Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Mautic's Predictable Page Indexing Might Lead to Sensitive Data Exposure CVE-2025-5257, GHSA-cqx4-9vqf-q3m8 | Medium | 0.4% | 28 May, 2025 | Packagist mautic/core |
Mautic does not shield .env files from web traffic CVE-2024-47056, GHSA-h2wg-v8wg-jhxh | Medium | 0.1% | 28 May, 2025 | Packagist mautic/core |
Chrome PHP is missing encoding in `CssSelector` CVE-2025-48883, GHSA-3432-fmrf-7vmh | Medium | 0.5% | 28 May, 2025 | Packagist chrome-php/chrome |
Laravel Rest Api has a Search Validation Bypass CVE-2025-48490, GHSA-69rh-hccr-cxrj | Medium | 0.6% | 27 May, 2025 | Packagist lomkit/laravel-rest-api |
Drupal Quick Node Block Missing Authorization vulnerability CVE-2025-48013, DRUPAL-CONTRIB-2025-065, GHSA-r6xj-43cf-9f88 | Medium | 0.3% | 21 May, 2025 | Packagist drupal/quick_node_block Packagist:https://packages.drupal.org/8 drupal/quick_node_block |
Drupal Quick Node Block Missing Authorization vulnerability CVE-2025-48444, DRUPAL-CONTRIB-2025-064, GHSA-c424-hgg9-9c4w | Medium | 0.3% | 21 May, 2025 | Packagist drupal/quick_node_block Packagist:https://packages.drupal.org/8 drupal/quick_node_block |
The Backup Plus extension for TYPO3 (ns_backup) allows XSS CVE-2025-48206, GHSA-xg53-mhh9-3cq7 | Medium | 0.2% | 21 May, 2025 | Packagist nitsan/ns-backup |
The Backup Plus extension for TYPO3 (ns_backup) allows command injections CVE-2025-48204, GHSA-463c-jhp2-4mm7 | Medium | 0.8% | 21 May, 2025 | Packagist nitsan/ns-backup |
[clickstorm] SEO (cs_seo) TYPO3 extension Cross-site Scripting (XSS) vulnerability CVE-2025-48203, GHSA-6p8w-pc35-mqv8 | Medium | 0.2% | 21 May, 2025 | Packagist clickstorm/cs-seo |
The femanager TYPO3 extension allows Insecure Direct Object Reference CVE-2025-48202, GHSA-xxwr-wv9g-7jw3 | Medium | 0.3% | 21 May, 2025 | Packagist in2code/femanager |
TYPO3 Allows Unrestricted File Upload in File Abstraction Layer CVE-2025-47939, GHSA-9hq9-cr36-4wpj | Medium | 0.2% | 20 May, 2025 | Packagist typo3/cms-core |
TYPO3 Allows Information Disclosure via DBAL Restriction Handling CVE-2025-47937, GHSA-x8pv-fgxp-8v3x | Medium | 0.3% | 20 May, 2025 | Packagist typo3/cms-core |
TYPO3 CMS Webhooks Server Side Request Forgery CVE-2025-47936, GHSA-p4xx-m758-3hpx | Medium | 0.3% | 20 May, 2025 | Packagist typo3/cms-webhooks |
Symfony UX allows unsanitized HTML attribute injection via ComponentAttributes CVE-2025-47946, GHSA-5j3w-5pcr-f8hg | Medium | 0.3% | 19 May, 2025 | Packagist symfony/ux-live-component Packagist symfony/ux-twig-component |
tarteaucitron-wp WordPress Plugin Vulnerable to Stored Cross-Site Scripting CVE-2024-11718, GHSA-fxpc-qmrh-7j2h | Medium | 0.3% | 15 May, 2025 | Packagist couleurcitron/tarteaucitron-wp |
Sulu vulnerable to XXE in SVG File upload Inspector CVE-2025-47778, GHSA-f6rx-hf55-4255 | Medium | 0.5% | 14 May, 2025 | Packagist sulu/sulu |
Kirby vulnerable to path traversal of collection names during file system lookup CVE-2025-31493, GHSA-x275-h9j4-7p4h | Medium | 0.6% | 13 May, 2025 | Packagist getkirby/cms |
