Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
UnoPim has CSV Injection on Quick Export feature CVE-2025-55745, GHSA-74rg-6f92-g6wx | Low | 0.6% | 22 Aug, 2025 | Packagist unopim/unopim |
UnoPim has Broken Access Control CVE-2025-55741, GHSA-8p2f-fx4q-75cx | High | 0.4% | 22 Aug, 2025 | Packagist unopim/unopim |
UnoPim vulnerable to CSRF on Product edit feature and creation of other types CVE-2025-55744, GHSA-287x-6r2h-f9mw | Medium | 0.2% | 21 Aug, 2025 | Packagist unopim/unopim |
UnoPim vulnerable to remote code execution through Arbitrary File upload CVE-2025-55743, GHSA-v22v-xwh7-2vrm | High | 0.5% | 21 Aug, 2025 | Packagist unopim/unopim |
UnoPim has Stored Cross-site Scripting vulnerability in user creation functionality CVE-2025-55742, GHSA-xr97-25v7-hc2q | Medium | 0.4% | 21 Aug, 2025 | Packagist unopim/unopim |
WP Crontrol Authenticated (Administrator+) plugin vulnerable to Blind Server-Side Request Forgery CVE-2025-8678, GHSA-35c5-67fm-cpcp | Medium | 0.4% | 19 Aug, 2025 | Packagist johnbillion/wp-crontrol |
MoonShine SQL Injection Vulnerability CVE-2025-51510, GHSA-9g9j-3w64-3cjh | Medium | 0.5% | 19 Aug, 2025 | Packagist moonshine/moonshine |
MoonShine Arbitrary File Upload Vulnerability CVE-2025-51489, GHSA-8xfq-7f6m-mpmf | Medium | 0.3% | 19 Aug, 2025 | Packagist moonshine/moonshine |
moonshine Stored Cross-Site Scripting Vulnerability in Create Admin CVE-2025-51488, GHSA-rh9f-gr6q-mpc4 | Medium | 0.6% | 19 Aug, 2025 | Packagist moonshine/moonshine |
moonshine Stored Cross-Site Scripting Vulnerability in Create Article CVE-2025-51487, GHSA-p632-58pp-c9xg | Medium | 0.4% | 19 Aug, 2025 | Packagist moonshine/moonshine |
LibreNMS allows stored XSS in Alert Template name field CVE-2025-55296, GHSA-vxq6-8cwm-wj99 | Medium | 17.0% | 18 Aug, 2025 | Packagist librenms/librenms |
Soosyze CMS's /user/login endpoint missing rate-limiting and lockout mechanisms CVE-2025-52392, GHSA-vq9x-w82r-rhmc | High | 0.9% | 13 Aug, 2025 | Packagist soosyze/soosyze |
Magento vulnerable to path traversal CVE-2025-49559, GHSA-h4f4-gv6h-x824 | Medium | 0.7% | 12 Aug, 2025 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability CVE-2025-49558, GHSA-wcmw-8xpp-rwfj | Medium | 0.4% | 12 Aug, 2025 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento Cross-site Scripting vulnerability CVE-2025-49557, GHSA-8mq8-c243-2335 | High | 0.6% | 12 Aug, 2025 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento has incorrect authorization issue that leads to arbitrary file system read CVE-2025-49556, GHSA-7hrj-3c9x-xv5h | High | 0.6% | 12 Aug, 2025 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento Cross-Site Request Forgery (CSRF) vulnerability CVE-2025-49555, GHSA-5777-jj7p-mpqw | High | 0.9% | 12 Aug, 2025 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento vulnerable to denial of service CVE-2025-49554, GHSA-xgfm-992v-h2hr | High | 0.6% | 12 Aug, 2025 | Packagist magento/community-edition Packagist magento/project-community-edition |
svg-sanitizer Bypasses Attribute Sanitization CVE-2025-55166, GHSA-22wq-q86m-83fh | Medium | 0.5% | 12 Aug, 2025 | Packagist enshrined/svg-sanitize |
Craft CMS has a theoretical bypass for CVE-2025-23209 CVE-2025-54417, GHSA-2vcf-qxv3-2mgw | Medium | 0.5% | 08 Aug, 2025 | Packagist craftcms/cms |
Shopware race condition bypasses voucher restrictions CVE-2025-7954, GHSA-27gv-mg7w-mm34 | Medium | 0.4% | 06 Aug, 2025 | Packagist shopware/platform |
Concrete CMS is vulnerable to Stored XSS from Home Folder on Members Dashboard page CVE-2025-8573, GHSA-c5xf-rmv4-j85h | Low | 0.5% | 05 Aug, 2025 | Packagist concrete5/concrete5 |
Concrete CMS vulnerable to Reflected Cross-Site Scripting (XSS) in Conversation Messages Dashboard Page CVE-2025-8571, GHSA-4pcg-pjp5-3mc6 | Medium | 0.4% | 05 Aug, 2025 | Packagist concrete5/concrete5 |
FPDI allows Memory Exhaustion (OOM) in PDF Parser which leads to Denial of Service CVE-2025-54869, GHSA-jxhh-4648-vpp3 | Medium | 0.3% | 05 Aug, 2025 | Packagist setasign/fpdi |
ThinkPHP Path Traversal Vulnerability CVE-2025-50706, GHSA-mrwc-mvr8-9xq5 | Critical | 1.1% | 05 Aug, 2025 | Packagist topthink/framework |
