Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Citizen Short Description stored XSS vulnerability through wikitext CVE-2025-53369, GHSA-p85q-mww9-gwqf | High | 0.3% | 03 Jul, 2025 | Packagist starcitizentools/short-description |
starcitizentools/citizen-skin is vulnerable to Stored XSS attack in the legacy search bar through page descriptions CVE-2025-53368, GHSA-rq6g-6g94-jfr4 | High | 0.3% | 03 Jul, 2025 | Packagist starcitizentools/citizen-skin |
Bolt CMS vulnerable to authenticated remote code execution CVE-2025-34086, GHSA-p9qc-8jjx-g8cg | High | 4.2% | 03 Jul, 2025 | Packagist bolt/bolt |
Microweber CMS API has authenticated local file inclusion vulnerability CVE-2025-34076, GHSA-j64v-xh5w-8hqj | Medium | 2.2% | 02 Jul, 2025 | Packagist microweber/microweber |
TabberNeue vulnerable to Stored XSS through wikitext CVE-2025-53093, GHSA-jfj7-249r-7j2m | High | 0.4% | 27 Jun, 2025 | Packagist starcitizentools/tabber-neue |
raspap-webgui has a Directory Traversal vulnerability CVE-2025-44163, GHSA-277f-37gw-9gmq | High | 0.6% | 27 Jun, 2025 | Packagist billz/raspap-webgui |
JuzaWeb CMS is vulnerable to Incorrect Privilege Assignment when installing certain components CVE-2025-6736, GHSA-mrph-pjv2-34f4 | Low | 0.5% | 27 Jun, 2025 | Packagist juzaweb/cms |
JuzaWeb CMS is vulnerable to Incorrect Privilege Assignment when installing Import Page component CVE-2025-6735, GHSA-rq7x-cfmc-rq3w | Low | 0.5% | 27 Jun, 2025 | Packagist juzaweb/cms |
Magento Security feature bypass CVE-2025-49550, GHSA-8hcx-xvww-6c6h | Medium | 0.4% | 25 Jun, 2025 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento Authenticated Security feature bypass CVE-2025-49549, GHSA-85jx-x9r4-45m2 | Low | 0.4% | 25 Jun, 2025 | Packagist magento/community-edition Packagist magento/project-community-edition |
Moodle Session Fixation allows unauthenticated users to hijack sessions via sesskey parameter BIT-moodle-2025-53021, CVE-2025-53021, GHSA-cgvv-3455-824j | Medium | 0.3% | 24 Jun, 2025 | Packagist moodle/moodle |
Pterodactyl Panel Allows Unauthenticated Arbitrary Remote Code Execution CVE-2025-49132, GHSA-24wv-6c99-f843 | Critical | 54.5% | 19 Jun, 2025 | Packagist pterodactyl/panel |
handcraftedinthealps/goodby-csv has Potential Gadget Chain allowing Remote Code Execution CVE-2025-49597, GHSA-x3c7-22c8-prg7 | Low | 0.2% | 13 Jun, 2025 | Packagist handcraftedinthealps/goodby-csv |
Ibexa RichText Field Type XSS vulnerabilities in back office GHSA-9qv6-4pwm-m68f | Medium | Not scored | 13 Jun, 2025 | Packagist ibexa/fieldtype-richtext |
Ibexa Admin UI XSS vulnerabilities in back office GHSA-5r6x-g6jv-4v87 | Medium | Not scored | 13 Jun, 2025 | Packagist ibexa/admin-ui |
Ibexa Admin UI assets XSS vulnerabilities in back office GHSA-vhgq-r8gx-5fpv | Medium | Not scored | 13 Jun, 2025 | Packagist ibexa/admin-ui-assets |
Ibexa eZ Platform Admin UI assets XSS vulnerabilities in back office GHSA-r5rx-53g9-25rj | Medium | Not scored | 13 Jun, 2025 | Packagist ezsystems/ezplatform-admin-ui-assets |
