Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Shopware 6 allows attackers to check for registered accounts through the store-api CVE-2025-30150, GHSA-hh7j-6x3q-f52h | Medium | 0.4% | 08 Apr, 2025 | Packagist shopware/core Packagist shopware/platform |
API Platform Core can leak exceptions message that may contain sensitive information CVE-2023-47639, GHSA-rfw5-cqjj-7v9r | Medium | 0.4% | 03 Apr, 2025 | Packagist api-platform/core |
Concrete CMS Vulnerable to Cross-Site Request Forgery (CSRF) and Cross-Site Scripting (XSS) CVE-2025-3153, GHSA-cmm4-p9v2-q453 | Medium | 0.2% | 03 Apr, 2025 | Packagist concrete5/concrete5 |
Drupal Obfuscate Vulnerable to Stored Cross-Site Scripting (XSS) CVE-2025-3130, DRUPAL-CONTRIB-2025-029, GHSA-hphm-3x7f-g875 | Medium | 0.2% | 02 Apr, 2025 | Packagist drupal/obfuscate Packagist:https://packages.drupal.org/8 drupal/obfuscate |
ConcreteCMS Cross-Site Scripting (XSS) via HTML Block Text Field CVE-2025-2967, GHSA-xfqf-5rhg-5c73 | Medium | Not scored | 31 Mar, 2025 | Packagist concrete5/concrete5 |
ShopXO Vulnerable to Server-Side Request Forgery (SSRF) and Cross-Site Scripting (XSS) CVE-2025-28094, GHSA-24cf-848g-762c | Medium | 0.2% | 28 Mar, 2025 | Packagist shopxo/shopxo |
ShopXO Vulnerable to Server-Side Request Forgery (SSRF) via Email Settings CVE-2025-28093, GHSA-gfhv-5rqh-7qx3 | Medium | 0.3% | 28 Mar, 2025 | Packagist shopxo/shopxo |
ShopXO Vulnerable to Server-Side Request Forgery (SSRF) via Image Upload CVE-2025-28092, GHSA-p736-g6pg-hjhw | Medium | 0.3% | 28 Mar, 2025 | Packagist shopxo/shopxo |
wp-svg-upload WordPress plugin vulnerable to Stored Cross-site Scripting CVE-2024-11847, GHSA-v2rr-fhv8-mx74 | Medium | 0.3% | 26 Mar, 2025 | Packagist digimix/wp-svg-upload |
Pixelfed may allow unauthorized actor to view private posts and private users CVE-2025-30741, GHSA-7287-grhx-542x | Medium | 0.3% | 25 Mar, 2025 | Packagist pixelfed/pixelfed |
API Platform Core does not call GraphQl securityAfterResolver CVE-2025-23204, GHSA-7mxx-3cgm-xxv3 | Medium | 0.3% | 24 Mar, 2025 | Packagist api-platform/core |
yiisoft Yii2 Deserialization of Untrusted Data CVE-2025-2689, GHSA-88m2-j94x-v4fx | Medium | 0.6% | 24 Mar, 2025 | Packagist yiisoft/yii2-dev |
Drupal Core Cross-Site Scripting (XSS) Vulnerability BIT-drupal-2025-31675, CVE-2025-31675, DRUPAL-CORE-2025-004, GHSA-m4wj-hhwj-47qp | Medium | 0.5% | 19 Mar, 2025 | Packagist drupal/core |
Drupal Formatter Suite Vulnerable to Cross-Site Scripting (XSS) via Link Element Attributes CVE-2025-31697, DRUPAL-CONTRIB-2025-026, GHSA-5r66-vgc7-2mm3 | Medium | 0.3% | 19 Mar, 2025 | Packagist drupal/formatter_suite Packagist:https://packages.drupal.org/8 drupal/formatter_suite |
Drupal RapiDoc OAS Field Formatter Cross-Site Scripting (XSS) vulnerability CVE-2025-31696, DRUPAL-CONTRIB-2025-025, GHSA-86h4-w859-3hhv | Medium | 0.3% | 19 Mar, 2025 | Packagist drupal/rapidoc_elements_field_formatter Packagist:https://packages.drupal.org/8 drupal/rapidoc_elements_field_formatter |
