Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Moodle has a time restriction bypass BIT-moodle-2025-62401, CVE-2025-62401, GHSA-w29j-8phw-ffjf | Medium | 0.2% | 23 Oct, 2025 | Packagist moodle/moodle |
Moodle exposed the names of hidden groups to users BIT-moodle-2025-62400, CVE-2025-62400, GHSA-422v-w6c5-vq42 | Medium | 0.3% | 23 Oct, 2025 | Packagist moodle/moodle |
Moodle vulnerable to brute-force password guesses BIT-moodle-2025-62399, CVE-2025-62399, GHSA-m58f-9pvv-8mp2 | High | 0.4% | 23 Oct, 2025 | Packagist moodle/moodle |
Moodle does not properly enforce MFA BIT-moodle-2025-62398, CVE-2025-62398, GHSA-25wf-7x6c-wmpf | Medium | 0.2% | 23 Oct, 2025 | Packagist moodle/moodle |
Moodle's error handling leads to sensitive information disclosure BIT-moodle-2025-62396, CVE-2025-62396, GHSA-c5cj-xp43-qcc3 | Medium | 0.3% | 23 Oct, 2025 | Packagist moodle/moodle |
Moodle sends quiz-related messages to inactive/suspended users BIT-moodle-2025-62394, CVE-2025-62394, GHSA-8fcv-4qp9-pg32 | Medium | 0.2% | 23 Oct, 2025 | Packagist moodle/moodle |
Moodle course access permissions are not properly checked in course_output_fragment_course_overview BIT-moodle-2025-62393, CVE-2025-62393, GHSA-rjcm-7v2p-9265 | Medium | 0.2% | 23 Oct, 2025 | Packagist moodle/moodle |
Admidio Vulnerable to Authenticated SQL Injection in Member Assignment Functionality CVE-2025-62617, GHSA-2v5m-cq9w-fc33 | High | 0.4% | 22 Oct, 2025 | Packagist admidio/admidio |
Drupal CivicTheme Design System allows Cross-Site Scripting (XSS) CVE-2025-12083, DRUPAL-CONTRIB-2025-113, GHSA-h72q-cq3w-h3wc | Medium | 0.2% | 22 Oct, 2025 | Packagist drupal/civictheme Packagist:https://packages.drupal.org/8 drupal/civictheme |
Drupal CivicTheme Design System allows Forceful Browsing CVE-2025-12082, DRUPAL-CONTRIB-2025-112, GHSA-qxr9-f877-9842 | High | 0.3% | 22 Oct, 2025 | Packagist drupal/civictheme Packagist:https://packages.drupal.org/8 drupal/civictheme |
code16 Sharp vulnerable to Cross Site Scripting (XSS) CVE-2025-61457, GHSA-9778-v769-qvjf | Medium | 0.3% | 21 Oct, 2025 | Packagist code16/sharp |
ProcessWire CMS vulnerable to resource-exhaustion Denial of Service CVE-2025-60790, GHSA-9p44-q66p-xm6p | Medium | 0.4% | 21 Oct, 2025 | Packagist processwire/processwire |
Shopware Customer Orders can be canceled, even if refunds are disabled GHSA-r2vg-hvjm-fg38 | Medium | Not scored | 21 Oct, 2025 | Packagist shopware/core Packagist shopware/platform |
Shopware exposes sensitive user information via CSV export mapping GHSA-27c9-vp3w-6ww8 | Medium | Not scored | 21 Oct, 2025 | Packagist shopware/core Packagist shopware/platform |
Shopware vulnerable to Server-Side Request Forgery (SSRF) – order invoice GHSA-3cpp-fv95-mpr5 | Low | Not scored | 21 Oct, 2025 | Packagist shopware/core Packagist shopware/platform |
Shopware vulnerable to path traversal via Plugin upload GHSA-6wh5-mw9h-5c3w | Low | Not scored | 21 Oct, 2025 | Packagist shopware/core Packagist shopware/platform |
