Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Twig has unguarded calls to `__isset()` and to array-accesses when the sandbox is enabled CVE-2024-51755, GHSA-jjxq-ff2g-95vh | Low | 0.4% | 06 Nov, 2024 | Packagist twig/twig |
Twig has unguarded calls to `__toString()` when nesting an object into an array CVE-2024-51754, GHSA-6377-hfv9-hqf6 | Low | 0.4% | 06 Nov, 2024 | Packagist twig/twig |
Symfony has an incorrect response from Validator when input ends with `\n` CVE-2024-50343, GHSA-g3rh-rrhp-jhh9 | Low | 0.5% | 06 Nov, 2024 | Packagist symfony/symfony Packagist symfony/validator |
Symfony's `Security::login` does not take into account custom `user_checker` CVE-2024-50341, GHSA-jxgr-3v7q-3w9v | Low | 0.3% | 06 Nov, 2024 | Packagist symfony/security-bundle Packagist symfony/symfony |
Magento Open Source Improper Access Control vulnerability BIT-magento-2024-45149, CVE-2024-45149, GHSA-w7rg-7wq2-pjrw | Low | 0.5% | 10 Oct, 2024 | Packagist magento/community-edition |
LibreNMS has Stored Cross-site Scripting vulnerability in "Alert Templates" feature CVE-2024-47526, GHSA-gcgp-q2jq-fw52 | Low | 0.5% | 01 Oct, 2024 | Packagist librenms/librenms |
ipl/web's `ipl\Web\Common\CsrfCounterMeasure` is susceptible to CSRF CVE-2024-41811, GHSA-w9pg-7c3h-fc8j | Low | 0.2% | 05 Aug, 2024 | Packagist ipl/web |
aimeos/ai-admin-graphql improper access control vulnerability allows editors to manage own services CVE-2024-39324, GHSA-jj68-cp4v-98qf | Low | 0.4% | 02 Jul, 2024 | Packagist aimeos/ai-admin-graphql |
Typo3 Information Disclosure in Page Tree GHSA-h934-f4m4-wc8x | Low | Not scored | 05 Jun, 2024 | Packagist typo3/cms |
Information Disclosure in TYPO3 CMS GHSA-c7p6-3c9c-f88q | Low | Not scored | 05 Jun, 2024 | Packagist typo3/cms |
Password confirmation stored in plain text via registration form in statamic/cms CVE-2024-36119, GHSA-qvpj-w7xj-r6w9 | Low | 0.1% | 30 May, 2024 | Packagist statamic/cms |
silverstripe/framework sends passwords back to browsers under some circumstances GHSA-vh7q-j8p5-2h4h | Low | Not scored | 27 May, 2024 | Packagist silverstripe/framework |
silverstripe/framework's pre-existing alc_enc cookies log users in if remember me is disabled GHSA-5r8w-66hq-rc39 | Low | Not scored | 27 May, 2024 | Packagist silverstripe/framework |
silverstripe/framework password encryption salt not updated GHSA-f3wp-xpv2-6vmg | Low | Not scored | 27 May, 2024 | Packagist silverstripe/framework |
Silverstripe admin XSS Vulnerability via WYSIWYG editor GHSA-779c-7w4p-2c4g | Low | Not scored | 22 May, 2024 | Packagist silverstripe/admin |
Passbolt Api Retrieval of HTTP-only cookies GHSA-f5pp-pmq8-gp46 | Low | Not scored | 20 May, 2024 | Packagist passbolt/passbolt_api |
random_compat Uses insecure CSPRNG GHSA-3fmq-x9q6-wm39 | Low | Not scored | 17 May, 2024 | Packagist paragonie/random_compat |
onelogin/php-saml Improper signature validation on LogoutRequest/LogoutResponse. GHSA-9wrw-p9rm-r782 | Low | Not scored | 17 May, 2024 | Packagist onelogin/php-saml |
Insecure deserialize Vulnerability in FLOW3 GHSA-7h74-7vcw-4mwp | Low | Not scored | 17 May, 2024 | Packagist neos/flow |
Monolog Header injection in NativeMailerHandler GHSA-f57v-q966-7fh6 | Low | Not scored | 15 May, 2024 | Packagist monolog/monolog |
Laravel Encrypter Failure to decryption vulnerability GHSA-6wjw-qf87-fv5v | Low | Not scored | 15 May, 2024 | Packagist illuminate/encryption |
datadog/dd-trace Circumvents open_basedir INI directive GHSA-qvgg-r6rq-vwfx | Low | Not scored | 15 May, 2024 | Packagist datadog/dd-trace |
RosarioSIS cross site scripting vulnerability CVE-2024-3138, GHSA-r32g-w9cv-9fgc | Low | 0.5% | 01 Apr, 2024 | Packagist francoisjacquet/rosariosis |
phpMyFAQ Path Traversal in Attachments CVE-2024-29196, GHSA-mmh6-5cpf-2c72 | Low | 0.6% | 25 Mar, 2024 | Packagist phpmyfaq/phpmyfaq |
[TagAwareCipher] - Decryption Failure (Regex Match) CVE-2024-28864, GHSA-rj29-j2g4-77q8 | Low | 0.3% | 18 Mar, 2024 | Packagist ilicmiljan/secure-props |
