Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Moodle's mod_data edit/delete pages pass CSRF token in GET parameter BIT-moodle-2025-3637, CVE-2025-3637, GHSA-9vc3-vm42-fjhm | Low | 0.4% | 25 Apr, 2025 | Packagist moodle/moodle |
Moodle allows IDOR in RSS block, which allows access to additional RSS feeds BIT-moodle-2025-3636, CVE-2025-3636, GHSA-chmf-m33p-ph8m | Medium | 0.3% | 25 Apr, 2025 | Packagist moodle/moodle |
Moodle has a CSRF risk in user tours manager that allows tour duplication BIT-moodle-2025-3635, CVE-2025-3635, GHSA-88xj-97gf-7wpq | Low | 0.2% | 25 Apr, 2025 | Packagist moodle/moodle |
Moodle reveals student identities through assignment submissions search on anonymous submissions BIT-moodle-2025-3628, CVE-2025-3628, GHSA-69m9-rprc-2x7g | Medium | 0.3% | 25 Apr, 2025 | Packagist moodle/moodle |
Moodle makes some user data available before completing second factor with MFA enabled BIT-moodle-2025-3627, CVE-2025-3627, GHSA-x45j-jq9q-gf3q | Medium | 0.3% | 25 Apr, 2025 | Packagist moodle/moodle |
Moodle shows hidden grades to users without permission on some grade reports BIT-moodle-2025-32045, CVE-2025-32045, GHSA-8m7c-hm88-2p97 | Medium | 0.3% | 25 Apr, 2025 | Packagist moodle/moodle |
Moodle allows unauthenticated REST API user data exposure BIT-moodle-2025-32044, CVE-2025-32044, GHSA-345q-9jmq-g9q4 | High | 0.5% | 25 Apr, 2025 | Packagist moodle/moodle |
Craft CMS Allows Remote Code Execution CVE-2025-32432, GHSA-f3gw-9ww9-jmc3 | CriticalExploited | 99.8% | 25 Apr, 2025 | Packagist craftcms/cms |
Moodle self enrollment available before completing second factor with MFA enabled BIT-moodle-2025-3634, CVE-2025-3634, GHSA-qhc7-xhc2-7p7w | Medium | 0.3% | 25 Apr, 2025 | Packagist moodle/moodle |
Laravel Starter Cross Site Scripting (XSS) CVE-2025-26159, GHSA-fpx3-h2pc-88vf | Medium | 0.3% | 22 Apr, 2025 | Packagist nasirkhan/laravel-starter |
croogo Host header injection CVE-2024-29643, GHSA-847x-x4jg-6gf4 | Critical | 0.6% | 18 Apr, 2025 | Packagist croogo/croogo |
PEAR HTTP_Request2 vulnerable to Cross-site Scripting CVE-2025-43717, GHSA-w7gh-f2fm-9q8r | Medium | 0.3% | 17 Apr, 2025 | Packagist pear/http_request2 |
DevDojo Voyager Argument Injection vulnerability CVE-2025-32931, GHSA-qq2h-m2hj-hrff | Critical | 0.6% | 14 Apr, 2025 | Packagist tcg/voyager |
Formie has XSS vulnerability for importing forms CVE-2025-32427, GHSA-p9hh-mh5x-wvx3 | Medium | 0.2% | 11 Apr, 2025 | Packagist verbb/formie |
Formie has XSS vulnerability for email notification content for preview CVE-2025-32426, GHSA-2xm2-23ff-p8ww | Medium | 0.2% | 11 Apr, 2025 | Packagist verbb/formie |
Silverstripe Framework user enumeration via timing attack on login and password reset forms GHSA-256q-hx8w-xcqx | Medium | Not scored | 10 Apr, 2025 | Packagist silverstripe/framework |
Yii does not prevent XSS in scenarios where fallback error renderer is used CVE-2025-32027, GHSA-7r2v-8wxr-3ch5 | Medium | 0.2% | 10 Apr, 2025 | Packagist yiisoft/yii |
