Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Moodle sends quiz-related messages to inactive/suspended users BIT-moodle-2025-62394, CVE-2025-62394, GHSA-8fcv-4qp9-pg32 | Medium | 0.2% | 23 Oct, 2025 | Packagist moodle/moodle |
Moodle course access permissions are not properly checked in course_output_fragment_course_overview BIT-moodle-2025-62393, CVE-2025-62393, GHSA-rjcm-7v2p-9265 | Medium | 0.2% | 23 Oct, 2025 | Packagist moodle/moodle |
Drupal CivicTheme Design System allows Cross-Site Scripting (XSS) CVE-2025-12083, DRUPAL-CONTRIB-2025-113, GHSA-h72q-cq3w-h3wc | Medium | 0.2% | 22 Oct, 2025 | Packagist drupal/civictheme Packagist:https://packages.drupal.org/8 drupal/civictheme |
code16 Sharp vulnerable to Cross Site Scripting (XSS) CVE-2025-61457, GHSA-9778-v769-qvjf | Medium | 0.3% | 21 Oct, 2025 | Packagist code16/sharp |
ProcessWire CMS vulnerable to resource-exhaustion Denial of Service CVE-2025-60790, GHSA-9p44-q66p-xm6p | Medium | 0.4% | 21 Oct, 2025 | Packagist processwire/processwire |
Shopware Customer Orders can be canceled, even if refunds are disabled GHSA-r2vg-hvjm-fg38 | Medium | Not scored | 21 Oct, 2025 | Packagist shopware/core Packagist shopware/platform |
Shopware exposes sensitive user information via CSV export mapping GHSA-27c9-vp3w-6ww8 | Medium | Not scored | 21 Oct, 2025 | Packagist shopware/core Packagist shopware/platform |
Shopware vulnerable to MediaVisibilityRestrictionSubscriber bypass when reading media entities by aggregating fields individually GHSA-m895-2hj3-8cg9 | Medium | Not scored | 21 Oct, 2025 | Packagist shopware/core Packagist shopware/platform |
Cargo Mediawiki Extension vulnerable to Cross-site Scripting CVE-2025-62671, GHSA-gr6v-3pmp-996p | Medium | 0.5% | 18 Oct, 2025 | Packagist mediawiki/cargo |
Citizen vulnerable to stored XSS in sticky header button messages CVE-2025-62508, GHSA-g955-vw6w-v6pp | Medium | 0.4% | 17 Oct, 2025 | Packagist starcitizentools/citizen-skin |
ibexa/fieldtype-richtext has an XSS vulnerability via acronym custom tag in Rich Text GHSA-8c2g-f8jm-5cr7 | Medium | Not scored | 17 Oct, 2025 | Packagist ibexa/fieldtype-richtext |
ibexa/admin-ui has an XSS vulnerability in Cancel/Reschedule future publication modal GHSA-2mx6-fq24-g2mh | Medium | Not scored | 17 Oct, 2025 | Packagist ibexa/admin-ui |
ezsystems/ezplatform-admin-ui has an XSS vulnerability in Cancel/Reschedule future publication modal GHSA-99c7-c3mw-mxhv | Medium | Not scored | 17 Oct, 2025 | Packagist ezsystems/ezplatform-admin-ui |
ibexa/user login enumerates user accounts GHSA-q3x8-6898-23g3 | Medium | Not scored | 17 Oct, 2025 | Packagist ibexa/user |
bagisto has a Cross Site Scripting (XSS) vulnerability in TinyMCE Image Upload (SVG) CVE-2025-62418, GHSA-fg89-g389-p346 | Medium | 0.3% | 16 Oct, 2025 | Packagist bagisto/bagisto |
bagisto has Server Side Template Injection (SSTI) in Product Description CVE-2025-62416, GHSA-527q-4wqv-g9wj | Medium | 0.4% | 16 Oct, 2025 | Packagist bagisto/bagisto |
