Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Cross-site Scripting in pegasus/google-for-jobs CVE-2021-43561, GHSA-hfm8-2q22-h7hv | Medium | 0.5% | 10 Nov, 2021 | Packagist pegasus/google-for-jobs |
Cross-site Scripting in LibreNMS CVE-2021-43324, GHSA-46rx-6jg9-4fh8 | Medium | 0.6% | 03 Nov, 2021 | Packagist librenms/librenms |
Cross-site scripting vulnerability in TinyMCE plugins CVE-2024-21910, GHSA-r8hm-w5f7-wj39, PYSEC-2026-632 | Medium | 1.0% | 02 Nov, 2021 | NuGet TinyMCE Packagist tinymce/tinymce PyPI django-tinymce npm tinymce |
Cross-Site Scripting in grav CVE-2021-3904, GHSA-5jxc-hmqf-3f73 | Medium | 0.6% | 27 Oct, 2021 | Packagist getgrav/grav |
Cross-Site Request Forgery in firefly-iii CVE-2021-3900, GHSA-pfj7-w373-gqch | Medium | 0.6% | 27 Oct, 2021 | Packagist grumpydictator/firefly-iii |
Authenticated Stored XSS in shopware/shopware CVE-2021-41188, GHSA-4p3x-8qw9-24w9 | Medium | 0.8% | 26 Oct, 2021 | Packagist shopware/shopware |
pterodactyl/panel CSRF allowing an external page to trigger a user logout event CVE-2021-41176, GHSA-m49f-hcxp-6hm6 | Medium | 0.5% | 25 Oct, 2021 | Packagist pterodactyl/panel |
Foxlor cross-site scripting (XSS) vulnerability CVE-2020-28957, GHSA-cv24-vh45-4hjm | Medium | 0.6% | 22 Oct, 2021 | Packagist froxlor/froxlor |
Cross-site scripting in forkcms CVE-2020-23049, GHSA-3374-7h99-xr85 | Medium | 0.6% | 22 Oct, 2021 | Packagist forkcms/forkcms |
Cross-site scripting vulnerability in TinyMCE CVE-2024-21908, GHSA-5h9g-x5rv-25wg | Medium | 1.1% | 22 Oct, 2021 | NuGet TinyMCE Packagist tinymce/tinymce npm tinymce |
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in sulu/sulu CVE-2021-41169, GHSA-h58v-g3q6-q9fx | Medium | 0.6% | 21 Oct, 2021 | Packagist sulu/sulu |
Cross Site Scripting in Microweber CVE-2021-33988, GHSA-w7x8-cq7r-g5g9 | Medium | 1.1% | 19 Oct, 2021 | Packagist microweber/microweber |
Cross-site Scripting in snipe-it CVE-2021-3879, GHSA-9g3v-j3cr-6fc6 | Medium | 0.8% | 19 Oct, 2021 | Packagist snipe/snipe-it |
Cross-site Scripting in snipe-it CVE-2021-3863, GHSA-5rg2-6qr5-2xp8 | Medium | 0.8% | 19 Oct, 2021 | Packagist snipe/snipe-it |
Open Redirect in firefly-iii CVE-2021-3851, GHSA-5fvx-5p2r-4mvp | Medium | 0.6% | 19 Oct, 2021 | Packagist grumpydictator/firefly-iii |
Magento Open Source allows Cross-Site Request Forgery (CSRF) CVE-2021-39864, GHSA-94wq-87g6-8h77 | Medium | 1.6% | 15 Oct, 2021 | Packagist magento/community-edition Packagist magento/project-community-edition |
MediaWiki allows a denial of service BIT-mediawiki-2021-41800, CVE-2021-41800, GHSA-c8wv-qwwc-6j73 | Medium | 1.9% | 11 Oct, 2021 | Packagist mediawiki/core |
Cross-site Scripting in Limesurvey BIT-limesurvey-2021-42112, CVE-2021-42112, GHSA-h9ph-jcgh-gf69 | Medium | 1.5% | 08 Oct, 2021 | Packagist limesurvey/limesurvey |
SilverStripe GraphQL Server permission checker not inherited by query subclass. BIT-silverstripe-2021-28661, CVE-2021-28661, GHSA-r7rh-g777-g5gx | Medium | 0.8% | 07 Oct, 2021 | Packagist silverstripe/graphql |
Cross-site Scripting in SilverStripe Framework BIT-silverstripe-2021-36150, CVE-2021-36150, GHSA-j66h-cc96-c32q | Medium | 0.9% | 07 Oct, 2021 | Packagist silverstripe/admin |
HTTP Host Header Injection BIT-typo3-2021-41114, CVE-2021-41114, GHSA-m2jh-fxw4-gphm | Medium | 1.2% | 05 Oct, 2021 | Packagist typo3/cms Packagist typo3/cms-core |
Cross-site scripting in application/controllers/dropbox.php in JustWriting CVE-2021-41467, GHSA-gxmc-5wj3-jx64 | Medium | 3.6% | 01 Oct, 2021 | Packagist hjue/justwriting |
Cross-site scripting in demos/demo.mysqli.php in getID3 CVE-2021-40926, GHSA-x2gw-85w6-fjjw | Medium | 1.0% | 01 Oct, 2021 | Packagist james-heinrich/getid3 |
Cross-site Scripting in LaraCMS CVE-2020-20129, GHSA-m72g-42q6-gvc2 | Medium | 0.6% | 29 Sep, 2021 | Packagist wanglelecc/laracms |
File reference keys leads to incorrect hashes on HMAC algorithms CVE-2021-41106, GHSA-7322-jrq4-x5hf | Medium | 0.2% | 28 Sep, 2021 | Packagist lcobucci/jwt |
Cross-site Scripting in GilaCMS CVE-2020-20696, GHSA-h7mq-27r7-w972 | Medium | 0.5% | 27 Sep, 2021 | Packagist gilacms/gila |
Cross-site Scripting in GilaCMS CVE-2020-20695, GHSA-6675-wwqr-jhmf | Medium | 0.5% | 27 Sep, 2021 | Packagist gilacms/gila |
Reliance on Cookies without Validation and Integrity Checking in getgrav/grav CVE-2021-3818, GHSA-cg3q-59w7-rvc2 | Medium | 2.5% | 27 Sep, 2021 | Packagist getgrav/grav |
Incorrect Authorization in Drupal core BIT-drupal-2020-13676, CVE-2020-13676, DRUPAL-CORE-2021-009, GHSA-qfhg-m6r8-xxpj | Medium | 0.8% | 15 Sep, 2021 | Packagist drupal/core |
Cross-Site Request Forgery in Drupal core BIT-drupal-2020-13674, CVE-2020-13674, DRUPAL-CORE-2021-007, GHSA-j586-cj67-vg4p | Medium | 0.5% | 15 Sep, 2021 | Packagist drupal/core |
This advisory addresses a similar issue to [Drupal core - Moderately critical - Cross Site Request Forgery - SA-CORE-2021-006](https://www.drupal.org/sa-core-2021-006).
