Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Microweber Cross-site Scripting vulnerability CVE-2024-33299, GHSA-97h9-p9f8-4p3r | Medium | 1.2% | 10 Jan, 2025 | Packagist microweber/microweber |
Microweber Cross-site Scripting vulnerability CVE-2024-33298, GHSA-w5g5-4jj3-8f6v | Medium | 0.9% | 10 Jan, 2025 | Packagist microweber/microweber |
Microweber Cross-site Scripting vulnerability CVE-2024-33297, GHSA-j4v9-cm37-h7c2 | Medium | 1.2% | 10 Jan, 2025 | Packagist microweber/microweber |
Stored XSS in REDAXO CVE-2024-13209, GHSA-7wj8-856p-qc9m | Medium | 0.4% | 09 Jan, 2025 | Packagist redaxo/source |
Carbon has an arbitrary file include via unvalidated input passed to Carbon::setLocale CVE-2025-22145, GHSA-j3f9-p6hm-5w6q | Medium | 0.8% | 08 Jan, 2025 | Packagist nesbot/carbon |
PHP-Textile has persistent XSS vulnerability in image link handling GHSA-95m2-chm4-mq7m | High | Not scored | 07 Jan, 2025 | Packagist netcarver/textile |
Guzzle OAuth Subscriber has insufficient nonce entropy CVE-2025-21617, GHSA-237r-r8m4-4q88 | Medium | 0.5% | 06 Jan, 2025 | Packagist guzzlehttp/oauth-subscriber |
REDAXO CMS Cross-site Scripting vulnerability CVE-2024-46209, GHSA-2p95-8xvm-2pjx | Medium | 0.4% | 06 Jan, 2025 | Packagist redaxo/source |
Grav Cross-site Scripting vulnerability CVE-2024-35498, GHSA-m78c-qx99-mvw9 | Medium | 0.4% | 06 Jan, 2025 | Packagist getgrav/grav |
Extension:TabberNeue vulnerable to Cross-site Scripting CVE-2025-21612, GHSA-4x6x-8rm8-c37j | High | 0.5% | 06 Jan, 2025 | Packagist starcitizentools/tabber-neue |
PhpSpreadsheet allows bypass XSS sanitizer using the javascript protocol and special characters CVE-2024-56412, GHSA-q9jv-mm3r-j47r | Medium | 0.4% | 03 Jan, 2025 | Packagist phpoffice/phpexcel Packagist phpoffice/phpspreadsheet |
PhpSpreadsheet has a Cross-Site Scripting (XSS) vulnerability of the hyperlink base in the HTML page header CVE-2024-56411, GHSA-hwcp-2h35-p66w | Medium | 0.4% | 03 Jan, 2025 | Packagist phpoffice/phpexcel Packagist phpoffice/phpspreadsheet |
PhpSpreadsheet has a Cross-Site Scripting (XSS) vulnerability in custom properties CVE-2024-56410, GHSA-wv23-996v-q229 | Medium | 0.3% | 03 Jan, 2025 | Packagist phpoffice/phpexcel Packagist phpoffice/phpspreadsheet |
PhpSpreadsheet allows unauthorized Reflected XSS in Currency.php file CVE-2024-56409, GHSA-j2xg-cjcx-4677 | High | 0.3% | 03 Jan, 2025 | Packagist phpoffice/phpexcel Packagist phpoffice/phpspreadsheet |
PhpSpreadsheet allows unauthorized Reflected XSS in the Accounting.php file CVE-2024-56366, GHSA-c6fv-7vh8-2rhr | High | 0.3% | 03 Jan, 2025 | Packagist phpoffice/phpexcel Packagist phpoffice/phpspreadsheet |
PhpSpreadsheet allows unauthorized Reflected XSS in the constructor of the Downloader class CVE-2024-56365, GHSA-jmpx-686v-c3wx | High | 0.3% | 03 Jan, 2025 | Packagist phpoffice/phpexcel Packagist phpoffice/phpspreadsheet |