bagisto has Cross Site Scripting (XSS) in Create New Customer CVE-2025-62414, GHSA-r9xj-mvqf-jm7w | Medium | 0.3% | 16 Oct, 2025 | Packagist bagisto/bagisto |
LibreNMS alert-rules has a Cross-Site Scripting Vulnerability CVE-2025-62412, GHSA-6g2v-66ch-6xmh | Medium | 0.3% | 16 Oct, 2025 | Packagist librenms/librenms |
PrestaShop Checkout Backoffice directory traversal allows arbitrary file disclosure CVE-2025-61923, GHSA-fpxp-pfqm-x54w | Medium | 0.9% | 16 Oct, 2025 | Packagist prestashop/ps_checkout |
bagisto has Cross Site Scripting (XSS) issue in TinyMCE Image Upload (HTML) CVE-2025-62415, GHSA-67px-r26w-598x | Medium | 0.3% | 16 Oct, 2025 | Packagist bagisto/bagisto |
LibreNMS has a Stored XSS vulnerability in its Alert Transport name field CVE-2025-62411, GHSA-frc6-pwgr-c28w | Medium | 12.7% | 16 Oct, 2025 | Packagist librenms/librenms |
Magento vulnerable to privilege escalation due to incorrect authorization CVE-2025-54267, GHSA-qvwr-p3hj-j6jf | Medium | 0.4% | 14 Oct, 2025 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento vulnerable to stored Cross-Site Scripting (XSS) CVE-2025-54266, GHSA-pcrx-r49h-x2w5 | Medium | 0.3% | 14 Oct, 2025 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento allows incorrect authorization CVE-2025-54265, GHSA-r355-75hw-r8jf | Medium | 0.6% | 14 Oct, 2025 | Packagist magento/community-edition Packagist magento/project-community-edition |
LibreNMS is vulnerable to Reflected-XSS in `report_this` function CVE-2025-62365, GHSA-86rg-8hc8-v82p | Medium | 0.2% | 13 Oct, 2025 | Packagist librenms/librenms |
Alt Redirect: Potential Authentication Bypass by Spoofing through query-string stripping logic flaw CVE-2025-60868, GHSA-rpjr-pcmr-9ppw | Medium | 0.2% | 10 Oct, 2025 | Packagist alt-design/alt-redirect |
VaahCMS is vulnerable to XSS through its Avatar Upload endpoint CVE-2025-61183, GHSA-q769-phqg-263r | Medium | 0.3% | 08 Oct, 2025 | Packagist webreinvent/vaahcms |
Joomla! CMS vulnerable to XSS via the input filter CVE-2025-54476, GHSA-fm22-g2q9-j3pw | Medium | 0.3% | 30 Sep, 2025 | Packagist joomla/filter |
Drupal Reverse Proxy Header allows Manipulating User-Controlled Variables CVE-2025-10929, DRUPAL-CONTRIB-2025-111, GHSA-fg8x-q69g-4qp3 | Medium | 0.3% | 24 Sep, 2025 | Packagist drupal/reverse_proxy_header Packagist:https://packages.drupal.org/8 drupal/reverse_proxy_header |
Drupal Currency allows Cross Site Request Forgery CVE-2025-10930, DRUPAL-CONTRIB-2025-110, GHSA-27fv-rpgj-4c6m | Medium | 0.1% | 24 Sep, 2025 | Packagist drupal/currency Packagist:https://packages.drupal.org/8 drupal/currency |
Drupal Access code allows Brute Force Attempts CVE-2025-10928, DRUPAL-CONTRIB-2025-108, GHSA-27mc-9399-r9mx | Medium | 0.2% | 24 Sep, 2025 | Packagist drupal/access_code Packagist:https://packages.drupal.org/8 drupal/access_code |
Drupal Plausible tracking is vulnerable to XSS CVE-2025-10927, DRUPAL-CONTRIB-2025-107, GHSA-pr6m-qwrr-mrw9 | Medium | 0.2% | 24 Sep, 2025 | Packagist drupal/plausible_tracking Packagist:https://packages.drupal.org/8 drupal/plausible_tracking |
