Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
SimpleSAMLphp xml-common XXE vulnerability CVE-2024-52596, GHSA-2x65-fpch-2fcm | High | 1.0% | 02 Dec, 2024 | Packagist simplesamlphp/xml-common |
Ibexa Admin UI vulnerable to Cross-site Scripting in a field that is used in the Content name pattern CVE-2024-53864, GHSA-8w3p-gf85-qcch | Medium | 0.5% | 29 Nov, 2024 | Packagist ibexa/admin-ui |
Withdrawn Advisory: Symfony http-security has authentication bypass CVE-2024-36611, GHSA-7q22-x757-cmgc | High | 0.8% | 29 Nov, 2024 | Packagist symfony/security-http |
SPEmailHandler-PHP has Potential Abuse for Sending Arbitrary Emails CVE-2024-53860, GHSA-mj5r-x73q-fjw6 | High | 0.5% | 27 Nov, 2024 | Packagist spencer14420/sp-php-email-handler |
TCPDF Local File Inclusion vulnerability CVE-2024-51058, GHSA-rmv2-8jjc-23xw | Medium | 0.8% | 26 Nov, 2024 | Packagist tecnickcom/tcpdf |
Drupal core contains a potential PHP Object Injection vulnerability BIT-drupal-2024-55638, CVE-2024-55638, DRUPAL-CORE-2024-008, GHSA-gvf2-2f4g-jqf4 | Critical | 1.0% | 20 Nov, 2024 | Packagist drupal/core Packagist drupal/core-recommended Packagist drupal/drupal |
Drupal core contains a potential PHP Object Injection vulnerability BIT-drupal-2024-55637, CVE-2024-55637, DRUPAL-CORE-2024-007, GHSA-w6rx-9g2x-mg5g | Critical | 0.8% | 20 Nov, 2024 | Packagist drupal/core Packagist drupal/core-recommended Packagist drupal/drupal |
Drupal core contains a potential PHP Object Injection vulnerability BIT-drupal-2024-55636, CVE-2024-55636, DRUPAL-CORE-2024-006, GHSA-938f-5r4f-h65v | Critical | 0.9% | 20 Nov, 2024 | Packagist drupal/core Packagist drupal/core-recommended Packagist drupal/drupal |
Drupal core Access bypass BIT-drupal-2024-55634, CVE-2024-55634, DRUPAL-CORE-2024-004, GHSA-7cwc-fjqm-8vh8 | High | 0.4% | 20 Nov, 2024 | Packagist drupal/core Packagist drupal/core-recommended Packagist drupal/drupal |
Drupal Core Cross-Site Scripting (XSS) BIT-drupal-2024-12393, CVE-2024-12393, DRUPAL-CORE-2024-003, GHSA-8mvq-8h2v-j9vf | Medium | 0.3% | 20 Nov, 2024 | Packagist drupal/core Packagist drupal/core-recommended Packagist drupal/drupal |
Moodle IDOR when accessing list of course badges BIT-moodle-2024-48899, CVE-2024-48899, GHSA-r4xr-m393-778m | Medium | 0.3% | 20 Nov, 2024 | Packagist moodle/moodle |
Moodle Lesson activity password bypass through PHP loose comparison BIT-moodle-2024-45691, CVE-2024-45691, GHSA-xfv7-h2qg-rjm7 | Medium | 0.4% | 20 Nov, 2024 | Packagist moodle/moodle |
Moodle IDOR when deleting OAuth2 linked accounts BIT-moodle-2024-45690, CVE-2024-45690, GHSA-fhg2-r2h9-h7q8 | High | 0.4% | 20 Nov, 2024 | Packagist moodle/moodle |
Moodle allows users to retrieve information they did not have permission to access BIT-moodle-2024-45689, CVE-2024-45689, GHSA-j822-x5gg-5r56 | Medium | 0.4% | 20 Nov, 2024 | Packagist moodle/moodle |
Statamic CMS has a Path Traversal in Asset Upload CVE-2024-52600, GHSA-p7f6-8mcm-fwv3 | Medium | 0.6% | 19 Nov, 2024 | Packagist statamic/cms |