Kirby vulnerable to path traversal of snippet names in the `snippet()` helper CVE-2025-30159, GHSA-fw82-87p8-v6hp | Medium | 0.7% | 13 May, 2025 | Packagist getkirby/kirby |
Craft CMS stores arbitrary content provided by unauthenticated users in session files CVE-2025-35939, GHSA-7vrx-9684-xrf2 | MediumExploited | 1.3% | 07 May, 2025 | Packagist craftcms/cms |
Koillection Cross Site Scripting vulnerability CVE-2025-29746, GHSA-fxvx-gfmr-5xfj | Medium | 0.3% | 07 May, 2025 | Packagist koillection/koillection |
league/commonmark contains a XSS vulnerability in Attributes extension CVE-2025-46734, GHSA-3527-qv2q-pfvx | Medium | 0.4% | 05 May, 2025 | Packagist league/commonmark |
Grokability Snipe-IT has incorrect authorization for accessing asset information CVE-2025-47226, GHSA-h3vp-qwmx-5j25 | Medium | 1.3% | 02 May, 2025 | Packagist snipe/snipe-it |
YesWiki Stored XSS Vulnerability in Comments CVE-2025-46346, GHSA-59x8-cvxh-3mm4 | Medium | 0.4% | 29 Apr, 2025 | Packagist yeswiki/yeswiki |
Yeswiki Vulnerable to Authenticated Reflected Cross-site Scripting CVE-2025-46350, GHSA-cg4f-cq8h-3ch8 | Medium | 0.3% | 29 Apr, 2025 | Packagist yeswiki/yeswiki |
Yeswiki Vulnerable to Unauthenticated Reflected Cross-site Scripting CVE-2025-46550, GHSA-ggqx-43h2-55jp | Medium | 0.5% | 29 Apr, 2025 | Packagist yeswiki/yeswiki |
Yeswiki Vulnerable to Unauthenticated Reflected Cross-site Scripting CVE-2025-46549, GHSA-r9gv-qffm-xw6f | Medium | 0.5% | 29 Apr, 2025 | Packagist yeswiki/yeswiki |
Moodle allows IDOR when accessing the cohorts report BIT-moodle-2025-3647, CVE-2025-3647, GHSA-34g7-pg9j-pxgp | Medium | 0.3% | 25 Apr, 2025 | Packagist moodle/moodle |
Moodle has an IDOR in messaging web service which allows access to some user details BIT-moodle-2025-3645, CVE-2025-3645, GHSA-pj96-xh2w-fgqx | Medium | 0.4% | 25 Apr, 2025 | Packagist moodle/moodle |
Moodle's AJAX section delete does not respect course_can_delete_section() BIT-moodle-2025-3644, CVE-2025-3644, GHSA-cpm7-mv33-jwf8 | Medium | 0.3% | 25 Apr, 2025 | Packagist moodle/moodle |
Moodle has reflected Cross-site Scripting risk in policy tool BIT-moodle-2025-3643, CVE-2025-3643, GHSA-hxgg-4qww-85ph | Medium | 0.3% | 25 Apr, 2025 | Packagist moodle/moodle |
Moodle has an IDOR in web service which allows users enrolled in a course to access some details of other users BIT-moodle-2025-3640, CVE-2025-3640, GHSA-6g5x-h5x7-q4mq | Medium | 0.4% | 25 Apr, 2025 | Packagist moodle/moodle |
Moodle allows IDOR in RSS block, which allows access to additional RSS feeds BIT-moodle-2025-3636, CVE-2025-3636, GHSA-chmf-m33p-ph8m | Medium | 0.3% | 25 Apr, 2025 | Packagist moodle/moodle |
Moodle reveals student identities through assignment submissions search on anonymous submissions BIT-moodle-2025-3628, CVE-2025-3628, GHSA-69m9-rprc-2x7g | Medium | 0.3% | 25 Apr, 2025 | Packagist moodle/moodle |
