Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Auth0 Wordpress plugin Does Not Properly Handle File Types in Bulk User Import GHSA-w22c-pw5m-482x | Low | Not scored | 01 Oct, 2025 | Packagist auth0/wordpress |
laravel-auth0 SDK Does Not Properly Handle File Types in Bulk User Import GHSA-hjfh-5jmm-xr24 | Low | Not scored | 01 Oct, 2025 | Packagist auth0/login |
auth0-PHP SDK Does Not Properly Handle File Types in Bulk User Import CVE-2025-58769, GHSA-9mh6-g99m-ppcw | Low | 0.4% | 01 Oct, 2025 | Packagist auth0/auth0-php |
Dolibarr vulnerable to RCE via the computed field parameter CVE-2025-56588, GHSA-27hj-48r9-x2vx | High | 0.5% | 01 Oct, 2025 | Packagist dolibarr/dolibarr |
Joomla! CMS vulnerable to XSS via the input filter CVE-2025-54476, GHSA-fm22-g2q9-j3pw | Medium | 0.3% | 30 Sep, 2025 | Packagist joomla/filter |
Star Citizen EmbedVideo Extension Stored XSS through wikitext caused by usage of non-reserved data attributes CVE-2025-59839, GHSA-4j5h-mvj3-m48v | High | 0.3% | 24 Sep, 2025 | Packagist starcitizenwiki/embedvideo |
Drupal Reverse Proxy Header allows Manipulating User-Controlled Variables CVE-2025-10929, DRUPAL-CONTRIB-2025-111, GHSA-fg8x-q69g-4qp3 | Medium | 0.3% | 24 Sep, 2025 | Packagist drupal/reverse_proxy_header Packagist:https://packages.drupal.org/8 drupal/reverse_proxy_header |
Drupal Currency allows Cross Site Request Forgery CVE-2025-10930, DRUPAL-CONTRIB-2025-110, GHSA-27fv-rpgj-4c6m | Medium | 0.1% | 24 Sep, 2025 | Packagist drupal/currency Packagist:https://packages.drupal.org/8 drupal/currency |
Drupal Umami Analytics allows Cross-Site Scripting (XSS) CVE-2025-10931, DRUPAL-CONTRIB-2025-109, GHSA-jxp8-4jw5-5xjc | Low | 0.2% | 24 Sep, 2025 | Packagist drupal/umami_analytics Packagist:https://packages.drupal.org/8 drupal/umami_analytics |
Drupal Access code allows Brute Force Attempts CVE-2025-10928, DRUPAL-CONTRIB-2025-108, GHSA-27mc-9399-r9mx | Medium | 0.2% | 24 Sep, 2025 | Packagist drupal/access_code Packagist:https://packages.drupal.org/8 drupal/access_code |
Drupal Plausible tracking is vulnerable to XSS CVE-2025-10927, DRUPAL-CONTRIB-2025-107, GHSA-pr6m-qwrr-mrw9 | Medium | 0.2% | 24 Sep, 2025 | Packagist drupal/plausible_tracking Packagist:https://packages.drupal.org/8 drupal/plausible_tracking |
Drupal JSON Field is vulnerable to XSS CVE-2025-10926, DRUPAL-CONTRIB-2025-106, GHSA-m3f2-xjgc-2wp2 | Medium | 0.2% | 24 Sep, 2025 | Packagist drupal/json_field Packagist:https://packages.drupal.org/8 drupal/json_field |
Mangati NovoSGA XSS vulnerability in /admin CVE-2025-10909, GHSA-4c44-r8rm-3p39 | Low | 0.3% | 24 Sep, 2025 | Packagist novosga/novosga |
GP247 and S-Cart have a stored cross-site scripting (XSS) vulnerability CVE-2025-57407, GHSA-46v4-5mc8-q2cf | Medium | 0.2% | 23 Sep, 2025 | Packagist gp247/core Packagist s-cart/core |
Snipe-IT allows unsafe deserialization CVE-2025-59713, GHSA-phwj-fgch-xvrj | High | 0.4% | 19 Sep, 2025 | Packagist snipe/snipe-it |