Shopware vulnerable to MediaVisibilityRestrictionSubscriber bypass when reading media entities by aggregating fields individually GHSA-m895-2hj3-8cg9 | Medium | Not scored | 21 Oct, 2025 | Packagist shopware/core Packagist shopware/platform |
TastyIgniter vulnerable to Cross-Site Scripting CVE-2025-61417, GHSA-4vrf-42cm-7xfw | High | 0.6% | 20 Oct, 2025 | Packagist tastyigniter/tastyigniter |
Cargo Mediawiki Extension vulnerable to Cross-site Scripting CVE-2025-62671, GHSA-gr6v-3pmp-996p | Medium | 0.5% | 18 Oct, 2025 | Packagist mediawiki/cargo |
Citizen vulnerable to stored XSS in sticky header button messages CVE-2025-62508, GHSA-g955-vw6w-v6pp | Medium | 0.4% | 17 Oct, 2025 | Packagist starcitizentools/citizen-skin |
ibexa/fieldtype-richtext has an XSS vulnerability via acronym custom tag in Rich Text GHSA-8c2g-f8jm-5cr7 | Medium | Not scored | 17 Oct, 2025 | Packagist ibexa/fieldtype-richtext |
ibexa/admin-ui has an XSS vulnerability in Cancel/Reschedule future publication modal GHSA-2mx6-fq24-g2mh | Medium | Not scored | 17 Oct, 2025 | Packagist ibexa/admin-ui |
ezsystems/ezplatform-admin-ui has an XSS vulnerability in Cancel/Reschedule future publication modal GHSA-99c7-c3mw-mxhv | Medium | Not scored | 17 Oct, 2025 | Packagist ezsystems/ezplatform-admin-ui |
ibexa/user login enumerates user accounts GHSA-q3x8-6898-23g3 | Medium | Not scored | 17 Oct, 2025 | Packagist ibexa/user |
bagisto has a Cross Site Scripting (XSS) vulnerability in TinyMCE Image Upload (SVG) CVE-2025-62418, GHSA-fg89-g389-p346 | Medium | 0.3% | 16 Oct, 2025 | Packagist bagisto/bagisto |
bagisto has CSV Formula Injection in Create New Product CVE-2025-62417, GHSA-jqrp-58fv-w8cq | Critical | 0.4% | 16 Oct, 2025 | Packagist bagisto/bagisto |
bagisto has Server Side Template Injection (SSTI) in Product Description CVE-2025-62416, GHSA-527q-4wqv-g9wj | Medium | 0.4% | 16 Oct, 2025 | Packagist bagisto/bagisto |
bagisto has Cross Site Scripting (XSS) in Create New Customer CVE-2025-62414, GHSA-r9xj-mvqf-jm7w | Medium | 0.3% | 16 Oct, 2025 | Packagist bagisto/bagisto |
LibreNMS alert-rules has a Cross-Site Scripting Vulnerability CVE-2025-62412, GHSA-6g2v-66ch-6xmh | Medium | 0.3% | 16 Oct, 2025 | Packagist librenms/librenms |
PrestaShop Checkout Target PayPal merchant account hijacking from backoffice CVE-2025-61924, GHSA-wvpg-4wrh-5889 | Low | 0.3% | 16 Oct, 2025 | Packagist prestashop/ps_checkout |
PrestaShop Checkout Backoffice directory traversal allows arbitrary file disclosure CVE-2025-61923, GHSA-fpxp-pfqm-x54w | Medium | 0.9% | 16 Oct, 2025 | Packagist prestashop/ps_checkout |
PrestaShop Checkout allows customer account takeover via email CVE-2025-61922, GHSA-54hq-mf6h-48xh | Critical | 0.5% | 16 Oct, 2025 | Packagist prestashop/ps_checkout |
bagisto has Cross Site Scripting (XSS) issue in TinyMCE Image Upload (HTML) CVE-2025-62415, GHSA-67px-r26w-598x | Medium | 0.3% | 16 Oct, 2025 | Packagist bagisto/bagisto |