Drupal JSON Field is vulnerable to XSS CVE-2025-10926, DRUPAL-CONTRIB-2025-106, GHSA-m3f2-xjgc-2wp2 | Medium | 0.2% | 24 Sep, 2025 | Packagist drupal/json_field Packagist:https://packages.drupal.org/8 drupal/json_field |
GP247 and S-Cart have a stored cross-site scripting (XSS) vulnerability CVE-2025-57407, GHSA-46v4-5mc8-q2cf | Medium | 0.2% | 23 Sep, 2025 | Packagist gp247/core Packagist s-cart/core |
Snipe-IT allows XSS CVE-2025-59712, GHSA-c9wp-pr7f-hfqm | Medium | 0.3% | 19 Sep, 2025 | Packagist snipe/snipe-it |
Open Web Analytics Server is vulnerable to SQL Injection CVE-2025-59397, GHSA-6w8r-xgqq-qg6g | Medium | 0.4% | 15 Sep, 2025 | Packagist open-web-analytics/open-web-analytics |
Subrion CMS: Authenticated administrators are able to gain escalated access through Run SQL Query tool CVE-2025-56556, GHSA-h8wv-vv58-468h | Medium | 0.2% | 11 Sep, 2025 | Packagist intelliants/subrion |
TinyEnv: Inline comments not stripped properly in .env values CVE-2025-58759, GHSA-72cm-7236-h43r | Medium | 0.2% | 09 Sep, 2025 | Packagist datahihi1/tiny-env |
YesWiki Cross Site Scripting vulnerability CVE-2025-52277, GHSA-29cj-cxw4-v4j2 | Medium | 0.4% | 09 Sep, 2025 | Packagist yeswiki/yeswiki |
TYPO3 CSV download feature information disclosure CVE-2025-59019, GHSA-j8vm-7q52-2m2m | Medium | 0.2% | 09 Sep, 2025 | Packagist typo3/cms-backend Packagist typo3/cms-recordlist |
TYPO3 backend modules have Broken Access Control CVE-2025-59017, GHSA-2fhw-2j7m-mr4m | Medium | 0.3% | 09 Sep, 2025 | Packagist typo3/cms-backend Packagist typo3/cms-beuser Packagist typo3/cms-dashboard Packagist typo3/cms-recycler +1 more |
TYPO3 CMS exposes sensitive information in an error message CVE-2025-59016, GHSA-cvm2-5f78-g9m8 | Medium | 0.2% | 09 Sep, 2025 | Packagist typo3/cms-core |
TYPO3 CMS uses insufficient entropy when generating passwords CVE-2025-59015, GHSA-p5jq-5383-qvc7 | Medium | 0.2% | 09 Sep, 2025 | Packagist typo3/cms-core |
TYPO3 Bookmark Toolbar vulnerable to denial of service CVE-2025-59014, GHSA-xrcq-533q-8rxw | Medium | 0.3% | 09 Sep, 2025 | Packagist typo3/cms-backend |
TYPO3 CMS has an open‑redirect vulnerability CVE-2025-59013, GHSA-72jf-5fg5-3cw3 | Medium | 0.2% | 09 Sep, 2025 | Packagist typo3/cms-core |
Presta Shop vulnerable to email enumeration CVE-2025-51586, GHSA-8xx5-h6m3-jr33 | Medium | 0.8% | 04 Sep, 2025 | Packagist prestashop/prestashop |
Mautic Vulnerable to User Enumeration via Response Timing CVE-2025-9824, GHSA-3ggv-qwcp-j6xg | Medium | 0.3% | 03 Sep, 2025 | Packagist mautic/core |
Mautic vulnerable to reflected XSS in lead:addLeadTags - Quick Add CVE-2025-9823, GHSA-9v8p-m85m-f7mm | Medium | 0.3% | 03 Sep, 2025 | Packagist mautic/core |
Mautic vulnerable to secret data extraction via elfinder CVE-2025-9822, GHSA-438m-6mhw-hq5w | Medium | 0.2% | 03 Sep, 2025 | Packagist mautic/core |
Contao does not properly manage privileges for page and article fields CVE-2025-57759, GHSA-qqfq-7cpp-hcqj | Medium | 0.3% | 28 Aug, 2025 | Packagist contao/contao Packagist contao/core-bundle |