PhpSpreadsheet allows unauthorized Reflected XSS in `Convert-Online.php` file CVE-2024-56408, GHSA-x88g-h956-m5xg | High | 0.4% | 03 Jan, 2025 | Packagist phpoffice/phpexcel Packagist phpoffice/phpspreadsheet |
phpMyFAQ Vulnerable to Stored HTML Injection at FAQ CVE-2024-56199, GHSA-ww33-jppq-qfrp | High | 0.4% | 02 Jan, 2025 | Packagist phpmyfaq/phpmyfaq Packagist thorsten/phpmyfaq |
The wp-enable-svg WordPress plugin does not sanitize SVG files when uploaded CVE-2024-11184, GHSA-j77f-79w9-rghc | Medium | 0.4% | 02 Jan, 2025 | Packagist mwdelaney/wp-enable-svg |
LGSL has a reflected XSS at /lgsl_files/lgsl_list.php CVE-2024-56517, GHSA-ggwq-xc72-33r3 | Medium | 0.6% | 30 Dec, 2024 | Packagist tltneon/lgsl |
TeamPass privileges issue CVE-2024-50703, GHSA-9wmc-988h-2mv2 | Critical | 0.5% | 30 Dec, 2024 | Packagist nilsteampassnet/teampass |
TeamPass mail_me operation authorization issue CVE-2024-50702, GHSA-7rm3-4w6j-8xx4 | Medium | 0.3% | 30 Dec, 2024 | Packagist nilsteampassnet/teampass |
TeamPass does not properly check whether a folder is in a user's allowed folders list CVE-2024-50701, GHSA-2697-96mv-3gfm | Medium | 0.3% | 30 Dec, 2024 | Packagist nilsteampassnet/teampass |
Dcat-Admin Cross-Site Scripting (XSS) vulnerability CVE-2024-54775, GHSA-37x3-j9jq-vrjx | Medium | 0.3% | 27 Dec, 2024 | Packagist dcat/laravel-admin |
Dcat Admin Cross-site Scripting (XSS) vulnerability CVE-2024-54774, GHSA-9q34-7hfr-h8jm | Medium | 0.3% | 27 Dec, 2024 | Packagist dcat/laravel-admin |
TCPDF missing character escape on error messages CVE-2024-56527, GHSA-qx95-cwh6-9mvq | High | 0.8% | 27 Dec, 2024 | Packagist tecnickcom/tcpdf |
TCPDF has incorrect comparison CVE-2024-56522, GHSA-w95c-7994-ghpr | High | 0.6% | 27 Dec, 2024 | Packagist tecnickcom/tcpdf |
TCPDF missing certificate validation CVE-2024-56521, GHSA-9mgx-552f-59p6 | Critical | 0.8% | 27 Dec, 2024 | Packagist tecnickcom/tcpdf |
tecnickcom/tc-lib-pdf-font mishandles fonts CVE-2024-56520, GHSA-grhh-r4jj-8jh7 | High | 0.6% | 27 Dec, 2024 | Packagist tecnickcom/tc-lib-pdf-font |
TCPDF lacks SVG sanitization CVE-2024-56519, GHSA-4p8j-vhjm-6pvw | High | 0.6% | 27 Dec, 2024 | Packagist tecnickcom/tcpdf |
lgsl Stored Cross-Site Scripting vulnerability CVE-2024-56361, GHSA-xx95-62h6-h7v3 | High | 0.5% | 26 Dec, 2024 | Packagist tltneon/lgsl |
Cross-site Scripting vulnerability in SimpleXLSXEx::readThemeColors, SimpleXLSXEx::getColorValue and SimpleXLSX::toHTMLEx CVE-2024-56364, GHSA-r87q-fj25-f8jf | Medium | 0.3% | 23 Dec, 2024 | Packagist shuchkin/simplexlsx |
Socialstream has a Potential Account Takeover Vulnerability in Social Account Linking Due to Missing User Consent After OAuth Callback CVE-2024-56329, GHSA-3q97-vjpp-c8rp | High | 0.6% | 20 Dec, 2024 | Packagist joelbutcher/socialstream |
