Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Contao can disclose sensitive information in the news module CVE-2025-57757, GHSA-w53m-gxvg-vx7p | Medium | 0.3% | 28 Aug, 2025 | Packagist contao/contao Packagist contao/core-bundle |
Contao discloses sensitive information in the front end search index CVE-2025-57756, GHSA-2xmj-8wmq-7475 | Medium | 0.3% | 28 Aug, 2025 | Packagist contao/contao Packagist contao/core-bundle |
Contao applies improper access control in the back end voters CVE-2025-57758, GHSA-7m47-r75r-cx8v | Medium | 0.3% | 28 Aug, 2025 | Packagist contao/contao Packagist contao/core-bundle |
Craft CMS Potential Remote Code Execution via Twig SSTI CVE-2025-57811, GHSA-crcq-738g-pqvc | Medium | 0.9% | 25 Aug, 2025 | Packagist craftcms/cms |
UnoPim vulnerable to CSRF on Product edit feature and creation of other types CVE-2025-55744, GHSA-287x-6r2h-f9mw | Medium | 0.2% | 21 Aug, 2025 | Packagist unopim/unopim |
UnoPim has Stored Cross-site Scripting vulnerability in user creation functionality CVE-2025-55742, GHSA-xr97-25v7-hc2q | Medium | 0.4% | 21 Aug, 2025 | Packagist unopim/unopim |
WP Crontrol Authenticated (Administrator+) plugin vulnerable to Blind Server-Side Request Forgery CVE-2025-8678, GHSA-35c5-67fm-cpcp | Medium | 0.4% | 19 Aug, 2025 | Packagist johnbillion/wp-crontrol |
MoonShine SQL Injection Vulnerability CVE-2025-51510, GHSA-9g9j-3w64-3cjh | Medium | 0.5% | 19 Aug, 2025 | Packagist moonshine/moonshine |
MoonShine Arbitrary File Upload Vulnerability CVE-2025-51489, GHSA-8xfq-7f6m-mpmf | Medium | 0.3% | 19 Aug, 2025 | Packagist moonshine/moonshine |
moonshine Stored Cross-Site Scripting Vulnerability in Create Admin CVE-2025-51488, GHSA-rh9f-gr6q-mpc4 | Medium | 0.6% | 19 Aug, 2025 | Packagist moonshine/moonshine |
moonshine Stored Cross-Site Scripting Vulnerability in Create Article CVE-2025-51487, GHSA-p632-58pp-c9xg | Medium | 0.4% | 19 Aug, 2025 | Packagist moonshine/moonshine |
LibreNMS allows stored XSS in Alert Template name field CVE-2025-55296, GHSA-vxq6-8cwm-wj99 | Medium | 17.0% | 18 Aug, 2025 | Packagist librenms/librenms |
Magento vulnerable to path traversal CVE-2025-49559, GHSA-h4f4-gv6h-x824 | Medium | 0.7% | 12 Aug, 2025 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability CVE-2025-49558, GHSA-wcmw-8xpp-rwfj | Medium | 0.4% | 12 Aug, 2025 | Packagist magento/community-edition Packagist magento/project-community-edition |
svg-sanitizer Bypasses Attribute Sanitization CVE-2025-55166, GHSA-22wq-q86m-83fh | Medium | 0.5% | 12 Aug, 2025 | Packagist enshrined/svg-sanitize |
Craft CMS has a theoretical bypass for CVE-2025-23209 CVE-2025-54417, GHSA-2vcf-qxv3-2mgw | Medium | 0.5% | 08 Aug, 2025 | Packagist craftcms/cms |
Shopware race condition bypasses voucher restrictions CVE-2025-7954, GHSA-27gv-mg7w-mm34 | Medium | 0.4% | 06 Aug, 2025 | Packagist shopware/platform |
Concrete CMS vulnerable to Reflected Cross-Site Scripting (XSS) in Conversation Messages Dashboard Page CVE-2025-8571, GHSA-4pcg-pjp5-3mc6 | Medium | 0.4% | 05 Aug, 2025 | Packagist concrete5/concrete5 |
FPDI allows Memory Exhaustion (OOM) in PDF Parser which leads to Denial of Service CVE-2025-54869, GHSA-jxhh-4648-vpp3 | Medium | 0.3% | 05 Aug, 2025 | Packagist setasign/fpdi |
Microweber has Reflected XSS Vulnerability in the layout Parameter CVE-2025-51502, GHSA-mvj3-hc7j-vp74 | Medium | 0.9% | 01 Aug, 2025 | Packagist microweber/microweber |
Microweber has Reflected XSS Vulnerability in the id Parameter CVE-2025-51501, GHSA-8357-fjvx-xrm8 | Medium | 0.9% | 01 Aug, 2025 | Packagist microweber/microweber |
php-jwt contains weak encryption CVE-2025-45769, GHSA-2x45-7fc3-mxwq | Medium | 0.1% | 31 Jul, 2025 | Packagist firebase/php-jwt |
Withdrawn Advisory: CodeIgniter4 Cross-Site Scripting Vulnerability in debugbar_time Parameter CVE-2025-45406, GHSA-49jm-g4m8-x53p | Medium | 0.4% | 25 Jul, 2025 | Packagist codeigniter4/framework |
Femanager extension for TYPO3 allows Insecure Direct Object Reference CVE-2025-7900, GHSA-rc5f-3hfv-jxp2 | Medium | 0.3% | 22 Jul, 2025 | Packagist in2code/femanager |
Powermail extension for TYPO3 allows Insecure Direct Object Reference CVE-2025-7899, GHSA-x769-3cwv-f8hc | Medium | 0.3% | 22 Jul, 2025 | Packagist in2code/powermail |