Snipe-IT allows XSS CVE-2025-59712, GHSA-c9wp-pr7f-hfqm | Medium | 0.3% | 19 Sep, 2025 | Packagist snipe/snipe-it |
TYPO3 "Form to Database" extension susceptible to Cross-site Scripting CVE-2025-10316, GHSA-54pg-2x9h-cmx8 | Low | 0.3% | 16 Sep, 2025 | Packagist lavitto/typo3-form-to-database |
Open Web Analytics Server is vulnerable to SQL Injection CVE-2025-59397, GHSA-6w8r-xgqq-qg6g | Medium | 0.4% | 15 Sep, 2025 | Packagist open-web-analytics/open-web-analytics |
Subrion CMS: Authenticated administrators are able to gain escalated access through Run SQL Query tool CVE-2025-56556, GHSA-h8wv-vv58-468h | Medium | 0.2% | 11 Sep, 2025 | Packagist intelliants/subrion |
Shopware: Reflective Cross Site-Scripting (XSS) in CMS components GHSA-9v82-vcjx-m76j | High | Not scored | 10 Sep, 2025 | Packagist shopware/core Packagist shopware/shopware |
TinyEnv: Inline comments not stripped properly in .env values CVE-2025-58759, GHSA-72cm-7236-h43r | Medium | 0.2% | 09 Sep, 2025 | Packagist datahihi1/tiny-env |
TinyEnv: Missing .env file not required — may cause unexpected behavior CVE-2025-58758, GHSA-3j7m-5g4q-gfpc | High | 0.2% | 09 Sep, 2025 | Packagist datahihi1/tiny-env |
YesWiki Cross Site Scripting vulnerability CVE-2025-52277, GHSA-29cj-cxw4-v4j2 | Medium | 0.4% | 09 Sep, 2025 | Packagist yeswiki/yeswiki |
Magento Community Edition Improper Input Validation vulnerability CVE-2025-54236, GHSA-wh92-6q6g-px7j | CriticalExploited | 94.7% | 09 Sep, 2025 | Packagist magento/community-edition Packagist magento/project-community-edition |
TYPO3 CSV download feature information disclosure CVE-2025-59019, GHSA-j8vm-7q52-2m2m | Medium | 0.2% | 09 Sep, 2025 | Packagist typo3/cms-backend Packagist typo3/cms-recordlist |
TYPO3 Workspaces Module Information Disclosure CVE-2025-59018, GHSA-w2pf-7q5w-2cgw | High | 0.3% | 09 Sep, 2025 | Packagist typo3/cms-workspaces |
TYPO3 backend modules have Broken Access Control CVE-2025-59017, GHSA-2fhw-2j7m-mr4m | Medium | 0.3% | 09 Sep, 2025 | Packagist typo3/cms-backend Packagist typo3/cms-beuser Packagist typo3/cms-dashboard Packagist typo3/cms-recycler +1 more |
TYPO3 CMS exposes sensitive information in an error message CVE-2025-59016, GHSA-cvm2-5f78-g9m8 | Medium | 0.2% | 09 Sep, 2025 | Packagist typo3/cms-core |
TYPO3 CMS uses insufficient entropy when generating passwords CVE-2025-59015, GHSA-p5jq-5383-qvc7 | Medium | 0.2% | 09 Sep, 2025 | Packagist typo3/cms-core |
TYPO3 Bookmark Toolbar vulnerable to denial of service CVE-2025-59014, GHSA-xrcq-533q-8rxw | Medium | 0.3% | 09 Sep, 2025 | Packagist typo3/cms-backend |
TYPO3 CMS has an open‑redirect vulnerability CVE-2025-59013, GHSA-72jf-5fg5-3cw3 | Medium | 0.2% | 09 Sep, 2025 | Packagist typo3/cms-core |
Maho is Vulnerable to Authenticated Remote Code Execution via File Upload CVE-2025-58449, GHSA-vgmm-27fc-vmgp | High | 0.3% | 08 Sep, 2025 | Packagist mahocommerce/maho |
Presta Shop vulnerable to email enumeration CVE-2025-51586, GHSA-8xx5-h6m3-jr33 | Medium | 0.8% | 04 Sep, 2025 | Packagist prestashop/prestashop |
