Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
October CMS Cross-site Scripting vulnerability CVE-2023-25365, GHSA-gcgj-qh8p-57hm | High | 0.4% | 08 Feb, 2024 | Packagist october/october |
Composer code execution and possible privilege escalation via compromised InstalledVersions.php or installed.php BIT-composer-2024-24821, CVE-2024-24821, GHSA-7c6p-848j-wh5h | High | 0.3% | 08 Feb, 2024 | Packagist composer/composer |
Statmic CMS vulnerable to account takeover via XSS and password reset link CVE-2024-24570, GHSA-vqxq-hvxw-9mv9 | High | 0.7% | 01 Feb, 2024 | Packagist statamic/cms |
livewire Cross-Site Request Forgery vulnerability CVE-2024-22859, GHSA-2cjh-75gp-34gc | High | 0.5% | 01 Feb, 2024 | Packagist livewire/livewire |
Craft CMS Feed-Me CVE-2023-36260, GHSA-6p78-f7h9-6838 | High | 1.1% | 30 Jan, 2024 | Packagist craftcms/cms |
Dolibarr Application Home Page has HTML injection vulnerability BIT-dolibarr-2024-23817, CVE-2024-23817, GHSA-7947-48q7-cp5m | High | 0.6% | 25 Jan, 2024 | Packagist dolibarr/dolibarr |
Arbitrary Code Execution in Processwire CVE-2023-24676, GHSA-2cvg-w29m-j8xc | High | 1.3% | 24 Jan, 2024 | Packagist processwire/processwire |
SQL Injection in Admin download files as zip CVE-2024-23646, GHSA-cwx6-4wmf-c6xv | High | 1.0% | 24 Jan, 2024 | Packagist pimcore/admin-ui-classic-bundle |
Host header injection in the password reset CVE-2024-23648, GHSA-mrqg-mwh7-q94j | High | 0.8% | 24 Jan, 2024 | Packagist pimcore/admin-ui-classic-bundle |
Drupal core Denial of Service BIT-drupal-2024-11941, CVE-2024-11941, DRUPAL-CORE-2024-001, GHSA-xq54-x54m-vcpx | High | 0.5% | 17 Jan, 2024 | Packagist drupal/core |
Drupal Denial of Service vulnerability BIT-drupal-2024-22362, CVE-2024-22362, GHSA-62cf-jvpp-48q6 | High | 0.8% | 16 Jan, 2024 | Packagist drupal/core |
WWBN AVideo Improper Restriction of Excessive Authentication Attempts vulnerability CVE-2023-49810, GHSA-v977-h4hm-rrff | High | 0.7% | 10 Jan, 2024 | Packagist wwbn/avideo |
Froxlor username/surname AND company field Bypass CVE-2023-50256, GHSA-625g-fm5w-w7w4 | High | 0.7% | 03 Jan, 2024 | Packagist froxlor/froxlor |
Craft CMS Privilege Escalation CVE-2024-21622, GHSA-j5g9-j7r4-6qvx | High | 0.6% | 03 Jan, 2024 | Packagist craftcms/cms |
PrestaShop some attribute not escaped in Validate::isCleanHTML method CVE-2024-21627, GHSA-xgpm-q3mq-46rq | High | 0.5% | 02 Jan, 2024 | Packagist prestashop/prestashop |
Authenticated Blind SSRF in automad/automad CVE-2023-7037, GHSA-q5q3-qm26-9jwm | High | 0.7% | 21 Dec, 2023 | Packagist automad/automad |
MainWP Dashboard SQL Command Injection vulnerability CVE-2023-38519, GHSA-87fg-9x5w-j3rm | High | 0.6% | 20 Dec, 2023 | Packagist mainwp/mainwp |
yiisoft/yii2-authclient's Oauth2 PKCE implementation is vulnerable CVE-2023-50714, GHSA-rw54-6826-c8j5 | High | 0.5% | 18 Dec, 2023 | Packagist yiisoft/yii2-authclient |
Configuration Injection in extension "Direct Mail" (direct_mail) CVE-2023-50461, GHSA-p6xx-fhfw-7mj7 | High | 0.5% | 13 Dec, 2023 | Packagist directmailteam/direct-mail |
Denial of service caused by infinite recursion when parsing SVG images CVE-2023-50262, GHSA-3qx2-6f78-w2j2 | High | 1.5% | 13 Dec, 2023 | Packagist dompdf/dompdf |
Denial of service caused by infinite recursion when parsing SVG document CVE-2023-50251, GHSA-ff5x-7qg5-vwf2 | High | 0.9% | 12 Dec, 2023 | Packagist phenx/php-svg-lib |
PHPEMS Deserialization of Untrusted Data vulnerability CVE-2023-6654, GHSA-5rv2-vvmf-f7w8 | High | 1.7% | 10 Dec, 2023 | Packagist phpems/phpems |
Magento LTS vulnerable to Stored XSS via TinyMCE WYSIWYG Editor GHSA-9j5w-2cqc-cwj9 | High | Not scored | 08 Dec, 2023 | Packagist openmage/magento-lts |
Microweber allows a remote attacker to obtain sensitive information via the HTTP GET method CVE-2023-48122, GHSA-p8q6-qrgj-7gx2 | High | 0.8% | 08 Dec, 2023 | Packagist microweber/microweber |
ThinkAdmin arbitrary file upload vulnerability CVE-2023-48966, GHSA-7gq9-p94f-g5v9 | High | 1.1% | 04 Dec, 2023 | Packagist zoujingli/thinkadmin |
