Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
reint_downloadmanager TYPO3 Extension is susceptible to Insecure Direct Object Reference CVE-2025-48207, GHSA-jjwh-4x89-7f5w | High | 0.4% | 21 May, 2025 | Packagist renolit/reint-downloadmanager |
The Backup Plus extension for TYPO3 (ns_backup) allows XSS CVE-2025-48206, GHSA-xg53-mhh9-3cq7 | Medium | 0.2% | 21 May, 2025 | Packagist nitsan/ns-backup |
The Front End User Registration extension for TYPO3 (sr_feuser_register) allows Insecure Direct Object Reference CVE-2025-48205, GHSA-cvgc-mx2w-h3w8 | High | 0.4% | 21 May, 2025 | Packagist sjbr/sr-feuser-register |
The Backup Plus extension for TYPO3 (ns_backup) allows command injections CVE-2025-48204, GHSA-463c-jhp2-4mm7 | Medium | 0.8% | 21 May, 2025 | Packagist nitsan/ns-backup |
[clickstorm] SEO (cs_seo) TYPO3 extension Cross-site Scripting (XSS) vulnerability CVE-2025-48203, GHSA-6p8w-pc35-mqv8 | Medium | 0.2% | 21 May, 2025 | Packagist clickstorm/cs-seo |
The femanager TYPO3 extension allows Insecure Direct Object Reference CVE-2025-48202, GHSA-xxwr-wv9g-7jw3 | Medium | 0.3% | 21 May, 2025 | Packagist in2code/femanager |
The Backup Plus extension for TYPO3 (ns_backup) has a Predictable Resource Location CVE-2025-48201, GHSA-hq4f-5qjv-fwrg | High | 0.4% | 21 May, 2025 | Packagist nitsan/ns-backup |
The Front End User Registration extension for TYPO3 (sr_feuser_register) Remote Code Execution CVE-2025-48200, GHSA-qfm8-78qf-p75j | Critical | 0.9% | 21 May, 2025 | Packagist sjbr/sr-feuser-register |
The TYPO3 CMS Backend has Broken Authentication in Backend MFA CVE-2025-47941, GHSA-744g-7qm9-hjh9 | High | 0.5% | 20 May, 2025 | Packagist typo3/cms-backend |
TYPO3 Allows Privilege Escalation to System Maintainer CVE-2025-47940, GHSA-6frx-j292-c844 | High | 0.5% | 20 May, 2025 | Packagist typo3/cms-core |
TYPO3 Allows Unrestricted File Upload in File Abstraction Layer CVE-2025-47939, GHSA-9hq9-cr36-4wpj | Medium | 0.2% | 20 May, 2025 | Packagist typo3/cms-core |
TYPO3 Unverified Password Change for Backend Users CVE-2025-47938, GHSA-3jrg-97f3-rqh9 | Low | 0.3% | 20 May, 2025 | Packagist typo3/cms-core Packagist typo3/cms-setup |
TYPO3 Allows Information Disclosure via DBAL Restriction Handling CVE-2025-47937, GHSA-x8pv-fgxp-8v3x | Medium | 0.3% | 20 May, 2025 | Packagist typo3/cms-core |
TYPO3 CMS Webhooks Server Side Request Forgery CVE-2025-47936, GHSA-p4xx-m758-3hpx | Medium | 0.3% | 20 May, 2025 | Packagist typo3/cms-webhooks |
Symfony UX allows unsanitized HTML attribute injection via ComponentAttributes CVE-2025-47946, GHSA-5j3w-5pcr-f8hg | Medium | 0.3% | 19 May, 2025 | Packagist symfony/ux-live-component Packagist symfony/ux-twig-component |
LibreNMS stored Cross-site Scripting vulnerability in poller group name CVE-2025-47931, GHSA-hxw5-9cc5-cmw5 | Low | 10.1% | 17 May, 2025 | Packagist librenms/librenms |
