Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
OroPlatform vulnerable to path traversal during temporary file manipulations CVE-2022-41951, GHSA-9v3j-4j64-p937 | Critical | 0.9% | 27 Nov, 2023 | Packagist oro/platform |
Concrete CMS allows unauthorized access because directories can be created with insecure permissions CVE-2023-48648, GHSA-m87h-jxr6-f82w | Critical | 1.2% | 17 Nov, 2023 | Packagist concrete5/concrete5 |
yiisoft/yii deserializing untrusted user input can lead to remote code execution CVE-2023-47130, GHSA-mw2w-2hj2-fg8q | Critical | 3.1% | 14 Nov, 2023 | Packagist yiisoft/yii |
Statamic CMS remote code execution via front-end form uploads CVE-2023-47129, GHSA-72hg-5wr5-rmfc | Critical | 1.1% | 10 Nov, 2023 | Packagist statamic/cms |
Froxlor Improper Input Validation vulnerability CVE-2023-6069, GHSA-4jch-8qq5-hqg6 | Critical | 0.8% | 10 Nov, 2023 | Packagist froxlor/froxlor |
Moodle Code Injection vulnerability BIT-moodle-2023-5550, CVE-2023-5550, GHSA-5cvx-cwpx-9rjh | Critical | 1.6% | 09 Nov, 2023 | Packagist moodle/moodle |
Magnesium-PHP Injection vulnerability CVE-2017-20187, GHSA-8pp6-5qpw-85g3 | Critical | 0.7% | 05 Nov, 2023 | Packagist floriangaerber/magnesium |
Json response for search reveals Solr credentials GHSA-7crc-r3wg-cfgf | Critical | Not scored | 03 Nov, 2023 | Packagist ezsystems/ezplatform-solr-search-engine |
Json response for search reveals Solr credentials GHSA-v6xp-ccvx-w52m | Critical | Not scored | 03 Nov, 2023 | Packagist ibexa/solr |
Insufficient Session Expiration in thorsten/phpmyfaq CVE-2023-5865, GHSA-f728-prhw-2g68 | Critical | 0.6% | 31 Oct, 2023 | Packagist thorsten/phpmyfaq |
baserCMS Code Injection Vulnerability in Mail Form Feature CVE-2023-43792, GHSA-vrm6-c878-fpq6 | Critical | 0.7% | 26 Oct, 2023 | Packagist baserproject/basercms |
baserCMS CSRF vulnerability in Content preview Feature CVE-2023-43649, GHSA-fw9x-cqjq-7jx5 | Critical | 0.4% | 26 Oct, 2023 | Packagist baserproject/basercms |
Cachet vulnerable to Authenticated Remote Code Execution CVE-2023-43661, GHSA-hv79-p62r-wg3p | Critical | 51.9% | 11 Oct, 2023 | Packagist cachethq/cachet |
phpMyFAQ Cross-site Scripting vulnerability CVE-2023-5320, GHSA-pp4w-g5p4-85p2 | Critical | 0.6% | 30 Sep, 2023 | Packagist thorsten/phpmyfaq |
phpMyFAQ Cross-site Scripting vulnerability CVE-2023-5316, GHSA-58v7-58c2-qwm9 | Critical | 0.5% | 30 Sep, 2023 | Packagist thorsten/phpmyfaq |
phpMyFAQ allows unrestricted file types in image field CVE-2023-5227, GHSA-qcjg-hvg6-hxcp | Critical | 0.6% | 30 Sep, 2023 | Packagist thorsten/phpmyfaq |
Yii2 allows attackers to execute any local .php file via a relative path in the view parameter CVE-2015-5467, GHSA-7cfq-72w2-24q4 | Critical | 0.9% | 21 Sep, 2023 | Packagist yiisoft/yii2 |
Cache poisoning in drupal/core BIT-drupal-2023-5256, CVE-2023-5256, DRUPAL-CORE-2023-006, GHSA-rjqg-3h9m-fx5x | Critical | 0.9% | 20 Sep, 2023 | Packagist drupal/core |
Cross Site Scripting vulnerability in Dolibarr ERP CRM BIT-dolibarr-2023-38888, CVE-2023-38888, GHSA-62wf-h26v-5m57 | Critical | 1.3% | 20 Sep, 2023 | Packagist dolibarr/dolibarr |
Craft CMS Remote Code Execution vulnerability CVE-2023-41892, GHSA-4w8r-3xrw-v25g | Critical | 94.2% | 13 Sep, 2023 | Packagist craftcms/cms |
Snappy PHAR deserialization vulnerability CVE-2023-41330, GHSA-92rv-4j2h-8mjj | Critical | 2.3% | 06 Sep, 2023 | Packagist knplabs/knp-snappy |
