Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
solspace/craft-freeform Exposed to Known Axios Vulnerabilities via Precompiled Assets GHSA-rwr8-xrpw-9qf5 | Low | Not scored | 15 Jan, 2026 | Packagist solspace/craft-freeform |
solspace/craft-freeform Vulnerable to XSS in `PhpSpreadsheet` HTML Writer Due to Unsanitized Styling Data GHSA-44jg-mv3h-wj6g | Low | Not scored | 15 Jan, 2026 | Packagist solspace/craft-freeform |
solspace/craft-freeform Has a DoS Vulnerability GHSA-58q2-9x27-h2jm | Low | Not scored | 15 Jan, 2026 | Packagist solspace/craft-freeform |
Composer is vulnerable to ANSI sequence injection BIT-composer-2025-67746, CVE-2025-67746, GHSA-59pp-r3rg-353g | Low | 0.5% | 30 Dec, 2025 | Packagist composer/composer |
Pterodactyl has a Reflected XSS vulnerability in “Create New Database Host” GHSA-mgr9-6c2j-jxrq | Low | Not scored | 30 Dec, 2025 | Packagist pterodactyl/panel |
AzuraCast Vulnerable to Pre-Auth File Deletion & Admin RCE CVE-2025-67737, GHSA-9449-rphm-mjqr | Low | 0.2% | 11 Dec, 2025 | Packagist azuracast/azuracast |
Skuul School Management System has a Sensitive Data Exposure Vulnerability in Uploaded Images CVE-2025-13785, GHSA-xmh7-35v2-fp6h | Low | 0.4% | 30 Nov, 2025 | Packagist yungifez/skuul |
yungifez Skuul School Management System vulnerable to XSS via SVG CVE-2025-13784, GHSA-92x3-mfjp-j3h3 | Low | 0.3% | 30 Nov, 2025 | Packagist yungifez/skuul |
LibreNMS has Weak Password Policy CVE-2025-65014, GHSA-5mrf-j8v6-f45g | Low | 0.3% | 18 Nov, 2025 | Packagist librenms/librenms |
Drupal core allows Exploiting Incorrectly Configured Access Control Security Levels BIT-drupal-2025-13083, CVE-2025-13083, DRUPAL-CORE-2025-008, GHSA-mhpg-hpj5-73r2 | Low | 0.3% | 12 Nov, 2025 | Packagist drupal/core |
Skuul School Management System has an Insecure Direct Object Reference (IDOR) Vulnerability in View Fee Invoice CVE-2025-12918, GHSA-fqq7-h225-8w6h | Low | 0.4% | 09 Nov, 2025 | Packagist yungifez/skuul |
Drupal Simple multi step form allows Cross-Site Scripting CVE-2025-12761, DRUPAL-CONTRIB-2025-116, GHSA-gg35-374m-9ph8 | Low | 0.2% | 05 Nov, 2025 | Packagist drupal/simple_multistep Packagist:https://packages.drupal.org/8 drupal/simple_multistep |
Shopware vulnerable to Server-Side Request Forgery (SSRF) – order invoice GHSA-3cpp-fv95-mpr5 | Low | Not scored | 21 Oct, 2025 | Packagist shopware/core Packagist shopware/platform |
Shopware vulnerable to path traversal via Plugin upload GHSA-6wh5-mw9h-5c3w | Low | Not scored | 21 Oct, 2025 | Packagist shopware/core Packagist shopware/platform |
PrestaShop Checkout Target PayPal merchant account hijacking from backoffice CVE-2025-61924, GHSA-wvpg-4wrh-5889 | Low | 0.3% | 16 Oct, 2025 | Packagist prestashop/ps_checkout |
drupal-pattern-lab/unified-twig-extensions is vulnerable to XXS CVE-2025-11570, GHSA-64mv-9655-37hx | Low | 0.2% | 10 Oct, 2025 | Packagist drupal-pattern-lab/unified-twig-extensions |