The ADOdb sqlite3 driver allows SQL injection CVE-2025-54119, GHSA-vf2r-cxg9-p7rf | Critical | 0.5% | 04 Aug, 2025 | Packagist adodb/adodb-php |
Microweber XSS Vulnerability in the homepage Endpoint CVE-2025-51504, GHSA-2x2j-3c2v-g3c2 | High | 0.6% | 01 Aug, 2025 | Packagist microweber/microweber |
Microweber has Reflected XSS Vulnerability in the layout Parameter CVE-2025-51502, GHSA-mvj3-hc7j-vp74 | Medium | 0.9% | 01 Aug, 2025 | Packagist microweber/microweber |
Microweber has Reflected XSS Vulnerability in the id Parameter CVE-2025-51501, GHSA-8357-fjvx-xrm8 | Medium | 0.9% | 01 Aug, 2025 | Packagist microweber/microweber |
php-jwt contains weak encryption CVE-2025-45769, GHSA-2x45-7fc3-mxwq | Medium | 0.1% | 31 Jul, 2025 | Packagist firebase/php-jwt |
Microweber Has Stored XSS Vulnerability in User Profile Fields CVE-2025-51503, GHSA-782f-gxj5-xvqc | High | 0.5% | 31 Jul, 2025 | Packagist microweber/microweber |
Bacula-web SQL Injection Vulnerability CVE-2025-45346, GHSA-hq25-vp56-qr86 | High | 0.7% | 29 Jul, 2025 | Packagist bacula-web/bacula-web |
z-push/z-push-dev SQL Injection Vulnerability CVE-2025-8264, GHSA-w832-w3p8-cw29 | High | 0.4% | 29 Jul, 2025 | Packagist z-push/z-push-dev |
CodeIgniter4's ImageMagick Handler has Command Injection Vulnerability CVE-2025-54418, GHSA-9952-gv64-x94c | Critical | 1.5% | 28 Jul, 2025 | Packagist codeigniter4/framework |
HAX CMS API Lacks Authorization Checks CVE-2025-54378, GHSA-9jr9-8ff3-m894 | High | 0.6% | 25 Jul, 2025 | Packagist elmsln/haxcms npm @haxtheweb/haxcms-nodejs |
Withdrawn Advisory: CodeIgniter4 Cross-Site Scripting Vulnerability in debugbar_time Parameter CVE-2025-45406, GHSA-49jm-g4m8-x53p | Medium | 0.4% | 25 Jul, 2025 | Packagist codeigniter4/framework |
Femanager extension for TYPO3 allows Insecure Direct Object Reference CVE-2025-7900, GHSA-rc5f-3hfv-jxp2 | Medium | 0.3% | 22 Jul, 2025 | Packagist in2code/femanager |
Powermail extension for TYPO3 allows Insecure Direct Object Reference CVE-2025-7899, GHSA-x769-3cwv-f8hc | Medium | 0.3% | 22 Jul, 2025 | Packagist in2code/powermail |
HAX CMS application pages vulnerable to clickjacking CVE-2025-54139, GHSA-54vw-f4xf-f92j | Medium | 0.4% | 21 Jul, 2025 | Packagist elmsln/haxcms npm @haxtheweb/haxcms-nodejs |
LibreNMS has Authenticated Remote File Inclusion in ajax_form.php that Allows RCE CVE-2025-54138, GHSA-gq96-8w38-hhj2 | High | 1.2% | 21 Jul, 2025 | Packagist librenms/librenms |
Dolibarr has Remote Code Execution Vulnerability (Bypass) GHSA-49xw-hw94-fmv2 | High | Not scored | 21 Jul, 2025 | Packagist dolibarr/dolibarr |
nova-tiptap has Unauthenticated Arbitrary File Upload Vulnerability CVE-2025-54082, GHSA-96c2-h667-9fxp | Critical | 0.9% | 21 Jul, 2025 | Packagist manogi/nova-tiptap Packagist marshmallow/nova-tiptap |
Filemanager is vulnerable to Relative Path Traversal through filemanager.php CVE-2025-46002, GHSA-r7q6-6fmq-mx4c | Medium | 1.1% | 18 Jul, 2025 | Packagist simogeo/filemanager |
simogeo/filemanager arbitrary file upload vulnerability CVE-2025-46001, GHSA-m5hw-rhvr-f47c | Critical | 0.8% | 18 Jul, 2025 | Packagist simogeo/filemanager |
Livewire is vulnerable to remote command execution during component property update hydration CVE-2025-54068, GHSA-29cq-5w36-x7w3 | CriticalExploited | 96.3% | 17 Jul, 2025 | Packagist livewire/livewire |
LaRecipe is vulnerable to Server-Side Template Injection attacks CVE-2025-53833, GHSA-jv7x-xhv2-p5v2 | Critical | 9.1% | 14 Jul, 2025 | Packagist binarytorch/larecipe |
phpThumb is vulnerable to Command Injection through its gif_outputAsJpeg function CVE-2025-52994, GHSA-q745-cfqh-hcrw | Medium | 0.7% | 11 Jul, 2025 | Packagist james-heinrich/phpthumb |
DynamicPageList3 vulnerability exposes hidden/suppressed usernames CVE-2025-53625, GHSA-7pgw-q3qp-6pgq | High | 0.5% | 10 Jul, 2025 | Packagist universal-omega/dynamic-page-list3 |
Cockpit - Content Platform vulnerable to XSS through name or email argument names CVE-2025-7053, GHSA-j4rj-fgcq-wmqp | Medium | 0.4% | 04 Jul, 2025 | Packagist cockpit-hq/cockpit |
Citizen vulnerable to Stored XSS through short descriptions CVE-2025-53370, GHSA-prmv-7r8c-794g | High | 0.4% | 03 Jul, 2025 | Packagist starcitizentools/citizen-skin |