Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Drupal core contains a potential PHP Object Injection vulnerability BIT-drupal-2024-55636, CVE-2024-55636, DRUPAL-CORE-2024-006, GHSA-938f-5r4f-h65v | Critical | 0.9% | 20 Nov, 2024 | Packagist drupal/core Packagist drupal/core-recommended Packagist drupal/drupal |
LibreNMS has an Authenticated OS Command Injection CVE-2024-51092, GHSA-x645-6pf9-xwxw | Critical | 7.2% | 15 Nov, 2024 | Packagist librenms/librenms |
Improper Restriction of XML External Entity Reference in dompdf/dompdf CVE-2021-3902, GHSA-3vjh-xrhf-v9xh | Critical | 1.0% | 15 Nov, 2024 | Packagist dompdf/dompdf |
Deserialization of Untrusted Data in dompdf/dompdf CVE-2021-3838, GHSA-577p-7j7h-2jgf | Critical | 1.4% | 15 Nov, 2024 | Packagist dompdf/dompdf |
FileManager Deserialization of Untrusted Data vulnerability CVE-2024-52306, GHSA-8237-957h-h2c2 | Critical | 0.6% | 13 Nov, 2024 | Packagist backpack/filemanager |
Symfony vulnerable to command execution hijack on Windows with Process class CVE-2024-51736, GHSA-qq5c-677p-737q | Critical | 0.4% | 06 Nov, 2024 | Packagist symfony/process Packagist symfony/symfony |
YesWiki Uses a Broken or Risky Cryptographic Algorithm CVE-2024-51478, GHSA-4fvx-h823-38v3 | Critical | 0.4% | 31 Oct, 2024 | Packagist yeswiki/yeswiki |
ThinkPHP deserialization vulnerability CVE-2024-48112, GHSA-pjhx-j53p-c5f5 | Critical | 0.9% | 30 Oct, 2024 | Packagist topthink/thinkphp |
Remote code execution in php-heic-to-jpg CVE-2024-48514, GHSA-g8v9-c8m3-942v | Critical | 1.0% | 24 Oct, 2024 | Packagist maestroerror/php-heic-to-jpg |
ThinkPHP deserialization vulnerability CVE-2024-44902, GHSA-f4wh-359g-4pq7 | Critical | 4.2% | 09 Sep, 2024 | Packagist topthink/framework |
Powermail TYPO3 extension Broken Access Control in the OutputController CVE-2024-45233, GHSA-9jqr-5x45-pgw8 | Critical | 0.4% | 29 Aug, 2024 | Packagist in2code/powermail |
Shopware vulnerable to blind SQL-injection in DAL aggregations CVE-2024-42357, GHSA-p6w9-r443-r752 | Critical | 0.6% | 08 Aug, 2024 | Packagist shopware/core Packagist shopware/platform |
Shopware vulnerable to Server Side Template Injection in Twig using deprecation silence tag CVE-2024-42355, GHSA-27wp-jvhw-v4xp | Critical | 0.9% | 08 Aug, 2024 | Packagist shopware/core Packagist shopware/platform |
Studio 42 elFinder vulnerable to Incorrect Access Control CVE-2024-38909, GHSA-3h9f-mm2x-4j58 | Critical | 0.5% | 30 Jul, 2024 | Packagist studio-42/elfinder |
Admidio Vulnerable to RCE via Arbitrary File Upload in Message Attachment CVE-2024-38529, GHSA-g872-jwwr-vggm | Critical | 1.2% | 29 Jul, 2024 | Packagist admidio/admidio |
Admidio has Blind SQL Injection in ecard_send.php CVE-2024-37906, GHSA-69wx-xc6j-28v3 | Critical | 0.9% | 29 Jul, 2024 | Packagist admidio/admidio |
RaspAP allows an attacker to escalate privileges CVE-2024-41637, GHSA-q623-2j2j-23jj | Critical | 0.8% | 29 Jul, 2024 | Packagist billz/raspap-webgui |
TorrentPier Deserialization of Untrusted Data vulnerability CVE-2024-40624, GHSA-fg86-4c2r-7wxw | Critical | 1.0% | 15 Jul, 2024 | Packagist torrentpier/torrentpier |
EGroupware mishandles an ORDER BY clause CVE-2024-40614, GHSA-phg7-8mm9-gj88 | Critical | 0.7% | 07 Jul, 2024 | Packagist egroupware/egroupware |
Craft CMS SQL injection vulnerability via the GraphQL API endpoint CVE-2024-37843, GHSA-hq4f-mv3q-8wcv | Critical | 53.2% | 25 Jun, 2024 | Packagist craftcms/cms |
Magento Open Source Improper Access Control vulnerability BIT-magento-2024-34107, CVE-2024-34107, GHSA-r7cm-g469-wm4g | Critical | 1.1% | 13 Jun, 2024 | Packagist magento/community-edition |
Magento Open Source Improper Authentication vulnerability BIT-magento-2024-34103, CVE-2024-34103, GHSA-f7q4-9gwv-6774 | Critical | 0.9% | 13 Jun, 2024 | Packagist magento/community-edition |
Magento Open Source affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability BIT-magento-2024-34102, CVE-2024-34102, GHSA-m8cj-3v68-3cxj | CriticalExploited | 100.0% | 13 Jun, 2024 | Packagist magento/community-edition |
