Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Fix for arbitrary file deletion in customer media allows for remote code execution CVE-2021-41143, GHSA-5vpv-xmcj-9q85 | High | 1.3% | 27 Jan, 2023 | Packagist openmage/magento-lts |
Fix for arbitrary command execution in custom layout update through blocks CVE-2021-39217, GHSA-c9q3-r4rv-mjm7 | High | 1.3% | 27 Jan, 2023 | Packagist openmage/magento-lts |
symfont/process typosquatting malware spoofs symfony/process GHSA-g3j5-mpp2-2fqm | High | Not scored | 26 Jan, 2023 | Packagist symfont/process |
Command injection in yiisoft/yii2-gii CVE-2020-36655, GHSA-3mpg-q26j-83j5 | High | 1.5% | 21 Jan, 2023 | Packagist yiisoft/yii2-gii |
CakePHP vulnerable to Denial of Service attack through XML payloads GHSA-q79m-c546-2g63 | High | Not scored | 20 Jan, 2023 | Packagist cakephp/cakephp |
Shopware has Improper Input Validation issue in newsletter subscription CVE-2023-22734, GHSA-46h7-vj7x-fxg2 | High | 0.6% | 17 Jan, 2023 | Packagist shopware/core Packagist shopware/platform |
Shopware vulnerable to Improper Input Validation of Clearance sale in cart CVE-2023-22730, GHSA-8r6h-m72v-38fg | High | 0.7% | 17 Jan, 2023 | Packagist shopware/core Packagist shopware/platform |
Froxlor vulnerable to Command Injection CVE-2023-0315, GHSA-cp68-42pf-6627 | High | 97.7% | 16 Jan, 2023 | Packagist froxlor/froxlor |
Flarum post mentions can be used to read any post on the forum without access control CVE-2023-22487, GHSA-22m9-m3ww-53h3 | High | 0.7% | 10 Jan, 2023 | Packagist flarum/mentions |
PocketMine-MP has improperly handled dye colour IDs in banner NBT, leading to server crash CVE-2023-54396, GHSA-wqqv-jcfr-9f5g | High | 0.5% | 09 Jan, 2023 | Packagist pocketmine/pocketmine-mp |
FrameworkUserBundle Generates Error Message Containing Sensitive Information CVE-2015-10012, GHSA-6m7c-45ff-3328 | High | 0.8% | 03 Jan, 2023 | Packagist sumocoders/framework-user-bundle |
Microweber vulnerable to unrestricted malicious uploads CVE-2022-4732, GHSA-8h43-xg5g-9cj7 | High | 38.2% | 27 Dec, 2022 | Packagist microweber/microweber |
CodeIgniter4 allows spoofing of IP address when using proxy BIT-codeigniter-2022-23556, CVE-2022-23556, GHSA-ghw3-5qvm-3mqc | High | 0.4% | 22 Dec, 2022 | Packagist codeigniter4/framework |
SilverStripe Subsite weakens file permissions CVE-2022-42949, GHSA-cx45-565q-6qx8 | High | 0.6% | 19 Dec, 2022 | Packagist silverstripe/subsites |
"Newsletter subscriber management" (fp_newsletter) TYPO3 extension leaks subscriber data CVE-2022-47411, GHSA-r44w-pfx8-28jv | High | 0.7% | 14 Dec, 2022 | Packagist fixpunkt/fp-newsletter |
"Newsletter subscriber management" (fp_newsletter) TYPO3 extension leaks subscriber data CVE-2022-47410, GHSA-vxmc-qg5x-pvfx | High | 0.7% | 14 Dec, 2022 | Packagist fixpunkt/fp-newsletter |
TYPO3 CMS vulnerable to Arbitrary Code Execution via Form Framework BIT-typo3-2022-23503, CVE-2022-23503, GHSA-c5wx-6c2c-f7rm | High | 0.8% | 13 Dec, 2022 | Packagist typo3/cms Packagist typo3/cms-core |
TYPO3 CMS vulnerable to Denial of Service in Page Error Handling BIT-typo3-2022-23500, CVE-2022-23500, GHSA-8c28-5mp7-v24h | High | 0.7% | 13 Dec, 2022 | Packagist typo3/cms Packagist typo3/cms-core |
phpMyFAQ has insecure HTTP cookies CVE-2022-4409, GHSA-wpgc-5cr5-h9gg | High | 0.5% | 11 Dec, 2022 | Packagist thorsten/phpmyfaq |
Akeneo PIM Community Edition vulnerable to remote php code execution BIT-akeneo-2022-46157, CVE-2022-46157, GHSA-w9wc-4xcq-8gr6 | High | 1.5% | 09 Dec, 2022 | Packagist akeneo/pim-community-dev |
Thinkphp has a code logic error CVE-2022-44289, GHSA-59fh-rjq3-xq7j | High | 3.1% | 06 Dec, 2022 | Packagist topthink/framework |
Craft CMS discloses password hashes CVE-2022-37783, GHSA-h972-v458-m892 | High | 1.1% | 05 Dec, 2022 | Packagist craftcms/cms |
ThinkCMF Cross Site Request Forgery (CSRF) vulnerability CVE-2022-40489, GHSA-6xw3-cpqj-8mxr | High | 0.4% | 01 Dec, 2022 | Packagist thinkcmf/thinkcmf |
code injection in phpxmlrpc/phpxmlrpc GHSA-3fgr-xjr6-xqm8 | High | Not scored | 28 Nov, 2022 | Packagist phpxmlrpc/phpxmlrpc |
Browsershot does not validate URL protocols passed to Browsershot URL method CVE-2022-41706, GHSA-8c2c-jxwj-jqgf | High | 0.6% | 25 Nov, 2022 | Packagist spatie/browsershot |
