Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
yiisoft Yii2 Deserialization of Untrusted Data CVE-2025-2689, GHSA-88m2-j94x-v4fx | Medium | 0.6% | 24 Mar, 2025 | Packagist yiisoft/yii2-dev |
Drupal Core Cross-Site Scripting (XSS) Vulnerability BIT-drupal-2025-31675, CVE-2025-31675, DRUPAL-CORE-2025-004, GHSA-m4wj-hhwj-47qp | Medium | 0.5% | 19 Mar, 2025 | Packagist drupal/core |
Drupal Formatter Suite Vulnerable to Cross-Site Scripting (XSS) via Link Element Attributes CVE-2025-31697, DRUPAL-CONTRIB-2025-026, GHSA-5r66-vgc7-2mm3 | Medium | 0.3% | 19 Mar, 2025 | Packagist drupal/formatter_suite Packagist:https://packages.drupal.org/8 drupal/formatter_suite |
Drupal RapiDoc OAS Field Formatter Cross-Site Scripting (XSS) vulnerability CVE-2025-31696, DRUPAL-CONTRIB-2025-025, GHSA-86h4-w859-3hhv | Medium | 0.3% | 19 Mar, 2025 | Packagist drupal/rapidoc_elements_field_formatter Packagist:https://packages.drupal.org/8 drupal/rapidoc_elements_field_formatter |
Drupal Link field display mode formatter Cross-Site Scripting (XSS) vulnerability CVE-2025-31695, DRUPAL-CONTRIB-2025-024, GHSA-p2wg-8h29-874v | Medium | 0.3% | 19 Mar, 2025 | Packagist drupal/link_field_display_mode_formatter Packagist:https://packages.drupal.org/8 drupal/link_field_display_mode_formatter |
Sylius PayPal Plugin has an Order Manipulation Vulnerability after PayPal Checkout CVE-2025-30152, GHSA-hxg4-65p5-9w37 | Medium | 0.4% | 19 Mar, 2025 | Packagist sylius/paypal-plugin |
Clickstorm SEO Allows Cross-Site Scripting (XSS) CVE-2025-30081, GHSA-vmgw-24w6-9v82 | Medium | Not scored | 19 Mar, 2025 | Packagist clickstorm/cs-seo |
Additional TCA Allows Cross-Site Scripting (XSS) CVE-2025-30083, GHSA-rrh3-cgmx-w62f | Medium | Not scored | 19 Mar, 2025 | Packagist codingms/additional-tca |
Contao Vulnerable to Cross-Site Scripting (XSS) through SVG uploads CVE-2025-29790, GHSA-vqqr-fgmh-f626 | Medium | 0.2% | 18 Mar, 2025 | Packagist contao/core-bundle |
TastyIgniter Has an Incorrect Access Control Vulnerability CVE-2024-44314, GHSA-w5h7-mw56-4v7x | Medium | 0.3% | 18 Mar, 2025 | Packagist tastyigniter/tastyigniter |
TastyIgniter Has an Incorrect Access Control Vulnerability via `invoice()` Function CVE-2024-44313, GHSA-gg2f-r4jh-vpmh | High | 0.7% | 18 Mar, 2025 | Packagist tastyigniter/tastyigniter |
Sylius PayPal Plugin Payment Amount Manipulation Vulnerability CVE-2025-29788, GHSA-pqq3-q84h-pj6x | Medium | 0.5% | 17 Mar, 2025 | Packagist sylius/paypal-plugin |
MODX allows cross-site scripting (XSS) via an SVG file CVE-2025-28010, GHSA-hm54-fg2w-2g6j | Medium | 0.3% | 13 Mar, 2025 | Packagist modx/revolution |
laravel-crud-wizard-free has File Validation Bypass GHSA-3wgq-h4fr-cwg5 | Medium | Not scored | 12 Mar, 2025 | Packagist macropay-solutions/laravel-crud-wizard-free |
Flarum Vulnerable to Session Hijacking via Authoritative Subdomain Cookie Overwrite CVE-2025-27794, GHSA-hg9j-64wp-m9px | Medium | 0.5% | 12 Mar, 2025 | Packagist flarum/core Packagist flarum/framework |
Microweber vulnerable to XSS attack due to insure `group` component in its Settings handler CVE-2025-2214, GHSA-hcgh-r5gq-6qc2 | Medium | 0.5% | 12 Mar, 2025 | Packagist microweber/microweber |
