Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Mautic vulnerable to cross-site scripting in notifications via saving Dashboards CVE-2022-25774, GHSA-fhcx-f7jg-jx3f | Medium | 0.4% | 12 Apr, 2024 | Packagist mautic/core |
Reportico affected by Incorrect Access Control CVE-2023-48865, GHSA-pww3-x2g7-x8q2 | Medium | 0.6% | 11 Apr, 2024 | Packagist reportico-web/reportico |
Contao: Insufficient BBCode sanitizer CVE-2024-28234, GHSA-j55w-hjpj-825g | Medium | 0.6% | 09 Apr, 2024 | Packagist contao/comments-bundle |
Contao: Unencoded insert tags in the frontend CVE-2024-28191, GHSA-747v-52c4-8vj8 | Medium | 0.5% | 09 Apr, 2024 | Packagist contao/core-bundle |
Contao: Cross site scripting in the file manager CVE-2024-28190, GHSA-v24p-7p4j-qvvf | Medium | 0.5% | 09 Apr, 2024 | Packagist contao/core-bundle |
Shopware Improper Session Handling in store-api account logout CVE-2024-31447, GHSA-5297-wrrp-rcj7 | Medium | 0.5% | 08 Apr, 2024 | Packagist shopware/core Packagist shopware/platform |
Concrete CMS Stored XSS in the Search Field CVE-2024-3181, GHSA-qgm9-rxmq-jxmq | Medium | 0.4% | 03 Apr, 2024 | Packagist concrete5/concrete5 |
Concrete CMS Stored XSS in blocks of type file CVE-2024-3180, GHSA-9qhc-pg6j-wf23 | Medium | 0.4% | 03 Apr, 2024 | Packagist concrete5/concrete5 |
Concrete CMS Stored XSS in the Custom Class page editing CVE-2024-3179, GHSA-r7q4-cw9r-vhp4 | Medium | 0.4% | 03 Apr, 2024 | Packagist concrete5/concrete5 |
Concrete CMS Cross-site Scripting (XSS) in the Advanced File Search Filter CVE-2024-3178, GHSA-xwrh-qxmc-x8c8 | Medium | 0.4% | 03 Apr, 2024 | Packagist concrete5/concrete5 |
Concrete CMS Stored XSS on the calendar color settings screen CVE-2024-2753, GHSA-pj42-r64f-4xfq | Medium | 0.4% | 03 Apr, 2024 | Packagist concrete5/concrete5 |
OpenID Connect Authentication (oidc) Typo3 extension Authentication Bypass CVE-2024-30173, GHSA-hhf8-f5w9-g6vh | Medium | Not scored | 02 Apr, 2024 | Packagist causal/oidc |
Kimai API returns timesheet entries a user should not be authorized to view CVE-2024-29200, GHSA-cj3c-5xpm-cx94 | Medium | 0.6% | 28 Mar, 2024 | Packagist kimai/kimai |
Pimcore Preview Documents are not restricted to logged in users anymore CVE-2024-29197, GHSA-5737-rqv4-v445 | Medium | 0.7% | 26 Mar, 2024 | Packagist pimcore/pimcore |
TinyMCE Cross-Site Scripting (XSS) vulnerability in handling external SVG files through Object or Embed elements CVE-2024-29881, GHSA-5359-pvf2-pw78 | Medium | 0.7% | 26 Mar, 2024 | NuGet TinyMCE Packagist tinymce/tinymce npm tinymce |
TinyMCE Cross-Site Scripting (XSS) vulnerability in handling iframes CVE-2024-29203, GHSA-438c-3975-5x3f | Medium | 0.7% | 26 Mar, 2024 | NuGet TinyMCE Packagist tinymce/tinymce npm tinymce |
dcat-admin Cross Site Scripting vulnerability CVE-2024-29644, GHSA-mr24-cf69-5chq | Medium | 0.6% | 26 Mar, 2024 | Packagist dcat/laravel-admin |
phpMyFAQ Stored Cross-site Scripting at File Attachments CVE-2024-29179, GHSA-hm8r-95g3-5hj9 | Medium | 0.5% | 25 Mar, 2024 | Packagist phpmyfaq/phpmyfaq |
phpMyFAQ Stored HTML Injection at contentLink CVE-2024-28108, GHSA-48vw-jpf8-hwqh | Medium | 0.5% | 25 Mar, 2024 | Packagist phpmyfaq/phpmyfaq |
phpMyFAQ Stored Cross-site Scripting at FAQ News Content CVE-2024-28106, GHSA-6p68-36m6-392r | Medium | 0.5% | 25 Mar, 2024 | Packagist phpmyfaq/phpmyfaq |
phpMyFAQ stored Cross-site Scripting at user email CVE-2024-27300, GHSA-q7g6-xfh2-vhpx | Medium | 0.7% | 25 Mar, 2024 | Packagist phpmyfaq/phpmyfaq |
Storefront user can access history and most viewed data from matching back-office user with the same ID CVE-2023-48296, GHSA-v7px-46v9-5qwp | Medium | 0.4% | 25 Mar, 2024 | Packagist oro/customer-portal |
Pinned entity creation form shows wrong data CVE-2023-45824, GHSA-vxq2-p937-3px3 | Medium | 0.4% | 25 Mar, 2024 | Packagist oro/platform |
Cross-Site Request Forgery in Anchor CMS CVE-2024-29338, GHSA-2whx-ccr7-fxqm | Medium | 0.3% | 22 Mar, 2024 | Packagist anchorcms/anchor-cms |
