Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Paymenter vulnerable to Remote Code Execution via public file uploads CVE-2025-58048, GHSA-5pm9-r2m8-rcmj | Critical | 0.4% | 28 Aug, 2025 | Packagist paymenter/paymenter |
The Freeform CraftCMS plugin contains an Server-side template injection (SSTI) vulnerability CVE-2025-52122, GHSA-9hp3-f5g8-rccg | Critical | 0.6% | 27 Aug, 2025 | Packagist solspace/craft-freeform |
Badaso CMS file upload vulnerability CVE-2025-52353, GHSA-gqp9-jh35-439m | Critical | 0.7% | 26 Aug, 2025 | Packagist badaso/core |
ThinkPHP Path Traversal Vulnerability CVE-2025-50706, GHSA-mrwc-mvr8-9xq5 | Critical | 1.1% | 05 Aug, 2025 | Packagist topthink/framework |
The ADOdb sqlite3 driver allows SQL injection CVE-2025-54119, GHSA-vf2r-cxg9-p7rf | Critical | 0.5% | 04 Aug, 2025 | Packagist adodb/adodb-php |
CodeIgniter4's ImageMagick Handler has Command Injection Vulnerability CVE-2025-54418, GHSA-9952-gv64-x94c | Critical | 1.5% | 28 Jul, 2025 | Packagist codeigniter4/framework |
nova-tiptap has Unauthenticated Arbitrary File Upload Vulnerability CVE-2025-54082, GHSA-96c2-h667-9fxp | Critical | 0.9% | 21 Jul, 2025 | Packagist manogi/nova-tiptap Packagist marshmallow/nova-tiptap |
simogeo/filemanager arbitrary file upload vulnerability CVE-2025-46001, GHSA-m5hw-rhvr-f47c | Critical | 0.8% | 18 Jul, 2025 | Packagist simogeo/filemanager |
Livewire is vulnerable to remote command execution during component property update hydration CVE-2025-54068, GHSA-29cq-5w36-x7w3 | CriticalExploited | 96.3% | 17 Jul, 2025 | Packagist livewire/livewire |
LaRecipe is vulnerable to Server-Side Template Injection attacks CVE-2025-53833, GHSA-jv7x-xhv2-p5v2 | Critical | 9.1% | 14 Jul, 2025 | Packagist binarytorch/larecipe |
Pterodactyl Panel Allows Unauthenticated Arbitrary Remote Code Execution CVE-2025-49132, GHSA-24wv-6c99-f843 | Critical | 54.5% | 19 Jun, 2025 | Packagist pterodactyl/panel |
Magneto contains stored XSS vulnerability CVE-2025-47110, GHSA-j934-vjh5-vf9r | Critical | 0.7% | 10 Jun, 2025 | Packagist magento/community-edition |
laravel-auth0 SDK Deserialization of Untrusted Data vulnerability GHSA-c42h-56wx-h85q | Critical | Not scored | 06 Jun, 2025 | Packagist auth0/login |
Auth0 Symfony SDK Deserialization of Untrusted Data vulnerability GHSA-98j6-67v3-mw34 | Critical | Not scored | 06 Jun, 2025 | Packagist auth0/symfony |
Auth0 Wordpress Plugin vulnerable to Deserialization of Untrusted Data GHSA-862m-5253-832r | Critical | Not scored | 05 Jun, 2025 | Packagist auth0/wordpress |
Auth0-PHP SDK Deserialization of Untrusted Data vulnerability CVE-2025-48951, GHSA-v9m8-9xxp-q492 | Critical | 0.7% | 03 Jun, 2025 | Packagist auth0/auth0-php |
Roundcube Webmail Vulnerable to Authenticated RCE via PHP Object Deserialization CVE-2025-49113, GHSA-8j8w-wwqc-x596 | CriticalExploited | 99.7% | 02 Jun, 2025 | Packagist roundcube/roundcubemail |