Froxlor has an HTML Injection Vulnerability CVE-2025-48958, GHSA-26xq-m8xw-6373 | Medium | 0.4% | 11 Mar, 2025 | Packagist froxlor/froxlor |
Froxlor allows Multiple Accounts to Share the Same Email Address Leading to Potential Privilege Escalation or Account Takeover CVE-2025-29773, GHSA-7j6w-p859-464f | High | 0.3% | 11 Mar, 2025 | Packagist froxlor/froxlor |
The SimpleSAMLphp SAML2 library incorrectly verifies signatures for HTTP-Redirect binding CVE-2025-27773, GHSA-46r4-f8gj-xg56 | High | 0.4% | 11 Mar, 2025 | Packagist simplesamlphp/saml2 Packagist simplesamlphp/saml2-legacy |
Pimcore Vulnerable to SQL Injection in getRelationFilterCondition CVE-2025-27617, GHSA-qjpx-5m2p-5pgh | Medium | 0.5% | 11 Mar, 2025 | Packagist pimcore/pimcore |
Concrete CMS affected by a stored XSS in Folder Function.The "Add Folder" functionality CVE-2025-0660, GHSA-pvmx-mjmh-jfcx | Medium | 0.3% | 10 Mar, 2025 | Packagist concrete5/concrete5 |
PocketMine-MP allows malicious client data to waste server resources due to lack of limits for explode() CVE-2025-71418, GHSA-g274-c6jj-h78p | Medium | 0.5% | 10 Mar, 2025 | Packagist pocketmine/pocketmine-mp |
Laravel framework susceptible to reflected cross-site scripting CVE-2024-13919, GHSA-83wp-f5c3-hqqr | Medium | 0.5% | 10 Mar, 2025 | Packagist laravel/framework |
Laravel framework susceptible to reflected cross-site scripting CVE-2024-13918, GHSA-546h-56qp-8jmw | Medium | 0.6% | 10 Mar, 2025 | Packagist laravel/framework |
GeSHi XSS possible in the get_var function of /contrib/cssgen.php CVE-2025-2123, GHSA-pr6q-g5gv-qgr7 | Medium | 0.5% | 09 Mar, 2025 | Packagist geshi/geshi |
Volt Allows RCE Via User-Crafted Requests CVE-2025-27517, GHSA-v69f-5jxm-hwvv | Critical | 0.6% | 05 Mar, 2025 | Packagist livewire/volt |
Laravel has a File Validation Bypass BIT-laravel-2025-27515, CVE-2025-27515, GHSA-78fx-h6xr-vch4 | Medium | 0.7% | 05 Mar, 2025 | Packagist laravel/framework |
Drupal Two-factor Authentication (TFA) Vulnerable to Forceful Browsing CVE-2025-31694, DRUPAL-CONTRIB-2025-023, GHSA-hf6c-fgp3-jfch | High | 0.4% | 05 Mar, 2025 | Packagist drupal/tfa Packagist:https://packages.drupal.org/8 drupal/tfa |
Drupal AI Vulnerable to OS Command Injection CVE-2025-31693, DRUPAL-CONTRIB-2025-022, GHSA-vx9m-rfxq-gr74 | Medium | 0.8% | 05 Mar, 2025 | Packagist drupal/ai Packagist:https://packages.drupal.org/8 drupal/ai |
Drupal AI Vulnerable to OS Command Injection via Optional Automator Types CVE-2025-31692, DRUPAL-CONTRIB-2025-021, GHSA-pwjq-fx3v-8f9r | High | 0.8% | 05 Mar, 2025 | Packagist drupal/ai Packagist:https://packages.drupal.org/8 drupal/ai |
REDAXO allows Authenticated Reflected Cross Site Scripting - packages installation CVE-2025-27412, GHSA-8366-xmgf-334f | Medium | 0.3% | 05 Mar, 2025 | Packagist redaxo/source |
REDAXO allows Arbitrary File Upload in the mediapool page CVE-2025-27411, GHSA-wppf-gqj5-fc4f | Medium | 0.3% | 05 Mar, 2025 | Packagist redaxo/source |
Formwork improperly validates input of User role preventing site and panel availability GHSA-c85w-x26q-ch87 | High | Not scored | 01 Mar, 2025 | Packagist getformwork/formwork |
