Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Grav's Twig processing allowing dangerous PHP functions by default CVE-2021-29440, GHSA-g8r4-p96j-xfxc | High | 29.9% | 13 Apr, 2021 | Packagist getgrav/grav |
Improper Certificate Validation in phpseclib CVE-2021-30130, GHSA-vf4w-fg7r-5v94 | High | 1.1% | 06 Apr, 2021 | Packagist phpseclib/phpseclib |
BuddyPress privilege escalation via REST API CVE-2021-21389, GHSA-m6j4-8r7p-wpp3 | High | 14.8% | 26 Mar, 2021 | Packagist buddypress/buddypress |
OS Command Injection in baserCMS CVE-2021-20682, GHSA-g39q-f4rm-85x4 | High | 2.5% | 26 Mar, 2021 | Packagist baserproject/basercms |
Denial of Service in Page Error Handling BIT-typo3-2021-21359, CVE-2021-21359, GHSA-4p9g-qgx9-397p | High | 1.7% | 23 Mar, 2021 | Packagist typo3/cms Packagist typo3/cms-core |
Broken Access Control in Form Framework BIT-typo3-2021-21357, CVE-2021-21357, GHSA-3vg7-jw9m-pc3f | High | 1.6% | 23 Mar, 2021 | Packagist typo3/cms Packagist typo3/cms-core Packagist typo3/cms-form |
Unrestricted File Upload in Form Framework BIT-typo3-2021-21355, CVE-2021-21355, GHSA-2r6j-862c-m2v2 | High | 1.6% | 23 Mar, 2021 | Packagist typo3/cms Packagist typo3/cms-core Packagist typo3/cms-form |
Cleartext storage of session identifier BIT-typo3-2021-21339, CVE-2021-21339, GHSA-qx3w-4864-94ch | High | 0.9% | 23 Mar, 2021 | Packagist typo3/cms Packagist typo3/cms-core |
Cross-site scripting in eZ Platform Kernel CVE-2021-46875, GHSA-mrvj-7q4f-5p42 | High | 0.4% | 19 Mar, 2021 | Packagist ezsystems/ezplatform-kernel Packagist ezsystems/ezpublish-kernel |
Grav CMS Cross-Site Request Forgery (CSRF) CVE-2020-29553, GHSA-fqff-vcvx-68h3 | High | 1.4% | 15 Mar, 2021 | Packagist getgrav/grav |
Grav CMS Arbitrary File Deletion CVE-2020-29555, GHSA-gpmf-q5jh-hjx4 | High | 2.9% | 15 Mar, 2021 | Packagist getgrav/grav |
Potential Session Hijacking CVE-2021-32710, GHSA-h9q8-5gv2-v6mg | High | 0.9% | 12 Mar, 2021 | Packagist shopware/platform |
/user/sessions endpoint allows detecting valid accounts GHSA-7vwg-39h8-8qp8 | High | Not scored | 11 Mar, 2021 | Packagist ezsystems/ezplatform-rest |
October CMS vulnerable to Potential Host Header Poisoning on misconfigured servers CVE-2021-21265, GHSA-xhfx-hgmf-v6vp | High | 1.7% | 10 Mar, 2021 | Packagist october/backend |
MantisBT Insufficient Session Expiration cookie string not reset after logout CVE-2009-20001, GHSA-jm72-67rm-763j | High | 0.9% | 07 Mar, 2021 | Packagist mantisbt/mantisbt |
ThinkAdmin Admin Panel Access using Default Credentials CVE-2020-35296, GHSA-cxv7-6jgf-7gwf | High | 2.2% | 03 Mar, 2021 | Packagist zoujingli/thinkadmin |
Sandbox escape through template_object in smarty CVE-2021-26119, GHSA-w5hr-jm4j-9jvq | High | 8.5% | 22 Feb, 2021 | Packagist smarty/smarty |
Path traversal in pimcore/pimcore CVE-2021-23340, GHSA-h7f9-cvh5-qw7f, SNYK-PHP-PIMCOREPIMCORE-1070132 | High | 1.3% | 18 Feb, 2021 | Packagist pimcore/pimcore |
Path traversal in bolt/core CVE-2021-27367, GHSA-q88g-qx42-xfrh | High | 1.7% | 17 Feb, 2021 | Packagist bolt/core |
Zip slip in Microweber CVE-2020-28337, GHSA-pqcf-v8v5-jmcg | High | 16.6% | 15 Feb, 2021 | Packagist microweber/microweber |
SSRF in adminer CVE-2021-21311, GHSA-x5r2-hj5c-8jx6 | HighExploited | 98.5% | 11 Feb, 2021 | Packagist vrana/adminer |
Magento stored cross-site scripting (XSS) in the customer address upload feature BIT-magento-2021-21030, CVE-2021-21030, GHSA-6988-g89m-27vf | High | 5.6% | 11 Feb, 2021 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento OS command injection via the customer attribute save controller BIT-magento-2021-21015, CVE-2021-21015, GHSA-w2p4-2c8c-2g7h | High | 2.9% | 11 Feb, 2021 | Packagist magento/community-edition |
SQL Injection in librenms CVE-2020-35700, GHSA-h59f-p56g-g75v | High | 2.3% | 08 Feb, 2021 | Packagist librenms/librenms |
Unexpected database bindings GHSA-x7p5-p2c9-phvg | High | Not scored | 02 Feb, 2021 | Packagist illuminate/database Packagist laravel/framework |