Zendframework1 Potential SQL injection in ORDER and GROUP functions GHSA-6fqw-j3vm-7f66 | Critical | Not scored | 07 Jun, 2024 | Packagist zendframework/zendframework1 |
Zendframework1 potential SQL injection vector using null byte for PDO (MsSql, SQLite) GHSA-v42g-7q2x-cw32 | Critical | Not scored | 07 Jun, 2024 | Packagist zendframework/zendframework1 |
ZendFramework1 Potential SQL injection in the ORDER implementation of Zend_Db_Select GHSA-2x36-qhx3-7m5f | Critical | Not scored | 07 Jun, 2024 | Packagist zendframework/zendframework1 |
willdurand/js-translation-bundle potential path traversal attack and remote code injection GHSA-x86x-qhf8-f37w | Critical | Not scored | 07 Jun, 2024 | Packagist willdurand/js-translation-bundle |
Zend-JSON vulnerable to XXE/XEE attacks GHSA-8x2v-pcg7-94f4 | Critical | Not scored | 07 Jun, 2024 | Packagist zendframework/zend-json |
ZendFramework potential XML eXternal Entity injection vectors GHSA-mhpx-3rv8-wrjm | Critical | Not scored | 07 Jun, 2024 | Packagist zendframework/zendframework1 |
ZendFramework potential SQL Injection Vector When Using PDO_MySql GHSA-qf36-fx9f-232x | Critical | Not scored | 07 Jun, 2024 | Packagist zendframework/zendframework1 |
ZendFramework vulnerable to XXE/XEE attacks GHSA-f4fj-q6m4-cc52 | Critical | Not scored | 07 Jun, 2024 | Packagist zendframework/zend-xmlrpc |
Zendframework vulnerable to XXE/XEE attacks GHSA-qc7w-4567-84wv | Critical | Not scored | 07 Jun, 2024 | Packagist zendframework/zendframework |
Arbitrary Code Execution in TYPO3 CMS GHSA-67wg-6j7r-mqh8 | Critical | Not scored | 05 Jun, 2024 | Packagist typo3/cms |
Missing Access Check in TYPO3 CMS GHSA-gwfx-p7mr-f92v | Critical | Not scored | 05 Jun, 2024 | Packagist typo3/cms |
Unsafe Reflection in base Component class in yiisoft/yii2 CVE-2024-4990, GHSA-cjcc-p67m-7qxm | Critical | 80.2% | 02 Jun, 2024 | Packagist yiisoft/yii2 |
Moodle Improper Input Validation BIT-moodle-2024-33999, CVE-2024-33999, GHSA-r2wx-46gp-rp3h | Critical | 0.5% | 31 May, 2024 | Packagist moodle/moodle |
TYPO3 CMS Insecure Deserialization & Arbitrary Code Execution GHSA-cc97-g92w-jm65 | Critical | Not scored | 30 May, 2024 | Packagist typo3/cms-core |
titon/framework vulnerable to Remote Code Execution via Chosen-Ciphertext Attack GHSA-q3jm-v27q-jfww | Critical | Not scored | 30 May, 2024 | Packagist titon/framework |
Symfony XML decoding attack vector through external entities GHSA-mmcv-fvq8-r9x3 | Critical | Not scored | 30 May, 2024 | Packagist symfony/symfony |
Symfony XML decoding attack vector through external entities GHSA-j68w-pg49-f6vx | Critical | Not scored | 30 May, 2024 | Packagist symfony/serializer |
Swiftmailer Sendmail transport arbitrary shell execution GHSA-4qpj-gxxg-jqg4 | Critical | Not scored | 29 May, 2024 | Packagist swiftmailer/swiftmailer |
Dolibarr vulnerable to SQL Injection BIT-dolibarr-2024-5315, CVE-2024-5315, GHSA-q8x7-jc3h-p8xc | Critical | 34.5% | 24 May, 2024 | Packagist dolibarr/dolibarr |
Dolibarr vulnerable to SQL Injection BIT-dolibarr-2024-5314, CVE-2024-5314, GHSA-c3h9-q3jx-w7fc | Critical | 0.6% | 24 May, 2024 | Packagist dolibarr/dolibarr |
Silverstripe Brute force bypass on default admin GHSA-8v6m-7f5v-hhx6 | Critical | Not scored | 23 May, 2024 | Packagist silverstripe/framework |
VuFind Server-Side Request Forgery (SSRF) vulnerability CVE-2024-25738, GHSA-wx24-vqrg-m6m5 | Critical | 0.7% | 22 May, 2024 | Packagist vufind/vufind |
VuFind Server-Side Request Forgery (SSRF) vulnerability CVE-2024-25737, GHSA-fwhc-mm9q-mqq8 | Critical | 0.4% | 22 May, 2024 | Packagist vufind/vufind |
Shopware Remote Code Execution Vulnerability GHSA-83jv-4prm-34g7 | Critical | Not scored | 21 May, 2024 | Packagist shopware/shopware |
Shopware Remote Code Execution Vulnerability GHSA-7336-ghhp-f2qj | Critical | Not scored | 21 May, 2024 | Packagist shopware/shopware |
Shopware Remote Code Execution Vulnerability GHSA-q3g4-2vw9-xv27 | Critical | Not scored | 21 May, 2024 | Packagist shopware/shopware |
propel/propel1 SQL injection possible with limit() on MySQL GHSA-7g7c-qhf3-x59p | Critical | Not scored | 20 May, 2024 | Packagist propel/propel1 |