Microweber file upload vulnerability CVE-2023-49052, GHSA-2c7x-w3mx-h7p6 | High | 2.5% | 30 Nov, 2023 | Packagist microweber/microweber |
Validation of SignedInfo CVE-2023-49087, GHSA-ww7x-3gxh-qm6r | High | 0.2% | 28 Nov, 2023 | Packagist simplesamlphp/saml2 Packagist simplesamlphp/xml-security |
Pimcore Admin UI has Two Factor Authentication disabled for non admin security firewalls CVE-2023-49075, GHSA-9wwg-r3c7-4vfg | High | 1.4% | 27 Nov, 2023 | Packagist pimcore/admin-ui-classic-bundle |
Phpseclib needs guardrails on large binaryfield integers CVE-2023-49316, GHSA-2f25-pfq3-c7h8 | High | 0.8% | 27 Nov, 2023 | Packagist phpseclib/phpseclib |
Cross Site Request Forgery in SwiftyEdit CVE-2023-47350, GHSA-2492-xxqf-6h78 | High | 0.4% | 22 Nov, 2023 | Packagist swiftyedit/swiftyedit |
Cross-site Scripting via uploaded assets CVE-2023-48701, GHSA-8jjh-j3c2-cjcv | High | 0.7% | 21 Nov, 2023 | Packagist statamic/cms |
LibreNMS vulnerable to rate limiting bypass on login page CVE-2023-46745, GHSA-rq42-58qf-v3qx | High | 0.6% | 17 Nov, 2023 | Packagist librenms/librenms |
Pimcore SQL Injection in Admin Grid Filter API through Multiselect::getFilterConditionExt() CVE-2023-47637, GHSA-72hh-xf79-429p | High | 1.2% | 15 Nov, 2023 | Packagist pimcore/pimcore |
Statamic CMS vulnerable to remote code execution via form uploads CVE-2023-48217, GHSA-2r53-9295-3m86 | High | 1.1% | 14 Nov, 2023 | Packagist statamic/cms |
Guest Entries Remote code execution via file uploads CVE-2023-47621, GHSA-rw82-mhmx-grmj | High | 1.0% | 13 Nov, 2023 | Packagist doublethreedigital/guest-entries Packagist duncanmcclean/guest-entries |
Moodle Code Injection vulnerability BIT-moodle-2023-5540, CVE-2023-5540, GHSA-w8x2-w4qr-v3x4 | High | 2.3% | 09 Nov, 2023 | Packagist moodle/moodle |
Moodle Code Injection vulnerability BIT-moodle-2023-5539, CVE-2023-5539, GHSA-3xxm-3g3c-w579 | High | 2.2% | 09 Nov, 2023 | Packagist moodle/moodle |
PrestaShop blockreassurance BO User can remove any file from server when adding a and deleting a block CVE-2023-47109, GHSA-83j2-qhx2-p7jc | High | 0.8% | 08 Nov, 2023 | Packagist prestashop/blockreassurance |
Subrion remote command execution vulnerability CVE-2023-46947, GHSA-2x28-c7j7-23gv | High | 1.3% | 03 Nov, 2023 | Packagist intelliants/subrion |
FoodCoopShop Server-Side Request Forgery vulnerability CVE-2023-46725, GHSA-jhww-fx2j-3rf7 | High | 0.5% | 02 Nov, 2023 | Packagist foodcoopshop/foodcoopshop |
Dolibarr Improper Input Validation vulnerability BIT-dolibarr-2023-4197, CVE-2023-4197, GHSA-r9cm-pw9j-3fpx | High | 35.9% | 01 Nov, 2023 | Packagist dolibarr/dolibarr |
phpMyFAQ Cross-site Scripting vulnerability CVE-2023-5864, GHSA-g5hp-328h-jj98 | High | 0.5% | 31 Oct, 2023 | Packagist thorsten/phpmyfaq |
Kimai (Authenticated) SSTI to RCE by Uploading a Malicious Twig File CVE-2023-46245, GHSA-fjhg-96cp-6fcw | High | 1.5% | 30 Oct, 2023 | Packagist kimai/kimai |
CodeIgniter4 vulnerable to information disclosure when detailed error report is displayed in production environment BIT-codeigniter-2023-46240, CVE-2023-46240, GHSA-hwxf-qxj7-7rfj | High | 0.6% | 30 Oct, 2023 | Packagist codeigniter4/framework |
pimcore/admin-ui-classic-bundle Unverified Password Change CVE-2023-5844, GHSA-6f58-j323-6472 | High | 0.6% | 30 Oct, 2023 | Packagist pimcore/admin-ui-classic-bundle |
juzawebCMS Injection vulnerability CVE-2023-46468, GHSA-h92m-4g9m-72vr | High | 0.6% | 28 Oct, 2023 | Packagist juzaweb/cms |
Silverstripe GraphQL has DDOS Vulnerability due to lack of protection against recursive queries CVE-2023-40180, GHSA-v23w-pppm-jh66 | High | 1.1% | 16 Oct, 2023 | Packagist silverstripe/graphql |
SQL injection in librenms/librenms CVE-2023-5591, GHSA-mr6h-7x2m-rgmq | High | 23.8% | 16 Oct, 2023 | Packagist librenms/librenms |
Magento Open Source allows Improper Authorization CVE-2023-38220, GHSA-grc6-r6f8-xj7c | High | 0.8% | 13 Oct, 2023 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento Open Source allows Cross-Site Scripting (XSS) CVE-2023-38219, GHSA-3j7w-jp46-9752 | High | 0.8% | 13 Oct, 2023 | Packagist magento/community-edition Packagist magento/project-community-edition |