laravel-auth0 SDK Vulnerable to Brute Force Authentication Tags of CookieStore Sessions GHSA-9fwj-9mjf-rhj3 | Critical | Not scored | 17 May, 2025 | Packagist auth0/login |
Auth0 Wordpress plugin Vulnerable to Brute Force Authentication Tags of CookieStore Sessions GHSA-2f4r-34m4-3w8q | Critical | Not scored | 17 May, 2025 | Packagist auth0/wordpress |
Auth0 Symfony SDK Vulnerable to Brute Force Authentication Tags of CookieStore Sessions GHSA-9wg9-93h9-j8ch | Critical | Not scored | 17 May, 2025 | Packagist auth0/symfony |
Brute Force Authentication Tags of CookieStore Sessions in Auth0-PHP SDK CVE-2025-47275, GHSA-g98g-r7gf-2r25 | Critical | 0.5% | 15 May, 2025 | Packagist auth0/auth0-php |
tarteaucitron-wp WordPress Plugin Vulnerable to Stored Cross-Site Scripting CVE-2024-11718, GHSA-fxpc-qmrh-7j2h | Medium | 0.3% | 15 May, 2025 | Packagist couleurcitron/tarteaucitron-wp |
Sulu vulnerable to XXE in SVG File upload Inspector CVE-2025-47778, GHSA-f6rx-hf55-4255 | Medium | 0.5% | 14 May, 2025 | Packagist sulu/sulu |
Kirby vulnerable to path traversal of collection names during file system lookup CVE-2025-31493, GHSA-x275-h9j4-7p4h | Medium | 0.6% | 13 May, 2025 | Packagist getkirby/cms |
Kirby vulnerable to path traversal in the router for PHP's built-in server CVE-2025-30207, GHSA-9p3p-w5jf-8xxg | Low | 0.6% | 13 May, 2025 | Packagist getkirby/cms |
OXID eShop May Display User Information CVE-2024-56526, GHSA-qqcr-9jfc-35c4 | High | 0.4% | 13 May, 2025 | Packagist oxid-esales/oxideshop-ce Packagist oxid-esales/oxideshop-metapackage-ce Packagist oxid-esales/smarty-component |
Kirby vulnerable to path traversal of snippet names in the `snippet()` helper CVE-2025-30159, GHSA-fw82-87p8-v6hp | Medium | 0.7% | 13 May, 2025 | Packagist getkirby/kirby |
Craft CMS stores arbitrary content provided by unauthenticated users in session files CVE-2025-35939, GHSA-7vrx-9684-xrf2 | MediumExploited | 1.3% | 07 May, 2025 | Packagist craftcms/cms |
Koillection Cross Site Scripting vulnerability CVE-2025-29746, GHSA-fxvx-gfmr-5xfj | Medium | 0.3% | 07 May, 2025 | Packagist koillection/koillection |
Easy!Appointments Denial of Service (DoS) CVE-2025-29448, GHSA-hcjv-982c-5f29 | High | 0.6% | 07 May, 2025 | Packagist alextselegidis/easyappointments |
league/commonmark contains a XSS vulnerability in Attributes extension CVE-2025-46734, GHSA-3527-qv2q-pfvx | Medium | 0.4% | 05 May, 2025 | Packagist league/commonmark |
Craft CMS Contains a Potential Remote Code Execution Vulnerability via Twig SSTI CVE-2025-46731, GHSA-7c58-g782-9j38 | High | 1.5% | 05 May, 2025 | Packagist craftcms/cms |
October CMS Allows Unprotected SVG Rename in Media Manager CVE-2024-51991, GHSA-96hh-8hx5-cpw7 | Low | 0.4% | 05 May, 2025 | Packagist october/october Packagist october/system |
Grokability Snipe-IT has incorrect authorization for accessing asset information CVE-2025-47226, GHSA-h3vp-qwmx-5j25 | Medium | 1.3% | 02 May, 2025 | Packagist snipe/snipe-it |
