Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Propel2 SQL injection possible with limit() on MySQL GHSA-7vw7-qx38-37vr | Critical | Not scored | 20 May, 2024 | Packagist propel/propel |
Flow Swift Mailer package Remote code execution GHSA-rq6q-hjvh-5mwh | Critical | Not scored | 17 May, 2024 | Packagist neos/swiftmailer |
namshi/jose - Verification bypass GHSA-4rr6-gf59-ggw5 | Critical | Not scored | 17 May, 2024 | Packagist namshi/jose |
Magento RCE,XSS and other vulnerabilities GHSA-8j7c-682x-r9f2 | Critical | Not scored | 15 May, 2024 | Packagist magento/community-edition |
Magento remote code execution (RCE), Cross-Site Scripting (XSS) and other vulnerabilities GHSA-5gmh-85x8-5cx7 | Critical | Not scored | 15 May, 2024 | Packagist magento/community-edition |
Magento Open Source Security Advisory: Patch SUPEE-10975 GHSA-cv25-3pxr-4q7x | Critical | Not scored | 15 May, 2024 | Packagist magento/community-edition |
Magento Patch SUPEE-9652 - Remote Code Execution using mail vulnerability GHSA-26hq-7286-mg8f | Critical | Not scored | 15 May, 2024 | Packagist magento/community-edition |
Magento Security enhancements that help close RCE,XSS,CSRF and other vulnerabilities GHSA-6wm4-3rjj-c8xx | Critical | Not scored | 15 May, 2024 | Packagist magento/community-edition |
Magento Patch SUPEE-10752 - Multiple security enhancements vulnerabilities GHSA-prpf-cj87-hwvr | Critical | Not scored | 15 May, 2024 | Packagist magento/community-edition |
Laravel RCE vulnerability in "cookie" session driver GHSA-qm5c-m76r-2hfr | Critical | Not scored | 15 May, 2024 | Packagist laravel/framework |
Laravel RCE vulnerability in "cookie" session driver GHSA-2ffv-r4r9-r8xr | Critical | Not scored | 15 May, 2024 | Packagist illuminate/cookie |
gree/jose - "None" Algorithm treated as valid in tokens GHSA-9gxv-x7rp-r2hc | Critical | Not scored | 15 May, 2024 | Packagist gree/jose |
firebase/php-jwt: "None" Algorithm treated as valid on tokens GHSA-h533-5v22-8vcp | Critical | Not scored | 15 May, 2024 | Packagist firebase/php-jwt |
Drupal core Remote Code Execution GHSA-jf8c-36vw-98x4 | Critical | Not scored | 15 May, 2024 | Packagist drupal/drupal |
Drupal Core Insufficient Contextual Links validation leads to Remote Code Execution GHSA-jjx7-8462-w4m4 | Critical | Not scored | 15 May, 2024 | Packagist drupal/drupal |
Drupal Core Insufficient Contextual Links validation leads to Remote Code Execution GHSA-7v68-3pr5-h3cr | Critical | Not scored | 15 May, 2024 | Packagist drupal/core |
Drupal core Remote Code Execution GHSA-6mgp-v5cm-ghg5 | Critical | Not scored | 15 May, 2024 | Packagist drupal/core |
Doctrine SQL injection vulnerability GHSA-6q9v-4hq6-5m67 | Critical | Not scored | 15 May, 2024 | Packagist doctrine/orm |
contao/core Insufficient input validation allows for code injection and remote execution GHSA-wxxw-5gq6-j2g5 | Critical | Not scored | 15 May, 2024 | Packagist contao/core |
codeigniter/framework SQL injection in ODBC database driver GHSA-27qr-636m-wxg2 | Critical | Not scored | 15 May, 2024 | Packagist codeigniter/framework |
ADOdb SQL injection vulnerability GHSA-h63c-xvpf-264j | Critical | Not scored | 15 May, 2024 | Packagist adodb/adodb-php |
Grav Vulnerable to Arbitrary File Read to Account Takeover CVE-2024-34082, GHSA-f8v5-jmfh-pr69 | Critical | 3.0% | 15 May, 2024 | Packagist getgrav/grav |
PrestaShop cross-site scripting via customer contact form in FO, through file upload CVE-2024-34716, GHSA-45vm-3j38-7p78 | Critical | 56.4% | 14 May, 2024 | Packagist prestashop/prestashop |
Cockpit CMS contains an arbitrary file upload vulenrability CVE-2024-4825, GHSA-vpj8-xfqc-jcv9 | Critical | 0.7% | 14 May, 2024 | Packagist cockpit-hq/cockpit |
Blind XSS Leading to Froxlor Application Compromise CVE-2024-34070, GHSA-x525-54hf-xr53 | Critical | 1.0% | 10 May, 2024 | Packagist froxlor/froxlor |
Zenario uses Twig filters insecurely in the Twig Snippet plugin CVE-2024-34461, GHSA-hr2r-w6wc-25pv | Critical | 1.0% | 04 May, 2024 | Packagist tribalsystems/zenario |
PHPECC vulnerable to multiple cryptographic side-channel attacks GHSA-346h-749j-r28w | Critical | Not scored | 25 Apr, 2024 | Packagist mdanter/ecc |
