Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Appwrite Vulnerable to Cross-site Scripting CVE-2022-2925, GHSA-5ffj-mph5-c5hv | Medium | 0.8% | 09 Sep, 2022 | Packagist appwrite/server-ce |
ReactPHP's HTTP server parses encoded cookie names so malicious `__Host-` and `__Secure-` cookies can be sent CVE-2022-36032, GHSA-w3w9-vrf5-8mx8 | Medium | 1.2% | 06 Sep, 2022 | Packagist react/http |
Unauthenticated Sensitive Information Disclosure vulnerability CVE-2022-34867, GHSA-29qv-hhg4-6x96 | Medium | 0.8% | 06 Sep, 2022 | Packagist libreform/libreform |
francoisjacquet/rosariosis vulnerable to Cross-Site Scripting (XSS) CVE-2022-3072, GHSA-2mh7-qxcw-q39g | Medium | 0.9% | 01 Sep, 2022 | Packagist francoisjacquet/rosariosis |
PrestaShop Product Comments Cross-site Scripting vulnerability CVE-2022-35933, GHSA-prrh-qvhf-x788 | Medium | 0.6% | 31 Aug, 2022 | Packagist prestashop/productcomments |
LibreNMS vulnerable to Cross-Site Scripting (XSS) CVE-2022-36746, GHSA-325v-g5vx-whxc | Medium | 0.5% | 30 Aug, 2022 | Packagist librenms/librenms |
LibreNMS vulnerable to Cross-Site Scripting (XSS) CVE-2022-36745, GHSA-5229-94p3-7wwq | Medium | 0.5% | 30 Aug, 2022 | Packagist librenms/librenms |
snipe-it vulnerable to cross-site scripting (XSS) CVE-2022-3035, GHSA-rff2-vqm3-jpv5 | Medium | 0.7% | 29 Aug, 2022 | Packagist snipe/snipe-it |
Cross-site scripting from dynamic options in the multiselect field CVE-2022-36037, GHSA-3f89-869f-5w76 | Medium | 0.9% | 29 Aug, 2022 | Packagist getkirby/cms |
Subrion CMS 4.2.1 vulnerable to cross-site scripting in admin panel CVE-2022-37059, GHSA-rh4r-9689-6xw4 | Medium | 0.6% | 29 Aug, 2022 | Packagist intelliants/subrion |
Pagekit CMS cross-site scripting in Markdown text box where articles are edited CVE-2022-36573, GHSA-q6h8-qjjc-j8cg | Medium | 0.6% | 29 Aug, 2022 | Packagist pagekit/pagekit |
Froxlor vulnerable to Cross-Site Request Forgery (CSRF) CVE-2022-3017, GHSA-9xgp-3mxp-rv7x | Medium | 0.4% | 28 Aug, 2022 | Packagist froxlor/froxlor |
Kirby CMS 2.5.12 Cross-site Scripting CVE-2018-14520, GHSA-h3w2-qg2r-c7mf | Medium | 0.7% | 24 Aug, 2022 | Packagist getkirby/cms |
Kirby CMS 2.5.12 Cross-site Request Forgery CVE-2018-14519, GHSA-c7x2-7h8r-jq4m | Medium | 0.5% | 24 Aug, 2022 | Packagist getkirby/cms |
exceedone/exment and exceedone/laravel-admin Cross-site Scripting vulnerability CVE-2022-38080, GHSA-8629-83m5-rj75 | Medium | 0.9% | 24 Aug, 2022 | Packagist exceedone/exment Packagist exceedone/laravel-admin |
Pimcore Cross-site Scripting (XSS) CVE-2022-2796, GHSA-pr4f-4pcx-2r3h | Medium | 1.7% | 23 Aug, 2022 | Packagist pimcore/pimcore |
Cross site scripting in yetiforce/yetiforce-crm CVE-2022-2890, GHSA-jhxh-68jj-68c7 | Medium | 0.9% | 22 Aug, 2022 | Packagist yetiforce/yetiforce-crm |