SQL injection in ADOdb PostgreSQL driver pg_insert_id() method CVE-2025-46337, GHSA-8x27-jwjr-8545 | Critical | 0.7% | 01 May, 2025 | Packagist adodb/adodb-php |
ShowDoc unrestricted file upload vulnerability CVE-2025-0520, GHSA-6jmr-r7p6-f5wr | Critical | 2.4% | 29 Apr, 2025 | Packagist showdoc/showdoc |
YesWiki Stored XSS Vulnerability in Comments CVE-2025-46346, GHSA-59x8-cvxh-3mm4 | Medium | 0.4% | 29 Apr, 2025 | Packagist yeswiki/yeswiki |
YesWiki Remote Code Execution via Arbitrary PHP File Write and Execution CVE-2025-46347, GHSA-88xg-v53p-fpvf | High | 1.0% | 29 Apr, 2025 | Packagist yeswiki/yeswiki |
YesWiki Vulnerable to Unauthenticated Site Backup Creation and Download CVE-2025-46348, GHSA-wc9g-6j9w-hr95 | Critical | 0.7% | 29 Apr, 2025 | Packagist yeswiki/yeswiki |
YesWiki Vulnerable to Unauthenticated Reflected Cross-site Scripting CVE-2025-46349, GHSA-2f8p-qqx2-gwr2 | High | 0.6% | 29 Apr, 2025 | Packagist yeswiki/yeswiki |
Yeswiki Vulnerable to Authenticated Reflected Cross-site Scripting CVE-2025-46350, GHSA-cg4f-cq8h-3ch8 | Medium | 0.3% | 29 Apr, 2025 | Packagist yeswiki/yeswiki |
Yeswiki Vulnerable to Unauthenticated Reflected Cross-site Scripting CVE-2025-46550, GHSA-ggqx-43h2-55jp | Medium | 0.6% | 29 Apr, 2025 | Packagist yeswiki/yeswiki |
Yeswiki Vulnerable to Unauthenticated Reflected Cross-site Scripting CVE-2025-46549, GHSA-r9gv-qffm-xw6f | Medium | 0.6% | 29 Apr, 2025 | Packagist yeswiki/yeswiki |
Moodle allows IDOR when accessing the cohorts report BIT-moodle-2025-3647, CVE-2025-3647, GHSA-34g7-pg9j-pxgp | Medium | 0.3% | 25 Apr, 2025 | Packagist moodle/moodle |
Moodle has an IDOR in messaging web service which allows access to some user details BIT-moodle-2025-3645, CVE-2025-3645, GHSA-pj96-xh2w-fgqx | Medium | 0.4% | 25 Apr, 2025 | Packagist moodle/moodle |
Moodle's AJAX section delete does not respect course_can_delete_section() BIT-moodle-2025-3644, CVE-2025-3644, GHSA-cpm7-mv33-jwf8 | Medium | 0.3% | 25 Apr, 2025 | Packagist moodle/moodle |
Moodle has reflected Cross-site Scripting risk in policy tool BIT-moodle-2025-3643, CVE-2025-3643, GHSA-hxgg-4qww-85ph | Medium | 0.3% | 25 Apr, 2025 | Packagist moodle/moodle |
Moodle has an authenticated remote code execution risk in the Moodle LMS EQUELLA repository BIT-moodle-2025-3642, CVE-2025-3642, GHSA-m367-445c-2xqr | High | 1.1% | 25 Apr, 2025 | Packagist moodle/moodle |
Moodle has an authenticated remote code execution risk in the Moodle LMS Dropbox repository BIT-moodle-2025-3641, CVE-2025-3641, GHSA-c8v6-vxhf-wcrr | High | 1.0% | 25 Apr, 2025 | Packagist moodle/moodle |
Moodle has an IDOR in web service which allows users enrolled in a course to access some details of other users BIT-moodle-2025-3640, CVE-2025-3640, GHSA-6g5x-h5x7-q4mq | Medium | 0.4% | 25 Apr, 2025 | Packagist moodle/moodle |
Moodle has a CSRF risk in Brickfield tool's analysis request action BIT-moodle-2025-3638, CVE-2025-3638, GHSA-m8qh-hx4c-h9hr | High | 0.3% | 25 Apr, 2025 | Packagist moodle/moodle |