Formwork has a cross-site scripting (XSS) vulnerability in Site title GHSA-vf6x-59hh-332f | Medium | Not scored | 01 Mar, 2025 | Packagist getformwork/formwork |
Magento LTS vulnerable to stored XSS in theme config fields CVE-2025-27400, GHSA-5pxh-89cx-4668 | Low | 0.3% | 28 Feb, 2025 | Packagist openmage/magento-lts |
Drupal OAuth2 Server Missing Authorization vulnerability CVE-2025-31691, DRUPAL-CONTRIB-2025-020, GHSA-4f8q-mwgc-3mwc | Critical | 0.4% | 26 Feb, 2025 | Packagist drupal/oauth2_server Packagist:https://packages.drupal.org/8 drupal/oauth2_server |
Drupal Cache Utility Cross-Site Request Forgery (CSRF) vulnerability CVE-2025-31690, DRUPAL-CONTRIB-2025-019, GHSA-ccc9-jgj7-hxc7 | High | 0.2% | 26 Feb, 2025 | Packagist drupal/cache_utility Packagist:https://packages.drupal.org/8 drupal/cache_utility |
Drupal General Data Protection Regulation Cross-Site Request Forgery (CSRF) vulnerability CVE-2025-31689, DRUPAL-CONTRIB-2025-018, GHSA-jv6r-mj9p-9xff | High | 0.2% | 26 Feb, 2025 | Packagist drupal/gdpr Packagist:https://packages.drupal.org/8 drupal/gdpr |
Mautic allows Improper Authorization in Reporting API CVE-2024-47053, GHSA-8xv7-g2q3-fqgc | High | 0.7% | 26 Feb, 2025 | Packagist mautic/core |
Mautic allows Remote Code Execution and File Deletion in Asset Uploads CVE-2024-47051, GHSA-73gx-x7r9-77x2 | Critical | 1.8% | 26 Feb, 2025 | Packagist mautic/core |
Mautic allows Relative Path Traversal in assets file upload CVE-2022-25773, GHSA-4w2w-36vm-c8hf | Medium | 0.6% | 26 Feb, 2025 | Packagist mautic/core |
Moodle has a SQL injection risk in course search module list filter BIT-moodle-2025-26533, CVE-2025-26533, GHSA-rg56-94j7-hjx9 | Critical | 0.6% | 24 Feb, 2025 | Packagist moodle/moodle |
Moodle allows teachers to evade trusttext config when restoring glossary entries BIT-moodle-2025-26532, CVE-2025-26532, GHSA-cw24-f6fq-7j9v | Medium | 0.3% | 24 Feb, 2025 | Packagist moodle/moodle |
Moodle has an IDOR in badges allows disabling of arbitrary badges BIT-moodle-2025-26531, CVE-2025-26531, GHSA-g88w-v4cq-qgcp | Medium | 0.3% | 24 Feb, 2025 | Packagist moodle/moodle |
Moodle allows reflected XSS via question bank filter BIT-moodle-2025-26530, CVE-2025-26530, GHSA-4w32-c9g7-27qx | High | 0.4% | 24 Feb, 2025 | Packagist moodle/moodle |
Moodle has a stored XSS risk in admin live log BIT-moodle-2025-26529, CVE-2025-26529, GHSA-wr88-x8cm-7cgq | High | 0.5% | 24 Feb, 2025 | Packagist moodle/moodle |
Moodle has a stored XSS in ddimageortext question type BIT-moodle-2025-26528, CVE-2025-26528, GHSA-h697-w4ph-7pcx | Medium | 0.3% | 24 Feb, 2025 | Packagist moodle/moodle |
Moodle's non-searchable tags can still be discovered on the tag search page and in the tags block BIT-moodle-2025-26527, CVE-2025-26527, GHSA-5r85-6h7f-rg3r | Medium | 0.4% | 24 Feb, 2025 | Packagist moodle/moodle |
Moodle's feedback response viewing and deletions did not respect Separate Groups mode BIT-moodle-2025-26526, CVE-2025-26526, GHSA-pxg4-xjp7-w9c5 | Medium | 0.3% | 24 Feb, 2025 | Packagist moodle/moodle |
Moodle has an arbitrary file read risk through pdfTeX BIT-moodle-2025-26525, CVE-2025-26525, GHSA-4hmr-39vp-xfrr | High | 0.4% | 24 Feb, 2025 | Packagist moodle/moodle |