The Front End User Registration extension for TYPO3 (sr_feuser_register) Remote Code Execution CVE-2025-48200, GHSA-qfm8-78qf-p75j | Critical | 0.9% | 21 May, 2025 | Packagist sjbr/sr-feuser-register |
laravel-auth0 SDK Vulnerable to Brute Force Authentication Tags of CookieStore Sessions GHSA-9fwj-9mjf-rhj3 | Critical | Not scored | 17 May, 2025 | Packagist auth0/login |
Auth0 Wordpress plugin Vulnerable to Brute Force Authentication Tags of CookieStore Sessions GHSA-2f4r-34m4-3w8q | Critical | Not scored | 17 May, 2025 | Packagist auth0/wordpress |
Auth0 Symfony SDK Vulnerable to Brute Force Authentication Tags of CookieStore Sessions GHSA-9wg9-93h9-j8ch | Critical | Not scored | 17 May, 2025 | Packagist auth0/symfony |
Brute Force Authentication Tags of CookieStore Sessions in Auth0-PHP SDK CVE-2025-47275, GHSA-g98g-r7gf-2r25 | Critical | 0.5% | 15 May, 2025 | Packagist auth0/auth0-php |
SQL injection in ADOdb PostgreSQL driver pg_insert_id() method CVE-2025-46337, GHSA-8x27-jwjr-8545 | Critical | 0.7% | 01 May, 2025 | Packagist adodb/adodb-php |
ShowDoc unrestricted file upload vulnerability CVE-2025-0520, GHSA-6jmr-r7p6-f5wr | Critical | 2.6% | 29 Apr, 2025 | Packagist showdoc/showdoc |
YesWiki Vulnerable to Unauthenticated Site Backup Creation and Download CVE-2025-46348, GHSA-wc9g-6j9w-hr95 | Critical | 0.7% | 29 Apr, 2025 | Packagist yeswiki/yeswiki |
Craft CMS Allows Remote Code Execution CVE-2025-32432, GHSA-f3gw-9ww9-jmc3 | CriticalExploited | 99.8% | 25 Apr, 2025 | Packagist craftcms/cms |
croogo Host header injection CVE-2024-29643, GHSA-847x-x4jg-6gf4 | Critical | 0.6% | 18 Apr, 2025 | Packagist croogo/croogo |
DevDojo Voyager Argument Injection vulnerability CVE-2025-32931, GHSA-qq2h-m2hj-hrff | Critical | 0.6% | 14 Apr, 2025 | Packagist tcg/voyager |
yiisoft/yii2 Mishandles the Attaching of Behavior Defined by a `__class` Array Key CVE-2024-58136, GHSA-ggwg-cmwp-46r5 | CriticalExploited | 87.8% | 10 Apr, 2025 | Packagist yiisoft/yii2 |
RoadRunner is at risk of HTTP Request/Response Smuggling through vulnerable dependency BIT-golang-2025-22871, CVE-2025-22871, GHSA-g9pc-8g42-g6vq, GO-2025-3563 | Critical | 0.8% | 08 Apr, 2025 | Packagist spiral/roadrunner |
Joomla Framework Database Package Vulnerable to SQL Injection BIT-joomla-2025-25226, CVE-2025-25226, GHSA-44v2-prcf-pc3m | Critical | 0.5% | 08 Apr, 2025 | Packagist joomla/database |
Volt Allows RCE Via User-Crafted Requests CVE-2025-27517, GHSA-v69f-5jxm-hwvv | Critical | 0.6% | 05 Mar, 2025 | Packagist livewire/volt |
Drupal OAuth2 Server Missing Authorization vulnerability CVE-2025-31691, DRUPAL-CONTRIB-2025-020, GHSA-4f8q-mwgc-3mwc | Critical | 0.4% | 26 Feb, 2025 | Packagist drupal/oauth2_server Packagist:https://packages.drupal.org/8 drupal/oauth2_server |
Mautic allows Remote Code Execution and File Deletion in Asset Uploads CVE-2024-47051, GHSA-73gx-x7r9-77x2 | Critical | 1.8% | 26 Feb, 2025 | Packagist mautic/core |