HAX CMS application pages vulnerable to clickjacking CVE-2025-54139, GHSA-54vw-f4xf-f92j | Medium | 0.4% | 21 Jul, 2025 | Packagist elmsln/haxcms npm @haxtheweb/haxcms-nodejs |
Filemanager is vulnerable to Relative Path Traversal through filemanager.php CVE-2025-46002, GHSA-r7q6-6fmq-mx4c | Medium | 1.1% | 18 Jul, 2025 | Packagist simogeo/filemanager |
phpThumb is vulnerable to Command Injection through its gif_outputAsJpeg function CVE-2025-52994, GHSA-q745-cfqh-hcrw | Medium | 0.7% | 11 Jul, 2025 | Packagist james-heinrich/phpthumb |
Cockpit - Content Platform vulnerable to XSS through name or email argument names CVE-2025-7053, GHSA-j4rj-fgcq-wmqp | Medium | 0.4% | 04 Jul, 2025 | Packagist cockpit-hq/cockpit |
Microweber CMS API has authenticated local file inclusion vulnerability CVE-2025-34076, GHSA-j64v-xh5w-8hqj | Medium | 2.2% | 02 Jul, 2025 | Packagist microweber/microweber |
Magento Security feature bypass CVE-2025-49550, GHSA-8hcx-xvww-6c6h | Medium | 0.4% | 25 Jun, 2025 | Packagist magento/community-edition Packagist magento/project-community-edition |
Moodle Session Fixation allows unauthenticated users to hijack sessions via sesskey parameter BIT-moodle-2025-53021, CVE-2025-53021, GHSA-cgvv-3455-824j | Medium | 0.3% | 24 Jun, 2025 | Packagist moodle/moodle |
Ibexa RichText Field Type XSS vulnerabilities in back office GHSA-9qv6-4pwm-m68f | Medium | Not scored | 13 Jun, 2025 | Packagist ibexa/fieldtype-richtext |
Ibexa Admin UI XSS vulnerabilities in back office GHSA-5r6x-g6jv-4v87 | Medium | Not scored | 13 Jun, 2025 | Packagist ibexa/admin-ui |
Ibexa Admin UI assets XSS vulnerabilities in back office GHSA-vhgq-r8gx-5fpv | Medium | Not scored | 13 Jun, 2025 | Packagist ibexa/admin-ui-assets |
Ibexa eZ Platform Admin UI assets XSS vulnerabilities in back office GHSA-r5rx-53g9-25rj | Medium | Not scored | 13 Jun, 2025 | Packagist ezsystems/ezplatform-admin-ui-assets |
Ibexa eZ Platform Admin UI XSS vulnerabilities in back office GHSA-r7pm-mw8g-p7px | Medium | Not scored | 13 Jun, 2025 | Packagist ezsystems/ezplatform-admin-ui |
starcitizentools/citizen-skin allows stored XSS in menu heading message CVE-2025-49579, GHSA-g3cp-pq72-hjpv | Medium | 0.4% | 12 Jun, 2025 | Packagist starcitizentools/citizen-skin |
starcitizentools/citizen-skin allows stored XSS in user registration date message CVE-2025-49578, GHSA-2v3v-3whp-953h | Medium | 0.4% | 12 Jun, 2025 | Packagist starcitizentools/citizen-skin |
starcitizentools/citizen-skin allows stored XSS in preference menu heading messages CVE-2025-49577, GHSA-jwr7-992g-68mh | Medium | 0.4% | 12 Jun, 2025 | Packagist starcitizentools/citizen-skin |
starcitizentools/citizen-skin allows stored XSS in search no result messages CVE-2025-49576, GHSA-86xf-2mgp-gv3g | Medium | 0.4% | 12 Jun, 2025 | Packagist starcitizentools/citizen-skin |
Citizen skin vulnerable to stored XSS through multiple system messages CVE-2025-49575, GHSA-4c2h-67qq-vm87 | Medium | 0.4% | 11 Jun, 2025 | Packagist starcitizentools/citizen-skin |
Magento Improper Access Control leads to security feature bypass CVE-2025-27206, GHSA-g2pj-xmxq-3r9q | Medium | 0.5% | 10 Jun, 2025 | Packagist magento/community-edition Packagist magento/project-community-edition |
HAX CMS vulnerable to Local File Inclusion via saveOutline API Location Parameter CVE-2025-49138, GHSA-hxrr-x32w-cg8g | Medium | 0.5% | 09 Jun, 2025 | Packagist elmsln/haxcms |
Laravel Translation Manager Vulnerable to Stored Cross-site Scripting CVE-2025-49130, GHSA-j226-63j7-qrqh | Medium | 0.4% | 09 Jun, 2025 | Packagist barryvdh/laravel-translation-manager |
Yii 2 Redis may expose AUTH parameters in logs in case of connection failure CVE-2025-48493, GHSA-g3p6-82vc-43jh | Medium | 0.3% | 05 Jun, 2025 | Packagist yiisoft/yii2-redis |
juzaweb CMS allows cross-site scripting by uploading an SVG file CVE-2025-5420, GHSA-49rr-34j5-r8mw | Medium | 0.4% | 02 Jun, 2025 | Packagist juzaweb/cms |
Mautic has an Open Redirect vulnerability on user unlock path. CVE-2025-5256, GHSA-6vx9-9r2g-8373 | Medium | 0.2% | 28 May, 2025 | Packagist mautic/core |
Mautic segment cloning doesn't have a proper permission check CVE-2024-47055, GHSA-vph5-ghq3-q782 | Medium | 0.3% | 28 May, 2025 | Packagist mautic/core |
Mautic allows user name enumeration due to response time difference on password reset form CVE-2024-47057, GHSA-424x-cxvh-wq9p | Medium | 0.3% | 28 May, 2025 | Packagist mautic/core |