Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Microweber Cross-site Scripting vulnerability CVE-2024-33297, GHSA-j4v9-cm37-h7c2 | Medium | 1.2% | 10 Jan, 2025 | Packagist microweber/microweber |
Stored XSS in REDAXO CVE-2024-13209, GHSA-7wj8-856p-qc9m | Medium | 0.4% | 09 Jan, 2025 | Packagist redaxo/source |
Carbon has an arbitrary file include via unvalidated input passed to Carbon::setLocale CVE-2025-22145, GHSA-j3f9-p6hm-5w6q | Medium | 0.8% | 08 Jan, 2025 | Packagist nesbot/carbon |
Guzzle OAuth Subscriber has insufficient nonce entropy CVE-2025-21617, GHSA-237r-r8m4-4q88 | Medium | 0.5% | 06 Jan, 2025 | Packagist guzzlehttp/oauth-subscriber |
REDAXO CMS Cross-site Scripting vulnerability CVE-2024-46209, GHSA-2p95-8xvm-2pjx | Medium | 0.4% | 06 Jan, 2025 | Packagist redaxo/source |
Grav Cross-site Scripting vulnerability CVE-2024-35498, GHSA-m78c-qx99-mvw9 | Medium | 0.4% | 06 Jan, 2025 | Packagist getgrav/grav |
PhpSpreadsheet allows bypass XSS sanitizer using the javascript protocol and special characters CVE-2024-56412, GHSA-q9jv-mm3r-j47r | Medium | 0.4% | 03 Jan, 2025 | Packagist phpoffice/phpexcel Packagist phpoffice/phpspreadsheet |
PhpSpreadsheet has a Cross-Site Scripting (XSS) vulnerability of the hyperlink base in the HTML page header CVE-2024-56411, GHSA-hwcp-2h35-p66w | Medium | 0.4% | 03 Jan, 2025 | Packagist phpoffice/phpexcel Packagist phpoffice/phpspreadsheet |
PhpSpreadsheet has a Cross-Site Scripting (XSS) vulnerability in custom properties CVE-2024-56410, GHSA-wv23-996v-q229 | Medium | 0.3% | 03 Jan, 2025 | Packagist phpoffice/phpexcel Packagist phpoffice/phpspreadsheet |
The wp-enable-svg WordPress plugin does not sanitize SVG files when uploaded CVE-2024-11184, GHSA-j77f-79w9-rghc | Medium | 0.4% | 02 Jan, 2025 | Packagist mwdelaney/wp-enable-svg |
LGSL has a reflected XSS at /lgsl_files/lgsl_list.php CVE-2024-56517, GHSA-ggwq-xc72-33r3 | Medium | 0.6% | 30 Dec, 2024 | Packagist tltneon/lgsl |
TeamPass mail_me operation authorization issue CVE-2024-50702, GHSA-7rm3-4w6j-8xx4 | Medium | 0.3% | 30 Dec, 2024 | Packagist nilsteampassnet/teampass |
TeamPass does not properly check whether a folder is in a user's allowed folders list CVE-2024-50701, GHSA-2697-96mv-3gfm | Medium | 0.3% | 30 Dec, 2024 | Packagist nilsteampassnet/teampass |
Dcat-Admin Cross-Site Scripting (XSS) vulnerability CVE-2024-54775, GHSA-37x3-j9jq-vrjx | Medium | 0.3% | 27 Dec, 2024 | Packagist dcat/laravel-admin |
Dcat Admin Cross-site Scripting (XSS) vulnerability CVE-2024-54774, GHSA-9q34-7hfr-h8jm | Medium | 0.3% | 27 Dec, 2024 | Packagist dcat/laravel-admin |
Cross-site Scripting vulnerability in SimpleXLSXEx::readThemeColors, SimpleXLSXEx::getColorValue and SimpleXLSX::toHTMLEx CVE-2024-56364, GHSA-r87q-fj25-f8jf | Medium | 0.3% | 23 Dec, 2024 | Packagist shuchkin/simplexlsx |
