Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Authorization Bypass in moodle BIT-moodle-2024-25983, CVE-2024-25983, GHSA-9r26-5w88-qhp9 | Medium | 0.6% | 19 Feb, 2024 | Packagist moodle/moodle |
Improper Access Control in moodle BIT-moodle-2024-25981, CVE-2024-25981, GHSA-jfrg-9hpq-9hvp | Medium | 0.6% | 19 Feb, 2024 | Packagist moodle/moodle |
Improper Access Control in moodle BIT-moodle-2024-25980, CVE-2024-25980, GHSA-cp8m-h777-g4p3 | Medium | 0.5% | 19 Feb, 2024 | Packagist moodle/moodle |
Improper Handling of Parameters in moodle BIT-moodle-2024-25979, CVE-2024-25979, GHSA-6vjf-48fh-vxxj | Medium | 0.6% | 19 Feb, 2024 | Packagist moodle/moodle |
YetiForceCRM Directory Traversal vulnerability CVE-2023-49508, GHSA-394m-vxwj-363j | Medium | 1.0% | 16 Feb, 2024 | Packagist yetiforce/yetiforce-crm |
Magento Open Source allows Cross-Site Request Forgery (CSRF) CVE-2024-20718, GHSA-hqgj-4396-hmxv | Medium | 0.8% | 15 Feb, 2024 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento Open Source allows Uncontrolled Resource Consumption CVE-2024-20716, GHSA-c9h9-h5gf-885r | Medium | 0.9% | 15 Feb, 2024 | Packagist magento/community-edition Packagist magento/project-community-edition |
TYPO3 vulnerable to Improper Access Control of Resources Referenced by t3:// URI Scheme CVE-2024-25120, GHSA-wf85-8hx9-gj7c | Medium | 0.5% | 13 Feb, 2024 | Packagist typo3/cms-core |
TYPO3 Install Tool vulnerable to Information Disclosure of Encryption Key CVE-2024-25119, GHSA-h47m-3f78-qp9g | Medium | 0.4% | 13 Feb, 2024 | Packagist typo3/cms-core |
TYPO3 Backend Forms vulnerable to Information Disclosure of Hashed Passwords CVE-2024-25118, GHSA-38r2-5695-334w | Medium | 0.6% | 13 Feb, 2024 | Packagist typo3/cms-core |
Drupal core Denial of Service vulnerability GHSA-6ccv-8fgf-cjpw | Medium | Not scored | 12 Feb, 2024 | Packagist drupal/core |
Moodle Improper Access Control vulnerability BIT-moodle-2024-1439, CVE-2024-1439, GHSA-5p2x-8427-9fgp | Medium | 0.3% | 12 Feb, 2024 | Packagist moodle/moodle |
Concrete CMS vulnerable to reflected XSS via the Image URL Import Feature CVE-2024-1246, GHSA-9v3w-cj7m-qh5g | Medium | 0.5% | 09 Feb, 2024 | Packagist concrete5/concrete5 |
Concrete CMS vulnerable to stored XSS in file tags and description attributes CVE-2024-1245, GHSA-mgp6-j658-vcw9 | Medium | 0.4% | 09 Feb, 2024 | Packagist concrete5/concrete5 |
Concrete CMS vulnerable to stored XSS via the Role Name field CVE-2024-1247, GHSA-q25h-jch8-gfrp | Medium | 1.2% | 09 Feb, 2024 | Packagist concrete5/concrete5 |
Cross-site scripting (XSS) vulnerability in Grav CVE-2023-31506, GHSA-xrf8-cmrg-7436 | Medium | 1.0% | 09 Feb, 2024 | Packagist getgrav/grav |
CKEditor4 Cross-site Scripting vulnerability caused by incorrect CDATA detection CVE-2024-24815, GHSA-fq6h-4g8v-qqvm | Medium | 0.7% | 07 Feb, 2024 | Packagist ckeditor/ckeditor npm ckeditor4 |
