XSS) Reflected endpoint /admin/pages/[page], parameter data[header][content][items], located in the "Blog Config" tab CVE-2025-66309, GHSA-65mj-f7p4-wggq | Medium | 0.2% | 01 Dec, 2025 | Packagist getgrav/grav |
Grav Admin Plugin vulnerable to Cross-Site Scripting (XSS) Stored endpoint `/admin/config/site` parameter `data[taxonomies]` CVE-2025-66308, GHSA-gqxx-248x-g29f | Medium | 0.2% | 01 Dec, 2025 | Packagist getgrav/grav |
Grav Admin Plugin vulnerable to User Enumeration & Email Disclosure CVE-2025-66307, GHSA-q3qx-cp62-f6m7 | Medium | 0.3% | 01 Dec, 2025 | Packagist getgrav/grav |
Grav vulnerable to Information Disclosure via IDOR in Grav Admin Panel CVE-2025-66306, GHSA-4cwq-j7jv-qmwg | Medium | 0.3% | 01 Dec, 2025 | Packagist getgrav/grav |
Grav is vulnerable to a DOS on the admin panel CVE-2025-66303, GHSA-x62q-p736-3997 | Medium | 0.4% | 01 Dec, 2025 | Packagist getgrav/grav |
Grav vulnerable to Path Traversal allowing server files backup CVE-2025-66302, GHSA-j422-qmxp-hv94 | Medium | 0.5% | 01 Dec, 2025 | Packagist getgrav/grav |
Snipe-IT allows stored XSS via the Locations "Country" field CVE-2025-65622, GHSA-4g25-wj72-chxg | Medium | 0.2% | 01 Dec, 2025 | Packagist snipe/snipe-it |
Snipe-IT is vulnerable to stored cross-site scripting CVE-2025-65621, GHSA-fww5-m9wc-jcjc | Medium | 0.2% | 01 Dec, 2025 | Packagist snipe/snipe-it |
FeehiCMS fails to enforce server-side immutability CVE-2025-63523, GHSA-qgc9-p7cj-jvh6 | Medium | 0.3% | 01 Dec, 2025 | Packagist feehi/feehicms |
FeehiCMS is vulnerable to reverse tabnabbing CVE-2025-63522, GHSA-w756-rf26-7rmr | Medium | 0.2% | 01 Dec, 2025 | Packagist feehi/feehicms |
FeehiCMS is vulnerable to cross-site scripting via the id parameter of the User Update function CVE-2025-63520, GHSA-c2vx-rx6x-m9wj | Medium | 0.2% | 01 Dec, 2025 | Packagist feehi/feehicms |
REDAXO CMS is vulnerable to Reflected XSS in Mediapool Info Banner via args[types] CVE-2025-66026, GHSA-x6vr-q3vf-vqgq | Medium | 0.3% | 25 Nov, 2025 | Packagist redaxo/source |
Contao is vulnerable to cross-site scripting in templates CVE-2025-65961, GHSA-68q5-78xp-cwwc | Medium | 0.2% | 25 Nov, 2025 | Packagist contao/core-bundle |
Contao is vulnerable to remote code execution in template closures CVE-2025-65960, GHSA-98vj-mm79-v77r | Medium | 0.2% | 25 Nov, 2025 | Packagist contao/core-bundle |
REDAXO CMS is vulnerable to XSS through its module management component CVE-2025-64049, GHSA-vqc7-7fj4-3fm3 | Medium | 0.3% | 25 Nov, 2025 | Packagist redaxo/source |
Formwork CMS has Stored Cross-Site Scripting Vulnerebility in Blog Tags CVE-2025-65956, GHSA-7j46-f57w-76pj | Medium | 0.2% | 24 Nov, 2025 | Packagist getformwork/formwork |
Snipe-IT has Cross-site Scripting vulnerability in CSV import workflow CVE-2025-64027, GHSA-8x9v-8qgj-945x | Medium | 0.3% | 20 Nov, 2025 | Packagist snipe/snipe-it |
phppgadmin contains an incorrect access control vulnerability CVE-2025-60799, GHSA-r63p-v37q-g74c | Medium | 0.2% | 20 Nov, 2025 | Packagist phppgadmin/phppgadmin |
phppgadmin contains a SQL injection vulnerability CVE-2025-60798, GHSA-g6xh-wrpf-v6j6 | Medium | 0.3% | 20 Nov, 2025 | Packagist phppgadmin/phppgadmin |
phppgadmin contains a SQL injection vulnerability CVE-2025-60797, GHSA-927w-vq5c-8gc3 | Medium | 0.3% | 20 Nov, 2025 | Packagist phppgadmin/phppgadmin |
phppgadmin vulnerable to Cross-site Scripting CVE-2025-60796, GHSA-h369-cpjj-qfff | Medium | 0.3% | 20 Nov, 2025 | Packagist phppgadmin/phppgadmin |
MongoDB driver extension affected by mongoc_bulk_operation_t's read of invalid memory CVE-2025-12119, GHSA-mwcc-7vpp-xmv9 | Medium | 0.2% | 18 Nov, 2025 | Packagist mongodb/mongodb-extension |