Gila CMS SQL Injection vulnerability CVE-2020-26625, GHSA-3pfj-g4wr-qj3j | Low | 0.7% | 02 Jan, 2024 | Packagist gilacms/gila |
Gila CMS SQL Injection vulnerability CVE-2020-26624, GHSA-4vf6-2rmx-fgqx | Low | 0.7% | 02 Jan, 2024 | Packagist gilacms/gila |
Withdrawn Advisory: Stored Cross-site scripting affecting automad/automad CVE-2023-7035, GHSA-7j9h-ch38-474r | Low | 0.6% | 21 Dec, 2023 | Packagist automad/automad |
Moodle Exposure of Sensitive Information to an Unauthorized Actor vulnerability BIT-moodle-2023-5551, CVE-2023-5551, GHSA-jr83-8x65-xcr5 | Low | 0.3% | 09 Nov, 2023 | Packagist moodle/moodle |
Ibexa ezplatform-kernel download route allows filename change GHSA-gv2c-5g79-h73c | Low | Not scored | 03 Nov, 2023 | Packagist ezsystems/ezplatform-kernel |
Ibexa DXP Download route allows filename change GHSA-g95c-xc83-8353 | Low | Not scored | 03 Nov, 2023 | Packagist ibexa/core |
Download route allows filename change in eZpublish kernel GHSA-946c-f9w6-2c25 | Low | Not scored | 03 Nov, 2023 | Packagist ezsystems/ezpublish-kernel |
Economizzer Insecure Direct Object Reference vulnerability CVE-2023-38872, GHSA-896v-ph5w-379h | Low | 0.7% | 28 Sep, 2023 | Packagist gugoan/economizzer |
Froxlor vulnerable to business logic errors CVE-2023-4304, GHSA-9rmf-6qgj-g3wj | Low | 0.6% | 11 Aug, 2023 | Packagist froxlor/froxlor |
Silverstripe Framework: Members with no password can be created and bypass custom login forms CVE-2023-32302, GHSA-36xx-7vf6-7mv3 | Low | Not scored | 31 Jul, 2023 | Packagist silverstripe/framework |
Admidio Improper Access Control vulnerability CVE-2023-3303, GHSA-vmxg-wx6c-4f3r | Low | 0.4% | 23 Jun, 2023 | Packagist admidio/admidio |
Magento Open Source affected by Improper Input Validation CVE-2023-29293, GHSA-66c9-xrwj-9xv6 | Low | 1.0% | 15 Jun, 2023 | Packagist magento/community-edition Packagist magento/project-community-edition |
Timing attack in eZ Platform Ibexa CVE-2022-48366, GHSA-66m4-gc8h-hpjx | Low | 0.5% | 12 Mar, 2023 | Packagist ezsystems/ezplatform-kernel Packagist ezsystems/ezpublish-kernel |
Any Flarum user including unactivated can reply in public discussions whose first post was permanently deleted CVE-2023-22489, GHSA-hph3-hv3c-7725 | Low | 0.6% | 10 Jan, 2023 | Packagist flarum/core |
EC-CUBE Directory traversal vulnerability CVE-2022-40199, GHSA-wjpv-frf2-3r58 | Low | 1.2% | 27 Sep, 2022 | Packagist ec-cube/ec-cube |
XSS Injection Vulnerability GHSA-wf98-vxv9-jqfv | Low | Not scored | 05 Apr, 2022 | Packagist craftcms/cms |
Discoverability of user password hash in Statamic CMS CVE-2022-24784, GHSA-qcgx-7p5f-hxvr | Low | 1.0% | 25 Mar, 2022 | Packagist statamic/cms |
Shopware user session is not logged out if the password is reset via password recovery CVE-2022-24744, GHSA-w267-m9c4-8555 | Low | 0.5% | 09 Mar, 2022 | Packagist shopware/core Packagist shopware/platform |
Insufficient user authorization in Moodle BIT-moodle-2022-0333, CVE-2022-0333, GHSA-m434-m5pv-p35w | Low | 0.6% | 25 Jan, 2022 | Packagist moodle/moodle |
Magento Information Disclosure vulnerability BIT-magento-2021-28566, CVE-2021-28566, GHSA-w942-fw92-mqm2 | Low | 1.4% | 08 Sep, 2021 | Packagist magento/community-edition |
Use of a Broken or Risky Cryptographic Algorithm CVE-2021-27913, GHSA-x7g2-wrrp-r6h3 | Low | 0.5% | 30 Aug, 2021 | Packagist mautic/core |
User enumeration in authentication mechanisms GHSA-g2qj-pmxm-9f8f | Low | Not scored | 17 May, 2021 | Packagist symfony/security-http Packagist symfony/symfony |
User enumeration in authentication mechanisms GHSA-2frx-j9hj-6c65 | Low | Not scored | 17 May, 2021 | Packagist lexik/jwt-authentication-bundle |
User (Encrypted) Password Field Being Serialised GHSA-7fjp-g4m7-fx23 | Low | Not scored | 13 Apr, 2021 | Packagist pwweb/laravel-core |
Generation of fake documents via public GET-call GHSA-jvg4-9rc2-wvcr | Low | Not scored | 10 Feb, 2021 | Packagist shopware/platform |