Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Magento Open Source allows Incorrect Authorization CVE-2023-38218, GHSA-rpc7-gf58-v3x2 | High | 0.9% | 13 Oct, 2023 | Packagist magento/community-edition Packagist magento/project-community-edition |
Cross-Site Request Forgery (CSRF) in snipe/snipe-it CVE-2023-5511, GHSA-33vj-r6p6-x4p8 | High | 0.3% | 11 Oct, 2023 | Packagist snipe/snipe-it |
MediaWiki Denial of Service vulnerability BIT-mediawiki-2023-45363, CVE-2023-45363, GHSA-w5fx-cx7f-6vr9 | High | 23.8% | 09 Oct, 2023 | Packagist mediawiki/core |
phpMyFAQ Cross-site Scripting vulnerability CVE-2023-5319, GHSA-j5ww-5xf4-hqm2 | High | 0.5% | 30 Sep, 2023 | Packagist thorsten/phpmyfaq |
Microweber uses hard coded credentials CVE-2023-5318, GHSA-r657-3wqh-g2x9 | High | 0.7% | 30 Sep, 2023 | Packagist microweber/microweber |
Composer Remote Code Execution vulnerability via web-accessible composer.phar BIT-composer-2023-43655, CVE-2023-43655, GHSA-jm6m-4632-36hf | High | 1.5% | 29 Sep, 2023 | Packagist composer/composer |
Economizzer host header injection vulnerability CVE-2023-38877, GHSA-hqp9-mrjw-7qq2 | High | 1.1% | 28 Sep, 2023 | Packagist gugoan/economizzer |
Economizzer remote code execution vulnerability CVE-2023-38874, GHSA-pq98-6hf6-3rj3 | High | 31.6% | 28 Sep, 2023 | Packagist gugoan/economizzer |
OpenCart Path Traversal vulnerability CVE-2023-2315, GHSA-v4j2-cwmm-xg89 | High | 1.0% | 27 Sep, 2023 | Packagist opencart/opencart |
Composer allows cache poisoning from other projects built on the same host CVE-2015-8371, GHSA-725m-w832-q973 | High | 0.7% | 21 Sep, 2023 | Packagist composer/composer |
File Upload vulnerability in Dolibarr ERP CRM BIT-dolibarr-2023-38887, CVE-2023-38887, GHSA-g8h7-mcp6-pf47 | High | 1.5% | 20 Sep, 2023 | Packagist dolibarr/dolibarr |
Dolibarr allows a remote privileged attacker to execute arbitrary code via a crafted command/script BIT-dolibarr-2023-38886, CVE-2023-38886, GHSA-6773-rfjv-c54w | High | 29.6% | 20 Sep, 2023 | Packagist dolibarr/dolibarr |
Cross site scripting in librenms CVE-2023-5060, GHSA-2q8c-gqf4-mg3v | High | 0.6% | 19 Sep, 2023 | Packagist librenms/librenms |
PocketMine-MP server crash with certain invalid JSON payloads in `LoginPacket` due to dependency vulnerability (again) CVE-2023-54390, GHSA-92jh-gwch-jq38 | High | 0.6% | 14 Sep, 2023 | Packagist pocketmine/pocketmine-mp |
PocketMine-MP server crash due to incorrect EC curve used for LoginPacket identityPublicKey CVE-2023-54355, GHSA-79rc-jjh6-rc89 | High | 0.4% | 14 Sep, 2023 | Packagist pocketmine/pocketmine-mp |
Cecil Path Traversal vulnerability CVE-2023-4914, GHSA-q8hr-4w58-985p | High | 0.9% | 12 Sep, 2023 | Packagist cecil/cecil |
Magento Open Source affected by Improper Input Validation CVE-2022-24093, GHSA-5xmp-7wg5-x68q | High | 1.5% | 12 Sep, 2023 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento LTS's guest order "protect code" can be brute-forced too easily CVE-2023-41879, GHSA-9358-cpvx-c2qp | High | 1.3% | 11 Sep, 2023 | Packagist openmage/magento-lts |
MongoDB Driver may publish events containing authentication-related data CVE-2021-32050, GHSA-vxvm-qww3-2fh7 | High | 0.6% | 29 Aug, 2023 | Packagist mongodb/mongodb SwiftURL github.com/mongodb/mongo-swift-driver npm mongodb |
Command injection in pagekit CVE-2023-41005, GHSA-j6mp-hx4g-p3gm | High | 0.6% | 28 Aug, 2023 | Packagist pagekit/pagekit |
Craft CMS vulnerable to Remote Code Execution via validatePath bypass CVE-2023-40035, GHSA-44wr-rmwq-3phw | High | 2.3% | 21 Aug, 2023 | Packagist craftcms/cms |
Cockpit Cross-site Scripting vulnerability CVE-2023-4433, GHSA-ff45-2jp9-69jc | High | 0.6% | 19 Aug, 2023 | Packagist cockpit-hq/cockpit |
Cockpit Cross-site Scripting vulnerability CVE-2023-4432, GHSA-rmgx-3w4r-xcfp | High | 0.6% | 19 Aug, 2023 | Packagist cockpit-hq/cockpit |
Cockpit Cross-site Scripting vulnerability CVE-2023-4395, GHSA-5cv4-48h7-7782 | High | 0.6% | 17 Aug, 2023 | Packagist cockpit-hq/cockpit |
