Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Concrete CMS vulnerable to Stored Cross-site Scripting CVE-2024-4353, GHSA-3cpf-jmmc-8jm3 | Medium | 0.3% | 01 Aug, 2024 | Packagist concrete5/concrete5 |
eZ Platform Admin UI vulnerable to DOM-based Cross-site Scripting in file upload widget GHSA-gc5h-6jx9-q2qh | Medium | Not scored | 31 Jul, 2024 | Packagist ezsystems/ezplatform-admin-ui |
Ibexa Admin UI vulnerable to DOM-based Cross-site Scripting in file upload widget CVE-2024-39318, GHSA-qm44-wjm2-pr59 | Medium | 0.4% | 31 Jul, 2024 | Packagist ibexa/admin-ui |
Bolt CMS Cross-site Scripting vulnerability CVE-2024-7300, GHSA-xhqw-4hcq-fcvr | Medium | 0.4% | 31 Jul, 2024 | Packagist bolt/bolt |
Pimcore vulnerable to disclosure of system and database information behind /admin firewall CVE-2024-41109, GHSA-fx6j-9pp6-ph36 | Medium | 0.5% | 30 Jul, 2024 | Packagist pimcore/admin-ui-classic-bundle |
Magento LTS vulnerable to stored Cross-site Scripting (XSS) in admin system configs CVE-2024-41676, GHSA-5vrp-638w-p8m2 | Medium | 0.4% | 29 Jul, 2024 | Packagist openmage/magento-lts |
ICEcoder Path Traversal vulnerability CVE-2024-41373, GHSA-x38c-v778-w56m | Medium | 0.4% | 26 Jul, 2024 | Packagist icecoder/icecoder |
Reflected Cross Site-Scripting (XSS) in Oveleon Cookiebar CVE-2024-47069, GHSA-296q-rj83-g9rq | Medium | 0.4% | 26 Jul, 2024 | Packagist oveleon/contao-cookiebar |
Backdrop CMS does not sufficiently sanitize field labels before they are displayed in certain places CVE-2024-41709, GHSA-3wmx-48g3-x66g | Medium | 0.3% | 22 Jul, 2024 | Packagist backdrop/backdrop |
ProcessWire Cross Site Request Forgery vulnerability CVE-2024-41597, GHSA-r9vw-cjf9-xh4x | Medium | 0.2% | 19 Jul, 2024 | Packagist processwire/processwire |
Silverstripe uses TinyMCE which allows svg files linked in object tags GHSA-52cw-pvq9-9m5v | Medium | Not scored | 17 Jul, 2024 | Packagist silverstripe/framework |
Silverstripe Framework has a Cross-site Scripting vulnerability with encoded payload CVE-2024-32981, GHSA-chx7-9x8h-r5mg | Medium | 0.3% | 17 Jul, 2024 | Packagist silverstripe/framework |
Silverstripe Reports are still accessible even when `canView()` returns false CVE-2024-29885, GHSA-89q6-98xx-4ffw | Medium | 0.4% | 17 Jul, 2024 | Packagist silverstripe/reports |
The FIDO2/Webauthn Support for PHP library allows enumeration of valid usernames CVE-2024-39912, GHSA-875x-g8p7-5w27 | Medium | 0.4% | 15 Jul, 2024 | Packagist web-auth/webauthn-framework Packagist web-auth/webauthn-lib |
Login by Auth0 plugin for WordPress vulnerable to Reflected Cross-Site Scripting CVE-2023-6813, GHSA-x6p7-44rh-m3rr | Medium | 0.4% | 10 Jul, 2024 | Packagist auth0/wordpress |
PrivateBin allows shortening of URLs for other domains CVE-2024-39899, GHSA-mqqj-fx8h-437j | Medium | 0.6% | 09 Jul, 2024 | Packagist privatebin/privatebin |
