Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
PhpSpreadsheet allows unauthorized Reflected XSS in the constructor of the Downloader class CVE-2024-56365, GHSA-jmpx-686v-c3wx | High | 0.3% | 03 Jan, 2025 | Packagist phpoffice/phpexcel Packagist phpoffice/phpspreadsheet |
PhpSpreadsheet allows unauthorized Reflected XSS in `Convert-Online.php` file CVE-2024-56408, GHSA-x88g-h956-m5xg | High | 0.4% | 03 Jan, 2025 | Packagist phpoffice/phpexcel Packagist phpoffice/phpspreadsheet |
phpMyFAQ Vulnerable to Stored HTML Injection at FAQ CVE-2024-56199, GHSA-ww33-jppq-qfrp | High | 0.4% | 02 Jan, 2025 | Packagist phpmyfaq/phpmyfaq Packagist thorsten/phpmyfaq |
TCPDF missing character escape on error messages CVE-2024-56527, GHSA-qx95-cwh6-9mvq | High | 0.8% | 27 Dec, 2024 | Packagist tecnickcom/tcpdf |
TCPDF has incorrect comparison CVE-2024-56522, GHSA-w95c-7994-ghpr | High | 0.6% | 27 Dec, 2024 | Packagist tecnickcom/tcpdf |
tecnickcom/tc-lib-pdf-font mishandles fonts CVE-2024-56520, GHSA-grhh-r4jj-8jh7 | High | 0.6% | 27 Dec, 2024 | Packagist tecnickcom/tc-lib-pdf-font |
TCPDF lacks SVG sanitization CVE-2024-56519, GHSA-4p8j-vhjm-6pvw | High | 0.6% | 27 Dec, 2024 | Packagist tecnickcom/tcpdf |
lgsl Stored Cross-Site Scripting vulnerability CVE-2024-56361, GHSA-xx95-62h6-h7v3 | High | 0.5% | 26 Dec, 2024 | Packagist tltneon/lgsl |
Socialstream has a Potential Account Takeover Vulnerability in Social Account Linking Due to Missing User Consent After OAuth Callback CVE-2024-56329, GHSA-3q97-vjpp-c8rp | High | 0.6% | 20 Dec, 2024 | Packagist joelbutcher/socialstream |
Spatie Browsershot Directory Traversal vulnerability CVE-2024-21547, GHSA-v528-6rq9-h6gw | High | 0.9% | 18 Dec, 2024 | Packagist spatie/browsershot |
UniSharp Laravel Filemanager Code Injection vulnerability CVE-2024-21546, GHSA-6569-3785-r3v6 | High | 1.3% | 18 Dec, 2024 | Packagist unisharp/laravel-filemanager |
Laravel Pulse Allows Remote Code Execution via Unprotected Query Method CVE-2024-55661, GHSA-8vwh-pr89-4mw2 | High | 30.6% | 13 Dec, 2024 | Packagist laravel/pulse |
thorsten/phpmyfaq Unintended File Download Triggered by Embedded Frames CVE-2024-55889, GHSA-m3r7-8gw7-qwvc | High | 2.2% | 13 Dec, 2024 | Packagist thorsten/phpmyfaq |
league/commonmark's quadratic complexity bugs may lead to a denial of service CVE-2024-58382, GHSA-c2pc-g5qf-rfrf | High | 0.5% | 09 Dec, 2024 | Packagist league/commonmark |
Winter CMS Modules allows a sandbox bypass in Twig templates leading to data modification and deletion CVE-2024-54149, GHSA-xhw3-4j3m-hq53 | High | 0.4% | 09 Dec, 2024 | Packagist winter/wn-cms-module |
phpMyFAQ Generates an Error Message Containing Sensitive Information if database server is not available CVE-2024-54141, GHSA-vrjr-p3xp-xx2x | High | 0.5% | 06 Dec, 2024 | Packagist thorsten/phpmyfaq |
SimpleSAMLphp SAML2 has an XXE in parsing SAML messages CVE-2024-52806, GHSA-pxm4-r5ph-q2m2 | High | 0.4% | 02 Dec, 2024 | Packagist simplesamlphp/saml2 Packagist simplesamlphp/saml2-legacy |
