Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
starcitizentools/citizen-skin vulnerable to stored, self-XSS in the "real name" field CVE-2024-47536, GHSA-62r2-gcxr-426x | Medium | 0.5% | 30 Sep, 2024 | Packagist starcitizentools/citizen-skin |
MantisBT vulnerable to information disclosure with user profiles CVE-2024-45792, GHSA-h5q3-fjp4-2x7r | Medium | 0.5% | 30 Sep, 2024 | Packagist mantisbt/mantisbt |
Filament has unvalidated ColorColumn and ColorEntry values that can be used for Cross-site Scripting CVE-2024-47186, GHSA-9h9q-qhxg-89xr | Medium | 0.4% | 27 Sep, 2024 | Packagist filament/infolists Packagist filament/tables |
IDOR vulnerability in account profile page CVE-2024-39319, GHSA-rw3j-574h-mrcq | Medium | 0.5% | 26 Sep, 2024 | Packagist aimeos/ai-controller-frontend |
Cross site scripting in Concrete CMS CVE-2024-8291, GHSA-q7qr-22qw-pqgx | Medium | 0.5% | 25 Sep, 2024 | Packagist concrete5/concrete5 |
Cross site scripting in Concrete CMS CVE-2024-7398, GHSA-x8h2-255q-jg4x | Medium | 0.5% | 25 Sep, 2024 | Packagist concrete5/concrete5 |
Mautic allows users enumeration due to weak password login CVE-2024-47059, GHSA-8vff-35qm-qjvv | Medium | 0.3% | 18 Sep, 2024 | Packagist mautic/core |
Mautic has an XSS in contact tracking and page hits report CVE-2021-27917, GHSA-xpc5-rr39-v8v2 | Medium | 0.3% | 18 Sep, 2024 | Packagist mautic/core Packagist mautic/core-lib |
Mautic vulnerable to Cross-site Scripting (XSS) - stored (edit form HTML field) CVE-2024-47058, GHSA-xv68-rrmw-9xwf | Medium | 0.2% | 18 Sep, 2024 | Packagist mautic/core Packagist mautic/core-lib |
Mautic vulnerable to XSS in contact/company tracking (no authentication) CVE-2024-47050, GHSA-73gr-32wg-qhh7 | Medium | 0.3% | 18 Sep, 2024 | Packagist mautic/core Packagist mautic/core-lib |
Concrete CMS stored XSS vulnerability in the "Top Navigator Bar" block CVE-2024-8660, GHSA-998c-q8hh-h8gv | Medium | 0.3% | 17 Sep, 2024 | Packagist concrete5/concrete5 |
Wire UI has a JS XSS Vulnerability on route /wireui/button?label=Content CVE-2024-45803, GHSA-rw5h-g8xq-6877 | Medium | 0.4% | 17 Sep, 2024 | Packagist wireui/wireui |
Contao affected by insert tag injection via canonical URL CVE-2024-45612, GHSA-2xpq-xp6c-5mgj | Medium | 0.3% | 17 Sep, 2024 | Packagist contao/core-bundle |
Contao affected by directory traversal in the file selector widget CVE-2024-45604, GHSA-4p75-5p53-65m9 | Medium | 0.4% | 17 Sep, 2024 | Packagist contao/core-bundle |
Concrete CMS Stored XSS in the "Next&Previous Nav" block CVE-2024-8661, GHSA-xmxj-v2q8-8qx6 | Medium | 0.4% | 16 Sep, 2024 | Packagist concrete5/concrete5 |
auditor-bundle vulnerable to Cross-site Scripting because name of entity does not get escaped CVE-2024-45592, GHSA-78vg-7v27-hj67 | Medium | 0.4% | 10 Sep, 2024 | Packagist damienharper/auditor-bundle |
Httpful is Missing Certificate Validation GHSA-gcfg-hmwx-wq5h | Medium | Not scored | 09 Sep, 2024 | Packagist nategood/httpful |
Craft CMS vulnerable to stored XSS in breadcrumb list and title fields CVE-2024-45406, GHSA-28h4-788g-rh42 | Medium | 0.4% | 09 Sep, 2024 | Packagist craftcms/cms |
Drupal Open Social allows Functionality Misuse CVE-2024-13274, DRUPAL-CONTRIB-2024-038, GHSA-63wg-87qv-rw4r | Medium | 0.4% | 04 Sep, 2024 | Packagist goalgorilla/open_social Packagist:https://packages.drupal.org/8 drupal/social |
FeehiCMS User[avatar] unrestricted upload CVE-2024-8296, GHSA-xp68-7g33-f49m | Medium | 0.8% | 29 Aug, 2024 | Packagist feehi/cms |
FeehiCMS BannerForm[img] unrestricted upload CVE-2024-8295, GHSA-3wrg-6mg5-jg2v | Medium | 0.8% | 29 Aug, 2024 | Packagist feehi/cms |
FeehiCMS file upload vulnerability CVE-2024-8294, GHSA-xxqw-83c7-r24r | Medium | 0.8% | 29 Aug, 2024 | Packagist feehi/cms |
Drupal Full Path Disclosure CVE-2024-45440, GHSA-mg8j-w93w-xjgc | Medium | 9.3% | 29 Aug, 2024 | Packagist drupal/core Packagist drupal/core-recommended Packagist drupal/drupal |
"powermail" (powermail) Insecure Direct Object Reference (IDOR) CVE-2024-45232, GHSA-p652-xcgx-f85m | Medium | 0.3% | 29 Aug, 2024 | Packagist in2code/powermail |
PhpSpreadsheet HTML writer is vulnerable to Cross-Site Scripting via style information CVE-2024-45046, GHSA-wgmf-q9vr-vww6 | Medium | 0.4% | 28 Aug, 2024 | Packagist phpoffice/phpexcel Packagist phpoffice/phpspreadsheet |