XSS in Mautic CVE-2021-3142, GHSA-p7v4-gm6j-cw9m | High | Not scored | 29 Jan, 2021 | Packagist mautic/core |
Moodle Arbitrary PHP code execution by site admins via Shibboleth configuration BIT-moodle-2021-20187, CVE-2021-20187, GHSA-2jrm-gww7-wch2 | High | 1.6% | 28 Jan, 2021 | Packagist moodle/moodle |
Codiad Vulnerable to PHP Magic Hash Vulnerability CVE-2020-23355, GHSA-8fhh-hf9w-55p7 | High | 1.0% | 27 Jan, 2021 | Packagist codiad/codiad |
Zen Cart vulnerable to authenticated remote code execution CVE-2021-3291, GHSA-38f9-4vhq-9cr8 | High | 17.0% | 26 Jan, 2021 | Packagist zencart/zencart |
CakePHP allows method override parameters to bypass CSRF checks CVE-2020-35239, GHSA-9pgx-pf36-w46r | High | 0.6% | 26 Jan, 2021 | Packagist cakephp/cakephp |
Feehi CMS arbitrary file upload vulnerability CVE-2020-22643, GHSA-65x8-9vgm-5fg5 | High | 2.0% | 26 Jan, 2021 | Packagist feehi/cms |
Query Binding Exploitation BIT-laravel-2021-21263, CVE-2021-21263, GHSA-3p32-j457-pg5x | High | 1.6% | 19 Jan, 2021 | Packagist illuminate/database Packagist laravel/framework |
Directory Traversal in Archive_Tar BIT-drupal-2020-36193, CVE-2020-36193, GHSA-rpw6-9xfx-jvcx | HighExploited | 70.6% | 18 Jan, 2021 | Packagist pear/archive_tar |
Cross-Site Request Forgery in ForkCMS CVE-2020-23960, GHSA-pvgf-mrr4-cw7r | High | 0.7% | 11 Jan, 2021 | Packagist forkcms/forkcms |
MantisBT Incorrect Authorization for bug_revision_view_page.php check CVE-2020-35849, GHSA-7j8m-fm49-xgmg | High | 1.6% | 30 Dec, 2020 | Packagist mantisbt/mantisbt |
Dolibarr authenticated Remote Code Execution BIT-dolibarr-2020-35136, CVE-2020-35136, GHSA-7x8g-h246-gvx3 | High | 6.6% | 23 Dec, 2020 | Packagist dolibarr/dolibarr |
Moodle Denial of Service BIT-moodle-2020-25630, CVE-2020-25630, GHSA-66xp-28cq-mrf2 | High | 1.4% | 08 Dec, 2020 | Packagist moodle/moodle |
Moodle incorrect access control BIT-moodle-2020-25629, CVE-2020-25629, GHSA-f5r8-7h4f-jr9x | High | 1.3% | 08 Dec, 2020 | Packagist moodle/moodle |
Blind SQL injection in PrestaShop productcomments module CVE-2020-26248, GHSA-5v44-7647-xfw9 | High | 12.4% | 03 Dec, 2020 | Packagist prestashop/productcomments |
EC-CUBE Improper input validation vulnerability CVE-2020-5680, GHSA-6wm9-966m-73jr | High | 1.4% | 03 Dec, 2020 | Packagist ec-cube/ec-cube |
Cleartext storage of session identifier BIT-typo3-2020-26228, CVE-2020-26228, GHSA-954j-f27r-cj52 | High | 0.7% | 23 Nov, 2020 | Packagist typo3/cms Packagist typo3/cms-core |
Local File Inclusion by unauthenticated users CVE-2020-15246, GHSA-xwjr-6fj7-fc6h | High | 1.7% | 23 Nov, 2020 | Packagist october/cms |
Multiple vulnerabilities through filename manipulation in Archive_Tar BIT-drupal-2020-28948, BIT-drupal-2020-28949, CVE-2020-28948, CVE-2020-28949, DRUPAL-CORE-2020-013, GHSA-75c5-f4gw-38r9, GHSA-jh5x-hfhg-78jq | HighExploited | 84.6% | 19 Nov, 2020 | Packagist drupal/core Packagist pear/archive_tar |
Privilage Escalation in moodle BIT-moodle-2020-25699, CVE-2020-25699, GHSA-h77r-rp97-7rv4 | High | 1.6% | 19 Nov, 2020 | Packagist moodle/moodle |
Improper Access Control in moodle BIT-moodle-2020-25698, CVE-2020-25698, GHSA-vxhx-gmhm-623c | High | 1.9% | 19 Nov, 2020 | Packagist moodle/moodle |
Drupal core Unrestricted Upload of File with Dangerous Type BIT-drupal-2020-13671, CVE-2020-13671, DRUPAL-CORE-2020-012, GHSA-68jc-v27h-vhmw | HighExploited | 36.2% | 18 Nov, 2020 | Packagist drupal/core Packagist drupal/drupal |
Cross-Site Scripting through Fluid view helper arguments CVE-2020-26216, GHSA-hpjm-3ww5-6cpf | High | 1.0% | 17 Nov, 2020 | Packagist typo3fluid/fluid |
AVideo vulnerable to Improper Privilege Management CVE-2020-23489, GHSA-2mgx-226x-8pwv | High | 2.3% | 16 Nov, 2020 | Packagist wwbn/avideo |
Exploitable inventory component chaining in PocketMine-MP CVE-2020-37277, GHSA-8jq6-w5cg-wm45 | High | 0.5% | 11 Nov, 2020 | Packagist pocketmine/pocketmine-mp |
Subrion CMS CSRF Vulnerability CVE-2019-7357, GHSA-5mh2-82g9-72jv | High | 1.4% | 10 Nov, 2020 | Packagist intelliants/subrion |