Cross site scripting in yetiforce/yetiforce-crm CVE-2022-1340, GHSA-w83m-rghh-frxj | Medium | 0.5% | 22 Aug, 2022 | Packagist yetiforce/yetiforce-crm |
Cross site scripting in yetiforce/yetiforce-crm CVE-2022-2885, GHSA-rjvc-mf7r-ch7r | Medium | 0.5% | 21 Aug, 2022 | Packagist yetiforce/yetiforce-crm |
Magento Open Source has Improper Access Control vulnerability CVE-2022-35692, GHSA-gm4m-9rm8-7rxj | Medium | 0.8% | 19 Aug, 2022 | Packagist magento/community-edition Packagist magento/project-community-edition |
Cross site scripting in getkirby/starterkit CVE-2022-35174, GHSA-4m2g-668v-jwjx | Medium | 0.7% | 18 Aug, 2022 | Packagist getkirby/starterkit |
NotrinosERP Cross-site Scripting vulnerability CVE-2022-2871, GHSA-hrx5-cv4v-4c44 | Medium | 0.7% | 17 Aug, 2022 | Packagist notrinos/notrinos-erp |
Magento Improper Access Control vulnerability BIT-magento-2022-34259, CVE-2022-34259, GHSA-9wjf-94h3-r4rh | Medium | 1.6% | 16 Aug, 2022 | Packagist magento/community-edition |
Magento stored Cross-Site Scripting (XSS) vulnerability BIT-magento-2022-34258, CVE-2022-34258, GHSA-5m55-g8pv-x8ww | Medium | 69.2% | 16 Aug, 2022 | Packagist magento/community-edition |
Magento stored Cross-Site Scripting (XSS) vulnerability BIT-magento-2022-34257, CVE-2022-34257, GHSA-rg7p-wmgj-f374 | Medium | 1.0% | 16 Aug, 2022 | Packagist magento/community-edition |
Moodle reflected XSS Vulnerability BIT-moodle-2020-14320, CVE-2020-14320, GHSA-fcpw-vqh5-6qwj | Medium | 0.7% | 16 Aug, 2022 | Packagist moodle/moodle |
ForkCMS XSS via `end_date` parameter CVE-2022-35590, GHSA-pw4j-r69m-rrr5 | Medium | 0.8% | 12 Aug, 2022 | Packagist forkcms/forkcms |
ForkCMS XSS via `publish_on_time` parameter CVE-2022-35589, GHSA-q4qv-3x58-rxmh | Medium | 0.8% | 12 Aug, 2022 | Packagist forkcms/forkcms |
ForkCMS XSS via `publish_on_date` parameter CVE-2022-35587, GHSA-65wf-qm95-6mhm | Medium | 0.8% | 12 Aug, 2022 | Packagist forkcms/forkcms |
ForkCMS stored XSS via `start_date` parameter CVE-2022-35585, GHSA-9hmc-87h4-w869 | Medium | 0.8% | 12 Aug, 2022 | Packagist forkcms/forkcms |
Microweber's title parameter in the body of POST request vulnerable to stored XSS CVE-2022-2777, GHSA-cf6r-q678-f2p7 | Medium | 0.5% | 11 Aug, 2022 | Packagist microweber/microweber |
Moodle XSS Vulnerability BIT-moodle-2020-1691, CVE-2020-1691, GHSA-cwhp-rqfr-8462 | Medium | 0.6% | 05 Aug, 2022 | Packagist moodle/moodle |
Byobu user preference to prevent private discussions being started are not respected CVE-2022-35921, GHSA-6gjm-6wj6-4px5 | Medium | 0.5% | 01 Aug, 2022 | Packagist fof/byobu |
