Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Code injection in dolibarr/dolibarr BIT-dolibarr-2022-0819, CVE-2022-0819, GHSA-42qm-c3cf-9wv2 | High | 42.7% | 02 Mar, 2022 | Packagist dolibarr/dolibarr |
Rate limit missing in microweber CVE-2022-0777, GHSA-7r79-mrp6-8mhq | High | 1.2% | 01 Mar, 2022 | Packagist microweber/microweber |
Cross-Site Request Forgery (CSRF) Protection Bypass Vulnerability in CodeIgniter4 BIT-codeigniter-2022-24712, CVE-2022-24712, GHSA-4v37-24gm-h554 | High | 0.6% | 28 Feb, 2022 | Packagist codeigniter4/framework |
Unrestricted Upload of File with Dangerous Type in MODX Revolution CVE-2022-26149, GHSA-j8jp-9x42-4pj5 | High | 9.3% | 26 Feb, 2022 | Packagist modx/revolution |
Multi-Factor Authentication issue in Laravel Fortify CVE-2022-25838, GHSA-6w4v-qr4m-97gg | High | 0.9% | 24 Feb, 2022 | Packagist laravel/fortify |
File upload restriction bypass in Zenario CMS CVE-2022-23043, GHSA-6r86-2jm9-9mh4 | High | 1.5% | 24 Feb, 2022 | Packagist tribalsystems/zenario |
Authenticated remote code execution in October CMS CVE-2022-21705, GHSA-79jw-2f46-wv22 | High | 8.6% | 23 Feb, 2022 | Packagist october/system |
Insecure Storage of Sensitive Information in Microweber CVE-2022-0724, GHSA-j8cx-j9j2-f29w | High | 1.3% | 23 Feb, 2022 | Packagist microweber/microweber |
Insertion of Sensitive Information Into Debugging Code in Microweber CVE-2022-0721, GHSA-mjvc-j6rv-9xj8 | High | 1.4% | 23 Feb, 2022 | Packagist microweber/microweber |
Cross-site Scripting in Microweber CVE-2022-0719, GHSA-hj8g-cw8x-2c6m | High | 0.9% | 23 Feb, 2022 | Packagist microweber/microweber |
Cross-site Scripting in microweber CVE-2022-0690, GHSA-rgp5-m2pq-3fmg | High | 1.1% | 19 Feb, 2022 | Packagist microweber/microweber |
Unrestricted Upload of File with Dangerous Type in showdoc CVE-2022-0409, GHSA-6x3j-x9rp-whxp | High | 0.9% | 19 Feb, 2022 | Packagist showdoc/showdoc |
SSRF in Kitodo.Presentation CVE-2022-24980, GHSA-x832-r2rj-4g5p | High | 1.2% | 19 Feb, 2022 | Packagist kitodo/presentation |
CRLF Injection in microweber CVE-2022-0666, GHSA-3wwj-wh2w-g4xp | High | 44.3% | 18 Feb, 2022 | Packagist microweber/microweber |
Generation of Error Message Containing Sensitive Information in microweber CVE-2022-0660, GHSA-hhrj-wp42-32v3 | High | 6.9% | 18 Feb, 2022 | Packagist microweber/microweber |
Improper input validation in Drupal core BIT-drupal-2022-25271, CVE-2022-25271, DRUPAL-CORE-2022-003, GHSA-fmfv-x8mp-5767 | High | 1.3% | 16 Feb, 2022 | Packagist drupal/core |
Improper Privilege Management in Snipe-IT CVE-2022-0611, GHSA-j57w-3c39-gpp5 | High | 1.2% | 16 Feb, 2022 | Packagist snipe/snipe-it |
Improper Authorization in librenms CVE-2022-0587, GHSA-ppfm-rj6p-38q6 | High | 1.0% | 15 Feb, 2022 | Packagist librenms/librenms |
Improper Access Control in librenms CVE-2022-0580, GHSA-33wf-4crm-2322 | High | 1.2% | 14 Feb, 2022 | Packagist librenms/librenms |
OS Command Injection in Microweber CVE-2022-0557, GHSA-vm37-j55j-8655 | High | 51.2% | 11 Feb, 2022 | Packagist microweber/microweber |
ThinkPHP Remote Code Execution (RCE) vulnerability CVE-2021-44892, GHSA-75jp-87w2-c6x2 | High | 2.0% | 10 Feb, 2022 | Packagist topthink/framework |
Cross Site Request Forgery in concrete5/concrete5 CVE-2021-22954, GHSA-gr23-g276-xc73 | High | 0.5% | 09 Feb, 2022 | Packagist concrete5/concrete5 |
CSRF token missing in Symfony BIT-symfony-2022-23601, CVE-2022-23601, GHSA-vvmr-8829-6whx | High | 0.6% | 01 Feb, 2022 | Packagist symfony/framework-bundle |
Withdrawn Advisory: NULL Pointer Dereference in Protocol Buffers CVE-2021-22570, GHSA-77rm-9x9h-xj3g, PYSEC-2022-48 | High | 2.7% | 26 Jan, 2022 | Go github.com/protocolbuffers/protobuf Maven com.google.protobuf:protobuf-java NuGet Google.Protobuf Packagist google/protobuf +1 more |
