Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Drupal OAuth2 Client Cross-Site Request Forgery (CSRF) CVE-2025-31684, DRUPAL-CONTRIB-2025-013, GHSA-6chf-hhqf-749c | Medium | 0.2% | 05 Feb, 2025 | Packagist drupal/oauth2_client Packagist:https://packages.drupal.org/8 drupal/oauth2_client |
Browsershot Local File Inclusion CVE-2025-1026, GHSA-f2q5-6mx7-q9qq | Medium | 0.5% | 05 Feb, 2025 | Packagist spatie/browsershot |
Cockpit Arbitrary File Upload CVE-2025-1025, GHSA-wp68-xrfg-xvq4 | High | 18.9% | 05 Feb, 2025 | Packagist cockpit-hq/cockpit |
Browsershot Path Traversal CVE-2025-1022, GHSA-j2gw-r24m-j2qw | High | 0.5% | 05 Feb, 2025 | Packagist spatie/browsershot |
PhpSpreadsheet allows bypassing of XSS sanitizer using the javascript protocol and special characters CVE-2025-23210, GHSA-r57h-547h-w24f | Medium | 0.4% | 03 Feb, 2025 | Packagist phpoffice/phpexcel Packagist phpoffice/phpspreadsheet |
DevDojo Voyager Arbitrary File Write CVE-2024-55417, GHSA-35p2-5vrh-m3p6 | Medium | 14.1% | 30 Jan, 2025 | Packagist tcg/voyager |
DevDojo Voyager vulnerable to reflected Cross-site Scripting CVE-2024-55416, GHSA-mm49-4f2g-c3wf | Low | 20.5% | 30 Jan, 2025 | Packagist tcg/voyager |
DevDojo Voyager vulnerable to path traversal CVE-2024-55415, GHSA-j63m-2vr6-fv7m | High | 15.7% | 30 Jan, 2025 | Packagist tcg/voyager |
Drupal Google Tag Cross-Site Request Forgery (CSRF) CVE-2025-31683, DRUPAL-CONTRIB-2025-012, GHSA-qchr-8m24-7v66 | Medium | 0.2% | 29 Jan, 2025 | Packagist drupal/google_tag Packagist:https://packages.drupal.org/8 drupal/google_tag |
Drupal Google Tag Cross-Site Scripting (XSS) vulnerability CVE-2025-31682, DRUPAL-CONTRIB-2025-011, GHSA-36vv-q5jv-94cj | Medium | 0.2% | 29 Jan, 2025 | Packagist drupal/google_tag Packagist:https://packages.drupal.org/8 drupal/google_tag |
Drupal Authenticator Login Missing Authorization vulnerability CVE-2025-31681, DRUPAL-CONTRIB-2025-009, GHSA-jwpx-6c4p-q4jq | Critical | 0.4% | 29 Jan, 2025 | Packagist drupal/alogin Packagist:https://packages.drupal.org/8 drupal/alogin |
Twig security issue where escaping was missing when using null coalesce operator CVE-2025-24374, GHSA-3xg3-cgvq-2xwr | Medium | 0.3% | 29 Jan, 2025 | Packagist twig/twig |
Drupal Matomo Analytics Cross-Site Request Forgery (CSRF) vulnerability CVE-2025-31680, DRUPAL-CONTRIB-2025-008, GHSA-jh66-rjx8-8qqc | Medium | 0.2% | 29 Jan, 2025 | Packagist drupal/matomo Packagist:https://packages.drupal.org/8 drupal/matomo |
TYPO3-EXT-SA-2025-001: Account Takeover in extension "OpenID Connect Authentication" (oidc) CVE-2025-24856, GHSA-hj78-p4h7-m5fv | Medium | 0.2% | 28 Jan, 2025 | Packagist causal/oidc |
pimcore/customer-data-framework vulnerable to SQL Injection CVE-2024-11956, GHSA-q53r-9hh9-w277 | Medium | 0.9% | 28 Jan, 2025 | Packagist pimcore/customer-management-framework-bundle |
