Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Leantime allows Cross-Site Scripting (XSS) GHSA-f679-254h-qhvj | Low | Not scored | 21 Feb, 2025 | Packagist leantime/leantime |
Leantime affected by Improper Neutralization of HTML Tags CVE-2025-28254, GHSA-95j3-435g-vjcp | Medium | 0.3% | 21 Feb, 2025 | Packagist leantime/leantime |
Leantime has Missing Authorization Check for Host Parameter GHSA-3hfj-qcvj-4hx8 | Low | Not scored | 21 Feb, 2025 | Packagist leantime/leantime |
Leantime allows Stored Cross-Site Scripting (XSS) GHSA-c39w-3pjx-qc7m | High | Not scored | 21 Feb, 2025 | Packagist leantime/leantime |
Leantime allows Cross-Site Request Forgery (CSRF) GHSA-92xh-6x7v-4rmq | Medium | Not scored | 21 Feb, 2025 | Packagist leantime/leantime |
Leantime allows Cross Site Scripting (XSS) and SQL Injection (SQLi) GHSA-v4q9-437p-mhpg | High | Not scored | 21 Feb, 2025 | Packagist leantime/leantime |
Leantime allows Stored Cross-Site Scripting (XSS) GHSA-63cr-xg3f-8jvr | Medium | Not scored | 21 Feb, 2025 | Packagist leantime/leantime |
Leantime allows Refelected Cross-Site Scripting (XSS) GHSA-52xf-h226-pfgx | Medium | Not scored | 21 Feb, 2025 | Packagist leantime/leantime |
Leantime has Insufficiently Protected Credentials GHSA-h6w8-27ph-c385 | Medium | Not scored | 21 Feb, 2025 | Packagist leantime/leantime |
Leantime allows Stored Cross-Site Scripting (XSS) GHSA-mg4c-884j-pcq9 | Medium | Not scored | 21 Feb, 2025 | Packagist leantime/leantime |
Leantime has Host Header Injection Vulnerability GHSA-99r5-84gr-59f6 | Medium | Not scored | 21 Feb, 2025 | Packagist leantime/leantime |
Drupal Core Improperly Controlled Modification of Dynamically-Determined Object Attributes Vulnerability BIT-drupal-2025-31674, CVE-2025-31674, DRUPAL-CORE-2025-003, GHSA-2qph-q8xw-gv7q | High | 0.6% | 19 Feb, 2025 | Packagist drupal/core |
Drupal Core Vulnerable to Forceful Browsing BIT-drupal-2025-31673, CVE-2025-31673, DRUPAL-CORE-2025-002, GHSA-wpp8-fjgf-pwc7 | Medium | 0.3% | 19 Feb, 2025 | Packagist drupal/core |
Drupal Core Potential Cross-Site Scripting (XSS) via Error Messages BIT-drupal-2025-3057, CVE-2025-3057, DRUPAL-CORE-2025-001, GHSA-39g6-x4x8-5jcm | Medium | 0.3% | 19 Feb, 2025 | Packagist drupal/core |
Easy!Appointments Improper Restriction of Excessive Authentication Attempts CVE-2024-57602, GHSA-8fc2-fhh6-f6m5 | Critical | 0.8% | 12 Feb, 2025 | Packagist alextselegidis/easyappointments |
Remote code execution in alextselegidis/easyappointments CVE-2024-57601, GHSA-3wf7-83q3-948c | Medium | 0.5% | 12 Feb, 2025 | Packagist alextselegidis/easyappointments |
Crayfish Allows Remote Code Execution via hypercube X-Islandora-Args Header GHSA-c2p2-hgjg-9r3f | Critical | Not scored | 12 Feb, 2025 | Packagist islandora/crayfish |
Drupal Configuration Split Cross-Site Request Forgery (CSRF) vulnerability CVE-2025-31688, DRUPAL-CONTRIB-2025-017, GHSA-qq45-cqhg-jwx5 | Medium | 0.2% | 12 Feb, 2025 | Packagist drupal/config_split Packagist:https://packages.drupal.org/8 drupal/config_split |
Drupal SpamSpan Cross-Site Scripting (XSS) vulnerability CVE-2025-31687, DRUPAL-CONTRIB-2025-016, GHSA-8r2q-865v-wm8j | Medium | 0.3% | 12 Feb, 2025 | Packagist drupal/spamspan Packagist:https://packages.drupal.org/8 drupal/spamspan |
Drupal Open Social Missing Authorization vulnerability CVE-2025-31686, DRUPAL-CONTRIB-2025-015, GHSA-m9w8-wxvp-c9gv | High | 0.4% | 12 Feb, 2025 | Packagist goalgorilla/open_social Packagist:https://packages.drupal.org/8 drupal/social |
Drupal Open Social Missing Authorization vulnerability CVE-2025-31685, DRUPAL-CONTRIB-2025-014, GHSA-gf72-h4cp-wcm4 | Critical | 0.4% | 12 Feb, 2025 | Packagist goalgorilla/open_social Packagist:https://packages.drupal.org/8 drupal/social |
Magento stored Cross-Site Scripting (XSS) vulnerability CVE-2025-24438, GHSA-8884-7rm9-mrx4 | High | 0.8% | 11 Feb, 2025 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento Improper Access Control vulnerability CVE-2025-24437, GHSA-469f-wf4f-3jjv | Medium | 0.4% | 11 Feb, 2025 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento Improper Access Control vulnerability CVE-2025-24436, GHSA-ghpr-6qhr-rpp8 | Medium | 0.5% | 11 Feb, 2025 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento Improper Access Control vulnerability CVE-2025-24435, GHSA-82p4-55gj-956p | Medium | 0.5% | 11 Feb, 2025 | Packagist magento/community-edition Packagist magento/project-community-edition |
