Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Leantime has Host Header Injection Vulnerability GHSA-99r5-84gr-59f6 | Medium | Not scored | 21 Feb, 2025 | Packagist leantime/leantime |
Drupal Core Vulnerable to Forceful Browsing BIT-drupal-2025-31673, CVE-2025-31673, DRUPAL-CORE-2025-002, GHSA-wpp8-fjgf-pwc7 | Medium | 0.3% | 19 Feb, 2025 | Packagist drupal/core |
Drupal Core Potential Cross-Site Scripting (XSS) via Error Messages BIT-drupal-2025-3057, CVE-2025-3057, DRUPAL-CORE-2025-001, GHSA-39g6-x4x8-5jcm | Medium | 0.3% | 19 Feb, 2025 | Packagist drupal/core |
Remote code execution in alextselegidis/easyappointments CVE-2024-57601, GHSA-3wf7-83q3-948c | Medium | 0.5% | 12 Feb, 2025 | Packagist alextselegidis/easyappointments |
Drupal Configuration Split Cross-Site Request Forgery (CSRF) vulnerability CVE-2025-31688, DRUPAL-CONTRIB-2025-017, GHSA-qq45-cqhg-jwx5 | Medium | 0.2% | 12 Feb, 2025 | Packagist drupal/config_split Packagist:https://packages.drupal.org/8 drupal/config_split |
Drupal SpamSpan Cross-Site Scripting (XSS) vulnerability CVE-2025-31687, DRUPAL-CONTRIB-2025-016, GHSA-8r2q-865v-wm8j | Medium | 0.3% | 12 Feb, 2025 | Packagist drupal/spamspan Packagist:https://packages.drupal.org/8 drupal/spamspan |
Magento Improper Access Control vulnerability CVE-2025-24437, GHSA-469f-wf4f-3jjv | Medium | 0.4% | 11 Feb, 2025 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento Improper Access Control vulnerability CVE-2025-24436, GHSA-ghpr-6qhr-rpp8 | Medium | 0.5% | 11 Feb, 2025 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento Improper Access Control vulnerability CVE-2025-24435, GHSA-82p4-55gj-956p | Medium | 0.5% | 11 Feb, 2025 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento stored Cross-Site Scripting (XSS) vulnerability CVE-2025-24428, GHSA-mm87-rrqx-94cr | Medium | 0.4% | 11 Feb, 2025 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento Improper Access Control vulnerability CVE-2025-24427, GHSA-v3hq-g424-5mgg | Medium | 0.6% | 11 Feb, 2025 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento Business Logic Error vulnerability CVE-2025-24425, GHSA-6ff8-jrfg-43hh | Medium | 0.6% | 11 Feb, 2025 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento Improper Access Control vulnerability CVE-2025-24424, GHSA-539v-w87w-w62c | Medium | 0.8% | 11 Feb, 2025 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento Incorrect Authorization vulnerability CVE-2025-24421, GHSA-v6r2-425c-hfrr | Medium | 0.5% | 11 Feb, 2025 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento Information Exposure vulnerability CVE-2025-24408, GHSA-3cfg-w257-cgf8 | Medium | 1.0% | 11 Feb, 2025 | Packagist magento/community-edition Packagist magento/project-community-edition |
Connect-CMS Access control vulnerability GHSA-5rjc-jc28-cwgg | Medium | Not scored | 07 Feb, 2025 | Packagist opensource-workshop/connect-cms |
Pimcore Admin Classic Bundle allows user enumeration CVE-2025-24980, GHSA-vr5f-php7-rg24 | Medium | 0.5% | 07 Feb, 2025 | Packagist pimcore/admin-ui-classic-bundle |