Mautic vulnerable to stored cross-site scripting in description field CVE-2021-27915, GHSA-2rc5-2755-v422 | Critical | 0.6% | 11 Apr, 2024 | Packagist mautic/core |
WWBN AVideo Remote Code Execution CVE-2024-31819, GHSA-mv5w-wr5c-575p | Critical | 15.6% | 10 Apr, 2024 | Packagist wwbn/avideo |
Magento Open Source allows Improper Input Validation BIT-magento-2024-20758, CVE-2024-20758, GHSA-wh4m-6rh3-p4rq | Critical | 1.4% | 10 Apr, 2024 | Packagist magento/community-edition Packagist magento/project-community-edition |
Gleez Cms Server Side Request Forgery (SSRF) vulnerability CVE-2021-27312, GHSA-7mxg-r76p-363g | Critical | 1.0% | 03 Apr, 2024 | Packagist gleez/cms |
Gadget chain in Symfony 1 due to uncontrolled unserialized input in sfNamespacedParameterHolder CVE-2024-28861, GHSA-pv9j-c53q-h433 | Critical | 1.5% | 22 Mar, 2024 | Packagist friendsofsymfony1/symfony1 |
Gadget chain in Symfony 1 due to vulnerable Swift Mailer dependency CVE-2024-28859, GHSA-wjv8-pxr6-5f4r | Critical | 1.5% | 15 Mar, 2024 | Packagist friendsofsymfony1/swiftmailer Packagist friendsofsymfony1/symfony1 Packagist swiftmailer/swiftmailer |
livehelperchat Server-Side Template Injection CVE-2024-27516, GHSA-v4cp-2q7v-hg9q | Critical | 1.5% | 29 Feb, 2024 | Packagist remdex/livehelperchat |
Withdrawn Advisory: Subrion CMS vulnerable to SQL Injection CVE-2024-25400, GHSA-xxf8-fpmr-fw7v | Critical | 0.7% | 27 Feb, 2024 | Packagist intelliants/subrion |
Dompdf's usage of vulnerable version of phenx/php-svg-lib leads to restriction bypass and potential RCE GHSA-97m3-52wr-xvv2 | Critical | Not scored | 22 Feb, 2024 | Packagist phenx/php-svg-lib |
php-svg-lib lacks path validation on font through SVG inline styles CVE-2024-25117, GHSA-f3qr-qr4x-j273 | Critical | 0.9% | 21 Feb, 2024 | Packagist phenx/php-svg-lib |
Deserialization of Untrusted Data in Torrentpier CVE-2024-1651, GHSA-5rwm-2xw8-hh9p | Critical | 34.2% | 20 Feb, 2024 | Packagist torrentpier/torrentpier |
Pimcore Host Header Injection in user invitation link CVE-2024-25625, GHSA-3qpq-6w89-f7mx | Critical | 0.7% | 19 Feb, 2024 | Packagist pimcore/admin-ui-classic-bundle |
Magento Open Source allows OS Command Injection CVE-2024-20720, GHSA-525f-pvj5-vqmq | Critical | 3.7% | 15 Feb, 2024 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento Open Source allows Cross-Site Scripting (XSS) CVE-2024-20719, GHSA-264g-f7v8-q5qq | Critical | 1.3% | 15 Feb, 2024 | Packagist magento/community-edition Packagist magento/project-community-edition |
Pixelfed doesn't check OAuth Scopes in API routes, giving elevated permissions CVE-2024-25108, GHSA-gccq-h3xj-jgvf | Critical | 0.7% | 12 Feb, 2024 | Packagist pixelfed/pixelfed |
Pimcore Admin Classic Bundle permissions are not getting checked when working with tags CVE-2024-24822, GHSA-3rfr-mpfj-2jwq | Critical | 0.5% | 07 Feb, 2024 | Packagist pimcore/admin-ui-classic-bundle |
Bref vulnerable to Body Parsing Inconsistency in Event-Driven Functions CVE-2024-24754, GHSA-82vx-mm6r-gg8w | Critical | 0.6% | 01 Feb, 2024 | Packagist bref/bref |
Blind SQL injection in shopware CVE-2024-22406, GHSA-qmp9-2xwj-m6m9 | Critical | 0.6% | 16 Jan, 2024 | Packagist shopware/core Packagist shopware/platform |
WWBN AVideo Insufficient Entropy vulnerbaility CVE-2023-49599, GHSA-wqcc-qf63-c2x4 | Critical | 1.0% | 10 Jan, 2024 | Packagist wwbn/avideo |
plotly.js prototype pollution vulnerability CVE-2023-46308, GHSA-wjc4-73q6-gv3m | Critical | 0.9% | 03 Jan, 2024 | Packagist plotly/plotly.js npm plotly.js |
yii2-authclient vulnerable to possible timing attack on string comparison in OAuth1, OAuth2 and OpenID Connect implementation CVE-2023-50708, GHSA-w8vh-p74j-x9xp | Critical | 0.7% | 18 Dec, 2023 | Packagist yiisoft/yii2-authclient |
PHPMemcachedAdmin Path Traversal vulnerability CVE-2023-6026, GHSA-8qfm-h8rh-h3r7 | Critical | 0.9% | 30 Nov, 2023 | Packagist elijaa/phpmemcacheadmin |
October CMS safe mode bypass using Twig sandbox escape CVE-2023-44382, GHSA-p8q3-h652-65vx | Critical | 0.9% | 29 Nov, 2023 | Packagist october/system |