Pimcore Authenticated Stored Cross-Site Scripting (XSS) Via Search Document CVE-2024-11954, GHSA-xr3m-6gq6-22cg | High | 1.1% | 28 Jan, 2025 | Packagist pimcore/pimcore |
Dolibarr Cross-site Scripting vulnerability BIT-dolibarr-2024-55228, CVE-2024-55228, GHSA-x2j8-vjg7-386r | Critical | 0.7% | 27 Jan, 2025 | Packagist dolibarr/dolibarr |
Dolibarr Cross-site Scripting vulnerability BIT-dolibarr-2024-55227, CVE-2024-55227, GHSA-2v3r-gvq5-qqgh | Critical | 0.6% | 27 Jan, 2025 | Packagist dolibarr/dolibarr |
Reflected Cross Site Scripting (XSS) in error message GHSA-74j9-xhqr-6qv3 | Low | Not scored | 23 Jan, 2025 | Packagist silverstripe/framework |
phpMyAdmin XSS when checking tables BIT-phpmyadmin-2025-24530, CVE-2025-24530, GHSA-222v-cx2c-q2f5 | Medium | 0.4% | 23 Jan, 2025 | Packagist phpmyadmin/phpmyadmin |
Drupal Ignition Cross-Site Scripting (XSS) vulnerability CVE-2025-31679, DRUPAL-CONTRIB-2025-007, GHSA-rhxm-r44m-4325 | Medium | 0.3% | 22 Jan, 2025 | Packagist drupal/ignition Packagist:https://packages.drupal.org/8 drupal/ignition |
Drupal AI Missing Authorization vulnerability CVE-2025-31678, DRUPAL-CONTRIB-2025-004, GHSA-c8q6-wp7v-46r9 | High | 0.4% | 22 Jan, 2025 | Packagist drupal/ai Packagist:https://packages.drupal.org/8 drupal/ai |
ps_contactinfo has a potential XSS due to usage of the nofilter tag in template CVE-2025-24027, GHSA-35pq-7pv2-2rfw | Medium | 0.4% | 22 Jan, 2025 | Packagist prestashop/ps_contactinfo |
Authenticated arbitrary file deletion in YesWiki CVE-2025-24019, GHSA-43c9-gw4x-pcx6 | High | 0.6% | 21 Jan, 2025 | Packagist yeswiki/yeswiki |
Authenticated Stored XSS in YesWiki CVE-2025-24018, GHSA-w59h-3x3q-3p6j | High | 0.4% | 21 Jan, 2025 | Packagist yeswiki/yeswiki |
Unauthenticated DOM Based XSS in YesWiki CVE-2025-24017, GHSA-wphc-5f2j-jhvg | High | 0.4% | 21 Jan, 2025 | Packagist yeswiki/yeswiki |
Missing validation of header name and value in codeigniter4/framework CVE-2025-24013, GHSA-x5mq-jjr3-vmx6 | Medium | 0.5% | 20 Jan, 2025 | Packagist codeigniter4/framework |
Cross-Site Scripting (XSS) vulnerability in generateNavigation() function in PhpSpreadsheet CVE-2025-22131, GHSA-79xx-vf93-p7cx | Medium | 0.4% | 20 Jan, 2025 | Packagist phpoffice/phpexcel Packagist phpoffice/phpspreadsheet |
Craft CMS has a potential RCE with a compromised security key CVE-2025-23209, GHSA-x684-96hh-833x | HighExploited | 21.6% | 18 Jan, 2025 | Packagist craftcms/cms |
Librenms has a reflected XSS on error alert CVE-2025-23201, GHSA-g84x-g96g-rcjc | Medium | 0.4% | 16 Jan, 2025 | Packagist librenms/librenms |
LibreNMS Misc Section Stored Cross-site Scripting vulnerability CVE-2025-23200, GHSA-c66p-64fj-jmc2 | Medium | 31.6% | 16 Jan, 2025 | Packagist librenms/librenms |
LibreNMS Ports Stored Cross-site Scripting vulnerability CVE-2025-23199, GHSA-27vf-3g4f-6jp7 | Medium | 1.3% | 16 Jan, 2025 | Packagist librenms/librenms |
LibreNMS Display Name Stored Cross-site Scripting vulnerability CVE-2025-23198, GHSA-pm8j-3v64-92cq | Medium | 0.4% | 16 Jan, 2025 | Packagist librenms/librenms |