Feehi CMS Cross-site Scripting CVE-2022-34140, GHSA-25q6-m425-9fqr | Medium | 4.8% | 28 Jul, 2022 | Packagist feehi/cms |
Shopware vulnerable to persistent cross site scripting (XSS) in customer module CVE-2022-31148, GHSA-5834-xv5q-cgfw | Medium | 0.7% | 27 Jul, 2022 | Packagist shopware/shopware |
Diactoros before 2.11.1 vulnerable to HTTP Host Header Attack CVE-2022-31109, GHSA-8274-h5jp-97vr | Medium | 0.8% | 27 Jul, 2022 | Packagist laminas/laminas-diactoros |
Moodle LTI module reflected XSS risk BIT-moodle-2022-35653, CVE-2022-35653, GHSA-62wh-m4jr-233r | Medium | 4.8% | 25 Jul, 2022 | Packagist moodle/moodle |
Moodle Open redirect risk in mobile auto-login feature BIT-moodle-2022-35652, CVE-2022-35652, GHSA-243v-5pff-qqfj | Medium | 1.1% | 25 Jul, 2022 | Packagist moodle/moodle |
Moodle Stored XSS and blind SSRF possible via SCORM track details BIT-moodle-2022-35651, CVE-2022-35651, GHSA-wwv7-h477-wrv7 | Medium | 1.1% | 25 Jul, 2022 | Packagist moodle/moodle |
Microweber before 1.2.21 vulnerable to reflected XSS CVE-2022-2470, GHSA-cfcg-2qgr-v243 | Medium | 1.0% | 22 Jul, 2022 | Packagist microweber/microweber |
Microweber Stored Cross-site Scripting before v1.2.20 CVE-2022-2495, GHSA-xg72-6c83-ghh4 | Medium | 0.7% | 22 Jul, 2022 | Packagist microweber/microweber |
Lack of domain validation in Druple core BIT-drupal-2022-25276, CVE-2022-25276, DRUPAL-CORE-2022-015, GHSA-4wfq-jc9h-vpcx | Medium | 0.5% | 20 Jul, 2022 | Packagist drupal/core |
Access bypass in Drupal Core BIT-drupal-2022-25278, CVE-2022-25278, DRUPAL-CORE-2022-013, GHSA-cfh2-7f6h-3m85 | Medium | 0.6% | 20 Jul, 2022 | Packagist drupal/core |
Dompdf before v2.0.0 vulnerable to chroot check bypass CVE-2022-2400, GHSA-5qj8-6xxj-hp9h | Medium | 1.2% | 18 Jul, 2022 | Packagist dompdf/dompdf |
WooCommerce WordPress plugin before 6.6.0 vulnerable to stored HTML injection CVE-2022-2099, GHSA-jwvf-28fg-g4xg | Medium | 0.7% | 17 Jul, 2022 | Packagist woocommerce/woocommerce |
Bypass of CMS Safe Mode Security Feature GHSA-q37h-jhf3-85cj | Medium | Not scored | 15 Jul, 2022 | Packagist wintercms/winter |
OroCommerce vulnerable to XSS when adding class name to Selector Manager on pages that use GrapeJS editor GHSA-6f85-3f8q-qc94 | Medium | Not scored | 15 Jul, 2022 | Packagist oro/commerce |
libconnect Extension for Typo3 Vulnerable to XSS CVE-2022-33157, GHSA-c8f2-5h29-8j2h | Medium | 0.6% | 12 Jul, 2022 | Packagist subhh/libconnect |
Cross site scripting in ameos_tarteaucitron CVE-2022-33155, GHSA-4vr9-33fv-mg6r | Medium | 0.5% | 12 Jul, 2022 | Packagist ameos/ameos_tarteaucitron |
Microweber before v1.2.20 vulnerable to cross-site scripting CVE-2022-2353, GHSA-gmh3-x5w7-jg5m | Medium | 0.5% | 09 Jul, 2022 | Packagist microweber/microweber |