Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
UnoPim Cross-site Scripting vulnerability CVE-2024-50637, GHSA-hv6m-qj65-26q3 | Medium | 0.4% | 06 Nov, 2024 | Packagist unopim/unopim |
Symfony vulnerable to open redirect via browser-sanitized URLs CVE-2024-50345, GHSA-mrqx-rp3w-jpjp | Medium | 0.6% | 06 Nov, 2024 | Packagist symfony/http-foundation |
Symfony allows internal address and port enumeration by NoPrivateNetworkHttpClient CVE-2024-50342, GHSA-9c3x-r3wp-mgxm | Medium | 0.5% | 06 Nov, 2024 | Packagist symfony/http-client Packagist symfony/symfony |
Funadmin Cross-site Scripting vulnerability CVE-2024-48228, GHSA-j9wp-x5q5-xh2f | Medium | 0.3% | 25 Oct, 2024 | Packagist funadmin/funadmin |
Pterodactyl Panel has plain-text logging of user passwords when two-factor authentication is disabled CVE-2024-49762, GHSA-c479-wq8g-57hr | Medium | 0.1% | 24 Oct, 2024 | Packagist pterodactyl/panel |
ai-admin-graphql has a Denial of service vulnerability in SaaS and marketplace setups CVE-2024-47173, GHSA-qxgx-hvg3-v92w | Medium | 0.4% | 24 Oct, 2024 | Packagist aimeos/ai-admin-graphql |
baserCMS has a Cross-site Scripting (XSS) Vulnerability in Edit Email Form Settings Feature CVE-2024-46998, GHSA-p3m2-mj3j-j49x | Medium | 0.4% | 24 Oct, 2024 | Packagist baserproject/basercms |
baserCMS has a Cross-site Scripting (XSS) Vulnerability in Blog posts Feature CVE-2024-46996, GHSA-66jv-qrm3-vvfg | Medium | 0.3% | 24 Oct, 2024 | Packagist baserproject/basercms |
baserCMS has a Cross-site Scripting (XSS) Vulnerability in HTTP 400 Bad Request CVE-2024-46995, GHSA-mr7q-fv7j-jcgv | Medium | 0.3% | 24 Oct, 2024 | Packagist baserproject/basercms |
baserCMS has a Cross-site Scripting (XSS) Vulnerability in Blog posts and Contents list Feature CVE-2024-46994, GHSA-wrjc-fmfq-w3jr | Medium | 0.3% | 24 Oct, 2024 | Packagist baserproject/basercms |
Path traversal in redaxo CVE-2024-46212, GHSA-37gm-h5wr-pf25 | Medium | 0.9% | 16 Oct, 2024 | Packagist redaxo/source |
Admidio Vulnerable to HTML Injection In The Messages Section CVE-2024-47836, GHSA-7c4c-749j-pfp2 | Medium | 0.5% | 16 Oct, 2024 | Packagist admidio/admidio |
Drupal core vulnerable to improper error handling BIT-drupal-2024-11942, CVE-2024-11942, DRUPAL-CORE-2024-002, GHSA-52jr-x6h6-xj6g | Medium | 0.4% | 16 Oct, 2024 | Packagist drupal/core |
Magento Open Source Improper Access Control vulnerability BIT-magento-2024-45135, CVE-2024-45135, GHSA-8pxg-gcp4-57ww | Medium | 0.6% | 10 Oct, 2024 | Packagist magento/community-edition |
Magento Open Source Information Exposure vulnerability BIT-magento-2024-45134, CVE-2024-45134, GHSA-4f89-5cwm-rm5g | Medium | 0.6% | 10 Oct, 2024 | Packagist magento/community-edition |
Magento Open Source Information Exposure vulnerability BIT-magento-2024-45133, CVE-2024-45133, GHSA-j3mh-wx5f-2vhg | Medium | 0.6% | 10 Oct, 2024 | Packagist magento/community-edition |
