Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Grav vulnerable to Privilege Escalation in Grav Admin: Missing Username Uniqueness Check Allows Admin Account Takeover CVE-2025-66296, GHSA-cjcp-qxvg-4rjm | High | 0.3% | 01 Dec, 2025 | Packagist getgrav/grav |
Grav vulnerable to Path traversal / arbitrary YAML write via user creation leading to Account Takeover / System Corruption CVE-2025-66295, GHSA-h756-wh59-hhjv | High | 0.6% | 01 Dec, 2025 | Packagist getgrav/grav |
Grav is vulnerable to RCE via SSTI through Twig Sandbox Bypass CVE-2025-66294, GHSA-662m-56v4-3r8f | High | 2.8% | 01 Dec, 2025 | Packagist getgrav/grav |
Snipe-IT is vulnerable to stored cross-site scripting CVE-2025-65621, GHSA-fww5-m9wc-jcjc | Medium | 0.2% | 01 Dec, 2025 | Packagist snipe/snipe-it |
FeehiCMS fails to enforce server-side immutability CVE-2025-63523, GHSA-qgc9-p7cj-jvh6 | Medium | 0.3% | 01 Dec, 2025 | Packagist feehi/feehicms |
FeehiCMS is vulnerable to reverse tabnabbing CVE-2025-63522, GHSA-w756-rf26-7rmr | Medium | 0.2% | 01 Dec, 2025 | Packagist feehi/feehicms |
FeehiCMS is vulnerable to cross-site scripting via the id parameter of the User Update function CVE-2025-63520, GHSA-c2vx-rx6x-m9wj | Medium | 0.2% | 01 Dec, 2025 | Packagist feehi/feehicms |
Skuul School Management System has a Sensitive Data Exposure Vulnerability in Uploaded Images CVE-2025-13785, GHSA-xmh7-35v2-fp6h | Low | 0.4% | 30 Nov, 2025 | Packagist yungifez/skuul |
yungifez Skuul School Management System vulnerable to XSS via SVG CVE-2025-13784, GHSA-92x3-mfjp-j3h3 | Low | 0.3% | 30 Nov, 2025 | Packagist yungifez/skuul |
REDAXO CMS is vulnerable to Reflected XSS in Mediapool Info Banner via args[types] CVE-2025-66026, GHSA-x6vr-q3vf-vqgq | Medium | 0.3% | 25 Nov, 2025 | Packagist redaxo/source |
Contao is vulnerable to cross-site scripting in templates CVE-2025-65961, GHSA-68q5-78xp-cwwc | Medium | 0.2% | 25 Nov, 2025 | Packagist contao/core-bundle |
Contao is vulnerable to remote code execution in template closures CVE-2025-65960, GHSA-98vj-mm79-v77r | Medium | 0.2% | 25 Nov, 2025 | Packagist contao/core-bundle |
REDAXO CMS is vulnerable to RCE attack through its template management component CVE-2025-64050, GHSA-xj9j-gjxg-7jvq | High | 1.0% | 25 Nov, 2025 | Packagist redaxo/source |
REDAXO CMS is vulnerable to XSS through its module management component CVE-2025-64049, GHSA-vqc7-7fj4-3fm3 | Medium | 0.3% | 25 Nov, 2025 | Packagist redaxo/source |
Formwork CMS has Stored Cross-Site Scripting Vulnerebility in Blog Tags CVE-2025-65956, GHSA-7j46-f57w-76pj | Medium | 0.2% | 24 Nov, 2025 | Packagist getformwork/formwork |
Snipe-IT has Cross-site Scripting vulnerability in CSV import workflow CVE-2025-64027, GHSA-8x9v-8qgj-945x | Medium | 0.3% | 20 Nov, 2025 | Packagist snipe/snipe-it |
phppgadmin contains an incorrect access control vulnerability CVE-2025-60799, GHSA-r63p-v37q-g74c | Medium | 0.2% | 20 Nov, 2025 | Packagist phppgadmin/phppgadmin |
phppgadmin contains a SQL injection vulnerability CVE-2025-60798, GHSA-g6xh-wrpf-v6j6 | Medium | 0.3% | 20 Nov, 2025 | Packagist phppgadmin/phppgadmin |