Slow String Operations via MultiPart Requests in Event-Driven Functions CVE-2024-29186, GHSA-j4hq-f63x-f39r | Medium | 0.7% | 22 Mar, 2024 | Packagist bref/bref |
Cross-site Scripting in Moodle Chat BIT-moodle-2024-28593, CVE-2024-28593, GHSA-f6mh-79vh-2hv7 | Medium | 0.6% | 22 Mar, 2024 | Packagist moodle/moodle |
Cross site scripting in moodle BIT-moodle-2024-29374, CVE-2024-29374, GHSA-3qw5-v9cc-v262 | Medium | 0.5% | 21 Mar, 2024 | Packagist moodle/moodle |
Ibexa Kernel's files with blacklisted extensions can be still saved to drafts GHSA-9j39-4686-m3c4 | Medium | Not scored | 20 Mar, 2024 | Packagist ibexa/core |
Ibexa Kernel's files with blacklisted extensions can be still saved to drafts GHSA-mwvh-p3hx-x4gg | Medium | Not scored | 20 Mar, 2024 | Packagist ezsystems/ezplatform-kernel |
Cross-site Scripting in livewire/livewire CVE-2024-21504, GHSA-389c-cf87-qmwj | Medium | 0.5% | 19 Mar, 2024 | Packagist livewire/livewire |
Bagisto vulnerable to Insecure Direct Object Reference (IDOR) CVE-2023-36238, GHSA-pmc7-hmmw-g96q | Medium | 0.5% | 13 Mar, 2024 | Packagist bagisto/bagisto |
Concrete CMS Stored Cross-site Scripting vulnerability CVE-2024-2179, GHSA-4m7h-34xm-4wjv | Medium | 0.3% | 05 Mar, 2024 | Packagist concrete5/concrete5 |
Bagist Cross-site Scripting vulnerability CVE-2024-27499, GHSA-w5mx-334j-6fwv | Medium | 0.5% | 01 Mar, 2024 | Packagist bagisto/bagisto |
Cockpit CMS Cross-Site Scripting vulnerability CVE-2024-2001, GHSA-q76r-7p4q-mqpw | Medium | 0.3% | 29 Feb, 2024 | Packagist cockpit-hq/cockpit |
Concrete CMS Stored XSS CVE-2023-49337, GHSA-9xxv-q6pp-96wq | Medium | 0.5% | 29 Feb, 2024 | Packagist concrete5/concrete5 |
Concrete CMS Cross Site Request Forgery (CSRF) vulnerability CVE-2023-48653, GHSA-3rxx-8f33-7p6p | Medium | 0.3% | 29 Feb, 2024 | Packagist concrete5/concrete5 |
Concrete CMS Cross Site Request Forgery (CSRF) vulnerability CVE-2023-48651, GHSA-45m2-8q7f-93wv | Medium | 0.3% | 29 Feb, 2024 | Packagist concrete5/concrete5 |
Concrete CMS Stored XSS in Layout Preset Name CVE-2023-48650, GHSA-x577-gcc9-9xjj | Medium | 0.5% | 29 Feb, 2024 | Packagist concrete5/concrete5 |
Webtrees Path Traversal vulnerability CVE-2024-22723, GHSA-6w5q-79rf-7c49 | Medium | 0.9% | 28 Feb, 2024 | Packagist fisharebest/webtrees |
Magento LTS vulnerable to stored XSS in admin file form GHSA-gp6m-fq6h-cjcx | Medium | Not scored | 27 Feb, 2024 | Packagist openmage/magento-lts |
Subrion CMS vulnerable to Cross Site Scripting CVE-2024-25399, GHSA-q4qh-8pxw-r48q | Medium | 0.3% | 27 Feb, 2024 | Packagist intelliants/subrion |
Kirby vulnerable to Cross-site scripting (XSS) in the link field "Custom" type CVE-2024-27087, GHSA-63h4-w25c-3qv4 | Medium | 0.3% | 26 Feb, 2024 | Packagist getkirby/cms |
baserCMS Cross-site Scripting vulnerability in Content Management CVE-2024-26128, GHSA-jjxq-m8h3-4vw5 | Medium | 0.6% | 22 Feb, 2024 | Packagist baserproject/basercms |
baserCMS Cross-site Scripting vulnerability in Site search Feature CVE-2023-44379, GHSA-66c2-p8rh-qx87 | Medium | 0.5% | 22 Feb, 2024 | Packagist baserproject/basercms |
Enhavo Cross-site Scripting vulnerability CVE-2024-25876, GHSA-pcm8-qqrp-w6qf | Medium | 0.4% | 22 Feb, 2024 | Packagist enhavo/enhavo-app |
Enhavo Cross-site Scripting vulnerability CVE-2024-25875, GHSA-c579-hhw5-cr3p | Medium | 0.4% | 22 Feb, 2024 | Packagist enhavo/enhavo-app |
Enhavo Cross-site Scripting vulnerability CVE-2024-25874, GHSA-38m8-5gfc-663g | Medium | 0.4% | 22 Feb, 2024 | Packagist enhavo/enhavo-app |
Path Traversal in TYPO3 Core GHSA-gj48-w74w-8gvm | Medium | Not scored | 22 Feb, 2024 | Packagist typo3/cms |
Kirby vulnerable to self cross-site scripting (self-XSS) in the URL field CVE-2024-26481, GHSA-57f2-8p89-66x6 | Medium | 0.4% | 22 Feb, 2024 | Packagist getkirby/cms |
Path disclosure in JavaScript variable CVE-2024-26129, GHSA-3366-9287-7qpr | Medium | 0.6% | 19 Feb, 2024 | Packagist prestashop/prestashop |