Browsershot Improper Input Validation vulnerability CVE-2024-21549, GHSA-c9f5-29f6-c35w | Medium | 0.6% | 20 Dec, 2024 | Packagist spatie/browsershot |
Browsershot Local File Inclusion CVE-2024-21544, GHSA-g2r4-phv7-5fgv | Medium | 0.6% | 13 Dec, 2024 | Packagist spatie/browsershot |
Cross-site Scripting vulnerability in SimpleXLSXEx::readXfs and SimpeXLSX::toHTMLEx CVE-2024-55878, GHSA-x6mh-rjwm-8ph7 | Medium | 0.5% | 12 Dec, 2024 | Packagist shuchkin/simplexlsx |
LibreNMS stored cross-site scripting (XSS) vulnerability in the Device Settings section CVE-2024-53457, GHSA-6c5q-fg3g-qhhv | Medium | 46.4% | 05 Dec, 2024 | Packagist librenms/librenms |
ibexa/post-install affected by Breach with Varnish VCL GHSA-4h8f-c635-25p7 | Medium | Not scored | 02 Dec, 2024 | Packagist ibexa/post-install |
ibexa/http-cache affected by Breach with Varnish VCL GHSA-fh7v-q458-7vmw | Medium | Not scored | 02 Dec, 2024 | Packagist ibexa/http-cache |
ezsystems/ezplatform-http-cache affected by Breach with Varnish VCL GHSA-mgfg-7533-7jf6 | Medium | Not scored | 02 Dec, 2024 | Packagist ezsystems/ezplatform-http-cache |
Ibexa Admin UI vulnerable to Cross-site Scripting in a field that is used in the Content name pattern CVE-2024-53864, GHSA-8w3p-gf85-qcch | Medium | 0.5% | 29 Nov, 2024 | Packagist ibexa/admin-ui |
TCPDF Local File Inclusion vulnerability CVE-2024-51058, GHSA-rmv2-8jjc-23xw | Medium | 0.8% | 26 Nov, 2024 | Packagist tecnickcom/tcpdf |
Drupal Core Cross-Site Scripting (XSS) BIT-drupal-2024-12393, CVE-2024-12393, DRUPAL-CORE-2024-003, GHSA-8mvq-8h2v-j9vf | Medium | 0.3% | 20 Nov, 2024 | Packagist drupal/core Packagist drupal/core-recommended Packagist drupal/drupal |
Moodle IDOR when accessing list of course badges BIT-moodle-2024-48899, CVE-2024-48899, GHSA-r4xr-m393-778m | Medium | 0.3% | 20 Nov, 2024 | Packagist moodle/moodle |
Moodle Lesson activity password bypass through PHP loose comparison BIT-moodle-2024-45691, CVE-2024-45691, GHSA-xfv7-h2qg-rjm7 | Medium | 0.4% | 20 Nov, 2024 | Packagist moodle/moodle |
Moodle allows users to retrieve information they did not have permission to access BIT-moodle-2024-45689, CVE-2024-45689, GHSA-j822-x5gg-5r56 | Medium | 0.4% | 20 Nov, 2024 | Packagist moodle/moodle |
Statamic CMS has a Path Traversal in Asset Upload CVE-2024-52600, GHSA-p7f6-8mcm-fwv3 | Medium | 0.6% | 19 Nov, 2024 | Packagist statamic/cms |
Redaxo Core CMS Cross Site Scripting (XSS) CVE-2024-50803, GHSA-m5vv-7jxc-8p6x | Medium | 0.6% | 19 Nov, 2024 | Packagist redaxo/source |
moodle: IDOR when fetching report schedules BIT-moodle-2024-48901, CVE-2024-48901, GHSA-mg54-p2wj-5ph7 | Medium | 0.3% | 18 Nov, 2024 | Packagist moodle/moodle |
moodle: Some users can delete audiences of other reports BIT-moodle-2024-48898, CVE-2024-48898, GHSA-fjq9-452g-jg3q | Medium | 0.3% | 18 Nov, 2024 | Packagist moodle/moodle |