Drupal Acquia DAM allows Forceful Browsing CVE-2025-9954, DRUPAL-CONTRIB-2025-105, GHSA-x957-32v9-m7vg | High | 0.3% | 03 Sep, 2025 | Packagist drupal/acquia_dam Packagist:https://packages.drupal.org/8 drupal/acquia_dam |
Mautic Vulnerable to User Enumeration via Response Timing CVE-2025-9824, GHSA-3ggv-qwcp-j6xg | Medium | 0.3% | 03 Sep, 2025 | Packagist mautic/core |
Mautic vulnerable to reflected XSS in lead:addLeadTags - Quick Add CVE-2025-9823, GHSA-9v8p-m85m-f7mm | Medium | 0.3% | 03 Sep, 2025 | Packagist mautic/core |
Mautic vulnerable to secret data extraction via elfinder CVE-2025-9822, GHSA-438m-6mhw-hq5w | Medium | 0.2% | 03 Sep, 2025 | Packagist mautic/core |
Mautic vulnerable to SSRF via webhook function CVE-2025-9821, GHSA-hj6f-7hp7-xg69 | Low | 0.3% | 03 Sep, 2025 | Packagist mautic/core |
PocketMine-MP `ResourcePackDataInfoPacket` amplification vulnerability due to lack of resource pack sequence status checking CVE-2025-71417, GHSA-fqqv-56h5-f57g | High | 0.4% | 02 Sep, 2025 | Packagist pocketmine/pocketmine-mp |
Paymenter vulnerable to Remote Code Execution via public file uploads CVE-2025-58048, GHSA-5pm9-r2m8-rcmj | Critical | 0.4% | 28 Aug, 2025 | Packagist paymenter/paymenter |
Contao does not properly manage privileges for page and article fields CVE-2025-57759, GHSA-qqfq-7cpp-hcqj | Medium | 0.3% | 28 Aug, 2025 | Packagist contao/contao Packagist contao/core-bundle |
Contao can disclose sensitive information in the news module CVE-2025-57757, GHSA-w53m-gxvg-vx7p | Medium | 0.3% | 28 Aug, 2025 | Packagist contao/contao Packagist contao/core-bundle |
Contao discloses sensitive information in the front end search index CVE-2025-57756, GHSA-2xmj-8wmq-7475 | Medium | 0.3% | 28 Aug, 2025 | Packagist contao/contao Packagist contao/core-bundle |
Contao applies improper access control in the back end voters CVE-2025-57758, GHSA-7m47-r75r-cx8v | Medium | 0.3% | 28 Aug, 2025 | Packagist contao/contao Packagist contao/core-bundle |
The Freeform CraftCMS plugin contains an Server-side template injection (SSTI) vulnerability CVE-2025-52122, GHSA-9hp3-f5g8-rccg | Critical | 0.6% | 27 Aug, 2025 | Packagist solspace/craft-freeform |
Badaso CMS file upload vulnerability CVE-2025-52353, GHSA-gqp9-jh35-439m | Critical | 0.7% | 26 Aug, 2025 | Packagist badaso/core |
Craft CMS Potential Remote Code Execution via Twig SSTI CVE-2025-57811, GHSA-crcq-738g-pqvc | Medium | 0.9% | 25 Aug, 2025 | Packagist craftcms/cms |
Easy!Appointments SQL injection vulnerability CVE-2025-50383, GHSA-2f28-69j7-85hf | High | 0.4% | 25 Aug, 2025 | Packagist alextselegidis/easyappointments |
PhpSpreadsheet vulnerable to SSRF when reading and displaying a processed HTML document in the browser CVE-2025-54370, GHSA-rx7m-68vc-ppxh | High | 0.8% | 25 Aug, 2025 | Packagist phpoffice/phpspreadsheet |
Adminer PHP Object Injection issue leads to Denial of Service CVE-2025-43960, GHSA-mqh4-2mm8-g7w9 | High | 0.7% | 25 Aug, 2025 | Packagist vrana/adminer |