Flarum vulnerable to LFI and Blind SSRF via Avatar upload CVE-2023-40033, GHSA-67c6-q4j4-hccg | High | 0.5% | 16 Aug, 2023 | Packagist flarum/core Packagist flarum/framework |
LibreNMS Cross-site Scripting vulnerability CVE-2023-4347, GHSA-m6pf-cm3f-7876 | High | 69.7% | 15 Aug, 2023 | Packagist librenms/librenms |
Cockpit Cross-site Scripting vulnerability CVE-2023-4321, GHSA-3vf5-xm2p-6mh5 | High | 0.6% | 14 Aug, 2023 | Packagist cockpit-hq/cockpit |
Withdrawn Advisory: Daylight Studio FUEL-CMS SQLi Vulnerability CVE-2020-24950, GHSA-7rvp-xqj7-rxf2 | High | 1.4% | 11 Aug, 2023 | Packagist codeigniter/framework |
Magento Open Source allows Improper Neutralization of Special Elements Used CVE-2023-38208, GHSA-mxc9-g6m4-2v35 | High | 2.5% | 09 Aug, 2023 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento Open Source allows XML Injection CVE-2023-38207, GHSA-rpv2-g4pc-wp72 | High | 1.1% | 09 Aug, 2023 | Packagist magento/community-edition Packagist magento/project-community-edition |
PrestaShop file access through path traversal CVE-2023-39528, GHSA-hpf4-v7v2-95p2 | High | 0.8% | 07 Aug, 2023 | Packagist prestashop/prestashop |
PrestaShop XSS injection through Validate::isCleanHTML method CVE-2023-39527, GHSA-xw2r-f8xv-c8xp | High | 0.5% | 07 Aug, 2023 | Packagist prestashop/prestashop |
Cockpit Cross-site Scripting vulnerability CVE-2023-4196, GHSA-w3qm-93vf-5hrw | High | 0.5% | 06 Aug, 2023 | Packagist cockpit-hq/cockpit |
Pimcore Path Traversal Vulnerability in AssetController:importServerFilesAction CVE-2023-38708, GHSA-34hj-v8fm-x887 | High | 0.6% | 03 Aug, 2023 | Packagist pimcore/pimcore |
RaspAP Command Injection vulnerability CVE-2022-39987, GHSA-7r88-wjhj-jr8m | High | 37.3% | 01 Aug, 2023 | Packagist billz/raspap-webgui |
phpMyFAQ Stored Cross-site Scripting vulnerability CVE-2023-4007, GHSA-q9vm-29ph-p7mp | High | 0.5% | 31 Jul, 2023 | Packagist thorsten/phpmyfaq |
Denial of service from unlimited password lengths CVE-2023-38492, GHSA-3v6j-v3qc-cxff | High | 1.2% | 27 Jul, 2023 | Packagist getkirby/cms |
Insufficient Session Expiration after a password change CVE-2023-38489, GHSA-5mvj-rvp8-rf45 | High | 0.8% | 27 Jul, 2023 | Packagist getkirby/cms |
Field injection in the KirbyData text storage handler CVE-2023-38488, GHSA-x5mr-p6v4-wp93 | High | 0.9% | 27 Jul, 2023 | Packagist getkirby/cms |
Pimcore vulnerable to SQL Injection in Dataobjects sorting CVE-2023-3820, GHSA-c9hw-557q-f8hq | High | 1.2% | 21 Jul, 2023 | Packagist pimcore/pimcore |
Pimcore vulnerable to Exposure of Sensitive Information to an Unauthorized Actor CVE-2023-3819, GHSA-r87r-982q-2c3q | High | 0.7% | 21 Jul, 2023 | Packagist pimcore/pimcore |
Cockpit CMS Cross-Site Request Forgery vulnerability CVE-2023-37650, GHSA-45g2-r339-pjwf | High | 0.5% | 20 Jul, 2023 | Packagist cockpit-hq/cockpit |
Cockpit CMS vulnerable to incorrect access control CVE-2023-37649, GHSA-9r25-4j77-9wc7 | High | 0.9% | 20 Jul, 2023 | Packagist cockpit-hq/cockpit |
grav Server-side Template Injection (SSTI) mitigation bypass CVE-2023-37897, GHSA-9436-3gmp-4f53 | High | 2.8% | 18 Jul, 2023 | Packagist getgrav/grav |
Admidio vulnerable to Unrestricted Upload of File with Dangerous Type CVE-2023-3692, GHSA-q347-jrx8-5pw9 | High | 1.0% | 16 Jul, 2023 | Packagist admidio/admidio |
PocketMine-MP vulnerable to server crash using badly formatted sign NBT in BlockActorDataPacket CVE-2023-54392, GHSA-7wrv-6h42-w54f | High | 0.5% | 14 Jul, 2023 | Packagist pocketmine/pocketmine-mp |
zenstruck/collection passing callable string to EntityRepository::find() and query() CVE-2023-37473, GHSA-7xr2-8ff7-6fjq | High | 0.9% | 14 Jul, 2023 | Packagist zenstruck/collection |
Pimcore SQL Injection vulnerability CVE-2023-3673, GHSA-rxp5-qwrf-pfv3 | High | 0.9% | 14 Jul, 2023 | Packagist pimcore/pimcore |
TeamPass information exposure vulnerability CVE-2023-3553, GHSA-2rhg-hqq9-8xjh | High | 0.8% | 08 Jul, 2023 | Packagist nilsteampassnet/teampass |
TeamPass vulnerable to Improper Encoding or Escaping of Output CVE-2023-3552, GHSA-2cv5-qvq3-6276 | High | 0.5% | 08 Jul, 2023 | Packagist nilsteampassnet/teampass |