Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Mautic SQL Injection in dynamic Reports CVE-2022-25775, GHSA-jj6w-2cqg-7p94 | High | 0.6% | 12 Apr, 2024 | Packagist mautic/core |
Mautic vulnerable to Relative Path Traversal / Arbitrary File Deletion due to GrapesJS builder CVE-2021-27916, GHSA-9fcx-cv56-w58p | High | 0.8% | 12 Apr, 2024 | Packagist mautic/core |
timber/timber vulnerable to Deserialization of Untrusted Data CVE-2024-29800, GHSA-6363-v5m4-fvq3 | High | 0.5% | 12 Apr, 2024 | Packagist timber/timber |
Magento Open Source allows Cross-Site Scripting (XSS) BIT-magento-2024-20759, CVE-2024-20759, GHSA-59vf-hjxc-f9c5 | High | 1.0% | 10 Apr, 2024 | Packagist magento/community-edition Packagist magento/project-community-edition |
Contao: Remember-me tokens will not be cleared after a password change CVE-2024-30262, GHSA-r4r6-j2j3-7pp5 | High | 0.5% | 09 Apr, 2024 | Packagist contao/core-bundle |
Contao: Possible cookie sharing with external domains while checking protected pages for broken links CVE-2024-28235, GHSA-9jh5-qf84-x6pr | High | 0.7% | 09 Apr, 2024 | Packagist contao/core-bundle |
amphp/http-client Denial of Service via HTTP/2 CONTINUATION Frames GHSA-w8gf-g2vq-j2f4 | High | Not scored | 03 Apr, 2024 | Packagist amphp/http-client |
AMPHP Denial of Service via HTTP/2 CONTINUATION Frames CVE-2024-2653, GHSA-qjfw-cvjf-f4fm | High | 83.4% | 03 Apr, 2024 | Packagist amphp/http Packagist amphp/http-client |
Dolibarr ERP CRM Code Injection vulnerability during installation BIT-dolibarr-2024-29477, CVE-2024-29477, GHSA-p73x-rpgm-3v56 | High | 0.8% | 03 Apr, 2024 | Packagist dolibarr/dolibarr |
UVDesk Community Helpdesk Improper Privilege Management CVE-2024-3137, GHSA-57q5-h622-3cpx | High | 0.4% | 02 Apr, 2024 | Packagist uvdesk/core-framework |
Centreon insertGraphTemplate SQL Injection Remote Code Execution Vulnerability CVE-2024-23119, GHSA-626r-cj47-p49g | High | 1.4% | 01 Apr, 2024 | Packagist centreon/centreon |
Centreon updateContactHostCommands SQL Injection Remote Code Execution Vulnerability CVE-2024-23118, GHSA-2j4g-v4fv-rhwg | High | 53.4% | 01 Apr, 2024 | Packagist centreon/centreon |
Centreon updateContactServiceCommands SQL Injection Remote Code Execution Vulnerability CVE-2024-23117, GHSA-j8hg-v5qv-9m28 | High | 53.4% | 01 Apr, 2024 | Packagist centreon/centreon |
Centreon updateLCARelation SQL Injection Remote Code Execution Vulnerability CVE-2024-23116, GHSA-j4pc-vqvc-4p9x | High | 53.4% | 01 Apr, 2024 | Packagist centreon/centreon |
Centreon updateGroups SQL Injection Remote Code Execution Vulnerability CVE-2024-23115, GHSA-qjvm-p5vg-437c | High | 67.5% | 01 Apr, 2024 | Packagist centreon/centreon |
Centreon updateDirectory SQL Injection Remote Code Execution Vulnerability CVE-2024-0637, GHSA-22v7-v3mj-pm8r | High | 72.3% | 01 Apr, 2024 | Packagist centreon/centreon |
CodeIgniter4 DoS Vulnerability CVE-2024-29904, GHSA-39fp-mqmm-gxj6 | High | 0.8% | 29 Mar, 2024 | Packagist codeigniter4/framework |
Winter CMS Server-Side Template Injection (SSTI) vulnerability CVE-2024-29686, GHSA-8r5j-gm3j-cx9c | High | 1.8% | 29 Mar, 2024 | Packagist wintercms/winter |
SQL Injection vulnerability in Reportico Till CVE-2023-47438, GHSA-jjf4-959w-f545 | High | 0.5% | 27 Mar, 2024 | Packagist reportico-web/reportico |
WP Crontrol vulnerable to possible RCE when combined with a pre-condition CVE-2024-28850, GHSA-9xvf-cjvf-ff5q | High | 0.2% | 25 Mar, 2024 | Packagist johnbillion/wp-crontrol |
phpMyFAQ SQL injections at insertentry & saveentry CVE-2024-28107, GHSA-2grw-mc9r-822r | High | 1.0% | 25 Mar, 2024 | Packagist phpmyfaq/phpmyfaq |
phpMyFAQ's File Upload Bypass at Category Image Leads to RCE CVE-2024-28105, GHSA-pwh2-fpfr-x5gf | High | 1.5% | 25 Mar, 2024 | Packagist phpmyfaq/phpmyfaq |
phpMyFAQ SQL Injection at "Save News" CVE-2024-27299, GHSA-qgxx-4xv5-6hcw | High | 1.2% | 25 Mar, 2024 | Packagist phpmyfaq/phpmyfaq |
Cross-Site Request Forgery in Anchor CMS CVE-2024-29499, GHSA-4xw8-9fj7-j58j | High | 0.3% | 22 Mar, 2024 | Packagist anchorcms/anchor-cms |