Magento Open Source Improper Authorization vulnerability BIT-magento-2024-45131, CVE-2024-45131, GHSA-xc5p-773w-m3pm | Medium | 0.5% | 10 Oct, 2024 | Packagist magento/community-edition |
Magento Open Source Improper Access Control vulnerability BIT-magento-2024-45130, CVE-2024-45130, GHSA-v3v6-jfvw-m576 | Medium | 0.5% | 10 Oct, 2024 | Packagist magento/community-edition |
Magento Open Source Improper Access Control vulnerability BIT-magento-2024-45129, CVE-2024-45129, GHSA-m58h-998x-66f3 | Medium | 0.5% | 10 Oct, 2024 | Packagist magento/community-edition |
Magento Open Source Improper Authorization vulnerability BIT-magento-2024-45128, CVE-2024-45128, GHSA-qpp7-742q-58j3 | Medium | 0.6% | 10 Oct, 2024 | Packagist magento/community-edition |
Magento Open Source stored Cross-Site Scripting (XSS) vulnerability BIT-magento-2024-45127, CVE-2024-45127, GHSA-c89g-gq5r-2xw2 | Medium | 0.5% | 10 Oct, 2024 | Packagist magento/community-edition |
Magento Open Source Incorrect Authorization vulnerability BIT-magento-2024-45125, CVE-2024-45125, GHSA-xg36-8c2v-jpxh | Medium | 0.5% | 10 Oct, 2024 | Packagist magento/community-edition |
Magento Open Source Improper Access Control vulnerability BIT-magento-2024-45124, CVE-2024-45124, GHSA-w3p2-pc3h-69wv | Medium | 0.6% | 10 Oct, 2024 | Packagist magento/community-edition |
Magento Open Source reflected Cross-Site Scripting (XSS) vulnerability CVE-2024-45123, GHSA-88x2-cq34-5fwc | Medium | 0.5% | 10 Oct, 2024 | Packagist magento/community-edition |
Magento Open Source Improper Access Control vulnerability CVE-2024-45122, GHSA-46fm-x82m-5f74 | Medium | 0.6% | 10 Oct, 2024 | Packagist magento/community-edition |
Magento Open Source Improper Access Control vulnerability CVE-2024-45121, GHSA-2qhq-fw98-h6wg | Medium | 0.5% | 10 Oct, 2024 | Packagist magento/community-edition |
Magento Open Source Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability CVE-2024-45120, GHSA-47jp-46c9-25vf | Medium | 0.4% | 10 Oct, 2024 | Packagist magento/community-edition |
Magento Open Source Server-Side Request Forgery (SSRF) vulnerability CVE-2024-45119, GHSA-g9fm-wc6h-pvgj | Medium | 0.9% | 10 Oct, 2024 | Packagist magento/community-edition |
Denial of Service in TYPO3 Bookmark Toolbar CVE-2024-34537, GHSA-ffcv-v6pw-qhrp | Medium | 0.7% | 08 Oct, 2024 | Packagist typo3/cms-backend |
Information Disclosure in TYPO3 Page Tree CVE-2024-47780, GHSA-rf5m-h8q9-9w6q | Medium | 0.3% | 08 Oct, 2024 | Packagist typo3/cms-backend |
Krayin CRM vulnerable to Cross Site Scripting (XSS) via the organization name CVE-2024-45932, GHSA-74q2-6jp4-3rqq | Medium | 0.4% | 07 Oct, 2024 | Packagist krayin/laravel-crm |
LimeSurvey Cross Site Scripting vulnerability BIT-limesurvey-2024-28710, CVE-2024-28710, GHSA-632q-77qj-c89q | Medium | 0.6% | 07 Oct, 2024 | Packagist limesurvey/limesurvey |
LimeSurvey Cross Site Scripting vulnerability BIT-limesurvey-2024-28709, CVE-2024-28709, GHSA-c7xm-rwqj-pgcj | Medium | 0.6% | 07 Oct, 2024 | Packagist limesurvey/limesurvey |