Drupal OAuth2 Client Cross-Site Request Forgery (CSRF) CVE-2025-31684, DRUPAL-CONTRIB-2025-013, GHSA-6chf-hhqf-749c | Medium | 0.2% | 05 Feb, 2025 | Packagist drupal/oauth2_client Packagist:https://packages.drupal.org/8 drupal/oauth2_client |
Browsershot Local File Inclusion CVE-2025-1026, GHSA-f2q5-6mx7-q9qq | Medium | 0.5% | 05 Feb, 2025 | Packagist spatie/browsershot |
PhpSpreadsheet allows bypassing of XSS sanitizer using the javascript protocol and special characters CVE-2025-23210, GHSA-r57h-547h-w24f | Medium | 0.4% | 03 Feb, 2025 | Packagist phpoffice/phpexcel Packagist phpoffice/phpspreadsheet |
DevDojo Voyager Arbitrary File Write CVE-2024-55417, GHSA-35p2-5vrh-m3p6 | Medium | 14.1% | 30 Jan, 2025 | Packagist tcg/voyager |
Drupal Google Tag Cross-Site Request Forgery (CSRF) CVE-2025-31683, DRUPAL-CONTRIB-2025-012, GHSA-qchr-8m24-7v66 | Medium | 0.2% | 29 Jan, 2025 | Packagist drupal/google_tag Packagist:https://packages.drupal.org/8 drupal/google_tag |
Drupal Google Tag Cross-Site Scripting (XSS) vulnerability CVE-2025-31682, DRUPAL-CONTRIB-2025-011, GHSA-36vv-q5jv-94cj | Medium | 0.2% | 29 Jan, 2025 | Packagist drupal/google_tag Packagist:https://packages.drupal.org/8 drupal/google_tag |
Twig security issue where escaping was missing when using null coalesce operator CVE-2025-24374, GHSA-3xg3-cgvq-2xwr | Medium | 0.3% | 29 Jan, 2025 | Packagist twig/twig |
Drupal Matomo Analytics Cross-Site Request Forgery (CSRF) vulnerability CVE-2025-31680, DRUPAL-CONTRIB-2025-008, GHSA-jh66-rjx8-8qqc | Medium | 0.2% | 29 Jan, 2025 | Packagist drupal/matomo Packagist:https://packages.drupal.org/8 drupal/matomo |
TYPO3-EXT-SA-2025-001: Account Takeover in extension "OpenID Connect Authentication" (oidc) CVE-2025-24856, GHSA-hj78-p4h7-m5fv | Medium | 0.2% | 28 Jan, 2025 | Packagist causal/oidc |
pimcore/customer-data-framework vulnerable to SQL Injection CVE-2024-11956, GHSA-q53r-9hh9-w277 | Medium | 0.9% | 28 Jan, 2025 | Packagist pimcore/customer-management-framework-bundle |
phpMyAdmin XSS when checking tables BIT-phpmyadmin-2025-24530, CVE-2025-24530, GHSA-222v-cx2c-q2f5 | Medium | 0.4% | 23 Jan, 2025 | Packagist phpmyadmin/phpmyadmin |
Drupal Ignition Cross-Site Scripting (XSS) vulnerability CVE-2025-31679, DRUPAL-CONTRIB-2025-007, GHSA-rhxm-r44m-4325 | Medium | 0.3% | 22 Jan, 2025 | Packagist drupal/ignition Packagist:https://packages.drupal.org/8 drupal/ignition |
ps_contactinfo has a potential XSS due to usage of the nofilter tag in template CVE-2025-24027, GHSA-35pq-7pv2-2rfw | Medium | 0.4% | 22 Jan, 2025 | Packagist prestashop/ps_contactinfo |
Missing validation of header name and value in codeigniter4/framework CVE-2025-24013, GHSA-x5mq-jjr3-vmx6 | Medium | 0.5% | 20 Jan, 2025 | Packagist codeigniter4/framework |
Cross-Site Scripting (XSS) vulnerability in generateNavigation() function in PhpSpreadsheet CVE-2025-22131, GHSA-79xx-vf93-p7cx | Medium | 0.4% | 20 Jan, 2025 | Packagist phpoffice/phpexcel Packagist phpoffice/phpspreadsheet |