The Entity Embed module provides a filter to allow embedding entities in content fields. In certain circumstances, the filter coul CVE-2020-13673, DRUPAL-CONTRIB-2021-028, DRUPAL-CORE-2021-006 | Medium | 0.3% | 15 Sep, 2021 | Packagist drupal/core Packagist:https://packages.drupal.org/8 drupal/entity_embed |
Observable Response Discrepancy in Lost Password Service CVE-2021-39189, GHSA-579x-cjvr-cqj9 | Medium | 1.4% | 15 Sep, 2021 | Packagist pimcore/pimcore |
Cross-site Scripting in yourls CVE-2021-3785, GHSA-m9fq-c9hp-59g7 | Medium | 0.7% | 15 Sep, 2021 | Packagist yourls/yourls |
Cross-site Scripting in yourls CVE-2021-3783, GHSA-cpq8-x35g-m439 | Medium | 0.7% | 15 Sep, 2021 | Packagist yourls/yourls |
Cross-site Scripting in LibreNMS CVE-2021-31274, GHSA-2r2w-jrh2-p4gr | Medium | 0.8% | 08 Sep, 2021 | Packagist librenms/librenms |
Magento Improper Authorization vulnerability in the customers module BIT-magento-2021-28567, CVE-2021-28567, GHSA-cc3w-r3w8-hfh7 | Medium | 0.8% | 08 Sep, 2021 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento discloses sensitive information CVE-2021-36039, GHSA-3g7m-g8qm-x6j5 | Medium | 1.7% | 01 Sep, 2021 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento discloses sensitive information via the Multishipping Module CVE-2021-36038, GHSA-wgpr-9675-8r67 | Medium | 1.8% | 01 Sep, 2021 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento is affected by an improper authorization vulnerability CVE-2021-36037, GHSA-vrq2-w7r7-3fp2 | Medium | 1.8% | 01 Sep, 2021 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento stored cross-site scripting vulnerability CVE-2021-36027, GHSA-x2v2-2jhp-c5hv | Medium | 1.4% | 01 Sep, 2021 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento stored cross-site scripting vulnerability in the customer address upload feature CVE-2021-36026, GHSA-8gfq-m4cf-w975 | Medium | 1.7% | 01 Sep, 2021 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento affected by a business logic error in the placeOrder graphql mutation CVE-2021-36012, GHSA-3f97-7pgv-gmgr | Medium | 2.0% | 01 Sep, 2021 | Packagist magento/community-edition Packagist magento/project-community-edition |
XSS vulnerability on password reset page CVE-2021-27909, GHSA-32hw-3pvh-vcvc | Medium | 4.1% | 30 Aug, 2021 | Packagist mautic/core |
Cross-site scripting in feehicms CVE-2020-19709, GHSA-f8pv-x7h8-687v | Medium | 0.6% | 26 Aug, 2021 | Packagist feehi/feehicms |
CKEditor 4 vulnerabilities in versions <4.16.1 GHSA-cfcv-q4qq-2ph4 | Medium | Not scored | 23 Aug, 2021 | Packagist pimcore/pimcore |
firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF) CVE-2021-3730, GHSA-c676-mcw3-qg55 | Medium | 0.5% | 23 Aug, 2021 | Packagist grumpydictator/firefly-iii |
firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF) CVE-2021-3729, GHSA-gp6w-ccqv-p7qr | Medium | 0.4% | 23 Aug, 2021 | Packagist grumpydictator/firefly-iii |
firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF) CVE-2021-3728, GHSA-xp5q-77mh-6hm2 | Medium | 0.5% | 23 Aug, 2021 | Packagist grumpydictator/firefly-iii |
Insecure direct object reference of log files of the Import/Export feature CVE-2021-37709, GHSA-54gp-qff8-946c | Medium | 0.8% | 16 Aug, 2021 | Packagist shopware/core Packagist shopware/platform |
Cross-site scripting in imgURL CVE-2021-38713, GHSA-f2rp-j8hv-g5gx | Medium | 0.5% | 16 Aug, 2021 | Packagist helloxz/imgurl |