Sulu HTML Injection via Autocomplete Suggestion CVE-2024-24807, GHSA-gfrh-gwqc-63cv | Medium | 0.5% | 05 Feb, 2024 | Packagist sulu/sulu |
phpMyFAQ vulnerable to stored XSS on attachments filename CVE-2024-24574, GHSA-7m8g-fprr-47fx | Medium | 0.9% | 05 Feb, 2024 | Packagist phpmyfaq/phpmyfaq |
phpMyFAQ sharing FAQ functionality can easily be abused for phishing purposes CVE-2024-22208, GHSA-9hhf-xmcw-r3xg | Medium | 0.7% | 05 Feb, 2024 | Packagist phpmyfaq/phpmyfaq |
phpMyFAQ User Removal Page Allows Spoofing Of User Details CVE-2024-22202, GHSA-6648-6g96-mg35 | Medium | 0.6% | 05 Feb, 2024 | Packagist phpmyfaq/phpmyfaq |
Bref Doesn't Support Multiple Value Headers in ApiGatewayFormatV2 CVE-2024-24753, GHSA-99f9-gv72-fw9r | Medium | 0.4% | 01 Feb, 2024 | Packagist bref/bref |
Bref's Uploaded Files Not Deleted in Event-Driven Functions CVE-2024-24752, GHSA-x4hh-frx8-98r5 | Medium | 0.8% | 01 Feb, 2024 | Packagist bref/bref |
C5 Firefly III CSV Injection. GHSA-29w6-c52g-m8jc | Medium | Not scored | 31 Jan, 2024 | Packagist grumpydictator/firefly-iii |
Craft CMS Audit Plugin Cross Site Scripting vulnerability CVE-2023-36259, GHSA-v89q-c273-3p42 | Medium | 0.4% | 30 Jan, 2024 | Packagist superbig/craft-audit |
No permission checks for editing/deleting records with CSV import form CVE-2023-49783, GHSA-j3m6-gvm8-mhvw | Medium | 0.3% | 23 Jan, 2024 | Packagist silverstripe/admin |
Record titles for restricted records can be viewed if exposed by GridFieldAddExistingAutocompleter CVE-2023-48714, GHSA-qm2j-qvq3-j29v | Medium | 0.4% | 23 Jan, 2024 | Packagist silverstripe/framework |
View permissions are bypassed for paginated lists of ORM data CVE-2023-44401, GHSA-jgph-w8rh-xf5p | Medium | 0.4% | 23 Jan, 2024 | Packagist silverstripe/graphql |
Broken Access Control order API in Shopware CVE-2024-22407, GHSA-3867-jc5c-66qf | Medium | 0.4% | 16 Jan, 2024 | Packagist shopware/core Packagist shopware/platform |
Cross-site Scripting in Bagisto CVE-2023-36236, GHSA-c962-g533-823f | Medium | 0.6% | 16 Jan, 2024 | Packagist bagisto/bagisto |
MediaWiki Cargo Extension Cross-site Scripting vulnerability BIT-mediawiki-2024-23173, CVE-2024-23173, GHSA-rhpm-63w5-79rg | Medium | 0.4% | 12 Jan, 2024 | Packagist mediawiki/cargo |
WWBN AVideo recovery notification bypass vulnerability CVE-2023-50172, GHSA-8m5f-2xvp-2c8w | Medium | 0.8% | 10 Jan, 2024 | Packagist wwbn/avideo |
Pimcore Customer Data Framework Improper Access Control allows unprivileged user to access GDPR extracts CVE-2024-21667, GHSA-g273-wppx-82w4 | Medium | 0.6% | 10 Jan, 2024 | Packagist pimcore/customer-management-framework-bundle |
Pimcore Customer Data Framework Improper Access Control allows unprivileged user to access customers duplicates list CVE-2024-21666, GHSA-c38c-c8mh-vq68 | Medium | 0.6% | 10 Jan, 2024 | Packagist pimcore/customer-management-framework-bundle |
