Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Improper Neutralization of Text-Values in Object Version Preview CVE-2021-39166, GHSA-w6j8-jc36-x5q9 | High | 0.8% | 01 Sep, 2021 | Packagist pimcore/pimcore |
XSS vulnerability on asset view CVE-2021-27912, GHSA-rh5w-82wh-jhr8 | High | 0.6% | 30 Aug, 2021 | Packagist mautic/core |
XSS vulnerability on contacts view CVE-2021-27911, GHSA-72hm-fx78-xwhc | High | 0.6% | 30 Aug, 2021 | Packagist mautic/core |
Stored XSS vulnerability on Bounce Management Callback CVE-2021-27910, GHSA-86pv-95mj-7w5f | High | 0.7% | 30 Aug, 2021 | Packagist mautic/core |
Cachet configuration leak CVE-2021-39174, GHSA-88f9-7xxh-c688 | High | 5.0% | 28 Aug, 2021 | Packagist cachethq/cachet |
Cachet vulnerable to forced reinstall CVE-2021-39173, GHSA-r67m-m8c7-jp83 | High | 2.4% | 27 Aug, 2021 | Packagist cachethq/cachet |
Cachet vulnerable to new line injection during configuration edition CVE-2021-39172, GHSA-9jxw-cfrh-jxq6 | High | 29.2% | 27 Aug, 2021 | Packagist cachethq/cachet |
Data Flow Sanitation Issue Fix CVE-2021-32759, GHSA-xm9f-vxmx-4m58 | High | 1.3% | 27 Aug, 2021 | Packagist openmage/magento-lts |
Layout XML Arbitrary Code Fix CVE-2021-32758, GHSA-26rr-v2j2-25fh | High | 2.0% | 27 Aug, 2021 | Packagist openmage/magento-lts |
Unauthenticated SQL Injection in Cachet CVE-2021-39165, GHSA-79mg-4w23-4fqc | High | 8.2% | 26 Aug, 2021 | Packagist cachethq/cachet |
October CMS auth bypass and account takeover CVE-2021-29487, GHSA-h76r-vgf3-j6w5 | High | 0.9% | 26 Aug, 2021 | Packagist october/system |
Improper Restriction of Rendered UI Layers or Frames in yourls CVE-2021-3734, GHSA-r6g8-jmj9-g945 | High | 0.4% | 26 Aug, 2021 | Packagist yourls/yourls |
Cross-site scripting vulnerability in file upload CVE-2021-39136, GHSA-hgjr-632x-qpp3 | High | 0.9% | 25 Aug, 2021 | Packagist baserproject/basercms |
raspap-webgui in RaspAP 2.6.6 allows attackers to execute commands as root because of the insecure sudoers permissions. CVE-2021-38557, GHSA-536p-4pcj-5mr9 | High | 2.2% | 24 Aug, 2021 | Packagist billz/raspap-webgui |
Command Injection in RaspAP 2.6.6 CVE-2021-38556, GHSA-7vph-p634-vrqf | High | 13.0% | 24 Aug, 2021 | Packagist billz/raspap-webgui |
OS Command Injection in Centreon CVE-2020-22345, GHSA-2q95-593f-g7h7 | High | 3.8% | 18 Aug, 2021 | Packagist centreon/centreon |
Improper Neutralization of Formula Elements in a CSV File in pimcore/pimcore CVE-2021-37702, GHSA-pp2h-95hm-hv9r | High | 1.1% | 18 Aug, 2021 | Packagist pimcore/pimcore |
Weak Password Recovery Mechanism for Forgotten Password CVE-2021-25957, GHSA-c32w-3cqh-f6jx | High | 1.1% | 17 Aug, 2021 | Packagist dolibarr/dolibarr |
Dolibarr vulnerable to Improper Authentication and Improper Access Control BIT-dolibarr-2021-25956, CVE-2021-25956, GHSA-fjqg-w8g6-hhq8 | High | 0.9% | 17 Aug, 2021 | Packagist dolibarr/dolibarr |
Authenticated server-side request forgery in file upload via URL. CVE-2021-37711, GHSA-gcvv-gq92-x94r | High | 1.1% | 16 Aug, 2021 | Packagist shopware/core Packagist shopware/platform |
Cross-Site Scripting via SVG media files CVE-2021-37710, GHSA-fc38-mxwr-pfhx | High | 0.7% | 16 Aug, 2021 | Packagist shopware/core Packagist shopware/platform |
Manipulation of product reviews via API CVE-2021-37707, GHSA-9f8f-574q-8jmf | High | 0.9% | 16 Aug, 2021 | Packagist shopware/core Packagist shopware/platform |
Improper Resource Shutdown or Release in TYPO3 extension CVE-2021-38623, GHSA-34jq-548x-m2x9 | High | 1.0% | 13 Aug, 2021 | Packagist webcoast/deferred-image-processing |
CSRF token exposure in TYPO3 extension CVE-2021-36793, GHSA-vpw5-grxx-v396 | High | 1.0% | 13 Aug, 2021 | Packagist lms/routes |
Sensitive Data Exposure in miniorange_saml CVE-2021-36786, GHSA-g485-29gq-6h2h | High | 1.0% | 13 Aug, 2021 | Packagist miniorange/miniorange-saml |
Privilege escalation via form generator CVE-2021-37627, GHSA-hq5m-mqmx-fw6m | High | 1.0% | 11 Aug, 2021 | Packagist contao/contao Packagist contao/core-bundle |