phppgadmin contains a SQL injection vulnerability CVE-2025-60797, GHSA-927w-vq5c-8gc3 | Medium | 0.3% | 20 Nov, 2025 | Packagist phppgadmin/phppgadmin |
phppgadmin vulnerable to Cross-site Scripting CVE-2025-60796, GHSA-h369-cpjj-qfff | Medium | 0.3% | 20 Nov, 2025 | Packagist phppgadmin/phppgadmin |
OpenSTAManager has Authenticated SQL Injection in API via 'display' parameter CVE-2025-65103, GHSA-2jm2-2p35-rp3j | High | 0.4% | 19 Nov, 2025 | Packagist devcode-it/openstamanager |
MongoDB driver extension affected by mongoc_bulk_operation_t's read of invalid memory CVE-2025-12119, GHSA-mwcc-7vpp-xmv9 | Medium | 0.2% | 18 Nov, 2025 | Packagist mongodb/mongodb-extension |
LibreNMS is vulnerable to SQL Injection (Boolean-Based Blind) in hostname parameter in ajax_output.php endpoint CVE-2025-65093, GHSA-6pmj-xjxp-p8g9 | Medium | 3.9% | 18 Nov, 2025 | Packagist librenms/librenms |
LibreNMS has Weak Password Policy CVE-2025-65014, GHSA-5mrf-j8v6-f45g | Low | 0.3% | 18 Nov, 2025 | Packagist librenms/librenms |
LibreNMS vulnerable to Reflected Cross-Site Scripting (XSS) in endpoint `/maps/nodeimage` parameter `Image Name` CVE-2025-65013, GHSA-j8cq-7f6p-256x | Medium | 0.3% | 18 Nov, 2025 | Packagist librenms/librenms |
Backdrop CMS Host Header Injection vulnerability CVE-2025-63828, GHSA-ffpg-gm3h-4p5p | Medium | 0.2% | 18 Nov, 2025 | Packagist backdrop/backdrop |
Kirby CMS has cross-site scripting (XSS) in the changes dialog CVE-2025-65012, GHSA-84hf-8gh5-575j | Medium | 0.2% | 18 Nov, 2025 | Packagist getkirby/cms |
phpMyFAQ has Authenticated SQL Injection in Configuration Update Functionality CVE-2025-62519, GHSA-fxm2-cmwj-qvx4 | High | 0.8% | 17 Nov, 2025 | Packagist phpmyfaq/phpmyfaq Packagist thorsten/phpmyfaq |
Shopware 6's password recovery link does not expire after email change GHSA-2w46-vq8h-98vh | Medium | Not scored | 14 Nov, 2025 | Packagist shopware/core |
PrivateBin's template-switching feature allows arbitrary local file inclusion through path traversal CVE-2025-64714, GHSA-g2j9-g8r5-rg82 | Medium | 0.5% | 13 Nov, 2025 | Packagist privatebin/privatebin |
PrivateBin vulnerable to malicious filename use for self-XSS / HTML injection locally for users CVE-2025-64711, GHSA-r9x7-7ggj-fx9f | Medium | 0.1% | 13 Nov, 2025 | Packagist privatebin/privatebin |
Symfony's incorrect parsing of PATH_INFO can lead to limited authorization bypass CVE-2025-64500, GHSA-3rg7-wf37-54rm | High | 1.4% | 12 Nov, 2025 | Packagist symfony/http-foundation Packagist symfony/symfony |
Drupal core allows Exploiting Incorrectly Configured Access Control Security Levels BIT-drupal-2025-13083, CVE-2025-13083, DRUPAL-CORE-2025-008, GHSA-mhpg-hpj5-73r2 | Low | 0.3% | 12 Nov, 2025 | Packagist drupal/core |
Drupal core allows Content Spoofing BIT-drupal-2025-13082, CVE-2025-13082, DRUPAL-CORE-2025-007, GHSA-h89p-5896-f4q8 | Medium | 0.2% | 12 Nov, 2025 | Packagist drupal/core |
