Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
scheb/two-factor-bundle bypass two-factor authentication with unverified JWT trusted device token GHSA-h6mp-mc7g-mg49 | High | Not scored | 21 May, 2024 | Packagist scheb/two-factor-bundle |
robrichards/xmlseclibs XPath injection GHSA-2g98-f9jv-w8c5 | High | Not scored | 20 May, 2024 | Packagist robrichards/xmlseclibs |
Passbolt API Stored XSS on first/last name during setup GHSA-2f46-4xjm-73x5 | High | Not scored | 20 May, 2024 | Packagist passbolt/passbolt_api |
Passbolt Api Remote code execution GHSA-cv5c-2qv5-w2m2 | High | Not scored | 20 May, 2024 | Packagist passbolt/passbolt_api |
nzo/url-encryptor-bundle Insecure default secret key and IV allowing anyone to decrypt values GHSA-r2r8-36pq-27cm | High | Not scored | 17 May, 2024 | Packagist nzo/url-encryptor-bundle |
Cross-site Scripting vulnerabilities in Neos GHSA-6cj3-rc4p-f38f | High | Not scored | 17 May, 2024 | Packagist neos/neos |
Neos Information Disclosure Security Note GHSA-3c5g-73f7-grvm | High | Not scored | 17 May, 2024 | Packagist neos/neos |
namshi/jose insecure JSON Web Signatures (JWS) GHSA-hxhc-wmg8-xrqf | High | Not scored | 17 May, 2024 | Packagist namshi/jose |
laravel framework SQL Injection via limit and offset functions GHSA-wq8p-mqvg-2p5h | High | Not scored | 15 May, 2024 | Packagist laravel/framework |
laravel framework Unexpected database bindings via requests GHSA-jwvj-pwww-3mj5 | High | Not scored | 15 May, 2024 | Packagist laravel/framework |
Laravel Cookie serialization vulnerability GHSA-6jvx-8ch9-j2jr | High | Not scored | 15 May, 2024 | Packagist laravel/framework |
Laravel Cookie serialization vulnerability GHSA-2867-6rrm-38gr | High | Not scored | 15 May, 2024 | Packagist illuminate/cookie |
gregwar/rst Local File Inclusion Vulnerability GHSA-2gq2-m628-33xp | High | Not scored | 15 May, 2024 | Packagist gregwar/rst |
fuel/core ImageMagick driver does not escape all shell arguments. GHSA-26hp-cgjj-m2j3 | High | Not scored | 15 May, 2024 | Packagist fuel/core |
FOSUserBundle Session Hijacking Vulnerability GHSA-6mjq-9x4w-m3w9 | High | Not scored | 15 May, 2024 | Packagist friendsofsymfony/user-bundle |
eZ Platform User data disclosure GHSA-3g43-xfrw-pv5m | High | Not scored | 15 May, 2024 | Packagist ezsystems/repository-forms |
EZsystems Remote code execution in file uploads GHSA-9895-26wr-4fgv | High | Not scored | 15 May, 2024 | Packagist ezsystems/ezpublish-legacy |
eZ Publish Legacy Passwordless login for LDAP users GHSA-p9mp-vq4v-v5m5 | High | Not scored | 15 May, 2024 | Packagist ezsystems/ezpublish-legacy |
eZ Platform Object Injection in SiteAccessMatchListener GHSA-64vj-933f-6pm3 | High | Not scored | 15 May, 2024 | Packagist ezsystems/ezpublish-kernel |
eZ Publish Legacy Patch EZSA-2018-001 for Several vulnerabilities GHSA-82rv-45pc-v28w | High | Not scored | 15 May, 2024 | Packagist ezsystems/ezpublish-legacy |
eZ Publish Information disclosure in backend content tree menu GHSA-cc2j-92jq-wgjg | High | Not scored | 15 May, 2024 | Packagist ezsystems/ezpublish-legacy |
eZ Publish Remote code execution in file uploads GHSA-3vwr-jj4f-h98x | High | Not scored | 15 May, 2024 | Packagist ezsystems/ezpublish-kernel |
eZ Platform CSRF token in login form is disabled by default GHSA-45qm-j4m9-whv9 | High | Not scored | 15 May, 2024 | Packagist ezsystems/ezplatform |
eZ Platform Admin UI Password reset vulnerability GHSA-hfpp-2vhw-qq43 | High | Not scored | 15 May, 2024 | Packagist ezsystems/ezplatform-user |
eZ Platform Object Injection in SiteAccessMatchListener GHSA-2w9p-xxqr-h253 | High | Not scored | 15 May, 2024 | Packagist ezsystems/ezplatform-kernel |
eZ Platform Admin UI Cross-site Scripting vulnerability GHSA-q73v-79x3-jv2w | High | Not scored | 15 May, 2024 | Packagist ezsystems/ezplatform-admin-ui |