Silverstripe Framework has a XSS vulnerability in HTML editor CVE-2025-30148, GHSA-rhx4-hvx9-j387 | Medium | 0.3% | 10 Apr, 2025 | Packagist silverstripe/framework |
Silverstripe cross-site scripting (XSS) attack in elemental "Content blocks in use" report CVE-2025-25197, GHSA-x8xm-c7p8-2pj2 | Medium | 0.3% | 10 Apr, 2025 | Packagist dnadesign/silverstripe-elemental |
ibexa/fieldtype-richtext allows access to external entities in XML GHSA-cj3w-g42v-wcj6 | High | Not scored | 10 Apr, 2025 | Packagist ibexa/fieldtype-richtext |
ezsystems/ezplatform-richtext allows access to external entities in XML GHSA-2jqj-5qv2-xvcg | High | Not scored | 10 Apr, 2025 | Packagist ezsystems/ezplatform-richtext |
yiisoft/yii2 Mishandles the Attaching of Behavior Defined by a `__class` Array Key CVE-2024-58136, GHSA-ggwg-cmwp-46r5 | CriticalExploited | 87.8% | 10 Apr, 2025 | Packagist yiisoft/yii2 |
Shopware default newsletter opt-in settings allow for mass sign-up abuse CVE-2025-32378, GHSA-4h9w-7vfp-px8m | Medium | 0.3% | 09 Apr, 2025 | Packagist shopware/core Packagist shopware/platform |
wallabag/wallabag Has Multiple Cross-Site Request Forgery (CSRF) Vulnerabilities GHSA-5pm7-cp8f-p2c2 | Medium | Not scored | 09 Apr, 2025 | Packagist wallabag/wallabag |
Magento does not properly protect credentials CVE-2025-27192, GHSA-2r94-wm5v-4prx | Low | 0.5% | 08 Apr, 2025 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento Improper Access Control leads to Security feature bypass CVE-2025-27191, GHSA-vhcq-4xrm-2cr2 | Medium | 0.5% | 08 Apr, 2025 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento Improper Access Control leads to Security feature bypass CVE-2025-27190, GHSA-6wq7-cg9h-mj6q | Medium | 0.5% | 08 Apr, 2025 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento Improper Authorization vulnerability CVE-2025-27188, GHSA-rr2g-rrjj-xw86 | Medium | 0.6% | 08 Apr, 2025 | Packagist magento/community-edition |
RoadRunner is at risk of HTTP Request/Response Smuggling through vulnerable dependency BIT-golang-2025-22871, CVE-2025-22871, GHSA-g9pc-8g42-g6vq, GO-2025-3563 | Critical | 0.8% | 08 Apr, 2025 | Packagist spiral/roadrunner |
Joomla CMS Multi-Factor Authentication Bypass BIT-joomla-2025-25227, CVE-2025-25227, GHSA-6423-85cc-8gf6 | High | 0.4% | 08 Apr, 2025 | Packagist joomla/joomla-cms |
Joomla Framework Database Package Vulnerable to SQL Injection BIT-joomla-2025-25226, CVE-2025-25226, GHSA-44v2-prcf-pc3m | Critical | 0.5% | 08 Apr, 2025 | Packagist joomla/database |
Shopware Broken ACL on Document retrieval to access other customers documents GHSA-68wv-g3fw-pq7q | Medium | Not scored | 08 Apr, 2025 | Packagist shopware/core Packagist shopware/platform |
Shopware Vulnerable to Blind SQL-injection in DAL aggregations CVE-2025-27892, GHSA-8g35-7rmw-7f59 | High | 12.9% | 08 Apr, 2025 | Packagist shopware/core Packagist shopware/platform |
Shopware allows Denial Of Service via password length CVE-2025-30151, GHSA-cgfj-hj93-rmh2 | High | 0.4% | 08 Apr, 2025 | Packagist shopware/core Packagist shopware/platform |