Drupal core allows Object Injection BIT-drupal-2025-13081, CVE-2025-13081, DRUPAL-CORE-2025-006, GHSA-m6vv-vcj8-w8m7 | Medium | 0.3% | 12 Nov, 2025 | Packagist drupal/core |
Drupal core allows Forceful Browsing BIT-drupal-2025-13080, CVE-2025-13080, DRUPAL-CORE-2025-005, GHSA-83v7-c2cf-p9c2 | Medium | 0.3% | 12 Nov, 2025 | Packagist drupal/core |
TYPO3 Modules Extension has Improper Authentication vulnerability CVE-2025-12998, GHSA-49qv-h8pm-73pf | High | 0.4% | 12 Nov, 2025 | Packagist codingms/modules |
TorrentPier is Vulnerable to Authenticated SQL Injection through Moderator Control Panel's topic_id parameter CVE-2025-64519, GHSA-4rwr-8c3m-55f6 | High | 0.5% | 10 Nov, 2025 | Packagist torrentpier/torrentpier |
Skuul School Management System has an Insecure Direct Object Reference (IDOR) Vulnerability in View Fee Invoice CVE-2025-12918, GHSA-fqq7-h225-8w6h | Low | 0.4% | 09 Nov, 2025 | Packagist yungifez/skuul |
Drupal Simple multi step form allows Cross-Site Scripting CVE-2025-12761, DRUPAL-CONTRIB-2025-116, GHSA-gg35-374m-9ph8 | Low | 0.2% | 05 Nov, 2025 | Packagist drupal/simple_multistep Packagist:https://packages.drupal.org/8 drupal/simple_multistep |
Drupal Email TFA allows Functionality Bypass CVE-2025-12760, DRUPAL-CONTRIB-2025-115, GHSA-9jrw-jrrj-p6fr | Medium | 0.2% | 05 Nov, 2025 | Packagist drupal/email_tfa Packagist:https://packages.drupal.org/8 drupal/email_tfa |
OpenMage vulnerable to XSS in Admin Notifications CVE-2025-64174, GHSA-qv78-c8hc-438r | Medium | 0.2% | 03 Nov, 2025 | Packagist openmage/magento-lts |
MantisBT unauthorized disclosure of private project column configuration CVE-2025-62520, GHSA-g582-8vwr-68h2 | Medium | 0.3% | 03 Nov, 2025 | Packagist mantisbt/mantisbt |
MantisBT lacks verification when changing a user's email address CVE-2025-55155, GHSA-q747-c74m-69pr | Medium | 0.2% | 03 Nov, 2025 | Packagist mantisbt/mantisbt |
MantisBT Vulnerable to Denial-of-Service (DoS) via Excessive Note Length CVE-2025-46556, GHSA-r3jf-hm7q-qfw5 | High | 0.4% | 03 Nov, 2025 | Packagist mantisbt/mantisbt |
MantisBT vulnerable to authentication bypass for some passwords due to PHP type juggling CVE-2025-47776, GHSA-4v8w-gg5j-ph37 | High | 0.3% | 03 Nov, 2025 | Packagist mantisbt/mantisbt |
Statamic Vulnerable to Superadmin Account Takeover via Stored Cross-Site Scripting and Lack of Proper X-CSRF-TOKEN Server-Side Validation CVE-2025-64112, GHSA-g59r-24g3-h7cm | High | 0.3% | 30 Oct, 2025 | Packagist statamic/cms |
Drupal Simple OAuth (OAuth2) & OpenID Connect allows Authentication Bypass CVE-2025-12466, DRUPAL-CONTRIB-2025-114, GHSA-jqmq-fpwv-p925 | High | 0.4% | 29 Oct, 2025 | Packagist drupal/simple_oauth Packagist:https://packages.drupal.org/8 drupal/simple_oauth |
Sharp user-provided input can be evaluated in a SharpShowTextField with Vue template syntax CVE-2025-62798, GHSA-9f58-4465-23c7 | Medium | 0.2% | 28 Oct, 2025 | Packagist code16/sharp |
PrivateBin is missing HTML sanitization of attached filename in file size hint CVE-2025-62796, GHSA-867c-p784-5q6g | Medium | 0.3% | 28 Oct, 2025 | Packagist privatebin/privatebin |