eZ Platform Password reset vulnerability GHSA-cg84-55jx-4237 | High | Not scored | 15 May, 2024 | Packagist ezsystems/ezplatform-admin-ui |
Cross-site Scripting in eZFind spellcheck GHSA-9cq2-pcgr-8h62 | High | Not scored | 15 May, 2024 | Packagist ezsystems/ezfind-ls |
Cross-site Scripting (XSS) in DemoBundle/ezdemo bundled VideoJS GHSA-jq9q-6p42-qpr7 | High | Not scored | 15 May, 2024 | Packagist ezsystems/ezdemo-ls-extension |
Cross-site Scripting (XSS) in DemoBundle/ezdemo bundled VideoJS GHSA-8c85-4rr5-chr4 | High | Not scored | 15 May, 2024 | Packagist ezsystems/demobundle |
Drupal core Arbitrary PHP code execution GHSA-j66p-fvp2-fxhj | High | Not scored | 15 May, 2024 | Packagist drupal/drupal |
Drupal core Multiple vulnerabilities due to the use of the third-party library Archive_Tar GHSA-m9fv-whq2-6wmc | High | Not scored | 15 May, 2024 | Packagist drupal/drupal |
Drupal core Arbitrary PHP code execution GHSA-gxxj-g9v8-w28p | High | Not scored | 15 May, 2024 | Packagist drupal/core |
Drupal core Multiple vulnerabilities due to the use of the third-party library Archive_Tar GHSA-98h9-727m-44qv | High | Not scored | 15 May, 2024 | Packagist drupal/core |
doctrine/orm Regression in Query Parenthesis can have Security Implications GHSA-vjrg-wpm8-rhrw | High | Not scored | 15 May, 2024 | Packagist doctrine/orm |
Doctrine DBAL SQL injection possibility GHSA-76w8-mqx4-wjrf | High | Not scored | 15 May, 2024 | Packagist doctrine/dbal |
contao/core PHP object injection vulnerability allows for arbitrary code execution GHSA-wq43-8r5p-w3mc | High | Not scored | 15 May, 2024 | Packagist contao/core |
OpenCFP Framework (Sentry) Account takeover via null password reset codes GHSA-2m5g-8xpw-42vp | High | Not scored | 15 May, 2024 | Packagist cartalyst/sentry |
easyadmin-extension-bundle action case insensitivity GHSA-32rx-xvvr-4xv9 | High | Not scored | 15 May, 2024 | Packagist alterphp/easyadmin-extension-bundle |
pygmentize Remote Code Execution GHSA-77mv-mp2j-gxxh | High | Not scored | 15 May, 2024 | Packagist 3f/pygmentize |
Reportico Web fails to invalidate cookies upon logout CVE-2024-31556, GHSA-2q2f-h83x-cx3x | High | 0.2% | 14 May, 2024 | Packagist reportico-web/reportico |
Mantis Bug Tracker (MantisBT) allows user account takeover in the signup/reset password process CVE-2024-34077, GHSA-93x3-m7pw-ppqm | High | 1.2% | 13 May, 2024 | Packagist mantisbt/mantisbt |
image-optimizer allows PHAR deserialization CVE-2024-34515, GHSA-6pjm-hmvf-h4rr | High | 1.9% | 05 May, 2024 | Packagist spatie/image-optimizer |
LibreNMS vulnerable to a Time-Based Blind SQL injection leads to database extraction CVE-2024-32480, GHSA-jh57-j3vq-h438 | High | 20.3% | 22 Apr, 2024 | Packagist librenms/librenms |
LibreNMS uses Improper Sanitization on Service template name leads to Stored XSS CVE-2024-32479, GHSA-72m9-7c8x-pmmw | High | 34.1% | 22 Apr, 2024 | Packagist librenms/librenms |
LibreNMS vulnerable to SQL injection time-based leads to database extraction CVE-2024-32461, GHSA-cwx6-cx7x-4q34 | High | 19.1% | 22 Apr, 2024 | Packagist librenms/librenms |
TCPDF vulnerable to Regular Expression Denial of Service CVE-2024-22640, GHSA-mx3p-fhpw-x6rv | High | 1.3% | 19 Apr, 2024 | Packagist tecnickcom/tcpdf |
Dolibarr vulnerable to Cross-Site Request Forgery BIT-dolibarr-2024-31503, CVE-2024-31503, GHSA-6ppg-rgrg-f573 | High | 0.3% | 17 Apr, 2024 | Packagist dolibarr/dolibarr |
Dusk plugin may allow unfettered user authentication in misconfigured installs CVE-2024-32003, GHSA-chcp-g9j5-3xxx | High | 0.7% | 12 Apr, 2024 | Packagist winter/wn-dusk-plugin |
Mautic Sensitive Data Exposure due to inadequate user permission settings CVE-2022-25776, GHSA-qjx3-2g35-6hv8 | High | 0.4% | 12 Apr, 2024 | Packagist mautic/core |