Cross Site Request Forgery in Moodle BIT-moodle-2022-0335, CVE-2022-0335, GHSA-xpfv-89vg-r562 | High | 0.6% | 25 Jan, 2022 | Packagist moodle/moodle |
Cross-Site Request Forgery in yetiforce CVE-2022-0269, GHSA-7g7r-gr46-q4p5 | High | 0.5% | 24 Jan, 2022 | Packagist yetiforce/yetiforce-crm |
IBX-1392: Image filenames sanitization GHSA-44m4-9cjp-j587 | High | Not scored | 21 Jan, 2022 | Packagist ezsystems/ezpublish-kernel |
Unhandled exception when decoding form response JSON CVE-2022-51014, GHSA-wjfq-88q2-r34j | High | 0.5% | 21 Jan, 2022 | Packagist pocketmine/pocketmine-mp |
Mustache remote code injection vulnerability CVE-2022-0323, GHSA-4rmr-c2jx-vx27 | High | 0.7% | 21 Jan, 2022 | Packagist mustache/mustache |
Code Injection in microweber CVE-2022-0282, GHSA-p5hj-xxfr-pwc3 | High | 1.4% | 20 Jan, 2022 | Packagist microweber/microweber |
Exposure of Sensitive Information to an Unauthorized Actor in microweber CVE-2022-0281, GHSA-7wv8-g97r-432h | High | 10.5% | 20 Jan, 2022 | Packagist microweber/microweber |
Unrestricted Upload of File with Dangerous Type in pimcore CVE-2022-0263, GHSA-c697-r227-pq6h | High | 1.1% | 18 Jan, 2022 | Packagist pimcore/pimcore |
Cross-site Scripting in HTML2PDF CVE-2021-45394, GHSA-6m93-343m-3jrc | High | 1.6% | 18 Jan, 2022 | Packagist spipu/html2pdf |
Unrestricted Upload of File with Dangerous Type in Crater CVE-2022-0242, GHSA-728c-42pc-fwxg | High | 1.4% | 17 Jan, 2022 | Packagist bytefury/crater |
pimcore is vulnerable to SQL Injection CVE-2022-0258, GHSA-vj9x-w7ch-f46p | High | 1.7% | 17 Jan, 2022 | Packagist pimcore/pimcore |
october/system arbitrary code execution CVE-2021-32650, GHSA-5hfj-r725-wpc4 | High | 2.1% | 14 Jan, 2022 | Packagist october/system |
October/System authenticated file write leads to remote code execution CVE-2021-32649, GHSA-wv23-pfj7-2mjj | High | 1.3% | 14 Jan, 2022 | Packagist october/system |
Unchecked validity of Facing values in PlayerActionPacket CVE-2022-51015, GHSA-xh99-hw7h-wf63 | High | 0.7% | 13 Jan, 2022 | Packagist pocketmine/pocketmine-mp |
crater is vulnerable to Unrestricted Upload of File with Dangerous Type CVE-2021-4080, GHSA-wppj-3pjr-9w79 | High | 1.5% | 12 Jan, 2022 | Packagist bytefury/crater |
Sandbox Escape by math function in smarty CVE-2021-29454, GHSA-29gp-2c3m-3j6m | High | 1.8% | 10 Jan, 2022 | Packagist smarty/smarty |
Access to restricted PHP code by dynamic static class access in smarty CVE-2021-21408, GHSA-4h9c-v5vg-5m6m | High | 2.1% | 10 Jan, 2022 | Packagist smarty/smarty |
Uncapped length of skin data fields submitted by players CVE-2022-51017, GHSA-c6fg-99pr-25m9 | High | 0.6% | 06 Jan, 2022 | Packagist pocketmine/pocketmine-mp |
Book page text, count, and author/title length is not limited in PocketMine-MP CVE-2022-51018, GHSA-p62j-hrxm-xcxf | High | 0.4% | 06 Jan, 2022 | Packagist pocketmine/pocketmine-mp |
Insufficient Session Expiration in shopware CVE-2022-21652, GHSA-p523-jrph-qjc6 | High | 0.8% | 05 Jan, 2022 | Packagist shopware/shopware |
Missing Authorization in DayByDay CRM CVE-2022-22111, GHSA-w6rp-4vj7-v2m8 | High | 1.0% | 05 Jan, 2022 | Packagist bottelet/flarepoint |
Weak Password Requirements in Daybyday CRM CVE-2022-22110, GHSA-96v6-hrwg-p378 | High | 1.2% | 05 Jan, 2022 | Packagist bottelet/flarepoint |
Sandbox bypass in Latte templates CVE-2022-21648, GHSA-36m2-8rhx-f36j | High | 0.8% | 04 Jan, 2022 | Packagist latte/latte |
Client-Side JavaScript Prototype Pollution in oro/platform CVE-2021-43852, GHSA-jx5q-g37m-h5hj | High | 1.1% | 04 Jan, 2022 | Packagist oro/platform |
Injection in UserFrosting CVE-2021-25994, GHSA-cv25-3gmg-c6m8 | High | 1.6% | 03 Jan, 2022 | Packagist userfrosting/userfrosting |
showdoc is vulnerable to Cross-Site Request Forgery (CSRF) CVE-2021-4168, GHSA-7vxc-chqj-h83g | High | 0.6% | 26 Dec, 2021 | Packagist showdoc/showdoc |