SimpleSAMLphp xml-common XXE vulnerability CVE-2024-52596, GHSA-2x65-fpch-2fcm | High | 1.0% | 02 Dec, 2024 | Packagist simplesamlphp/xml-common |
Withdrawn Advisory: Symfony http-security has authentication bypass CVE-2024-36611, GHSA-7q22-x757-cmgc | High | 0.8% | 29 Nov, 2024 | Packagist symfony/security-http |
SPEmailHandler-PHP has Potential Abuse for Sending Arbitrary Emails CVE-2024-53860, GHSA-mj5r-x73q-fjw6 | High | 0.5% | 27 Nov, 2024 | Packagist spencer14420/sp-php-email-handler |
Drupal core Access bypass BIT-drupal-2024-55634, CVE-2024-55634, DRUPAL-CORE-2024-004, GHSA-7cwc-fjqm-8vh8 | High | 0.4% | 20 Nov, 2024 | Packagist drupal/core Packagist drupal/core-recommended Packagist drupal/drupal |
Moodle IDOR when deleting OAuth2 linked accounts BIT-moodle-2024-45690, CVE-2024-45690, GHSA-fhg2-r2h9-h7q8 | High | 0.4% | 20 Nov, 2024 | Packagist moodle/moodle |
XXE in PHPSpreadsheet's XLSX reader CVE-2024-48917, GHSA-7cc9-j4mv-vcjp | High | 0.7% | 18 Nov, 2024 | Packagist phpoffice/phpexcel Packagist phpoffice/phpspreadsheet |
XmlScanner bypass leads to XXE CVE-2024-47873, GHSA-jw4x-v69f-hh5w | High | 0.8% | 18 Nov, 2024 | Packagist phpoffice/phpexcel Packagist phpoffice/phpspreadsheet |
LibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/includes/html/pages/device/services.inc.php CVE-2024-52526, GHSA-8fh4-942r-jf2g | High | 0.5% | 15 Nov, 2024 | Packagist librenms/librenms |
LibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/includes/html/print-customoid.php CVE-2024-51497, GHSA-gv4m-f6fx-859x | High | 0.4% | 15 Nov, 2024 | Packagist librenms/librenms |
LibreNMS has a Reflected XSS ('Cross-site Scripting') in librenms/includes/html/pages/wireless.inc.php CVE-2024-51496, GHSA-28p7-f6h6-3jh3 | High | 0.4% | 15 Nov, 2024 | Packagist librenms/librenms |
LibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/includes/html/dev-overview-data.inc.php CVE-2024-51495, GHSA-p66q-ppwr-q5j8 | High | 0.4% | 15 Nov, 2024 | Packagist librenms/librenms |
LibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/app/Http/Controllers/Table/EditPortsController.php CVE-2024-51494, GHSA-7663-37rg-c377 | High | 0.4% | 15 Nov, 2024 | Packagist librenms/librenms |
LibreNMS has a Persistent XSS from Insecure Input Sanitization Affects Multiple Endpoints CVE-2024-50355, GHSA-4m5r-w2rq-q54q | High | 0.3% | 15 Nov, 2024 | Packagist librenms/librenms |
LibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/includes/html/pages/device/overview/services.inc.php CVE-2024-50352, GHSA-qr8f-5qqg-j3wg | High | 41.4% | 15 Nov, 2024 | Packagist librenms/librenms |
LibreNMS has a Reflected XSS ('Cross-site Scripting') in librenms/includes/functions.php CVE-2024-50351, GHSA-v7w9-63xh-6r3w | High | 0.4% | 15 Nov, 2024 | Packagist librenms/librenms |
LibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/app/Http/Controllers/Table/EditPortsController.php CVE-2024-50350, GHSA-xh4g-c9p6-5jxg | High | 0.4% | 15 Nov, 2024 | Packagist librenms/librenms |
LibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/includes/html/pages/device/capture.inc.php CVE-2024-49764, GHSA-rmr4-x6c9-jc68 | High | 0.4% | 15 Nov, 2024 | Packagist librenms/librenms |
Stored XSS ('Cross-site Scripting') in librenms/includes/html/pages/edituser.inc.php CVE-2024-49759, GHSA-888j-pjqh-fx58 | High | 0.4% | 15 Nov, 2024 | Packagist librenms/librenms |
LibreNMS has a stored XSS ('Cross-site Scripting') in librenms/includes/html/pages/api-access.inc.php CVE-2024-49754, GHSA-gfwr-xqmj-j27v | High | 73.9% | 15 Nov, 2024 | Packagist librenms/librenms |
Symfony has an Authentication Bypass via RememberMe CVE-2024-51996, GHSA-cg23-qf8f-62rr | High | 0.6% | 13 Nov, 2024 | Packagist symfony/security-http |
Craft CMS vulnerable to Potential Remote Code Execution via missing path normalization & Twig SSTI CVE-2024-52293, GHSA-f3cw-hg6r-chfv | High | 1.4% | 13 Nov, 2024 | Packagist craftcms/cms |
Craft CMS Arbitrary System File Read CVE-2024-52292, GHSA-cw6g-qmjq-6w2w | High | 0.7% | 13 Nov, 2024 | Packagist craftcms/cms |
Local File System Validation Bypass Leading to File Overwrite, Sensitive File Access, and Potential Code Execution CVE-2024-52291, GHSA-jrh5-vhr9-qh7q | High | 1.3% | 13 Nov, 2024 | Packagist craftcms/cms |
Cross Site Scripting vulnerability in Snipe-IT CVE-2024-51093, GHSA-hw9x-8m75-4vjq | High | 0.4% | 12 Nov, 2024 | Packagist snipe/snipe-it |
Laravel environment manipulation via query string BIT-laravel-2024-52301, CVE-2024-52301, GHSA-gv7v-rgg6-548h | High | 44.8% | 12 Nov, 2024 | Packagist laravel/framework |
PHPExcel XXE Vulnerability CVE-2015-3542, GHSA-3m9x-2qfj-xvq4 | High | Not scored | 07 Nov, 2024 | Packagist phpoffice/phpexcel |
Moodle LFI vulnerability when restoring malformed block backups BIT-moodle-2024-43440, CVE-2024-43440, GHSA-qrqv-26gf-xgwh | High | 0.6% | 07 Nov, 2024 | Packagist moodle/moodle |
Moodle's IDOR in Feedback non-respondents report allows messaging arbitrary site users BIT-moodle-2024-43438, CVE-2024-43438, GHSA-p9cx-f595-h79h | High | 0.5% | 07 Nov, 2024 | Packagist moodle/moodle |
Moodle vulnerable to site administration SQL injection via XMLDB editor BIT-moodle-2024-43436, CVE-2024-43436, GHSA-mx26-62xm-2p83 | High | 0.8% | 07 Nov, 2024 | Packagist moodle/moodle |
Moodle has CSRF risk in Feedback non-respondents report BIT-moodle-2024-43434, CVE-2024-43434, GHSA-x87r-37q5-mmr8 | High | 0.6% | 07 Nov, 2024 | Packagist moodle/moodle |
Moodle's IDOR in badges allows deletion of arbitrary badges BIT-moodle-2024-43431, CVE-2024-43431, GHSA-wwjf-gwrv-wh45 | High | 0.5% | 07 Nov, 2024 | Packagist moodle/moodle |
Moodle vulnerable to cache poisoning via injection into storage BIT-moodle-2024-43428, CVE-2024-43428, GHSA-2r9m-wg35-rfvc | High | 0.2% | 07 Nov, 2024 | Packagist moodle/moodle |
Moodle has arbitrary file read risk through pdfTeX BIT-moodle-2024-43426, CVE-2024-43426, GHSA-vjmm-r9gg-425m | High | 0.7% | 07 Nov, 2024 | Packagist moodle/moodle |