Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Moodle Remote Code Execution vulnerability BIT-moodle-2024-43425, CVE-2024-43425, GHSA-v6f4-v8h8-3c87 | High | 87.5% | 07 Nov, 2024 | Packagist moodle/moodle |
Symfony allows changing the environment through a query CVE-2024-50340, GHSA-x8vp-gf4q-mw5j | High | 61.8% | 06 Nov, 2024 | Packagist symfony/runtime Packagist symfony/symfony |
Laravel Reverb Missing API Signature Verification CVE-2024-50347, GHSA-pfrr-xvrf-pxjx | High | 0.3% | 31 Oct, 2024 | Packagist laravel/reverb |
SQL injection in funadmin CVE-2024-48230, GHSA-2mv8-jjm5-f3hr | High | 0.5% | 25 Oct, 2024 | Packagist funadmin/funadmin |
SQL injection in funadmin CVE-2024-48229, GHSA-h345-r48x-g68f | High | 0.4% | 25 Oct, 2024 | Packagist funadmin/funadmin |
Logic flaw in Funadmin CVE-2024-48227, GHSA-r9v5-q97m-rj5g | High | 0.6% | 25 Oct, 2024 | Packagist funadmin/funadmin |
SQL injection in funadmin CVE-2024-48226, GHSA-9gw3-qr2f-3vg5 | High | 0.6% | 25 Oct, 2024 | Packagist funadmin/funadmin |
SQL injection in funadmin CVE-2024-48225, GHSA-vw6x-c5rg-jmjp | High | 0.6% | 25 Oct, 2024 | Packagist funadmin/funadmin |
SQL injection in funadmin CVE-2024-48224, GHSA-6j8f-88mh-r9vq | High | 0.7% | 25 Oct, 2024 | Packagist funadmin/funadmin |
SQL injection in funadmin CVE-2024-48223, GHSA-x2fr-vj74-5h35 | High | 0.6% | 25 Oct, 2024 | Packagist funadmin/funadmin |
SQL injection in funadmin CVE-2024-48222, GHSA-5g66-93qv-565j | High | 0.6% | 25 Oct, 2024 | Packagist funadmin/funadmin |
SQL injection in funadmin CVE-2024-48218, GHSA-h4px-9vmp-p7pv | High | 0.6% | 25 Oct, 2024 | Packagist funadmin/funadmin |
SQL injection in funadmin CVE-2024-48231, GHSA-7pp4-388x-2xqj | High | 0.5% | 21 Oct, 2024 | Packagist funadmin/funadmin |
Snipe-IT remote code execution CVE-2024-48987, GHSA-57qh-vmjr-5jxg | High | 1.0% | 11 Oct, 2024 | Packagist snipe/snipe-it |
Magento Open Source Improper Authorization vulnerability BIT-magento-2024-45132, CVE-2024-45132, GHSA-5f64-ppmg-cvvm | High | 0.7% | 10 Oct, 2024 | Packagist magento/community-edition |
Magento Open Source Improper Access Control vulnerability CVE-2024-45118, GHSA-cg52-68fv-94qq | High | 0.6% | 10 Oct, 2024 | Packagist magento/community-edition |
Magento Open Source Improper Input Validation vulnerability CVE-2024-45117, GHSA-3fr3-gcqh-3m2g | High | 0.8% | 10 Oct, 2024 | Packagist magento/community-edition |
Magento Open Source Cross-Site Scripting (XSS) vulnerability CVE-2024-45116, GHSA-873m-72g6-853g | High | 0.9% | 10 Oct, 2024 | Packagist magento/community-edition |
Livewire Remote Code Execution on File Uploads CVE-2024-47823, GHSA-f3cx-396f-7jqp | High | 0.8% | 08 Oct, 2024 | Packagist livewire/livewire |
XXE in PHPSpreadsheet's XLSX reader CVE-2024-45293, GHSA-6hwr-6v2f-3m88 | High | 2.8% | 07 Oct, 2024 | Packagist phpoffice/phpexcel Packagist phpoffice/phpspreadsheet |
PhpSpreadsheet allows absolute path traversal and Server-Side Request Forgery in HTML writer when embedding images is enabled CVE-2024-45291, GHSA-w9xv-qf98-ccq4 | High | 0.9% | 07 Oct, 2024 | Packagist phpoffice/phpexcel Packagist phpoffice/phpspreadsheet |
PhpSpreadsheet allows absolute path traversal and Server-Side Request Forgery when opening XLSX file CVE-2024-45290, GHSA-5gpr-w2p5-6m37 | High | 0.6% | 07 Oct, 2024 | Packagist phpoffice/phpexcel Packagist phpoffice/phpspreadsheet |
LibreNMS has Stored Cross-site Scripting vulnerability in "Device Group" Name CVE-2024-47524, GHSA-fc38-2254-48g7 | High | 0.5% | 01 Oct, 2024 | Packagist librenms/librenms |
Mautic has insufficient authentication in upgrade flow CVE-2022-25770, GHSA-qf6m-6m4g-rmrc | High | 0.3% | 18 Sep, 2024 | Packagist mautic/core Packagist mautic/core-lib |
Mautic vulnerable to Improper Access Control in UI upgrade process CVE-2022-25768, GHSA-x3jx-5w6m-q2fc | High | 0.3% | 18 Sep, 2024 | Packagist mautic/core Packagist mautic/core-lib |
Kimai has an XXE Leading to Local File Read GHSA-534c-hcr7-67jg | High | Not scored | 17 Sep, 2024 | Packagist kimai/kimai |