Automad Cross-site Scripting vulnerability CVE-2024-40111, GHSA-g8h2-j9pm-4xx2 | Medium | 0.8% | 23 Aug, 2024 | Packagist automad/automad |
Code Snippet GeSHi plugin in CKEditor 4 has reflected cross-site scripting (XSS) vulnerability CVE-2024-43407, GHSA-7r32-vfj5-c2jv | Medium | 0.4% | 21 Aug, 2024 | Packagist ckeditor/ckeditor npm ckeditor4 |
Magento Improper Access Control Leads to Privilege escalation CVE-2024-39419, GHSA-74w7-cr4v-wf2v | Medium | 0.4% | 14 Aug, 2024 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento Improper Authorization vulnerability CVE-2024-39418, GHSA-gvgf-pvh5-vjh4 | Medium | 0.4% | 14 Aug, 2024 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento Improper Authorization leads to Security feature bypass CVE-2024-39417, GHSA-4xmj-f664-hv98 | Medium | 0.4% | 14 Aug, 2024 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento Improper Authorization leads to Security feature bypass CVE-2024-39416, GHSA-4xgg-rw35-7mv5 | Medium | 0.4% | 14 Aug, 2024 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento Improper Authorization Leading to Security feature bypass CVE-2024-39415, GHSA-gj93-84g5-mcjq | Medium | 0.4% | 14 Aug, 2024 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento Improper Access Control Leads to Privilege escalation CVE-2024-39414, GHSA-x6f9-hv9r-fgq4 | Medium | 0.4% | 14 Aug, 2024 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento Improper Authorization vulnerability CVE-2024-39413, GHSA-8w5f-8992-g86j | Medium | 0.4% | 14 Aug, 2024 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento Open Source Improper Authorization vulnerability CVE-2024-39412, GHSA-7472-vw39-g2j3 | Medium | 0.4% | 14 Aug, 2024 | Packagist magento/community-edition |
Magento Improper Authorization leads to security feature bypass CVE-2024-39411, GHSA-qm77-mqf3-fmhq | Medium | 0.4% | 14 Aug, 2024 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento Open Source Cross-Site Request Forgery (CSRF) vulnerability CVE-2024-39410, GHSA-4323-f82v-f6jr | Medium | 0.5% | 14 Aug, 2024 | Packagist magento/community-edition |
Magento Open Source Cross-Site Request Forgery (CSRF) vulnerability CVE-2024-39409, GHSA-rf4q-m23c-7q8r | Medium | 0.5% | 14 Aug, 2024 | Packagist magento/community-edition |
Magento Open Source Cross-Site Request Forgery vulnerability CVE-2024-39408, GHSA-4cj6-f32v-6hgx | Medium | 0.5% | 14 Aug, 2024 | Packagist magento/community-edition |
Magento Improper Authorization vulnerability CVE-2024-39407, GHSA-cjm6-8mw8-2f8c | Medium | 0.4% | 14 Aug, 2024 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento Open Source Path Traversal vulnerability CVE-2024-39406, GHSA-6pxh-2557-5cj5 | Medium | 0.9% | 14 Aug, 2024 | Packagist magento/community-edition |
Magento Improper Authorization vulnerability CVE-2024-39405, GHSA-5g9f-7gqc-8hj4 | Medium | 0.4% | 14 Aug, 2024 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento Improper Authorization vulnerability CVE-2024-39404, GHSA-qrh3-vxjg-h9h6 | Medium | 0.5% | 14 Aug, 2024 | Packagist magento/community-edition Packagist magento/project-community-edition |
Concrete CMS vulnerable to Stored Cross-site Scripting CVE-2024-7512, GHSA-c47w-9mcf-w972 | Medium | 0.4% | 12 Aug, 2024 | Packagist concrete5/concrete5 |
Concrete CMS Stored Cross-site Scripting vulnerability CVE-2024-4350, GHSA-q5wx-m95r-4cgc | Medium | 0.5% | 12 Aug, 2024 | Packagist concrete5/concrete5 |
Concrete CMS Stored XSS in getAttributeSetName CVE-2024-7394, GHSA-w6j6-w6jx-vf2r | Medium | 0.4% | 08 Aug, 2024 | Packagist concrete5/concrete5 |
Shopware vulnerable to Improper Access Control with ManyToMany associations in store-api CVE-2024-42354, GHSA-hhcq-ph6w-494g | Medium | 0.4% | 08 Aug, 2024 | Packagist shopware/core Packagist shopware/platform |
Microweber Reflected Cross-site scripting (XSS) vulnerability CVE-2024-40101, GHSA-m99v-mmg2-66vf | Medium | 0.9% | 06 Aug, 2024 | Packagist microweber/microweber |
Microweber Cross Site Scripting (XSS) vulnerability CVE-2024-41381, GHSA-h4xf-wx99-jmv4 | Medium | 0.3% | 05 Aug, 2024 | Packagist microweber/microweber |
Microweber Cross Site Scripting (XSS) vulnerability CVE-2024-41380, GHSA-hf66-xfgj-42g8 | Medium | 0.3% | 05 Aug, 2024 | Packagist microweber/microweber |