Improper Authorization vulnerability in Magento and Adobe Commerce CVE-2025-24434, GHSA-fppq-f2m6-xv5c | Critical | 17.2% | 11 Feb, 2025 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability CVE-2025-24432, GHSA-7jmr-43qj-pw47 | Low | 0.4% | 11 Feb, 2025 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability CVE-2025-24430, GHSA-6w27-c66f-gvhq | Low | 0.4% | 11 Feb, 2025 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento Improper Access Control vulnerability CVE-2025-24429, GHSA-656q-fx2w-8ccv | Low | 0.5% | 11 Feb, 2025 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento stored Cross-Site Scripting (XSS) vulnerability CVE-2025-24428, GHSA-mm87-rrqx-94cr | Medium | 0.4% | 11 Feb, 2025 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento Improper Access Control vulnerability CVE-2025-24427, GHSA-v3hq-g424-5mgg | Medium | 0.6% | 11 Feb, 2025 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento Business Logic Error vulnerability CVE-2025-24425, GHSA-6ff8-jrfg-43hh | Medium | 0.6% | 11 Feb, 2025 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento Improper Access Control vulnerability CVE-2025-24424, GHSA-539v-w87w-w62c | Medium | 0.8% | 11 Feb, 2025 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento Incorrect Authorization vulnerability CVE-2025-24421, GHSA-v6r2-425c-hfrr | Medium | 0.5% | 11 Feb, 2025 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento Stored Cross-Site Scripting (XSS) Vulnerability CVE-2025-24417, GHSA-g3j6-9753-8mp2 | High | 0.7% | 11 Feb, 2025 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento Stored Cross-Site Scripting (XSS) Vulnerability CVE-2025-24416, GHSA-rjjw-g6hw-7pc9 | High | 0.7% | 11 Feb, 2025 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento Stored Cross-Site Scripting (XSS) Vulnerability CVE-2025-24415, GHSA-gc27-rvvm-q77r | High | 0.7% | 11 Feb, 2025 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento Stored Cross-Site Scripting (XSS) Vulnerability CVE-2025-24414, GHSA-fhw6-3mj5-w9gv | High | 0.7% | 11 Feb, 2025 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento Stored Cross-Site Scripting (XSS) Vulnerability CVE-2025-24413, GHSA-xwgx-8v72-4j5j | High | 0.7% | 11 Feb, 2025 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento Stored Cross-Site Scripting (XSS) Vulnerability CVE-2025-24412, GHSA-m4rg-mpp2-97px | High | 0.7% | 11 Feb, 2025 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento Improper Access Control vulnerability CVE-2025-24411, GHSA-36hw-x3cc-m258 | High | 0.9% | 11 Feb, 2025 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento Stored Cross-Site Scripting (XSS) Vulnerability CVE-2025-24410, GHSA-gjxp-46rq-wg4q | High | 0.7% | 11 Feb, 2025 | Packagist magento/community-edition Packagist magento/project-community-edition |
Adobe Commerce Improper Authorization vulnerability CVE-2025-24409, GHSA-vw47-79jv-3598 | High | 0.7% | 11 Feb, 2025 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento Information Exposure vulnerability CVE-2025-24408, GHSA-3cfg-w257-cgf8 | Medium | 1.0% | 11 Feb, 2025 | Packagist magento/community-edition Packagist magento/project-community-edition |
Adobe Commerce Path Traversal CVE-2025-24406, GHSA-954p-ff72-327w | High | 1.4% | 11 Feb, 2025 | Packagist magento/community-edition Packagist magento/project-community-edition |
Connect-CMS information that is restricted to viewing is visible GHSA-2237-5r9w-vm8j | High | Not scored | 07 Feb, 2025 | Packagist opensource-workshop/connect-cms |
Connect-CMS Access control vulnerability GHSA-5rjc-jc28-cwgg | Medium | Not scored | 07 Feb, 2025 | Packagist opensource-workshop/connect-cms |
Pimcore Admin Classic Bundle allows user enumeration CVE-2025-24980, GHSA-vr5f-php7-rg24 | Medium | 0.5% | 07 Feb, 2025 | Packagist pimcore/admin-ui-classic-bundle |
Withdrawn Advisory: Sylius allows unrestricted brute-force attacks on user accounts CVE-2024-57610, GHSA-2hjh-495w-hmxc | High | 1.2% | 06 Feb, 2025 | Packagist sylius/sylius |
Multiple rtmpdump vulnerabilities GHSA-vrpv-vw92-328g | Critical | Not scored | 06 Feb, 2025 | Packagist rudloff/rtmpdump-bin |