LibreNMS Display Name 2 Stored Cross-site Scripting vulnerability CVE-2024-56144, GHSA-2f4w-6mc7-4w78 | Medium | 0.4% | 16 Jan, 2025 | Packagist librenms/librenms |
Crayfish allows Remote Code Execution via Homarus Authorization header CVE-2025-25286, GHSA-mm6v-68qp-f9fw | Critical | 1.0% | 15 Jan, 2025 | Packagist islandora/crayfish |
Drupal AI Cross-Site Request Forgery (CSRF) vulnerability CVE-2025-31677, DRUPAL-CONTRIB-2025-003, GHSA-9w85-x5hg-fr66 | High | 0.2% | 15 Jan, 2025 | Packagist drupal/ai Packagist:https://packages.drupal.org/8 drupal/ai |
Silverstripe Framework has a Reflected Cross Site Scripting (XSS) in error message GHSA-mqf3-qpc3-g26q | Low | Not scored | 14 Jan, 2025 | Packagist silverstripe/framework |
Silverstripe Framework has a XSS in form messages CVE-2024-53277, GHSA-ff6q-3c9c-6cf5 | Medium | 0.3% | 14 Jan, 2025 | Packagist silverstripe/framework |
Silverstripe Framework has a XSS via insert media remote file oembed CVE-2024-47605, GHSA-7cmp-cgg8-4c82 | Medium | 1.2% | 14 Jan, 2025 | Packagist silverstripe/framework |
Mediawiki - DataTransfer Extension Cross-Site Request Forgery (CSRF) and Cross-site Scripting (XSS) CVE-2025-23081, GHSA-c3h5-h73c-29hq | Medium | 0.2% | 14 Jan, 2025 | Packagist mediawiki/data-transfer |
TYPO3 DB Check Module vulnerable to Cross-Site Request Forgery CVE-2024-55945, GHSA-8mv3-37rc-pvxj | Medium | 0.2% | 14 Jan, 2025 | Packagist typo3/cms-lowlevel |
TYPO3 Scheduler Module vulnerable to Cross-Site Request Forgery CVE-2024-55924, GHSA-7835-fcv3-g256 | High | 0.3% | 14 Jan, 2025 | Packagist typo3/cms-scheduler |
TYPO3 Indexed Search Module vulnerable to Cross-Site Request Forgery CVE-2024-55923, GHSA-7r5q-4qgx-v545 | Medium | 0.2% | 14 Jan, 2025 | Packagist typo3/cms-indexed-search |
TYPO3 Form Framework Module vulnerable to Cross-Site Request Forgery CVE-2024-55922, GHSA-ww7h-g2qf-7xv6 | Medium | 0.2% | 14 Jan, 2025 | Packagist typo3/cms-form |
TYPO3 Extension Manager Module vulnerable to Cross-Site Request Forgery CVE-2024-55921, GHSA-4g52-pq8j-6qv5 | High | 0.4% | 14 Jan, 2025 | Packagist typo3/cms-extensionmanager |
TYPO3 Cross-Site Request Forgery in Dashboard Module CVE-2024-55920, GHSA-qwx7-39pw-2mhr | Medium | 0.2% | 14 Jan, 2025 | Packagist typo3/cms-dashboard |
TYPO3 Cross-Site Request Forgery in Backend User Module CVE-2024-55894, GHSA-6w4x-gcx3-8p7v | Medium | 0.3% | 14 Jan, 2025 | Packagist typo3/cms-beuser |
TYPO3 Cross-Site Request Forgery in Log Module CVE-2024-55893, GHSA-cjfr-9f5r-3q93 | Medium | 0.3% | 14 Jan, 2025 | Packagist typo3/cms-belog |
TYPO3 Potential Open Redirect via Parsing Differences CVE-2024-55892, GHSA-2fx5-pggv-6jjr | Medium | 0.2% | 14 Jan, 2025 | Packagist typo3/cms-core |
TYPO3 Information Disclosure via Exception Handling/Logger CVE-2024-55891, GHSA-38x7-cc6w-j27q | Medium | 0.3% | 14 Jan, 2025 | Packagist typo3/cms-install |