Ibexa eZ Platform Admin UI XSS vulnerabilities in back office GHSA-r7pm-mw8g-p7px | Medium | Not scored | 13 Jun, 2025 | Packagist ezsystems/ezplatform-admin-ui |
starcitizentools/citizen-skin allows stored XSS in menu heading message CVE-2025-49579, GHSA-g3cp-pq72-hjpv | Medium | 0.4% | 12 Jun, 2025 | Packagist starcitizentools/citizen-skin |
starcitizentools/citizen-skin allows stored XSS in user registration date message CVE-2025-49578, GHSA-2v3v-3whp-953h | Medium | 0.4% | 12 Jun, 2025 | Packagist starcitizentools/citizen-skin |
starcitizentools/citizen-skin allows stored XSS in preference menu heading messages CVE-2025-49577, GHSA-jwr7-992g-68mh | Medium | 0.4% | 12 Jun, 2025 | Packagist starcitizentools/citizen-skin |
starcitizentools/citizen-skin allows stored XSS in search no result messages CVE-2025-49576, GHSA-86xf-2mgp-gv3g | Medium | 0.4% | 12 Jun, 2025 | Packagist starcitizentools/citizen-skin |
Citizen skin vulnerable to stored XSS through multiple system messages CVE-2025-49575, GHSA-4c2h-67qq-vm87 | Medium | 0.4% | 11 Jun, 2025 | Packagist starcitizentools/citizen-skin |
Magneto contains stored XSS vulnerability CVE-2025-47110, GHSA-j934-vjh5-vf9r | Critical | 0.7% | 10 Jun, 2025 | Packagist magento/community-edition |
Magento Improper Authorization leading to security feature bypass CVE-2025-43585, GHSA-r487-9vv5-75gg | High | 0.5% | 10 Jun, 2025 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento Improper Access Control leads to security feature bypass CVE-2025-27206, GHSA-g2pj-xmxq-3r9q | Medium | 0.5% | 10 Jun, 2025 | Packagist magento/community-edition Packagist magento/project-community-edition |
HAX CMS vulnerable to Local File Inclusion via saveOutline API Location Parameter CVE-2025-49138, GHSA-hxrr-x32w-cg8g | Medium | 0.5% | 09 Jun, 2025 | Packagist elmsln/haxcms |
Hax CMS Stored Cross-Site Scripting vulnerability CVE-2025-49137, GHSA-2vc4-3hx7-v7v7 | High | 0.3% | 09 Jun, 2025 | Packagist elmsln/haxcms |
Laravel Translation Manager Vulnerable to Stored Cross-site Scripting CVE-2025-49130, GHSA-j226-63j7-qrqh | Medium | 0.4% | 09 Jun, 2025 | Packagist barryvdh/laravel-translation-manager |
laravel-auth0 SDK Deserialization of Untrusted Data vulnerability GHSA-c42h-56wx-h85q | Critical | Not scored | 06 Jun, 2025 | Packagist auth0/login |
Auth0 Symfony SDK Deserialization of Untrusted Data vulnerability GHSA-98j6-67v3-mw34 | Critical | Not scored | 06 Jun, 2025 | Packagist auth0/symfony |
Yii 2 Redis may expose AUTH parameters in logs in case of connection failure CVE-2025-48493, GHSA-g3p6-82vc-43jh | Medium | 0.3% | 05 Jun, 2025 | Packagist yiisoft/yii2-redis |
Auth0 Wordpress Plugin vulnerable to Deserialization of Untrusted Data GHSA-862m-5253-832r | Critical | Not scored | 05 Jun, 2025 | Packagist auth0/wordpress |
Auth0-PHP SDK Deserialization of Untrusted Data vulnerability CVE-2025-48951, GHSA-v9m8-9xxp-q492 | Critical | 0.7% | 03 Jun, 2025 | Packagist auth0/auth0-php |
Roundcube Webmail Vulnerable to Authenticated RCE via PHP Object Deserialization CVE-2025-49113, GHSA-8j8w-wwqc-x596 | CriticalExploited | 99.5% | 02 Jun, 2025 | Packagist roundcube/roundcubemail |
