Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Sylius has a security vulnerability via adjustments API endpoint CVE-2024-40633, GHSA-55rf-8q29-4g43 | High | 0.4% | 17 Jul, 2024 | Packagist sylius/sylius |
BookStack Incorrect Access Control vulnerability CVE-2024-36676, GHSA-pj36-fcrg-327j | High | 0.6% | 09 Jul, 2024 | Packagist ssddanbrown/bookstack |
aimeos/ai-admin-graphql improper access control vulnerability allows an editor to modify admin account CVE-2024-39323, GHSA-vc7j-99jw-jrqm | High | 0.4% | 02 Jul, 2024 | Packagist aimeos/ai-admin-graphql |
Name confusion in x509 Subject Alternative Name fields CVE-2023-52892, GHSA-ff7q-6vwh-v9m4 | High | 0.4% | 27 Jun, 2024 | Packagist phpseclib/phpseclib |
Aimeos HTML client may potentially reveal sensitive information in error log CVE-2024-38516, GHSA-ppm5-jv84-2xg2 | High | 0.5% | 25 Jun, 2024 | Packagist aimeos/ai-client-html |
Arbitrary File Creation in opencart BIT-opencart-2024-21519, CVE-2024-21519, GHSA-7q3h-j95q-3vjh | High | 0.7% | 22 Jun, 2024 | Packagist opencart/opencart |
Zip slip in opencart BIT-opencart-2024-21518, CVE-2024-21518, GHSA-m7r8-2r98-vppj | High | 14.1% | 22 Jun, 2024 | Packagist opencart/opencart |
SQL injection in opencart CVE-2024-21514, GHSA-7crj-24g3-g7h7 | High | 19.1% | 22 Jun, 2024 | Packagist opencart/opencart |
Moodle CSRF risks due to misuse of confirm_sesskey BIT-moodle-2024-38276, CVE-2024-38276, GHSA-356g-7x36-7m34 | High | 0.5% | 18 Jun, 2024 | Packagist moodle/moodle |
Moodle HTTP authorization header is preserved between "emulated redirects" BIT-moodle-2024-38275, CVE-2024-38275, GHSA-p2cj-86v4-7782 | High | 0.4% | 18 Jun, 2024 | Packagist moodle/moodle |
Dolibarr arbitrary file upload vulnerability BIT-dolibarr-2024-37821, CVE-2024-37821, GHSA-p7r8-7w87-8g46 | High | 0.8% | 18 Jun, 2024 | Packagist dolibarr/dolibarr |
Snipe-IT allows users to promote or demote themselves or other users CVE-2024-5685, GHSA-544r-fc65-v832 | High | 0.4% | 14 Jun, 2024 | Packagist snipe/snipe-it |
Magento Open Source Server-Side Request Forgery (SSRF) vulnerability BIT-magento-2024-34111, CVE-2024-34111, GHSA-jmqp-r3gg-6jh3 | High | 1.3% | 13 Jun, 2024 | Packagist magento/community-edition |
Magento Open Source Improper Authorization vulnerability BIT-magento-2024-34104, CVE-2024-34104, GHSA-wwj3-573j-rvvm | High | 0.8% | 13 Jun, 2024 | Packagist magento/community-edition |
Composer has a command injection via malicious git branch name BIT-composer-2024-35241, CVE-2024-35241, GHSA-47f6-5gq3-vx9c | High | 1.1% | 10 Jun, 2024 | Packagist composer/composer |
Composer has multiple command injections via malicious git/hg branch names BIT-composer-2024-35242, CVE-2024-35242, GHSA-v9qv-c7wm-wgmf | High | 3.3% | 10 Jun, 2024 | Packagist composer/composer |
nukeviet Deserialization of Untrusted Data vulnerability CVE-2024-36528, GHSA-mhj4-vrcv-x4xc | High | 0.8% | 10 Jun, 2024 | Packagist nukeviet/nukeviet |
zfr authentication adapter did not verify validity of tokens GHSA-rcm4-jv5g-wccm | High | Not scored | 07 Jun, 2024 | Packagist zfr/zfr-oauth2-server-module |
ZendOpenID potential security issue in login mechanism GHSA-3x57-m5p4-rgh4 | High | Not scored | 07 Jun, 2024 | Packagist zendframework/zendopenid |
Zendframework Potential Information Disclosure and Insufficient Entropy vulnerability GHSA-848f-mph5-9pm9 | High | Not scored | 07 Jun, 2024 | Packagist zendframework/zendframework1 |
ZendFramework1 Potential Insufficient Entropy Vulnerability GHSA-8xhv-gqm4-3w99 | High | Not scored | 07 Jun, 2024 | Packagist zendframework/zendframework1 |
Zend-Captcha Information Disclosure and Insufficient Entropy vulnerability GHSA-mg4x-prh7-g4mx | High | Not scored | 07 Jun, 2024 | Packagist zendframework/zend-captcha |
Zendframework potential security issue in login mechanism GHSA-9v78-h226-2rmq | High | Not scored | 07 Jun, 2024 | Packagist zendframework/zendframework1 |