Drupal Link field display mode formatter Cross-Site Scripting (XSS) vulnerability CVE-2025-31695, DRUPAL-CONTRIB-2025-024, GHSA-p2wg-8h29-874v | Medium | 0.3% | 19 Mar, 2025 | Packagist drupal/link_field_display_mode_formatter Packagist:https://packages.drupal.org/8 drupal/link_field_display_mode_formatter |
Sylius PayPal Plugin has an Order Manipulation Vulnerability after PayPal Checkout CVE-2025-30152, GHSA-hxg4-65p5-9w37 | Medium | 0.4% | 19 Mar, 2025 | Packagist sylius/paypal-plugin |
Clickstorm SEO Allows Cross-Site Scripting (XSS) CVE-2025-30081, GHSA-vmgw-24w6-9v82 | Medium | Not scored | 19 Mar, 2025 | Packagist clickstorm/cs-seo |
Additional TCA Allows Cross-Site Scripting (XSS) CVE-2025-30083, GHSA-rrh3-cgmx-w62f | Medium | Not scored | 19 Mar, 2025 | Packagist codingms/additional-tca |
Contao Vulnerable to Cross-Site Scripting (XSS) through SVG uploads CVE-2025-29790, GHSA-vqqr-fgmh-f626 | Medium | 0.2% | 18 Mar, 2025 | Packagist contao/core-bundle |
TastyIgniter Has an Incorrect Access Control Vulnerability CVE-2024-44314, GHSA-w5h7-mw56-4v7x | Medium | 0.3% | 18 Mar, 2025 | Packagist tastyigniter/tastyigniter |
Sylius PayPal Plugin Payment Amount Manipulation Vulnerability CVE-2025-29788, GHSA-pqq3-q84h-pj6x | Medium | 0.5% | 17 Mar, 2025 | Packagist sylius/paypal-plugin |
MODX allows cross-site scripting (XSS) via an SVG file CVE-2025-28010, GHSA-hm54-fg2w-2g6j | Medium | 0.3% | 13 Mar, 2025 | Packagist modx/revolution |
laravel-crud-wizard-free has File Validation Bypass GHSA-3wgq-h4fr-cwg5 | Medium | Not scored | 12 Mar, 2025 | Packagist macropay-solutions/laravel-crud-wizard-free |
Flarum Vulnerable to Session Hijacking via Authoritative Subdomain Cookie Overwrite CVE-2025-27794, GHSA-hg9j-64wp-m9px | Medium | 0.5% | 12 Mar, 2025 | Packagist flarum/core Packagist flarum/framework |
Microweber vulnerable to XSS attack due to insure `group` component in its Settings handler CVE-2025-2214, GHSA-hcgh-r5gq-6qc2 | Medium | 0.5% | 12 Mar, 2025 | Packagist microweber/microweber |
Froxlor has an HTML Injection Vulnerability CVE-2025-48958, GHSA-26xq-m8xw-6373 | Medium | 0.4% | 11 Mar, 2025 | Packagist froxlor/froxlor |
Pimcore Vulnerable to SQL Injection in getRelationFilterCondition CVE-2025-27617, GHSA-qjpx-5m2p-5pgh | Medium | 0.5% | 11 Mar, 2025 | Packagist pimcore/pimcore |
Concrete CMS affected by a stored XSS in Folder Function.The "Add Folder" functionality CVE-2025-0660, GHSA-pvmx-mjmh-jfcx | Medium | 0.3% | 10 Mar, 2025 | Packagist concrete5/concrete5 |
PocketMine-MP allows malicious client data to waste server resources due to lack of limits for explode() CVE-2025-71418, GHSA-g274-c6jj-h78p | Medium | 0.5% | 10 Mar, 2025 | Packagist pocketmine/pocketmine-mp |
Laravel framework susceptible to reflected cross-site scripting CVE-2024-13919, GHSA-83wp-f5c3-hqqr | Medium | 0.5% | 10 Mar, 2025 | Packagist laravel/framework |
Laravel framework susceptible to reflected cross-site scripting CVE-2024-13918, GHSA-546h-56qp-8jmw | Medium | 0.6% | 10 Mar, 2025 | Packagist laravel/framework |