PhpSpreadsheet HTML writer is vulnerable to Cross-Site Scripting via JavaScript hyperlinks CVE-2024-45292, GHSA-r8w8-74ww-j4wh | Medium | 0.3% | 07 Oct, 2024 | Packagist phpoffice/phpexcel Packagist phpoffice/phpspreadsheet |
Lara-zeus Dynamic Dashboard and Artemis do not validate paragraph widget values which can be used for XSS CVE-2024-47817, GHSA-c6cw-g7fc-4gwc | Medium | 0.4% | 07 Oct, 2024 | Packagist lara-zeus/artemis Packagist lara-zeus/dynamic-dashboard |
PhpSpreadsheet has an Unauthenticated Cross-Site-Scripting (XSS) in sample file CVE-2024-45060, GHSA-v66g-p9x6-v98p | Medium | 0.5% | 07 Oct, 2024 | Packagist phpoffice/phpexcel Packagist phpoffice/phpspreadsheet |
Mediawiki Cargo extension vulnerable to Cross-site Scripting CVE-2024-47847, GHSA-jqvm-9xm2-gc38 | Medium | 0.4% | 05 Oct, 2024 | Packagist mediawiki/cargo |
Improper permissions handling in MediaWiki AbuseFilter CVE-2024-47913, GHSA-rmcp-9fhq-58pv | Medium | 0.5% | 04 Oct, 2024 | Packagist mediawiki/abuse-filter |
Minecraft MOTD Parser's HtmlGenerator vulnerable to XSS CVE-2024-47765, GHSA-q898-frwq-f3qp | Medium | 0.4% | 04 Oct, 2024 | Packagist dev-lancer/minecraft-motd-parser |
Cross-site Scripting via uploaded SVG CVE-2024-47618, GHSA-255w-87rh-rg44 | Medium | 0.4% | 03 Oct, 2024 | Packagist sulu/sulu |
Injection of arbitrary HTML/JavaScript code through the media download URL CVE-2024-47617, GHSA-6784-9c82-vr85 | Medium | 0.4% | 03 Oct, 2024 | Packagist sulu/sulu |
Duplicate Advisory: Contao allows admin an account to upload SVG file containing malicious JavaScript CVE-2024-45965, GHSA-mrw8-5368-phm3 | Medium | 0.3% | 02 Oct, 2024 | Packagist contao/contao |
Zenario Cross Site Scripting in the Image library CVE-2024-45964, GHSA-2cc5-429x-p387 | Medium | 0.4% | 02 Oct, 2024 | Packagist tribalsystems/zenario |
October allows an admin account to upload PDF containing malicious JavaScript CVE-2024-45962, GHSA-hxpp-g76m-qhvg | Medium | 0.5% | 02 Oct, 2024 | Packagist october/october |
Zenario allows authenticated admin users to upload PDF files containing malicious code CVE-2024-45960, GHSA-3636-hx62-pv26 | Medium | 0.4% | 02 Oct, 2024 | Packagist tribalsystems/zenario |
LibreNMS vulnerable to Stored Cross-site Scripting via File Upload CVE-2024-47528, GHSA-x8gm-j36p-fppf | Medium | 0.4% | 01 Oct, 2024 | Packagist librenms/librenms |
LibreNMS has Stored Cross-site Scripting vulnerability in "Alert Transports" feature CVE-2024-47523, GHSA-7f84-28qh-9486 | Medium | 0.6% | 01 Oct, 2024 | Packagist librenms/librenms |
LibreNMS has Stored Cross-site Scripting vulnerability in "Alert Rules" feature CVE-2024-47525, GHSA-j2j9-7pr6-xqwv | Medium | 29.6% | 01 Oct, 2024 | Packagist librenms/librenms |
LibreNMS has Stored Cross-site Scripting vulnerability in "Device Dependencies" feature CVE-2024-47527, GHSA-rwwc-2v8q-gc9v | Medium | 0.5% | 01 Oct, 2024 | Packagist librenms/librenms |
Pagekit Cross-site Scripting vulnerability CVE-2024-45967, GHSA-xw32-6422-frqm | Medium | 0.4% | 01 Oct, 2024 | Packagist pagekit/pagekit |