LibreNMS is vulnerable to SQL Injection (Boolean-Based Blind) in hostname parameter in ajax_output.php endpoint CVE-2025-65093, GHSA-6pmj-xjxp-p8g9 | Medium | 3.9% | 18 Nov, 2025 | Packagist librenms/librenms |
LibreNMS vulnerable to Reflected Cross-Site Scripting (XSS) in endpoint `/maps/nodeimage` parameter `Image Name` CVE-2025-65013, GHSA-j8cq-7f6p-256x | Medium | 0.3% | 18 Nov, 2025 | Packagist librenms/librenms |
Backdrop CMS Host Header Injection vulnerability CVE-2025-63828, GHSA-ffpg-gm3h-4p5p | Medium | 0.2% | 18 Nov, 2025 | Packagist backdrop/backdrop |
Kirby CMS has cross-site scripting (XSS) in the changes dialog CVE-2025-65012, GHSA-84hf-8gh5-575j | Medium | 0.2% | 18 Nov, 2025 | Packagist getkirby/cms |
Shopware 6's password recovery link does not expire after email change GHSA-2w46-vq8h-98vh | Medium | Not scored | 14 Nov, 2025 | Packagist shopware/core |
PrivateBin's template-switching feature allows arbitrary local file inclusion through path traversal CVE-2025-64714, GHSA-g2j9-g8r5-rg82 | Medium | 0.5% | 13 Nov, 2025 | Packagist privatebin/privatebin |
PrivateBin vulnerable to malicious filename use for self-XSS / HTML injection locally for users CVE-2025-64711, GHSA-r9x7-7ggj-fx9f | Medium | 0.1% | 13 Nov, 2025 | Packagist privatebin/privatebin |
Drupal core allows Content Spoofing BIT-drupal-2025-13082, CVE-2025-13082, DRUPAL-CORE-2025-007, GHSA-h89p-5896-f4q8 | Medium | 0.2% | 12 Nov, 2025 | Packagist drupal/core |
Drupal core allows Object Injection BIT-drupal-2025-13081, CVE-2025-13081, DRUPAL-CORE-2025-006, GHSA-m6vv-vcj8-w8m7 | Medium | 0.3% | 12 Nov, 2025 | Packagist drupal/core |
Drupal core allows Forceful Browsing BIT-drupal-2025-13080, CVE-2025-13080, DRUPAL-CORE-2025-005, GHSA-83v7-c2cf-p9c2 | Medium | 0.3% | 12 Nov, 2025 | Packagist drupal/core |
Drupal Email TFA allows Functionality Bypass CVE-2025-12760, DRUPAL-CONTRIB-2025-115, GHSA-9jrw-jrrj-p6fr | Medium | 0.2% | 05 Nov, 2025 | Packagist drupal/email_tfa Packagist:https://packages.drupal.org/8 drupal/email_tfa |
OpenMage vulnerable to XSS in Admin Notifications CVE-2025-64174, GHSA-qv78-c8hc-438r | Medium | 0.2% | 03 Nov, 2025 | Packagist openmage/magento-lts |
MantisBT unauthorized disclosure of private project column configuration CVE-2025-62520, GHSA-g582-8vwr-68h2 | Medium | 0.3% | 03 Nov, 2025 | Packagist mantisbt/mantisbt |
MantisBT lacks verification when changing a user's email address CVE-2025-55155, GHSA-q747-c74m-69pr | Medium | 0.2% | 03 Nov, 2025 | Packagist mantisbt/mantisbt |
Sharp user-provided input can be evaluated in a SharpShowTextField with Vue template syntax CVE-2025-62798, GHSA-9f58-4465-23c7 | Medium | 0.2% | 28 Oct, 2025 | Packagist code16/sharp |
PrivateBin is missing HTML sanitization of attached filename in file size hint CVE-2025-62796, GHSA-867c-p784-5q6g | Medium | 0.3% | 28 Oct, 2025 | Packagist privatebin/privatebin |
Moodle has a time restriction bypass BIT-moodle-2025-62401, CVE-2025-62401, GHSA-w29j-8phw-ffjf | Medium | 0.2% | 23 Oct, 2025 | Packagist moodle/moodle |
Moodle exposed the names of hidden groups to users BIT-moodle-2025-62400, CVE-2025-62400, GHSA-422v-w6c5-vq42 | Medium | 0.3% | 23 Oct, 2025 | Packagist moodle/moodle |
Moodle does not properly enforce MFA BIT-moodle-2025-62398, CVE-2025-62398, GHSA-25wf-7x6c-wmpf | Medium | 0.2% | 23 Oct, 2025 | Packagist moodle/moodle |
Moodle's error handling leads to sensitive information disclosure BIT-moodle-2025-62396, CVE-2025-62396, GHSA-c5cj-xp43-qcc3 | Medium | 0.3% | 23 Oct, 2025 | Packagist moodle/moodle |