GeSHi XSS possible in the get_var function of /contrib/cssgen.php CVE-2025-2123, GHSA-pr6q-g5gv-qgr7 | Medium | 0.5% | 09 Mar, 2025 | Packagist geshi/geshi |
Laravel has a File Validation Bypass BIT-laravel-2025-27515, CVE-2025-27515, GHSA-78fx-h6xr-vch4 | Medium | 0.7% | 05 Mar, 2025 | Packagist laravel/framework |
Drupal AI Vulnerable to OS Command Injection CVE-2025-31693, DRUPAL-CONTRIB-2025-022, GHSA-vx9m-rfxq-gr74 | Medium | 0.8% | 05 Mar, 2025 | Packagist drupal/ai Packagist:https://packages.drupal.org/8 drupal/ai |
REDAXO allows Authenticated Reflected Cross Site Scripting - packages installation CVE-2025-27412, GHSA-8366-xmgf-334f | Medium | 0.3% | 05 Mar, 2025 | Packagist redaxo/source |
REDAXO allows Arbitrary File Upload in the mediapool page CVE-2025-27411, GHSA-wppf-gqj5-fc4f | Medium | 0.3% | 05 Mar, 2025 | Packagist redaxo/source |
Formwork has a cross-site scripting (XSS) vulnerability in Site title GHSA-vf6x-59hh-332f | Medium | Not scored | 01 Mar, 2025 | Packagist getformwork/formwork |
Mautic allows Relative Path Traversal in assets file upload CVE-2022-25773, GHSA-4w2w-36vm-c8hf | Medium | 0.6% | 26 Feb, 2025 | Packagist mautic/core |
Moodle allows teachers to evade trusttext config when restoring glossary entries BIT-moodle-2025-26532, CVE-2025-26532, GHSA-cw24-f6fq-7j9v | Medium | 0.3% | 24 Feb, 2025 | Packagist moodle/moodle |
Moodle has an IDOR in badges allows disabling of arbitrary badges BIT-moodle-2025-26531, CVE-2025-26531, GHSA-g88w-v4cq-qgcp | Medium | 0.3% | 24 Feb, 2025 | Packagist moodle/moodle |
Moodle has a stored XSS in ddimageortext question type BIT-moodle-2025-26528, CVE-2025-26528, GHSA-h697-w4ph-7pcx | Medium | 0.3% | 24 Feb, 2025 | Packagist moodle/moodle |
Moodle's non-searchable tags can still be discovered on the tag search page and in the tags block BIT-moodle-2025-26527, CVE-2025-26527, GHSA-5r85-6h7f-rg3r | Medium | 0.4% | 24 Feb, 2025 | Packagist moodle/moodle |
Moodle's feedback response viewing and deletions did not respect Separate Groups mode BIT-moodle-2025-26526, CVE-2025-26526, GHSA-pxg4-xjp7-w9c5 | Medium | 0.3% | 24 Feb, 2025 | Packagist moodle/moodle |
Leantime affected by Improper Neutralization of HTML Tags CVE-2025-28254, GHSA-95j3-435g-vjcp | Medium | 0.3% | 21 Feb, 2025 | Packagist leantime/leantime |
Leantime allows Cross-Site Request Forgery (CSRF) GHSA-92xh-6x7v-4rmq | Medium | Not scored | 21 Feb, 2025 | Packagist leantime/leantime |
Leantime allows Stored Cross-Site Scripting (XSS) GHSA-63cr-xg3f-8jvr | Medium | Not scored | 21 Feb, 2025 | Packagist leantime/leantime |
Leantime allows Refelected Cross-Site Scripting (XSS) GHSA-52xf-h226-pfgx | Medium | Not scored | 21 Feb, 2025 | Packagist leantime/leantime |
Leantime has Insufficiently Protected Credentials GHSA-h6w8-27ph-c385 | Medium | Not scored | 21 Feb, 2025 | Packagist leantime/leantime |
Leantime allows Stored Cross-Site Scripting (XSS) GHSA-mg4c-884j-pcq9 | Medium | Not scored | 21 Feb, 2025 | Packagist leantime/leantime |