Pimcore Ecommerce Framework Bundle Improper Access Control allows unprivileged user to access back-office orders list CVE-2024-21665, GHSA-cx99-25hr-5jxf | Medium | 0.5% | 10 Jan, 2024 | Packagist pimcore/ecommerce-framework-bundle |
juzawebCMS Incorrect Access Control vulnerability CVE-2023-46906, GHSA-93p6-9cxv-5rpq | Medium | 0.7% | 09 Jan, 2024 | Packagist juzaweb/cms |
Flarum's logout Route allows open redirects CVE-2024-21641, GHSA-733r-8xcp-w9mr | Medium | 1.1% | 05 Jan, 2024 | Packagist flarum/core Packagist flarum/framework |
Firefly III allows webhooks HTML Injection. CVE-2024-22075, GHSA-vwv2-9wcj-64vx | Medium | 0.3% | 05 Jan, 2024 | Packagist grumpydictator/firefly-iii |
class.upload.php allows cross-site scripting attacks via uploaded files CVE-2023-6551, GHSA-v6f4-jwv9-682w | Medium | 0.4% | 04 Jan, 2024 | Packagist verot/class.upload.php |
PrestaShop XSS can be stored in DB from "add a message form" in order detail page (FO) CVE-2024-21628, GHSA-vr7m-r9vm-m4wf | Medium | 0.4% | 02 Jan, 2024 | Packagist prestashop/prestashop |
Gila CMS SQL Injection CVE-2020-26623, GHSA-rpjw-97p8-p2xp | Medium | 0.7% | 02 Jan, 2024 | Packagist gilacms/gila |
Winter CMS Local File Inclusion through Server Side Template Injection CVE-2023-52085, GHSA-2x7r-93ww-cxrq | Medium | 30.2% | 29 Dec, 2023 | Packagist winter/wn-backend-module |
Winter CMS Stored XSS through Backend ColorPicker FormWidget CVE-2023-52084, GHSA-43w4-4j3c-jx29 | Medium | 0.3% | 28 Dec, 2023 | Packagist winter/wn-backend-module |
Winter CMS Stored XSS through privileged upload of Media Manager file followed by renaming CVE-2023-52083, GHSA-4wvw-75qh-fqjp | Medium | 0.3% | 28 Dec, 2023 | Packagist winter/wn-system-module |
Concrete CMS Cross Site Request Forgery (CSRF) CVE-2023-48652, GHSA-qp42-5pj7-4ccm | Medium | 0.2% | 25 Dec, 2023 | Packagist concrete5/concrete5 |
Path Traversal in TYPO3 File Abstraction Layer Storages BIT-typo3-2023-30451, CVE-2023-30451, GHSA-w6x2-jg8h-p6mp | Medium | 1.2% | 25 Dec, 2023 | Packagist typo3/cms-core |
Potential URI resolution path traversal in the AWS SDK for PHP CVE-2023-51651, CVE-2025-69820, GHSA-557v-xcg6-rm5m, GHSA-73jg-4qh6-3f4g, GO-2026-4390 | Medium | 1.0% | 21 Dec, 2023 | Packagist aws/aws-sdk-php |
Cross-Site Request Forgery (CSRF) in automad/automad CVE-2023-7038, GHSA-4j8w-p6hv-3qxc | Medium | 0.4% | 21 Dec, 2023 | Packagist automad/automad |
Withdrawn Advisory: Unrestricted File Upload affecting automad CVE-2023-7036, GHSA-fpph-mqc8-h6q5 | Medium | 0.6% | 21 Dec, 2023 | Packagist automad/automad |
Phpsysinfo Cross Site Request Forgery (CSRF) vulnerability CVE-2023-49006, GHSA-67gv-xrw7-p72w | Medium | 0.5% | 19 Dec, 2023 | Packagist phpsysinfo/phpsysinfo |