ShopXO Server-Side Request Forgery Vulnerability CVE-2024-6524, GHSA-c96r-38gv-grp4 | Medium | 0.5% | 05 Jul, 2024 | Packagist shopxo/shopxo |
ai-controller-frontend payment status in basket isn't reset CVE-2024-39325, GHSA-m9gv-6p22-qgmj | Medium | 0.4% | 02 Jul, 2024 | Packagist aimeos/ai-controller-frontend |
aimeos/ai-admin-jsonadm improper access control vulnerability allows editors to remove required records CVE-2024-39322, GHSA-8fj2-587w-5whr | Medium | 0.5% | 02 Jul, 2024 | Packagist aimeos/ai-admin-jsonadm |
October System module has a Reflected XSS via X-October-Request-Handler Header CVE-2024-25637, GHSA-rjw8-v7rr-r563 | Medium | 0.3% | 26 Jun, 2024 | Packagist october/system |
October System module has an Open Redirect for Administrator Accounts CVE-2024-24764, GHSA-v2vf-jv88-3fp5 | Medium | 0.3% | 26 Jun, 2024 | Packagist october/system |
Cross site scripting in opencart BIT-opencart-2024-21517, CVE-2024-21517, GHSA-qc3q-8rr8-8p5v | Medium | 0.4% | 22 Jun, 2024 | Packagist opencart/opencart |
Cross site scripting in opencart BIT-opencart-2024-21516, CVE-2024-21516, GHSA-pqhq-77pw-763c | Medium | 0.4% | 22 Jun, 2024 | Packagist opencart/opencart |
Cross site scripting in opencart BIT-opencart-2024-21515, CVE-2024-21515, GHSA-qx44-885h-7p56 | Medium | 0.4% | 22 Jun, 2024 | Packagist opencart/opencart |
events2 TYPO3 extension insecure direct object reference (IDOR) vulnerability CVE-2024-38874, GHSA-cchp-3rq6-69wj | Medium | 0.3% | 21 Jun, 2024 | Packagist jweiland/events2 |
FriendlyCaptcha Plugin for TYPO3 Captcha Check Bypass CVE-2024-38873, GHSA-jg62-h7pv-hxgv | Medium | 0.5% | 21 Jun, 2024 | Packagist studiomitte/friendlycaptcha |
TinyMCE Cross-Site Scripting (XSS) vulnerability using noneditable_regexp option CVE-2024-38356, GHSA-9hcv-j9pv-qmph, PYSEC-2026-1301 | Medium | 0.5% | 19 Jun, 2024 | NuGet TinyMCE Packagist tinymce/tinymce PyPI django-tinymce npm tinymce |
TinyMCE Cross-Site Scripting (XSS) vulnerability using noscript elements CVE-2024-38357, GHSA-w9jx-4g6g-rp7x, PYSEC-2026-1302 | Medium | 0.5% | 19 Jun, 2024 | NuGet TinyMCE Packagist tinymce/tinymce PyPI django-tinymce npm tinymce |
Moodle uses the same key for QR login and auto-login BIT-moodle-2024-38277, CVE-2024-38277, GHSA-r82w-3phg-qvr4 | Medium | 0.2% | 18 Jun, 2024 | Packagist moodle/moodle |
Moodle stored XSS via calendar's event title when deleting the event BIT-moodle-2024-38274, CVE-2024-38274, GHSA-p5cg-6rfr-6mx8 | Medium | 0.4% | 18 Jun, 2024 | Packagist moodle/moodle |
Moodle BigBlueButton web service leaks meeting joining information BIT-moodle-2024-38273, CVE-2024-38273, GHSA-x29x-qwvx-fxr2 | Medium | 0.4% | 18 Jun, 2024 | Packagist moodle/moodle |
Firefly III has a MFA bypass in oauth flow CVE-2024-37893, GHSA-4gm4-c4mh-4p7w | Medium | 0.6% | 17 Jun, 2024 | Packagist grumpydictator/firefly-iii |
Magento Open Source Incorrect Authorization vulnerability BIT-magento-2024-34106, CVE-2024-34106, GHSA-p6h9-gx5g-wg64 | Medium | 0.8% | 13 Jun, 2024 | Packagist magento/community-edition |