NovoSGA: Manipulation of User Creation Page can lead to weak password requirements CVE-2025-11322, GHSA-xgr2-5837-hf48 | Low | 0.4% | 06 Oct, 2025 | Packagist novosga/novosga |
Auth0 Symfony SDK Does Not Properly Handle File Types in Bulk User Import GHSA-7jp2-5h22-m432 | Low | Not scored | 01 Oct, 2025 | Packagist auth0/symfony |
Auth0 Wordpress plugin Does Not Properly Handle File Types in Bulk User Import GHSA-w22c-pw5m-482x | Low | Not scored | 01 Oct, 2025 | Packagist auth0/wordpress |
laravel-auth0 SDK Does Not Properly Handle File Types in Bulk User Import GHSA-hjfh-5jmm-xr24 | Low | Not scored | 01 Oct, 2025 | Packagist auth0/login |
auth0-PHP SDK Does Not Properly Handle File Types in Bulk User Import CVE-2025-58769, GHSA-9mh6-g99m-ppcw | Low | 0.4% | 01 Oct, 2025 | Packagist auth0/auth0-php |
Drupal Umami Analytics allows Cross-Site Scripting (XSS) CVE-2025-10931, DRUPAL-CONTRIB-2025-109, GHSA-jxp8-4jw5-5xjc | Low | 0.2% | 24 Sep, 2025 | Packagist drupal/umami_analytics Packagist:https://packages.drupal.org/8 drupal/umami_analytics |
Mangati NovoSGA XSS vulnerability in /admin CVE-2025-10909, GHSA-4c44-r8rm-3p39 | Low | 0.3% | 24 Sep, 2025 | Packagist novosga/novosga |
TYPO3 "Form to Database" extension susceptible to Cross-site Scripting CVE-2025-10316, GHSA-54pg-2x9h-cmx8 | Low | 0.3% | 16 Sep, 2025 | Packagist lavitto/typo3-form-to-database |
Mautic vulnerable to SSRF via webhook function CVE-2025-9821, GHSA-hj6f-7hp7-xg69 | Low | 0.3% | 03 Sep, 2025 | Packagist mautic/core |
UnoPim has CSV Injection on Quick Export feature CVE-2025-55745, GHSA-74rg-6f92-g6wx | Low | 0.6% | 22 Aug, 2025 | Packagist unopim/unopim |
Concrete CMS is vulnerable to Stored XSS from Home Folder on Members Dashboard page CVE-2025-8573, GHSA-c5xf-rmv4-j85h | Low | 0.5% | 05 Aug, 2025 | Packagist concrete5/concrete5 |
JuzaWeb CMS is vulnerable to Incorrect Privilege Assignment when installing certain components CVE-2025-6736, GHSA-mrph-pjv2-34f4 | Low | 0.5% | 27 Jun, 2025 | Packagist juzaweb/cms |
JuzaWeb CMS is vulnerable to Incorrect Privilege Assignment when installing Import Page component CVE-2025-6735, GHSA-rq7x-cfmc-rq3w | Low | 0.5% | 27 Jun, 2025 | Packagist juzaweb/cms |
Magento Authenticated Security feature bypass CVE-2025-49549, GHSA-85jx-x9r4-45m2 | Low | 0.4% | 25 Jun, 2025 | Packagist magento/community-edition Packagist magento/project-community-edition |
handcraftedinthealps/goodby-csv has Potential Gadget Chain allowing Remote Code Execution CVE-2025-49597, GHSA-x3c7-22c8-prg7 | Low | 0.2% | 13 Jun, 2025 | Packagist handcraftedinthealps/goodby-csv |
TYPO3 Unverified Password Change for Backend Users CVE-2025-47938, GHSA-3jrg-97f3-rqh9 | Low | 0.3% | 20 May, 2025 | Packagist typo3/cms-core Packagist typo3/cms-setup |
LibreNMS stored Cross-site Scripting vulnerability in poller group name CVE-2025-47931, GHSA-hxw5-9cc5-cmw5 | Low | 10.1% | 17 May, 2025 | Packagist librenms/librenms |