Moodle makes some user data available before completing second factor with MFA enabled BIT-moodle-2025-3627, CVE-2025-3627, GHSA-x45j-jq9q-gf3q | Medium | 0.3% | 25 Apr, 2025 | Packagist moodle/moodle |
Moodle shows hidden grades to users without permission on some grade reports BIT-moodle-2025-32045, CVE-2025-32045, GHSA-8m7c-hm88-2p97 | Medium | 0.3% | 25 Apr, 2025 | Packagist moodle/moodle |
Moodle self enrollment available before completing second factor with MFA enabled BIT-moodle-2025-3634, CVE-2025-3634, GHSA-qhc7-xhc2-7p7w | Medium | 0.3% | 25 Apr, 2025 | Packagist moodle/moodle |
Laravel Starter Cross Site Scripting (XSS) CVE-2025-26159, GHSA-fpx3-h2pc-88vf | Medium | 0.3% | 22 Apr, 2025 | Packagist nasirkhan/laravel-starter |
PEAR HTTP_Request2 vulnerable to Cross-site Scripting CVE-2025-43717, GHSA-w7gh-f2fm-9q8r | Medium | 0.3% | 17 Apr, 2025 | Packagist pear/http_request2 |
Formie has XSS vulnerability for importing forms CVE-2025-32427, GHSA-p9hh-mh5x-wvx3 | Medium | 0.2% | 11 Apr, 2025 | Packagist verbb/formie |
Formie has XSS vulnerability for email notification content for preview CVE-2025-32426, GHSA-2xm2-23ff-p8ww | Medium | 0.2% | 11 Apr, 2025 | Packagist verbb/formie |
Silverstripe Framework user enumeration via timing attack on login and password reset forms GHSA-256q-hx8w-xcqx | Medium | Not scored | 10 Apr, 2025 | Packagist silverstripe/framework |
Yii does not prevent XSS in scenarios where fallback error renderer is used CVE-2025-32027, GHSA-7r2v-8wxr-3ch5 | Medium | 0.2% | 10 Apr, 2025 | Packagist yiisoft/yii |
Silverstripe Framework has a XSS vulnerability in HTML editor CVE-2025-30148, GHSA-rhx4-hvx9-j387 | Medium | 0.3% | 10 Apr, 2025 | Packagist silverstripe/framework |
Silverstripe cross-site scripting (XSS) attack in elemental "Content blocks in use" report CVE-2025-25197, GHSA-x8xm-c7p8-2pj2 | Medium | 0.3% | 10 Apr, 2025 | Packagist dnadesign/silverstripe-elemental |
Shopware default newsletter opt-in settings allow for mass sign-up abuse CVE-2025-32378, GHSA-4h9w-7vfp-px8m | Medium | 0.3% | 09 Apr, 2025 | Packagist shopware/core Packagist shopware/platform |
wallabag/wallabag Has Multiple Cross-Site Request Forgery (CSRF) Vulnerabilities GHSA-5pm7-cp8f-p2c2 | Medium | Not scored | 09 Apr, 2025 | Packagist wallabag/wallabag |
Magento Improper Access Control leads to Security feature bypass CVE-2025-27191, GHSA-vhcq-4xrm-2cr2 | Medium | 0.5% | 08 Apr, 2025 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento Improper Access Control leads to Security feature bypass CVE-2025-27190, GHSA-6wq7-cg9h-mj6q | Medium | 0.5% | 08 Apr, 2025 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento Improper Authorization vulnerability CVE-2025-27188, GHSA-rr2g-rrjj-xw86 | Medium | 0.6% | 08 Apr, 2025 | Packagist magento/community-edition |
Shopware Broken ACL on Document retrieval to access other customers documents GHSA-68wv-g3fw-pq7q | Medium | Not scored | 08 Apr, 2025 | Packagist shopware/core Packagist shopware/platform |