Magento Open Source Cross-Site Scripting (XSS) vulnerability BIT-magento-2024-34105, CVE-2024-34105, GHSA-5632-wq7m-gfq9 | Medium | 0.7% | 13 Jun, 2024 | Packagist magento/community-edition |
WooCommerce has a Cross-Site Scripting (XSS) Vulnerability in checkout & registration forms CVE-2024-37297, GHSA-cv23-q6gh-xfrf | Medium | 0.5% | 12 Jun, 2024 | Packagist woocommerce/woocommerce |
ua-parser/uap-php ReDoS vulnerability GHSA-78hm-5hjw-58mh | Medium | Not scored | 07 Jun, 2024 | Packagist ua-parser/uap-php |
Zend-developer-tools information disclosure vulnerability GHSA-qg7m-mwxm-j3h7 | Medium | Not scored | 07 Jun, 2024 | Packagist zendframework/zend-developer-tools |
Zend_Filter_StripTags vulnerable to Cross-site Scripting when comments allowed GHSA-4vf6-mq7w-3hp6 | Medium | Not scored | 07 Jun, 2024 | Packagist zendframework/zendframework1 |
Zend-Diactoros URL Rewrite vulnerability GHSA-fq4p-86hh-42v9 | Medium | Not scored | 07 Jun, 2024 | Packagist zendframework/zend-diactoros |
Zendframework potential Cross-site Scripting vector in `Zend_Service_ReCaptcha_MailHide` GHSA-4v57-pwvf-x35j | Medium | Not scored | 07 Jun, 2024 | Packagist zendframework/zendframework1 |
Zend-Form vulnerable to Cross-site Scripting GHSA-gvpp-6jrj-5pqc | Medium | Not scored | 07 Jun, 2024 | Packagist zendframework/zend-form |
Zendframework Potential XSS or HTML Injection vector in Zend_Json GHSA-vvm3-rv48-j3g5 | Medium | Not scored | 07 Jun, 2024 | Packagist zendframework/zendframework1 |
ZendFramework1 Potential Security Issues in Bundled Dojo Library GHSA-w5mj-j45q-m638 | Medium | Not scored | 07 Jun, 2024 | Packagist zendframework/zendframework1 |
ZendFramework Cross-site Scripting vector in `Zend_Filter_StripTags` GHSA-gwpm-pm6x-h7rj | Medium | Not scored | 07 Jun, 2024 | Packagist zendframework/zendframework1 |
Zend-Session session validation vulnerability GHSA-96c6-m98x-hxjx | Medium | Not scored | 07 Jun, 2024 | Packagist zendframework/zend-session |
ZendFramework Potential Cross-site Scripting in Development Environment Error View Script GHSA-g52p-86j5-xr8q | Medium | Not scored | 07 Jun, 2024 | Packagist zendframework/zendframework1 |
ZendFramework potential Cross-site Scripting vectors due to inconsistent encodings GHSA-hg35-vqp3-fv39 | Medium | Not scored | 07 Jun, 2024 | Packagist zendframework/zendframework1 |
ZendFramework potential Cross-site Scripting vector in `Zend_Dojo_View_Helper_Editor` GHSA-j543-vg33-g6vj | Medium | Not scored | 07 Jun, 2024 | Packagist zendframework/zendframework1 |
ZendFramework has potential Cross-site Scripting vector in multiple view helpers GHSA-m7hr-j867-3f34 | Medium | Not scored | 07 Jun, 2024 | Packagist zendframework/zend-view |
Zendframework URL Rewrite vulnerability GHSA-fh7r-58q4-6387 | Medium | Not scored | 07 Jun, 2024 | Packagist zendframework/zendframework |