Librenms has a reflected XSS on error alert CVE-2025-23201, GHSA-g84x-g96g-rcjc | Medium | 0.4% | 16 Jan, 2025 | Packagist librenms/librenms |
LibreNMS Misc Section Stored Cross-site Scripting vulnerability CVE-2025-23200, GHSA-c66p-64fj-jmc2 | Medium | 31.6% | 16 Jan, 2025 | Packagist librenms/librenms |
LibreNMS Ports Stored Cross-site Scripting vulnerability CVE-2025-23199, GHSA-27vf-3g4f-6jp7 | Medium | 1.3% | 16 Jan, 2025 | Packagist librenms/librenms |
LibreNMS Display Name Stored Cross-site Scripting vulnerability CVE-2025-23198, GHSA-pm8j-3v64-92cq | Medium | 0.4% | 16 Jan, 2025 | Packagist librenms/librenms |
LibreNMS Display Name 2 Stored Cross-site Scripting vulnerability CVE-2024-56144, GHSA-2f4w-6mc7-4w78 | Medium | 0.4% | 16 Jan, 2025 | Packagist librenms/librenms |
Silverstripe Framework has a XSS in form messages CVE-2024-53277, GHSA-ff6q-3c9c-6cf5 | Medium | 0.3% | 14 Jan, 2025 | Packagist silverstripe/framework |
Silverstripe Framework has a XSS via insert media remote file oembed CVE-2024-47605, GHSA-7cmp-cgg8-4c82 | Medium | 1.2% | 14 Jan, 2025 | Packagist silverstripe/framework |
Mediawiki - DataTransfer Extension Cross-Site Request Forgery (CSRF) and Cross-site Scripting (XSS) CVE-2025-23081, GHSA-c3h5-h73c-29hq | Medium | 0.2% | 14 Jan, 2025 | Packagist mediawiki/data-transfer |
TYPO3 DB Check Module vulnerable to Cross-Site Request Forgery CVE-2024-55945, GHSA-8mv3-37rc-pvxj | Medium | 0.2% | 14 Jan, 2025 | Packagist typo3/cms-lowlevel |
TYPO3 Indexed Search Module vulnerable to Cross-Site Request Forgery CVE-2024-55923, GHSA-7r5q-4qgx-v545 | Medium | 0.2% | 14 Jan, 2025 | Packagist typo3/cms-indexed-search |
TYPO3 Form Framework Module vulnerable to Cross-Site Request Forgery CVE-2024-55922, GHSA-ww7h-g2qf-7xv6 | Medium | 0.2% | 14 Jan, 2025 | Packagist typo3/cms-form |
TYPO3 Cross-Site Request Forgery in Dashboard Module CVE-2024-55920, GHSA-qwx7-39pw-2mhr | Medium | 0.2% | 14 Jan, 2025 | Packagist typo3/cms-dashboard |
TYPO3 Cross-Site Request Forgery in Backend User Module CVE-2024-55894, GHSA-6w4x-gcx3-8p7v | Medium | 0.3% | 14 Jan, 2025 | Packagist typo3/cms-beuser |
TYPO3 Cross-Site Request Forgery in Log Module CVE-2024-55893, GHSA-cjfr-9f5r-3q93 | Medium | 0.3% | 14 Jan, 2025 | Packagist typo3/cms-belog |
TYPO3 Potential Open Redirect via Parsing Differences CVE-2024-55892, GHSA-2fx5-pggv-6jjr | Medium | 0.2% | 14 Jan, 2025 | Packagist typo3/cms-core |
TYPO3 Information Disclosure via Exception Handling/Logger CVE-2024-55891, GHSA-38x7-cc6w-j27q | Medium | 0.3% | 14 Jan, 2025 | Packagist typo3/cms-install |
Microweber Cross-site Scripting vulnerability CVE-2024-33299, GHSA-97h9-p9f8-4p3r | Medium | 1.2% | 10 Jan, 2025 | Packagist microweber/microweber |
Microweber Cross-site Scripting vulnerability CVE-2024-33298, GHSA-w5g5-4jj3-8f6v | Medium | 0.9% | 10 Jan, 2025 | Packagist microweber/microweber |