Browsershot Improper Input Validation vulnerability CVE-2024-21549, GHSA-c9f5-29f6-c35w | Medium | 0.6% | 20 Dec, 2024 | Packagist spatie/browsershot |
Craft CMS has potential RCE when PHP `register_argc_argv` config setting is enabled CVE-2024-56145, GHSA-2p6p-9rc9-62j9 | CriticalExploited | 97.5% | 18 Dec, 2024 | Packagist craftcms/cms |
Spatie Browsershot Directory Traversal vulnerability CVE-2024-21547, GHSA-v528-6rq9-h6gw | High | 0.9% | 18 Dec, 2024 | Packagist spatie/browsershot |
UniSharp Laravel Filemanager Code Injection vulnerability CVE-2024-21546, GHSA-6569-3785-r3v6 | High | 1.3% | 18 Dec, 2024 | Packagist unisharp/laravel-filemanager |
Laravel Pulse Allows Remote Code Execution via Unprotected Query Method CVE-2024-55661, GHSA-8vwh-pr89-4mw2 | High | 30.6% | 13 Dec, 2024 | Packagist laravel/pulse |
thorsten/phpmyfaq Unintended File Download Triggered by Embedded Frames CVE-2024-55889, GHSA-m3r7-8gw7-qwvc | High | 2.2% | 13 Dec, 2024 | Packagist thorsten/phpmyfaq |
Browsershot Local File Inclusion CVE-2024-21544, GHSA-g2r4-phv7-5fgv | Medium | 0.6% | 13 Dec, 2024 | Packagist spatie/browsershot |
Cross-site Scripting vulnerability in SimpleXLSXEx::readXfs and SimpeXLSX::toHTMLEx CVE-2024-55878, GHSA-x6mh-rjwm-8ph7 | Medium | 0.5% | 12 Dec, 2024 | Packagist shuchkin/simplexlsx |
Withdrawn Advisory: Nette Database SQL injection CVE-2024-55586, GHSA-f626-677r-j5vq | Critical | 0.6% | 10 Dec, 2024 | Packagist nette/database |
league/commonmark's quadratic complexity bugs may lead to a denial of service CVE-2024-58382, GHSA-c2pc-g5qf-rfrf | High | 0.5% | 09 Dec, 2024 | Packagist league/commonmark |
Winter CMS Modules allows a sandbox bypass in Twig templates leading to data modification and deletion CVE-2024-54149, GHSA-xhw3-4j3m-hq53 | High | 0.4% | 09 Dec, 2024 | Packagist winter/wn-cms-module |
phpMyFAQ Generates an Error Message Containing Sensitive Information if database server is not available CVE-2024-54141, GHSA-vrjr-p3xp-xx2x | High | 0.5% | 06 Dec, 2024 | Packagist thorsten/phpmyfaq |
LibreNMS stored cross-site scripting (XSS) vulnerability in the Device Settings section CVE-2024-53457, GHSA-6c5q-fg3g-qhhv | Medium | 46.4% | 05 Dec, 2024 | Packagist librenms/librenms |
ibexa/post-install affected by Breach with Varnish VCL GHSA-4h8f-c635-25p7 | Medium | Not scored | 02 Dec, 2024 | Packagist ibexa/post-install |
ibexa/http-cache affected by Breach with Varnish VCL GHSA-fh7v-q458-7vmw | Medium | Not scored | 02 Dec, 2024 | Packagist ibexa/http-cache |
ezsystems/ezplatform-http-cache affected by Breach with Varnish VCL GHSA-mgfg-7533-7jf6 | Medium | Not scored | 02 Dec, 2024 | Packagist ezsystems/ezplatform-http-cache |
SimpleSAMLphp SAML2 has an XXE in parsing SAML messages CVE-2024-52806, GHSA-pxm4-r5ph-q2m2 | High | 0.4% | 02 Dec, 2024 | Packagist simplesamlphp/saml2 Packagist simplesamlphp/saml2-legacy |