Server Side Template Injection (SSTI) via Twig escape handler CVE-2024-28119, GHSA-2m7x-c7px-hp58 | High | 1.6% | 21 Mar, 2024 | Packagist getgrav/grav |
Server Side Template Injection (SSTI) CVE-2024-28118, GHSA-r6vw-8v8r-pmp4 | High | 1.2% | 21 Mar, 2024 | Packagist getgrav/grav |
Server Side Template Injection (SSTI) CVE-2024-28117, GHSA-qfv4-q44r-g7rv | High | 1.4% | 21 Mar, 2024 | Packagist getgrav/grav |
Server-Side Template Injection (SSTI) with Grav CMS security sandbox bypass CVE-2024-28116, GHSA-c9gp-64c4-2rrh | High | 5.8% | 21 Mar, 2024 | Packagist getgrav/grav |
Grav File Upload Path Traversal CVE-2024-27921, GHSA-m7hx-hw6h-mqmc | High | 60.6% | 21 Mar, 2024 | Packagist getgrav/grav |
RaspAP Vulnerable to Code Injection via an Unknown Process in File `includes/provider.php` CVE-2024-2497, GHSA-99wg-vmvq-2cp5 | High | 0.9% | 15 Mar, 2024 | Packagist billz/raspap-webgui |
raspap-webgui vulnerable to denial of service CVE-2024-28754, GHSA-vc9f-mgxr-h32r | High | 0.9% | 09 Mar, 2024 | Packagist billz/raspap-webgui |
PocketMine-MP server crash with certain invalid JSON payloads in `LoginPacket` due to dependency vulnerability (3rd time) CVE-2024-58381, GHSA-h6j3-j35f-v2x7 | High | 0.8% | 06 Mar, 2024 | Packagist pocketmine/pocketmine-mp |
PocketMine-MP BookEditPacket crash when inventory slot in the packet is invalid CVE-2024-58380, GHSA-xc7j-wj36-qjfr | High | 0.5% | 06 Mar, 2024 | Packagist pocketmine/pocketmine-mp |
Remote Code Execution by uploading a phar file using frontmatter CVE-2024-27923, GHSA-f6g2-h7qv-3m5v | High | 1.4% | 06 Mar, 2024 | Packagist getgrav/grav |
Shopware's session is persistent in Cache for 404 pages CVE-2024-27917, GHSA-c2f9-4jmm-v45m | High | 0.6% | 06 Mar, 2024 | Packagist shopware/platform Packagist shopware/storefront |
Sulu grants access to pages regardless of role permissions CVE-2024-27915, GHSA-jr83-m233-gg6p | High | 0.4% | 04 Mar, 2024 | Packagist sulu/sulu |
phpseclib guardrails needed on OID length CVE-2024-27355, GHSA-f2qx-66wf-wvvx | High | 0.6% | 01 Mar, 2024 | Packagist phpseclib/phpseclib |
phpseclib: guardrails needed on isPrime and randomPrime CVE-2024-27354, GHSA-2528-jw5q-ww88 | High | 0.6% | 01 Mar, 2024 | Packagist phpseclib/phpseclib |
Bagisto Cross-Site Request Forgery vulnerability CVE-2023-36237, GHSA-7p7q-fjfw-v3gf | High | 0.4% | 26 Feb, 2024 | Packagist bagisto/bagisto |
Appwrite Directory Traversal vulnerability CVE-2022-25377, GHSA-wfm3-gq9h-mrjm | High | 0.8% | 22 Feb, 2024 | Packagist appwrite/server-ce |
baserCMS OS command injection vulnerability in Installer CVE-2023-51450, GHSA-77fc-4cv5-hmfr | High | 1.5% | 22 Feb, 2024 | Packagist baserproject/basercms |
Kirby vulnerable to unrestricted file upload of user avatar images CVE-2024-26483, GHSA-xrvh-rvc4-5m43 | High | 1.0% | 22 Feb, 2024 | Packagist getkirby/cms |
Withdrawn Advisory: Kirby CMS HTML injection vulnerability CVE-2024-26482, GHSA-qv4x-v2v4-f8p9 | High | 0.3% | 22 Feb, 2024 | Packagist getkirby/cms |
MantisBT Host Header Injection vulnerability CVE-2024-23830, GHSA-mcqj-7p29-9528 | High | 1.0% | 20 Feb, 2024 | Packagist mantisbt/mantisbt |
Cross-Site Request Forgery in moodle BIT-moodle-2024-25982, CVE-2024-25982, GHSA-7pjp-fm93-p6pj | High | 0.5% | 19 Feb, 2024 | Packagist moodle/moodle |
Uncontrolled Resource Consumption in moodle BIT-moodle-2024-25978, CVE-2024-25978, GHSA-487g-3m3v-hjhq | High | 0.9% | 19 Feb, 2024 | Packagist moodle/moodle |
Code injection in REDAXO CVE-2024-25298, GHSA-7f2v-5877-rx3x | High | 1.1% | 17 Feb, 2024 | Packagist redaxo/source |
TYPO3 Install Tool vulnerable to Code Execution CVE-2024-22188, GHSA-5w2h-59j3-8x5w | High | 2.0% | 13 Feb, 2024 | Packagist typo3/cms-core |
TYPO3 vulnerable to Improper Access Control Persisting File Abstraction Layer Entities via Data Handler CVE-2024-25121, GHSA-rj3x-wvc6-5j66 | High | 0.5% | 13 Feb, 2024 | Packagist typo3/cms-core |
derhansen/sf_event_mgt vulnerable to Broken Access Control in Backend Module CVE-2024-24751, GHSA-4576-pgh2-g34j | High | 0.5% | 13 Feb, 2024 | Packagist derhansen/sf_event_mgt |