PHP file inclusion via insert tags CVE-2021-37626, GHSA-r6mv-ppjc-4hgr | High | 1.3% | 11 Aug, 2021 | Packagist contao/contao Packagist contao/core-bundle |
Use of Insufficiently Random Values in yiisoft/yii2-dev CVE-2021-3689, GHSA-hq3v-rg6f-6hx4 | High | 1.9% | 10 Aug, 2021 | Packagist yiisoft/yii2-dev |
Malicious password-reset in Akaunting CVE-2021-36804, GHSA-246r-r2wf-frhx | High | 1.0% | 04 Aug, 2021 | Packagist akaunting/akaunting |
No Restriction of Excessive Authentication Attempts in Firefly III CVE-2021-3663, GHSA-56cx-wf47-hx7w | High | 0.7% | 25 Jul, 2021 | Packagist grumpydictator/firefly-iii |
Directory Traversal in Archive_Tar CVE-2021-32610, DRUPAL-CORE-2021-004, GHSA-p8q8-jfcv-g2h2 | High | 73.4% | 21 Jul, 2021 | Packagist drupal/core Packagist pear/archive_tar |
Files or Directories Accessible to External Parties in ether/logs CVE-2021-32752, GHSA-fp63-499m-hq6m | High | 1.1% | 09 Jul, 2021 | Packagist ether/logs |
SQL injection in pimcore/pimcore CVE-2021-23405, GHSA-g8jx-66p8-vcm2, SNYK-PHP-PIMCOREPIMCORE-1316297 | High | 1.7% | 09 Jul, 2021 | Packagist pimcore/pimcore |
Arbitrary file upload in Fork CMS CVE-2021-28931, GHSA-748f-wv76-x9hg | High | 1.2% | 07 Jul, 2021 | Packagist forkcms/forkcms |
Cross-site scripting (XSS) from field and configuration text displayed in the Panel CVE-2021-32735, GHSA-2f2w-349x-vrqm | High | 0.5% | 02 Jul, 2021 | Packagist getkirby/cms |
EC-CUBE Improper access control vulnerability CVE-2021-20778, GHSA-4cxm-8hh5-jj33 | High | 2.1% | 01 Jul, 2021 | Packagist ec-cube/ec-cube |
Magento Path Traversal vulnerability BIT-magento-2021-28584, CVE-2021-28584, GHSA-7gpv-xrjr-f5h4 | High | 1.8% | 28 Jun, 2021 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento Violation of Secure Design Principles vulnerability in RMA PDF filename formats BIT-magento-2021-28583, CVE-2021-28583, GHSA-7gh6-f4jh-3crq | High | 1.9% | 28 Jun, 2021 | Packagist magento/community-edition Packagist magento/project-community-edition |
Exposure of Sensitive Information to an Unauthorized Actor CVE-2021-32717, GHSA-6gr8-c3m5-mvrg, GHSA-vrf2-xghr-j52v | High | 1.5% | 24 Jun, 2021 | Packagist shopware/core Packagist shopware/platform |
Authentication granted to all firewalls instead of just one BIT-symfony-2021-32693, CVE-2021-32693, GHSA-rfcf-m67m-jcrq | High | 1.4% | 17 Jun, 2021 | Packagist symfony/security-http Packagist symfony/symfony |
PHPMailer untrusted code may be run from an overridden address validator BIT-phpmailer-2021-3603, CVE-2021-3603, GHSA-77mr-wc79-m8j3 | High | 2.3% | 17 Jun, 2021 | Packagist phpmailer/phpmailer |
Remote Code Execution vulnerability in PHPMailer 6.4.1 running on Windows BIT-phpmailer-2021-34551, CVE-2021-34551, GHSA-7q44-r25x-wm4q | High | 2.8% | 16 Jun, 2021 | Packagist phpmailer/phpmailer |
Improper rate limiting in Koel CVE-2021-33563, GHSA-r37h-j483-cjjm | High | 0.8% | 24 May, 2021 | Packagist phanan/koel |
XSS in doc_link CVE-2021-29625, GHSA-2v82-5746-vwqc | High | 9.6% | 19 May, 2021 | Packagist vrana/adminer |
Cross-Site Request Forgery in forkcms CVE-2020-23264, GHSA-82xf-8h9p-c6qj | High | 0.6% | 06 May, 2021 | Packagist forkcms/forkcms |
SQL Server LIMIT / OFFSET SQL Injection in laravel/framework and illuminate/database GHSA-4mg9-vhxq-vm7j | High | Not scored | 29 Apr, 2021 | Packagist illuminate/database Packagist laravel/framework |
SQL Injection in t3/dce CVE-2021-31777, GHSA-5v5h-4w2g-gxxc | High | 1.4% | 28 Apr, 2021 | Packagist t3/dce |
Composer's missing argument delimiter can lead to code execution via VCS repository URLs or source download URLs on systems with Mercurial BIT-composer-2021-29472, CVE-2021-29472, GHSA-h5h8-pc6h-jvvx | High | 4.8% | 27 Apr, 2021 | Packagist composer/composer |
Cross-site scripting (XSS) from unsanitized uploaded SVG files in Kirby CVE-2021-29460, GHSA-qgp4-5qx6-548g | High | 3.2% | 27 Apr, 2021 | Packagist getkirby/cms |
Grav's Twig processing allowing dangerous PHP functions by default CVE-2021-29440, GHSA-g8r4-p96j-xfxc | High | 29.9% | 13 Apr, 2021 | Packagist getgrav/grav |