Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
ezsystems/ez-support-tools Failing access control in system info view GHSA-xmp3-7745-g4vj | Medium | Not scored | 15 May, 2024 | Packagist ezsystems/ez-support-tools |
endroid/qr-code-bundle File Disclosure via logo_path query parameter GHSA-mvf6-3f2g-xfxf | Medium | Not scored | 15 May, 2024 | Packagist endroid/qr-code-bundle |
Drupal Cross-Site Scripting (XSS) affecting CKEditor Third-party library GHSA-qf65-hph9-453r | Medium | Not scored | 15 May, 2024 | Packagist drupal/drupal |
Drupal core uses a vulnerable Third-party library CKEditor GHSA-337w-fxpq-5m34 | Medium | Not scored | 15 May, 2024 | Packagist drupal/drupal |
Drupal core Open Redirect vulnerability GHSA-wxfg-253g-m7r4 | Medium | Not scored | 15 May, 2024 | Packagist drupal/drupal |
Drupal core Access control bypass GHSA-5x28-3f32-x523 | Medium | Not scored | 15 May, 2024 | Packagist drupal/drupal |
Drupal core Denial of Service GHSA-w333-5f96-mjrr | Medium | Not scored | 15 May, 2024 | Packagist drupal/drupal |
Drupal Malicious file upload with filenames stating with dot GHSA-58xv-7h9r-mx3c | Medium | Not scored | 15 May, 2024 | Packagist drupal/drupal |
Drupal Anonymous Open Redirect GHSA-x6v2-xmrq-574j | Medium | Not scored | 15 May, 2024 | Packagist drupal/drupal |
Drupal Content moderation Access bypass GHSA-86xw-vmcx-9mj4 | Medium | Not scored | 15 May, 2024 | Packagist drupal/drupal |
Drupal External URL injection through URL aliases leading to Open Redirect GHSA-r67r-42wx-c8r7 | Medium | Not scored | 15 May, 2024 | Packagist drupal/drupal |
Drupal core Cross-Site Scripting (XSS) vulnerabilities GHSA-vfgc-c76h-mwh4 | Medium | Not scored | 15 May, 2024 | Packagist drupal/core |
Drupal core Open Redirect vulnerability GHSA-6gf6-24h2-66j4 | Medium | Not scored | 15 May, 2024 | Packagist drupal/core |
Drupal core uses a vulnerable Third-party library CKEditor GHSA-v273-j5hq-26xp | Medium | Not scored | 15 May, 2024 | Packagist drupal/core |
Drupal core Access bypass GHSA-mh4h-27gq-cxwj | Medium | Not scored | 15 May, 2024 | Packagist drupal/core |
Drupal core unrestricted file upload GHSA-7gwj-7fhm-vw4w | Medium | Not scored | 15 May, 2024 | Packagist drupal/core |
Drupal core Denial of Service GHSA-pr99-c33p-fwf6 | Medium | Not scored | 15 May, 2024 | Packagist drupal/core |
Drupal Anonymous Open Redirect GHSA-gfvf-2f25-f34r | Medium | Not scored | 15 May, 2024 | Packagist drupal/core |
Drupal External URL injection through URL aliases leading to Open Redirect GHSA-7f4f-p7mq-p4fv | Medium | Not scored | 15 May, 2024 | Packagist drupal/core |
Drupal Content moderation Access bypass GHSA-f84q-mgj9-8jfc | Medium | Not scored | 15 May, 2024 | Packagist drupal/core |
doctrine/doctrine-module zero-valued authentication credentials vulnerability GHSA-9wv8-3h8h-x2wc | Medium | Not scored | 15 May, 2024 | Packagist doctrine/doctrine-module |
Inadequate XSS Prevention in CodeIgniter/Framework Security Library GHSA-q9j3-4ghj-6h57 | Medium | Not scored | 15 May, 2024 | Packagist codeigniter/framework |
Denial of Service in extension "Code Highlight" (codehighlight) GHSA-4cv2-xc5f-px8h | Medium | Not scored | 15 May, 2024 | Packagist brotkrueml/codehighlight |
Denial of Service in extension "Code Highlight" (codehighlight) GHSA-65xh-hh78-6454 | Medium | Not scored | 15 May, 2024 | Packagist brotkrueml/codehighlight |
amphp/http Host Header Injection vulnerability GHSA-8v5x-6vv5-jv4g | Medium | Not scored | 15 May, 2024 | Packagist amphp/http |
amphp/artax Cookie leakage to wrong origins and non-restricted cookie acceptance GHSA-gm98-g2wf-7c68 | Medium | Not scored | 15 May, 2024 | Packagist amphp/artax |
amphp/http-client Header leakage on cross-domain redirects GHSA-8jp9-mpv9-98rj | Medium | Not scored | 15 May, 2024 | Packagist amphp/http-client |