Shopware 6 allows attackers to check for registered accounts through the store-api CVE-2025-30150, GHSA-hh7j-6x3q-f52h | Medium | 0.4% | 08 Apr, 2025 | Packagist shopware/core Packagist shopware/platform |
Pimcore's Admin Classic Bundle allows HTML Injection CVE-2025-30166, GHSA-x82r-6j37-vrgg | Low | 0.3% | 08 Apr, 2025 | Packagist pimcore/admin-ui-classic-bundle |
Browsershot Server-Side Request Forgery (SSRF) via setURL() Function CVE-2025-3192, GHSA-qw64-6vcc-8ghx | High | 0.4% | 04 Apr, 2025 | Packagist spatie/browsershot |
GraphQL grant on a property might be cached with different objects CVE-2025-31485, GHSA-428q-q3vv-3fq3 | High | 0.6% | 03 Apr, 2025 | Packagist api-platform/core Packagist api-platform/graphql |
GraphQL query operations security can be bypassed CVE-2025-31481, GHSA-cg3c-245w-728m | High | 0.5% | 03 Apr, 2025 | Packagist api-platform/core Packagist api-platform/graphql |
API Platform Core can leak exceptions message that may contain sensitive information CVE-2023-47639, GHSA-rfw5-cqjj-7v9r | Medium | 0.4% | 03 Apr, 2025 | Packagist api-platform/core |
Concrete CMS Vulnerable to Cross-Site Request Forgery (CSRF) and Cross-Site Scripting (XSS) CVE-2025-3153, GHSA-cmm4-p9v2-q453 | Medium | 0.2% | 03 Apr, 2025 | Packagist concrete5/concrete5 |
Drupal Obfuscate Vulnerable to Stored Cross-Site Scripting (XSS) CVE-2025-3130, DRUPAL-CONTRIB-2025-029, GHSA-hphm-3x7f-g875 | Medium | 0.2% | 02 Apr, 2025 | Packagist drupal/obfuscate Packagist:https://packages.drupal.org/8 drupal/obfuscate |
Yeswiki Path Traversal vulnerability allows arbitrary read of files CVE-2025-31131, GHSA-w34w-fvp3-68xm | High | 5.6% | 01 Apr, 2025 | Packagist yeswiki/yeswiki |
ConcreteCMS Cross-Site Scripting (XSS) via HTML Block Text Field CVE-2025-2967, GHSA-xfqf-5rhg-5c73 | Medium | Not scored | 31 Mar, 2025 | Packagist concrete5/concrete5 |
ShopXO Vulnerable to Server-Side Request Forgery (SSRF) and Cross-Site Scripting (XSS) CVE-2025-28094, GHSA-24cf-848g-762c | Medium | 0.2% | 28 Mar, 2025 | Packagist shopxo/shopxo |
ShopXO Vulnerable to Server-Side Request Forgery (SSRF) via Email Settings CVE-2025-28093, GHSA-gfhv-5rqh-7qx3 | Medium | 0.3% | 28 Mar, 2025 | Packagist shopxo/shopxo |
ShopXO Vulnerable to Server-Side Request Forgery (SSRF) via Image Upload CVE-2025-28092, GHSA-p736-g6pg-hjhw | Medium | 0.3% | 28 Mar, 2025 | Packagist shopxo/shopxo |
wp-svg-upload WordPress plugin vulnerable to Stored Cross-site Scripting CVE-2024-11847, GHSA-v2rr-fhv8-mx74 | Medium | 0.3% | 26 Mar, 2025 | Packagist digimix/wp-svg-upload |
Pixelfed may allow unauthorized actor to view private posts and private users CVE-2025-30741, GHSA-7287-grhx-542x | Medium | 0.3% | 25 Mar, 2025 | Packagist pixelfed/pixelfed |
API Platform Core does not call GraphQl securityAfterResolver CVE-2025-23204, GHSA-7mxx-3cgm-xxv3 | Medium | 0.3% | 24 Mar, 2025 | Packagist api-platform/core |