Browsershot version 3.57.3 vulnerable to improper input validation CVE-2022-43984, GHSA-6q49-35h6-rq2p | High | 0.6% | 25 Nov, 2022 | Packagist spatie/browsershot |
Browsershot vulnerable to Cross-Site Scripting (XSS) CVE-2022-43983, GHSA-82h9-v8vh-mfpq | High | 0.7% | 25 Nov, 2022 | Packagist spatie/browsershot |
Account Takeover Through Password Reset Poisoning CVE-2022-33012, GHSA-rp7f-fhm8-9hpf | High | 1.4% | 22 Nov, 2022 | Packagist microweber/microweber |
Blind SQL Injection via GridFieldSortableHeader CVE-2022-38148, GHSA-rr8h-f97q-8p9c | High | 0.8% | 21 Nov, 2022 | Packagist silverstripe/framework |
Cross-site Scripting in librenms/librenms CVE-2022-4068, GHSA-f3hw-3h74-wr98 | High | 37.5% | 20 Nov, 2022 | Packagist librenms/librenms |
Deserialization of Untrusted Data in librenms/librenms CVE-2022-3525, GHSA-cv9g-h8mm-xx5h | High | 1.0% | 20 Nov, 2022 | Packagist librenms/librenms |
Concrete CMS vulnerable to Cross-site Request Forgery CVE-2022-43693, GHSA-w8fp-3gwq-gxpw | High | 0.5% | 14 Nov, 2022 | Packagist concrete5/concrete5 |
ezplatform-graphql GraphQL queries can expose password hashes CVE-2022-41876, GHSA-c7pc-pgf6-mfh5 | High | 1.4% | 10 Nov, 2022 | Packagist ezsystems/ezplatform-graphql |
phpCAS vulnerable to Service Hostname Discovery Exploitation CVE-2022-39369, GHSA-8q72-6qq8-xv64 | High | 2.4% | 01 Nov, 2022 | Packagist apereo/phpcas |
Magento Improper input validation vulnerability BIT-magento-2022-42344, CVE-2022-42344, GHSA-297f-r9w7-w492 | High | 1.3% | 20 Oct, 2022 | Packagist magento/community-edition |
phpMyFAQ vulnerable to Cross-site Scripting CVE-2022-3608, GHSA-6rj8-9cm9-6gff | High | 1.2% | 19 Oct, 2022 | Packagist phpmyfaq/phpmyfaq Packagist thorsten/phpmyfaq |
Lavalite vulnerable to Arbitrary File Read via Directory Traversal CVE-2022-42188, GHSA-cm22-88qr-7ffh | High | 1.1% | 18 Oct, 2022 | Packagist lavalite/cms |
Magento Open Source allows Stored Cross-Site Scripting (Stored XSS) CVE-2022-35698, GHSA-4vj2-426r-jm3g | High | 14.6% | 14 Oct, 2022 | Packagist magento/community-edition Packagist magento/project-community-edition |
October CMS Safe Mode bypass leads to authenticated Remote Code Execution CVE-2022-35944, GHSA-x4q7-m6fp-4v9v | High | 1.0% | 13 Oct, 2022 | Packagist october/system |
melisplatform/melis-asset-manager vulnerable to Path Traversal CVE-2022-39296, GHSA-7fj2-rrq6-rphq | High | 1.9% | 11 Oct, 2022 | Packagist melisplatform/melis-asset-manager |
Backdrop CMS Unrestricted File Upload vulnerability CVE-2022-42092, GHSA-33c9-rppf-m7fq | High | 2.1% | 07 Oct, 2022 | Packagist backdrop/backdrop |
Moodle Cross-Site Request Forgery (CSRF) BIT-moodle-2022-2986, CVE-2022-2986, GHSA-xjr3-fwp9-9g96 | High | 0.5% | 06 Oct, 2022 | Packagist moodle/moodle |
Moodle Stored Cross-site Scripting and page denial of service BIT-moodle-2022-40313, CVE-2022-40313, GHSA-jqgr-gh62-jf53 | High | 0.7% | 30 Sep, 2022 | Packagist moodle/moodle |
Twig may load a template outside a configured directory when using the filesystem loader BIT-drupal-2022-39261, CVE-2022-39261, DRUPAL-CORE-2022-016, GHSA-52m2-vc4m-jj33 | High | 3.2% | 28 Sep, 2022 | Packagist drupal/core Packagist twig/twig |
Centreon SQL Injection vulnerability via esc_name parameter CVE-2022-40043, GHSA-25gv-wg6f-6frp | High | 1.4% | 26 Sep, 2022 | Packagist centreon/centreon |
Dompdf allows remote file inclusion because URI validation failure does not halt font registration CVE-2022-41343, GHSA-6x28-7h8c-chx4 | High | 6.0% | 25 Sep, 2022 | Packagist dompdf/dompdf |
ICEcoder vulnerable to Path Traversal CVE-2022-34026, GHSA-fvf5-xp83-vrqp | High | 1.8% | 22 Sep, 2022 | Packagist icecoder/icecoder |
TYPO3 CMS vulnerable to Denial of Service in Page Error Handling BIT-typo3-2022-36104, CVE-2022-36104, GHSA-fffr-7x4x-f98q | High | 1.6% | 13 Sep, 2022 | Packagist typo3/cms Packagist typo3/cms-core |
Shopware access control list bypassed via crafted specific URLs CVE-2022-36102, GHSA-qc43-pgwq-3q2q | High | 0.8% | 12 Sep, 2022 | Packagist shopware/shopware |
Cross-site scripting from content entered in the tags and multiselect fields GHSA-rv3r-vqjj-8c76 | High | Not scored | 30 Aug, 2022 | Packagist getkirby/cms |