moodle: IDOR in edit/delete RSS feed BIT-moodle-2024-48897, CVE-2024-48897, GHSA-x3x9-349x-2485 | Medium | 0.3% | 18 Nov, 2024 | Packagist moodle/moodle |
Moodle leaks user names BIT-moodle-2024-48896, CVE-2024-48896, GHSA-cq5f-wv7p-5gfc | Medium | 0.4% | 18 Nov, 2024 | Packagist moodle/moodle |
LibreNMS has a stored XSS in ExamplePlugin with Device's Notes CVE-2024-49758, GHSA-c86q-rj37-8f85 | Medium | 0.4% | 15 Nov, 2024 | Packagist librenms/librenms |
CSRF leading to delete account in wallabag/wallabag CVE-2023-0737, GHSA-99w8-c5f6-96pp | Medium | 0.3% | 15 Nov, 2024 | Packagist wallabag/wallabag |
Improper Authorization in dolibarr/dolibarr BIT-dolibarr-2021-3991, CVE-2021-3991, GHSA-wppr-j57c-8jpm | Medium | 0.3% | 15 Nov, 2024 | Packagist dolibarr/dolibarr |
Cross site scripting in sylius/sylius CVE-2021-3841, GHSA-hhvr-2q69-4563 | Medium | 0.3% | 15 Nov, 2024 | Packagist sylius/sylius |
UnoPim Stored XSS : Cookie hijacking through Create User function CVE-2024-52305, GHSA-cgr4-c233-h733 | Medium | 0.2% | 13 Nov, 2024 | Packagist unopim/unopim |
Moodle IDOR when accessing list of badge recipients BIT-moodle-2024-48900, CVE-2024-48900, GHSA-g8r3-2v89-j6r5 | Medium | 0.4% | 13 Nov, 2024 | Packagist moodle/moodle |
Orchid Platform has Method Exposure Vulnerability in Modals CVE-2024-51992, GHSA-cm46-gqf4-mv4f | Medium | 0.3% | 11 Nov, 2024 | Packagist orchid/platform |
Moodle reflected XSS via H5P error message BIT-moodle-2024-43439, CVE-2024-43439, GHSA-hjgc-jxjc-8v9j | Medium | 0.4% | 11 Nov, 2024 | Packagist moodle/moodle |
Moodle Cross-site Scripting vulnerability BIT-moodle-2024-43437, CVE-2024-43437, GHSA-4hjf-6pxr-549h | Medium | 0.3% | 11 Nov, 2024 | Packagist moodle/moodle |
Moodle has insufficient capability checks BIT-moodle-2024-43435, CVE-2024-43435, GHSA-4gq2-x5w4-7hp8 | Medium | 0.3% | 11 Nov, 2024 | Packagist moodle/moodle |
Moodle's user/power level management inconsistent with suspended users BIT-moodle-2024-43433, CVE-2024-43433, GHSA-q99x-mjmh-v8w7 | Medium | 0.3% | 11 Nov, 2024 | Packagist moodle/moodle |
Moodle authorization headers preserved between "emulated redirects" BIT-moodle-2024-43432, CVE-2024-43432, GHSA-7wmp-2xmx-g6h8 | Medium | 0.3% | 11 Nov, 2024 | Packagist moodle/moodle |
Moodle has insufficient access control BIT-moodle-2024-43430, CVE-2024-43430, GHSA-jpf2-9ppp-2c49 | Medium | 0.3% | 11 Nov, 2024 | Packagist moodle/moodle |
Moodle has user information visibility control issues in gradebook reports BIT-moodle-2024-43429, CVE-2024-43429, GHSA-c767-4whh-v7rw | Medium | 0.3% | 11 Nov, 2024 | Packagist moodle/moodle |
Froala WYSIWYG editor allows cross-site scripting (XSS) CVE-2024-51434, GHSA-549p-5c7f-c5p4 | Medium | 0.4% | 07 Nov, 2024 | Packagist froala/wysiwyg-editor npm froala-editor |