Contao affected by remote command execution through file upload CVE-2024-45398, GHSA-vm6r-j788-hjh5 | High | 0.5% | 17 Sep, 2024 | Packagist contao/core-bundle |
czim/file-handling vulnerable to SSRF and directory traversal CVE-2024-47049, GHSA-6rgh-r6j3-3223 | High | 0.6% | 17 Sep, 2024 | Packagist czim/file-handling |
powermail TYPO3 extension has Insecure Direct Object Reference CVE-2024-47047, GHSA-q25c-r482-77p9 | High | 0.5% | 17 Sep, 2024 | Packagist in2code/powermail |
Twig has a possible sandbox bypass CVE-2024-45411, GHSA-6j75-5wfj-gh66 | High | 0.8% | 09 Sep, 2024 | Packagist twig/twig |
Pimcore includes vulnerable PHPOffice/PhpSpreadsheet GHSA-hq76-662x-7mw4 | High | Not scored | 03 Sep, 2024 | Packagist pimcore/admin-ui-classic-bundle Packagist pimcore/data-importer Packagist pimcore/pimcore |
Kirby has insufficient permission checks in the language settings CVE-2024-41964, GHSA-jm9m-rqr3-wfmh | High | 0.5% | 29 Aug, 2024 | Packagist getkirby/cms |
XXE in PHPSpreadsheet encoding is returned CVE-2024-45048, GHSA-ghg6-32f9-2jp7 | High | 0.6% | 28 Aug, 2024 | Packagist phpoffice/phpexcel Packagist phpoffice/phpspreadsheet |
Froxlor: /etc/pure-ftpd/db/mysql.conf is chmod 644 but contains <SQL_UNPRIVILEGED_PASSWORD> CVE-2024-58383, GHSA-34qg-65m4-f23m | High | 0.2% | 23 Aug, 2024 | Packagist froxlor/froxlor |
Persistent Cross-site Scripting in eZ Platform Rich Text Field Type CVE-2024-43372, GHSA-rhm7-7469-rcpw | High | Not scored | 14 Aug, 2024 | Packagist ezsystems/ezplatform-richtext |
Persistent Cross-site Scripting in Ibexa RichText Field Type CVE-2024-43369, GHSA-hvcf-6324-cjh7 | High | 0.4% | 14 Aug, 2024 | Packagist ibexa/fieldtype-richtext |
Magento Stored Cross-Site Scripting (XSS) vulnerability CVE-2024-39403, GHSA-mmp7-8cg4-9wrg | High | 0.5% | 14 Aug, 2024 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento OS Command ('OS Command Injection') vulnerability CVE-2024-39402, GHSA-2ff6-837j-hg5x | High | 1.7% | 14 Aug, 2024 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento OS Command ('OS Command Injection') vulnerability CVE-2024-39401, GHSA-8frp-pxq2-3gpq | High | 1.7% | 14 Aug, 2024 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento DOM-based Cross-Site Scripting (XSS) vulnerability CVE-2024-39400, GHSA-52fg-wjxm-pp44 | High | 0.7% | 14 Aug, 2024 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento Path Traversal vulnerability CVE-2024-39399, GHSA-7r99-8wqp-h7pc | High | 0.9% | 14 Aug, 2024 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento does not properly restrict excessive authentication attempts CVE-2024-39398, GHSA-q628-54wg-4r5q | High | 0.9% | 14 Aug, 2024 | Packagist magento/community-edition Packagist magento/project-community-edition |
Filament Excel Vulnerable to Path Traversal Attack on Export Download Endpoint CVE-2024-42485, GHSA-m3px-vjxr-fx4m | High | 0.6% | 12 Aug, 2024 | Packagist pxlrbt/filament-excel |
Shopware vulnerable to Server Side Template Injection in Twig using Context functions CVE-2024-42356, GHSA-35jp-8cgg-p4wj | High | 0.6% | 08 Aug, 2024 | Packagist shopware/core Packagist shopware/platform |
ICEcoder vulnerable to Cross Site Scripting CVE-2024-41375, GHSA-5j47-3m62-7vr3 | High | 0.3% | 26 Jul, 2024 | Packagist icecoder/icecoder |
ICEcoder vulnerable to Cross Site Scripting CVE-2024-41374, GHSA-xcr9-pm5w-gvh2 | High | 0.3% | 26 Jul, 2024 | Packagist icecoder/icecoder |
Craft CMS Allows TOTP Token To Stay Valid After Use CVE-2024-41800, GHSA-wmx7-pw49-88jx | High | 0.5% | 25 Jul, 2024 | Packagist craftcms/cms |
Dolibarr ERP CRM vulnerable to remote code execution (RCE) CVE-2024-40137, GHSA-vprp-94p9-5jp8 | High | 0.7% | 24 Jul, 2024 | Packagist dolibarr/dolibarr |
Automad arbitrary file upload vulnerability CVE-2024-40400, GHSA-47mc-qmh2-mqj4 | High | 0.8% | 19 Jul, 2024 | Packagist automad/automad |
openCart Server-Side Template Injection (SSTI) vulnerability BIT-opencart-2024-36694, CVE-2024-36694, GHSA-xrh7-2gfq-4rcq | High | 0.9% | 17 Jul, 2024 | Packagist opencart/opencart |