Adminer file disclosure vulnerability GHSA-97h7-mf38-g9mf | High | Not scored | 07 Jun, 2024 | Packagist vrana/adminer |
Zend-Navigation vulnerable to Cross-site Scripting GHSA-6v7p-5qcq-268c | High | Not scored | 07 Jun, 2024 | Packagist zendframework/zend-navigation |
Zend-Feed URL Rewrite vulnerability GHSA-jmmp-vh96-78rm | High | Not scored | 07 Jun, 2024 | Packagist zendframework/zend-feed |
Zend-HTTP URL Rewrite vulnerability GHSA-cg8w-5jrc-675g | High | Not scored | 07 Jun, 2024 | Packagist zendframework/zend-http |
Zendframework Local file disclosure via XXE injection in Zend_XmlRpc GHSA-229x-22xc-2f2w | High | Not scored | 07 Jun, 2024 | Packagist zendframework/zendframework1 |
Zendframework Denial of Service vector via XEE injection GHSA-2jx7-xg83-j2m7 | High | Not scored | 07 Jun, 2024 | Packagist zendframework/zendframework1 |
Zend-Mail remote code execution in zend-mail via Sendmail adapter GHSA-cxf7-m5g2-v594 | High | Not scored | 07 Jun, 2024 | Packagist zendframework/zend-mail |
ZendFramework potential XML eXternal Entity injection vectors GHSA-4j9x-g4x8-vcmf | High | Not scored | 07 Jun, 2024 | Packagist zendframework/zendframework1 |
ZendFramework local file inclusion vector in `Zend_View::setScriptPath()` and `render()` GHSA-hx3m-959f-v849 | High | Not scored | 07 Jun, 2024 | Packagist zendframework/zendframework1 |
ZendFramework SQL injection due to execution of platform-specific SQL containing interpolations GHSA-x2f4-8wxf-w3vf | High | Not scored | 07 Jun, 2024 | Packagist zendframework/zendframework |
ZendFramework Potential Information Disclosure and Insufficient Entropy vulnerabilities GHSA-xg9w-r469-m455 | High | Not scored | 07 Jun, 2024 | Packagist zendframework/zendframework |
ZendFramework Route Parameter Injection Via Query String in `Zend\Mvc` GHSA-jq87-2wxp-8349 | High | Not scored | 07 Jun, 2024 | Packagist zendframework/zendframework |
Zendframework Remote Address Spoofing Vector in `Zend\Http\PhpEnvironment\RemoteAddress` GHSA-xffp-6w68-4775 | High | Not scored | 07 Jun, 2024 | Packagist zendframework/zendframework |
TYPO3 Security Misconfiguration in Install Tool Cookie GHSA-f777-f784-36gm | High | Not scored | 07 Jun, 2024 | Packagist typo3/cms |
TYPO3 Arbitrary Code Execution via File List Module GHSA-8h4m-r4wm-xj7r | High | Not scored | 07 Jun, 2024 | Packagist typo3/cms |
TYPO3 Denial of Service in Frontend Record Registration GHSA-g585-crjf-vhwq | High | Not scored | 07 Jun, 2024 | Packagist typo3/cms |
TYPO3 Security Misconfiguration for Backend User Accounts GHSA-c5mj-39cf-3pp5 | High | Not scored | 07 Jun, 2024 | Packagist typo3/cms |
TYPO3 CMS Possible Insecure Deserialization in Extbase Request Handling GHSA-hh95-5xm5-v8v7 | High | Not scored | 07 Jun, 2024 | Packagist typo3/cms |
Password hash exposed in CraftCMS two factor authentication plugin CVE-2024-5657, GHSA-3p4x-grpm-xw58 | High | 0.8% | 06 Jun, 2024 | Packagist born05/craft-twofactorauthentication |
typo3 Security fix for Flow Swift Mailer package GHSA-xjw3-5r5c-m5ph | High | Not scored | 05 Jun, 2024 | Packagist typo3/swiftmailer |
typo3 Information Disclosure Security Note GHSA-g4xv-r3qw-v3q2 | High | Not scored | 05 Jun, 2024 | Packagist typo3/neos |
Flow Bugfix Releases for Entity Security GHSA-vh6j-wv25-8qxr | High | Not scored | 05 Jun, 2024 | Packagist typo3/flow |
Cross-Site Scripting (XSS) vulnerabilities in Neos GHSA-4542-p56h-8xww | High | Not scored | 05 Jun, 2024 | Packagist typo3/neos |
Insecure Deserialization & Arbitrary Code Execution in TYPO3 CMS GHSA-ppgf-8745-8pgx | High | Not scored | 05 Jun, 2024 | Packagist typo3/cms |
Privilege Escalation & SQL Injection in TYPO3 CMS GHSA-7qwg-fcpw-xg5g | High | Not scored | 05 Jun, 2024 | Packagist typo3/cms |
TYPO3 Remote Code Execution in third party library swiftmailer GHSA-g4pf-3jvq-2gcw | High | Not scored | 05 Jun, 2024 | Packagist typo3/cms |
Insecure Deserialization in TYPO3 CMS GHSA-8h28-f46f-m87h | High | Not scored | 05 Jun, 2024 | Packagist typo3/cms |