Moodle has a SQL injection risk in course search module list filter BIT-moodle-2025-26533, CVE-2025-26533, GHSA-rg56-94j7-hjx9 | Critical | 0.6% | 24 Feb, 2025 | Packagist moodle/moodle |
Easy!Appointments Improper Restriction of Excessive Authentication Attempts CVE-2024-57602, GHSA-8fc2-fhh6-f6m5 | Critical | 0.8% | 12 Feb, 2025 | Packagist alextselegidis/easyappointments |
Crayfish Allows Remote Code Execution via hypercube X-Islandora-Args Header GHSA-c2p2-hgjg-9r3f | Critical | Not scored | 12 Feb, 2025 | Packagist islandora/crayfish |
Drupal Open Social Missing Authorization vulnerability CVE-2025-31685, DRUPAL-CONTRIB-2025-014, GHSA-gf72-h4cp-wcm4 | Critical | 0.4% | 12 Feb, 2025 | Packagist goalgorilla/open_social Packagist:https://packages.drupal.org/8 drupal/social |
Improper Authorization vulnerability in Magento and Adobe Commerce CVE-2025-24434, GHSA-fppq-f2m6-xv5c | Critical | 17.2% | 11 Feb, 2025 | Packagist magento/community-edition Packagist magento/project-community-edition |
Multiple rtmpdump vulnerabilities GHSA-vrpv-vw92-328g | Critical | Not scored | 06 Feb, 2025 | Packagist rudloff/rtmpdump-bin |
Drupal Authenticator Login Missing Authorization vulnerability CVE-2025-31681, DRUPAL-CONTRIB-2025-009, GHSA-jwpx-6c4p-q4jq | Critical | 0.4% | 29 Jan, 2025 | Packagist drupal/alogin Packagist:https://packages.drupal.org/8 drupal/alogin |
Dolibarr Cross-site Scripting vulnerability BIT-dolibarr-2024-55228, CVE-2024-55228, GHSA-x2j8-vjg7-386r | Critical | 0.7% | 27 Jan, 2025 | Packagist dolibarr/dolibarr |
Dolibarr Cross-site Scripting vulnerability BIT-dolibarr-2024-55227, CVE-2024-55227, GHSA-2v3r-gvq5-qqgh | Critical | 0.6% | 27 Jan, 2025 | Packagist dolibarr/dolibarr |
Crayfish allows Remote Code Execution via Homarus Authorization header CVE-2025-25286, GHSA-mm6v-68qp-f9fw | Critical | 1.0% | 15 Jan, 2025 | Packagist islandora/crayfish |
TeamPass privileges issue CVE-2024-50703, GHSA-9wmc-988h-2mv2 | Critical | 0.5% | 30 Dec, 2024 | Packagist nilsteampassnet/teampass |
TCPDF missing certificate validation CVE-2024-56521, GHSA-9mgx-552f-59p6 | Critical | 0.8% | 27 Dec, 2024 | Packagist tecnickcom/tcpdf |
Craft CMS has potential RCE when PHP `register_argc_argv` config setting is enabled CVE-2024-56145, GHSA-2p6p-9rc9-62j9 | CriticalExploited | 97.4% | 18 Dec, 2024 | Packagist craftcms/cms |
Withdrawn Advisory: Nette Database SQL injection CVE-2024-55586, GHSA-f626-677r-j5vq | Critical | 0.6% | 10 Dec, 2024 | Packagist nette/database |
Drupal core contains a potential PHP Object Injection vulnerability BIT-drupal-2024-55638, CVE-2024-55638, DRUPAL-CORE-2024-008, GHSA-gvf2-2f4g-jqf4 | Critical | 1.0% | 20 Nov, 2024 | Packagist drupal/core Packagist drupal/core-recommended Packagist drupal/drupal |
Drupal core contains a potential PHP Object Injection vulnerability BIT-drupal-2024-55637, CVE-2024-55637, DRUPAL-CORE-2024-007, GHSA-w6rx-9g2x-mg5g | Critical | 0.8% | 20 Nov, 2024 | Packagist drupal/core Packagist drupal/core-recommended Packagist drupal/drupal |