Redaxo Core CMS Cross Site Scripting (XSS) CVE-2024-50803, GHSA-m5vv-7jxc-8p6x | Medium | 0.6% | 19 Nov, 2024 | Packagist redaxo/source |
XXE in PHPSpreadsheet's XLSX reader CVE-2024-48917, GHSA-7cc9-j4mv-vcjp | High | 0.7% | 18 Nov, 2024 | Packagist phpoffice/phpexcel Packagist phpoffice/phpspreadsheet |
XmlScanner bypass leads to XXE CVE-2024-47873, GHSA-jw4x-v69f-hh5w | High | 0.8% | 18 Nov, 2024 | Packagist phpoffice/phpexcel Packagist phpoffice/phpspreadsheet |
moodle: IDOR when fetching report schedules BIT-moodle-2024-48901, CVE-2024-48901, GHSA-mg54-p2wj-5ph7 | Medium | 0.3% | 18 Nov, 2024 | Packagist moodle/moodle |
moodle: Some users can delete audiences of other reports BIT-moodle-2024-48898, CVE-2024-48898, GHSA-fjq9-452g-jg3q | Medium | 0.3% | 18 Nov, 2024 | Packagist moodle/moodle |
moodle: IDOR in edit/delete RSS feed BIT-moodle-2024-48897, CVE-2024-48897, GHSA-x3x9-349x-2485 | Medium | 0.3% | 18 Nov, 2024 | Packagist moodle/moodle |
Moodle leaks user names BIT-moodle-2024-48896, CVE-2024-48896, GHSA-cq5f-wv7p-5gfc | Medium | 0.4% | 18 Nov, 2024 | Packagist moodle/moodle |
LibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/includes/html/pages/device/services.inc.php CVE-2024-52526, GHSA-8fh4-942r-jf2g | High | 0.5% | 15 Nov, 2024 | Packagist librenms/librenms |
LibreNMS has an Authenticated OS Command Injection CVE-2024-51092, GHSA-x645-6pf9-xwxw | Critical | 7.2% | 15 Nov, 2024 | Packagist librenms/librenms |
LibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/includes/html/print-customoid.php CVE-2024-51497, GHSA-gv4m-f6fx-859x | High | 0.4% | 15 Nov, 2024 | Packagist librenms/librenms |
LibreNMS has a Reflected XSS ('Cross-site Scripting') in librenms/includes/html/pages/wireless.inc.php CVE-2024-51496, GHSA-28p7-f6h6-3jh3 | High | 0.4% | 15 Nov, 2024 | Packagist librenms/librenms |
LibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/includes/html/dev-overview-data.inc.php CVE-2024-51495, GHSA-p66q-ppwr-q5j8 | High | 0.4% | 15 Nov, 2024 | Packagist librenms/librenms |
LibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/app/Http/Controllers/Table/EditPortsController.php CVE-2024-51494, GHSA-7663-37rg-c377 | High | 0.4% | 15 Nov, 2024 | Packagist librenms/librenms |
LibreNMS has a Persistent XSS from Insecure Input Sanitization Affects Multiple Endpoints CVE-2024-50355, GHSA-4m5r-w2rq-q54q | High | 0.3% | 15 Nov, 2024 | Packagist librenms/librenms |
LibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/includes/html/pages/device/overview/services.inc.php CVE-2024-50352, GHSA-qr8f-5qqg-j3wg | High | 41.4% | 15 Nov, 2024 | Packagist librenms/librenms |
LibreNMS has a Reflected XSS ('Cross-site Scripting') in librenms/includes/functions.php CVE-2024-50351, GHSA-v7w9-63xh-6r3w | High | 0.4% | 15 Nov, 2024 | Packagist librenms/librenms |
LibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/app/Http/Controllers/Table/EditPortsController.php CVE-2024-50350, GHSA-xh4g-c9p6-5jxg | High | 0.4% | 15 Nov, 2024 | Packagist librenms/librenms |
LibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/includes/html/pages/device/capture.inc.php CVE-2024-49764, GHSA-rmr4-x6c9-jc68 | High | 0.4% | 15 Nov, 2024 | Packagist librenms/librenms |
Stored XSS ('Cross-site Scripting') in librenms/includes/html/pages/edituser.inc.php CVE-2024-49759, GHSA-888j-pjqh-fx58 | High | 0.4% | 15 Nov, 2024 | Packagist librenms/librenms |
LibreNMS has a stored XSS in ExamplePlugin with Device's Notes CVE-2024-49758, GHSA-c86q-rj37-8f85 | Medium | 0.4% | 15 Nov, 2024 | Packagist librenms/librenms |
LibreNMS has a stored XSS ('Cross-site Scripting') in librenms/includes/html/pages/api-access.inc.php CVE-2024-49754, GHSA-gfwr-xqmj-j27v | High | 73.9% | 15 Nov, 2024 | Packagist librenms/librenms |
CSRF leading to delete account in wallabag/wallabag CVE-2023-0737, GHSA-99w8-c5f6-96pp | Medium | 0.3% | 15 Nov, 2024 | Packagist wallabag/wallabag |
Improper Authorization in dolibarr/dolibarr BIT-dolibarr-2021-3991, CVE-2021-3991, GHSA-wppr-j57c-8jpm | Medium | 0.3% | 15 Nov, 2024 | Packagist dolibarr/dolibarr |
Improper Restriction of XML External Entity Reference in dompdf/dompdf CVE-2021-3902, GHSA-3vjh-xrhf-v9xh | Critical | 1.0% | 15 Nov, 2024 | Packagist dompdf/dompdf |
Cross site scripting in sylius/sylius CVE-2021-3841, GHSA-hhvr-2q69-4563 | Medium | 0.3% | 15 Nov, 2024 | Packagist sylius/sylius |
Deserialization of Untrusted Data in dompdf/dompdf CVE-2021-3838, GHSA-577p-7j7h-2jgf | Critical | 1.4% | 15 Nov, 2024 | Packagist dompdf/dompdf |
Symfony has an Authentication Bypass via RememberMe CVE-2024-51996, GHSA-cg23-qf8f-62rr | High | 0.6% | 13 Nov, 2024 | Packagist symfony/security-http |
FileManager Deserialization of Untrusted Data vulnerability CVE-2024-52306, GHSA-8237-957h-h2c2 | Critical | 0.6% | 13 Nov, 2024 | Packagist backpack/filemanager |
UnoPim Stored XSS : Cookie hijacking through Create User function CVE-2024-52305, GHSA-cgr4-c233-h733 | Medium | 0.2% | 13 Nov, 2024 | Packagist unopim/unopim |
Moodle IDOR when accessing list of badge recipients BIT-moodle-2024-48900, CVE-2024-48900, GHSA-g8r3-2v89-j6r5 | Medium | 0.4% | 13 Nov, 2024 | Packagist moodle/moodle |
Craft CMS vulnerable to Potential Remote Code Execution via missing path normalization & Twig SSTI CVE-2024-52293, GHSA-f3cw-hg6r-chfv | High | 1.4% | 13 Nov, 2024 | Packagist craftcms/cms |
Craft CMS Arbitrary System File Read CVE-2024-52292, GHSA-cw6g-qmjq-6w2w | High | 0.7% | 13 Nov, 2024 | Packagist craftcms/cms |
Local File System Validation Bypass Leading to File Overwrite, Sensitive File Access, and Potential Code Execution CVE-2024-52291, GHSA-jrh5-vhr9-qh7q | High | 1.3% | 13 Nov, 2024 | Packagist craftcms/cms |
Cross Site Scripting vulnerability in Snipe-IT CVE-2024-51093, GHSA-hw9x-8m75-4vjq | High | 0.4% | 12 Nov, 2024 | Packagist snipe/snipe-it |
Laravel environment manipulation via query string BIT-laravel-2024-52301, CVE-2024-52301, GHSA-gv7v-rgg6-548h | High | 44.8% | 12 Nov, 2024 | Packagist laravel/framework |