LibreNMS has a Stored XSS vulnerability in its Alert Transport name field CVE-2025-62411, GHSA-frc6-pwgr-c28w | Medium | 12.7% | 16 Oct, 2025 | Packagist librenms/librenms |
Magento vulnerable to privilege escalation due to incorrect authorization CVE-2025-54267, GHSA-qvwr-p3hj-j6jf | Medium | 0.4% | 14 Oct, 2025 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento vulnerable to stored Cross-Site Scripting (XSS) CVE-2025-54266, GHSA-pcrx-r49h-x2w5 | Medium | 0.3% | 14 Oct, 2025 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento allows incorrect authorization CVE-2025-54265, GHSA-r355-75hw-r8jf | Medium | 0.6% | 14 Oct, 2025 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento vulnerable to stored Cross-Site Scripting (XSS) CVE-2025-54264, GHSA-2768-5wmv-cfff | High | 0.6% | 14 Oct, 2025 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento provides incorrect authorization through a security feature bypass CVE-2025-54263, GHSA-69x9-xp2j-w8g8 | High | 0.6% | 14 Oct, 2025 | Packagist magento/community-edition Packagist magento/project-community-edition |
LibreNMS is vulnerable to Reflected-XSS in `report_this` function CVE-2025-62365, GHSA-86rg-8hc8-v82p | Medium | 0.2% | 13 Oct, 2025 | Packagist librenms/librenms |
Bagisto is vulnerable to XSS through Admin Panel's product creation path CVE-2025-60880, GHSA-29mf-w486-v3vc | High | 0.4% | 10 Oct, 2025 | Packagist bagisto/bagisto |
Alt Redirect: Potential Authentication Bypass by Spoofing through query-string stripping logic flaw CVE-2025-60868, GHSA-rpjr-pcmr-9ppw | Medium | 0.2% | 10 Oct, 2025 | Packagist alt-design/alt-redirect |
drupal-pattern-lab/unified-twig-extensions is vulnerable to XXS CVE-2025-11570, GHSA-64mv-9655-37hx | Low | 0.2% | 10 Oct, 2025 | Packagist drupal-pattern-lab/unified-twig-extensions |
VaahCMS is vulnerable to XSS through its Avatar Upload endpoint CVE-2025-61183, GHSA-q769-phqg-263r | Medium | 0.3% | 08 Oct, 2025 | Packagist webreinvent/vaahcms |
Melis Platform CMS Unauthenticated File Upload Leading to RCE CVE-2025-10353, GHSA-chw4-gjvw-3gxc | Critical | 2.7% | 08 Oct, 2025 | Packagist melisplatform/melis-cms-slider |
Melis Platform CMS Unauthenticated Admin Account Creation CVE-2025-10352, GHSA-p3vc-g9f9-mgw4 | Critical | 0.3% | 08 Oct, 2025 | Packagist melisplatform/melis-core |
Melis Platform CMS SQL Injection CVE-2025-10351, GHSA-mrmx-jfw8-qhgv | Critical | 0.4% | 08 Oct, 2025 | Packagist melisplatform/melis-cms |
NovoSGA: Manipulation of User Creation Page can lead to weak password requirements CVE-2025-11322, GHSA-xgr2-5837-hf48 | Low | 0.4% | 06 Oct, 2025 | Packagist novosga/novosga |
phpMyFAQ duplicate email registration allows multiple accounts with the same email CVE-2025-59943, GHSA-9wj2-4hcm-r74j | Critical | 0.4% | 03 Oct, 2025 | Packagist thorsten/phpmyfaq |
Auth0 Symfony SDK Does Not Properly Handle File Types in Bulk User Import GHSA-7jp2-5h22-m432 | Low | Not scored | 01 Oct, 2025 | Packagist auth0/symfony |