Kirby vulnerable to path traversal in the router for PHP's built-in server CVE-2025-30207, GHSA-9p3p-w5jf-8xxg | Low | 0.6% | 13 May, 2025 | Packagist getkirby/cms |
October CMS Allows Unprotected SVG Rename in Media Manager CVE-2024-51991, GHSA-96hh-8hx5-cpw7 | Low | 0.4% | 05 May, 2025 | Packagist october/october Packagist october/system |
Moodle's mod_data edit/delete pages pass CSRF token in GET parameter BIT-moodle-2025-3637, CVE-2025-3637, GHSA-9vc3-vm42-fjhm | Low | 0.4% | 25 Apr, 2025 | Packagist moodle/moodle |
Moodle has a CSRF risk in user tours manager that allows tour duplication BIT-moodle-2025-3635, CVE-2025-3635, GHSA-88xj-97gf-7wpq | Low | 0.2% | 25 Apr, 2025 | Packagist moodle/moodle |
Magento does not properly protect credentials CVE-2025-27192, GHSA-2r94-wm5v-4prx | Low | 0.5% | 08 Apr, 2025 | Packagist magento/community-edition Packagist magento/project-community-edition |
Pimcore's Admin Classic Bundle allows HTML Injection CVE-2025-30166, GHSA-x82r-6j37-vrgg | Low | 0.3% | 08 Apr, 2025 | Packagist pimcore/admin-ui-classic-bundle |
Magento LTS vulnerable to stored XSS in theme config fields CVE-2025-27400, GHSA-5pxh-89cx-4668 | Low | 0.3% | 28 Feb, 2025 | Packagist openmage/magento-lts |
Leantime allows Cross-Site Scripting (XSS) GHSA-f679-254h-qhvj | Low | Not scored | 21 Feb, 2025 | Packagist leantime/leantime |
Leantime has Missing Authorization Check for Host Parameter GHSA-3hfj-qcvj-4hx8 | Low | Not scored | 21 Feb, 2025 | Packagist leantime/leantime |
Magento Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability CVE-2025-24432, GHSA-7jmr-43qj-pw47 | Low | 0.4% | 11 Feb, 2025 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability CVE-2025-24430, GHSA-6w27-c66f-gvhq | Low | 0.4% | 11 Feb, 2025 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento Improper Access Control vulnerability CVE-2025-24429, GHSA-656q-fx2w-8ccv | Low | 0.5% | 11 Feb, 2025 | Packagist magento/community-edition Packagist magento/project-community-edition |
DevDojo Voyager vulnerable to reflected Cross-site Scripting CVE-2024-55416, GHSA-mm49-4f2g-c3wf | Low | 20.5% | 30 Jan, 2025 | Packagist tcg/voyager |
Reflected Cross Site Scripting (XSS) in error message GHSA-74j9-xhqr-6qv3 | Low | Not scored | 23 Jan, 2025 | Packagist silverstripe/framework |
Silverstripe Framework has a Reflected Cross Site Scripting (XSS) in error message GHSA-mqf3-qpc3-g26q | Low | Not scored | 14 Jan, 2025 | Packagist silverstripe/framework |
Moodle admin presets export tool includes some secrets that should not be exported BIT-moodle-2024-43427, CVE-2024-43427, GHSA-vpq5-56jj-vf2m | Low | 0.3% | 11 Nov, 2024 | Packagist moodle/moodle |
Filament has exported files stored in default (`public`) filesystem if not reconfigured CVE-2024-51758, GHSA-4hxw-gc2q-f6f3 | Low | 0.6% | 07 Nov, 2024 | Packagist filament/actions |