juzaweb CMS allows cross-site scripting by uploading an SVG file CVE-2025-5420, GHSA-49rr-34j5-r8mw | Medium | 0.4% | 02 Jun, 2025 | Packagist juzaweb/cms |
PHPOffice Math allows XXE when processing an XML file in the MathML format CVE-2025-48882, GHSA-42hm-pq2f-3r7m | High | 0.5% | 29 May, 2025 | Packagist phpoffice/math |
Mautic has an Open Redirect vulnerability on user unlock path. CVE-2025-5256, GHSA-6vx9-9r2g-8373 | Medium | 0.2% | 28 May, 2025 | Packagist mautic/core |
Mautic segment cloning doesn't have a proper permission check CVE-2024-47055, GHSA-vph5-ghq3-q782 | Medium | 0.3% | 28 May, 2025 | Packagist mautic/core |
Mautic allows user name enumeration due to response time difference on password reset form CVE-2024-47057, GHSA-424x-cxvh-wq9p | Medium | 0.3% | 28 May, 2025 | Packagist mautic/core |
Mautic's Predictable Page Indexing Might Lead to Sensitive Data Exposure CVE-2025-5257, GHSA-cqx4-9vqf-q3m8 | Medium | 0.4% | 28 May, 2025 | Packagist mautic/core |
Mautic does not shield .env files from web traffic CVE-2024-47056, GHSA-h2wg-v8wg-jhxh | Medium | 0.1% | 28 May, 2025 | Packagist mautic/core |
Chrome PHP is missing encoding in `CssSelector` CVE-2025-48883, GHSA-3432-fmrf-7vmh | Medium | 0.5% | 28 May, 2025 | Packagist chrome-php/chrome |
Laravel Rest Api has a Search Validation Bypass CVE-2025-48490, GHSA-69rh-hccr-cxrj | Medium | 0.6% | 27 May, 2025 | Packagist lomkit/laravel-rest-api |
Drupal Lightgallery Cross-site Scripting vulnerability CVE-2025-48447, DRUPAL-CONTRIB-2025-069, GHSA-w5px-5878-m9x4 | High | 0.3% | 21 May, 2025 | Packagist drupal/lightgallery Packagist:https://packages.drupal.org/8 drupal/lightgallery |
Drupal Admin Audit Trail Allocation of Resources Without Limits or Throttling vulnerability CVE-2025-48448, DRUPAL-CONTRIB-2025-068, GHSA-pwj7-5c7c-mwjc | High | 0.3% | 21 May, 2025 | Packagist drupal/admin_audit_trail Packagist:https://packages.drupal.org/8 drupal/admin_audit_trail |
Drupal Commerce Alphabank Redirect Incorrect Authorization vulnerability CVE-2025-48446, DRUPAL-CONTRIB-2025-067, GHSA-48wx-8736-jgx2 | High | 0.3% | 21 May, 2025 | Packagist drupal/commerce_alphabank_redirect Packagist:https://packages.drupal.org/8 drupal/commerce_alphabank_redirect |
Drupal Commerce Eurobank (Redirect) Incorrect Authorization vulnerability CVE-2025-48445, DRUPAL-CONTRIB-2025-066, GHSA-q9h3-r6wr-p3j3 | High | 0.3% | 21 May, 2025 | Packagist drupal/commerce_eurobank_redirect Packagist:https://packages.drupal.org/8 drupal/commerce_eurobank_redirect |
Drupal Quick Node Block Missing Authorization vulnerability CVE-2025-48013, DRUPAL-CONTRIB-2025-065, GHSA-r6xj-43cf-9f88 | Medium | 0.3% | 21 May, 2025 | Packagist drupal/quick_node_block Packagist:https://packages.drupal.org/8 drupal/quick_node_block |
Drupal Quick Node Block Missing Authorization vulnerability CVE-2025-48444, DRUPAL-CONTRIB-2025-064, GHSA-c424-hgg9-9c4w | Medium | 0.3% | 21 May, 2025 | Packagist drupal/quick_node_block Packagist:https://packages.drupal.org/8 drupal/quick_node_block |