asymmetricrypt/asymmetricrypt Padding Oracle Vulnerability in RSA Encryption GHSA-87mp-xc4x-x8rh | Medium | Not scored | 15 May, 2024 | Packagist asymmetricrypt/asymmetricrypt |
PHP Censor uses a weak hashing algorithm for the remember me key CVE-2024-34914, GHSA-fqw7-839j-hvxj | Medium | 0.3% | 14 May, 2024 | Packagist php-censor/php-censor |
Anonymous PrestaShop customer can download other customers' invoices CVE-2024-34717, GHSA-7pjr-2rgh-fc5g | Medium | 0.5% | 14 May, 2024 | Packagist prestashop/prestashop |
TYPO3 vulnerable to an Uncontrolled Resource Consumption in the ShowImageController CVE-2024-34358, GHSA-36g8-62qv-5957 | Medium | 0.5% | 14 May, 2024 | Packagist typo3/cms-core |
TYPO3 vulnerable to Cross-Site Scripting in the ShowImageController CVE-2024-34357, GHSA-hw6c-6gwq-3m3m | Medium | 0.5% | 14 May, 2024 | Packagist typo3/cms-core |
TYPO3 vulnerable to Cross-Site Scripting in the Form Manager Module CVE-2024-34356, GHSA-v6mw-h7w6-59w3 | Medium | 0.5% | 14 May, 2024 | Packagist typo3/cms-core |
TYPO3 vulnerable to an HTML Injection in the History Module CVE-2024-34355, GHSA-xjwx-78x7-q6jc | Medium | 0.6% | 14 May, 2024 | Packagist typo3/cms-core |
AVideo cross-site scripting vulnerability in the view/about.php page CVE-2024-34899, GHSA-f98p-2hc5-fm7v | Medium | 0.5% | 14 May, 2024 | Packagist wwbn/avideo |
Mantis Bug Tracker (MantisBT) vulnerable to cross-site scripting CVE-2024-34081, GHSA-wgx7-jp56-65mq | Medium | 0.6% | 13 May, 2024 | Packagist mantisbt/mantisbt |
MantisBT Vulnerable to Exposure of Sensitive Information to an Unauthorized Actor CVE-2024-34080, GHSA-99jc-wqmr-ff2q | Medium | 0.7% | 13 May, 2024 | Packagist mantisbt/mantisbt |
Sylius potentially vulnerable to Cross Site Scripting via "Name" field (Taxons, Products, Options, Variants) in Admin Panel CVE-2024-34349, GHSA-v2f9-rv6w-vw8r | Medium | 0.4% | 10 May, 2024 | Packagist sylius/sylius |
Kimai information disclosure vulnerability CVE-2024-4596, GHSA-6f3v-2r2j-2rpr | Medium | 0.8% | 07 May, 2024 | Packagist kimai/kimai |
MediaWiki UnlinkedWikibase Cross-site Scripting vulnerability BIT-mediawiki-2024-34500, CVE-2024-34500, GHSA-wcx3-63mm-h8x6 | Medium | 0.5% | 05 May, 2024 | Packagist samwilson/unlinked-wikibase |
ThinkPHP Cross-Site Scripting Vulnerability CVE-2024-34467, GHSA-969f-v7jv-pgj3 | Medium | 0.4% | 04 May, 2024 | Packagist topthink/framework |
Zenario's Tree Explorer tool from Organizer affected by Cross-site Scripting CVE-2024-34460, GHSA-7qwj-gcjf-828f | Medium | 0.6% | 04 May, 2024 | Packagist tribalsystems/zenario |
Pterodactyl panel's admin area vulnerable to Cross-site Scripting CVE-2024-34067, GHSA-384w-wffr-x63q | Medium | 0.5% | 03 May, 2024 | Packagist pterodactyl/panel |
mdanter/ecc affected by timing vulnerability in cryptographic side-channels CVE-2024-33851, GHSA-3494-cfwf-56hw | Medium | 0.4% | 27 Apr, 2024 | Packagist mdanter/ecc Packagist paragonie/ecc |
Lavalite CMS Cross Site Scripting vulnerability CVE-2024-31828, GHSA-5hcr-g32p-h74c | Medium | 0.5% | 26 Apr, 2024 | Packagist lavalite/cms |
Passbolt API allows HTML injection CVE-2024-33670, GHSA-2pg6-vw9c-qhjv | Medium | 0.5% | 26 Apr, 2024 | Packagist passbolt/passbolt_api |
Pimcore TinyMCE Bundle - tinymce CVE-2024-29203, CVE-2024-29881 GHSA-vjwg-28gv-pm8h | Medium | Not scored | 24 Apr, 2024 | Packagist pimcore/pimcore |
Sylius has potential Cross Site Scripting vulnerability via the "Province" field in the Checkout and Address Book CVE-2024-29376, GHSA-7prj-9ccr-hr3q | Medium | 0.4% | 22 Apr, 2024 | Packagist sylius/sylius |
TCPDF Cross-site Scripting vulnerability CVE-2024-32489, GHSA-g9wg-98c2-qv3v | Medium | 0.6% | 15 Apr, 2024 | Packagist tecnickcom/tcpdf |
Mautic: MST-48 Server-Side Request Forgery in Asset section CVE-2022-25777, GHSA-mgv8-w49f-822w | Medium | 0.4% | 12 Apr, 2024 | Packagist mautic/core |