Magento improper access control vulnerability within Magento's Media Gallery Upload workflow BIT-magento-2021-36036, CVE-2021-36036, GHSA-wqr6-wv6c-p8fx | Critical | 2.1% | 06 Sep, 2023 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento XML Injection vulnerability in the Widgets Update Layout BIT-magento-2021-36023, CVE-2021-36023, GHSA-8cjg-f53m-8m9q | Critical | 2.4% | 06 Sep, 2023 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento affected by remote code execution vulnerability in the CMS page scheduled update feature BIT-magento-2021-36021, CVE-2021-36021, GHSA-4g27-q2w9-m8m8 | Critical | 2.0% | 06 Sep, 2023 | Packagist magento/community-edition Packagist magento/project-community-edition |
PrestaShop file deletion via CustomerMessage CVE-2023-39530, GHSA-v4gr-v679-42p7 | Critical | 0.9% | 07 Aug, 2023 | Packagist prestashop/prestashop |
PrestaShop file deletion via attachment API CVE-2023-39529, GHSA-2rf5-3fw8-qm47 | Critical | 0.7% | 07 Aug, 2023 | Packagist prestashop/prestashop |
PrestaShop SQL manager vulnerability CVE-2023-39526, GHSA-gf46-prm4-56pc | Critical | 1.7% | 07 Aug, 2023 | Packagist prestashop/prestashop |
PrestaShop path traversal CVE-2023-39525, GHSA-m9r4-3fg7-pqm2 | Critical | 0.9% | 07 Aug, 2023 | Packagist prestashop/prestashop |
PrestaShop boolean SQL injection CVE-2023-39524, GHSA-75p5-jwx4-qw9h | Critical | 0.7% | 07 Aug, 2023 | Packagist prestashop/prestashop |
Cockpit PHP Remote File Inclusion vulnerability CVE-2023-4195, GHSA-xcq3-7pf3-5jvc | Critical | 1.1% | 06 Aug, 2023 | Packagist cockpit-hq/cockpit |
PyroCMS remote code execution vulnerability CVE-2023-29689, GHSA-w7vm-4v3j-vgpw | Critical | 53.5% | 04 Aug, 2023 | Packagist pyrocms/pyrocms |
RaspAP Command Injection vulnerability CVE-2022-39986, GHSA-7c28-wg7r-pg6f | Critical | 99.1% | 01 Aug, 2023 | Packagist billz/raspap-webgui |
phpMyFAQ Improper Neutralization of Formula Elements in a CSV File vulnerability CVE-2023-4006, GHSA-2xvx-368h-qcmv | Critical | 0.8% | 31 Jul, 2023 | Packagist thorsten/phpmyfaq |
XML External Entity (XXE) vulnerability in the XML data handler CVE-2023-38490, GHSA-q386-w6fg-gmgp | Critical | 1.7% | 27 Jul, 2023 | Packagist getkirby/cms |
Froxlor vulnerable to Improper Encoding or Escaping of Output CVE-2023-3668, GHSA-c6v5-pf66-xfq8 | Critical | 1.0% | 14 Jul, 2023 | Packagist froxlor/froxlor |
Orchid Deserialization of Untrusted Data vulnerability leads to Remote Code Execution CVE-2023-36825, GHSA-ph6g-p72v-pc3p | Critical | 1.1% | 11 Jul, 2023 | Packagist orchid/platform |
TeamPass Code Injection vulnerability CVE-2023-3551, GHSA-97hm-2mfr-2p97 | Critical | 1.1% | 08 Jul, 2023 | Packagist nilsteampassnet/teampass |
fuadmin vulnerable to insecure file upload CVE-2023-36097, GHSA-5m3m-q8cq-77g4 | Critical | 0.9% | 22 Jun, 2023 | Packagist funadmin/funadmin |
laravel-s vulnerable to Local File Inclusion CVE-2023-29931, GHSA-q2fp-jw87-86px | Critical | 0.9% | 22 Jun, 2023 | Packagist hhxsv5/laravel-s |
php-imap vulnerable to RCE through a directory traversal vulnerability CVE-2023-35169, GHSA-47p7-xfcc-4pv9 | Critical | 3.2% | 21 Jun, 2023 | Packagist webklex/laravel-imap Packagist webklex/php-imap |
Liufee CMS File Upload vulnerability CVE-2020-21489, GHSA-6vf2-mfmr-qqqw | Critical | 1.3% | 20 Jun, 2023 | Packagist feehi/cms |
liufee CMS File Upload vulnerability CVE-2020-21174, GHSA-q3q5-qvh5-cmw5 | Critical | 1.3% | 20 Jun, 2023 | Packagist feehi/cms |
ipandlanguageredirect extension vulnerable to SQL Injection CVE-2023-35782, GHSA-4xf2-7qfv-mgfx | Critical | 0.5% | 16 Jun, 2023 | Packagist in2code/ipandlanguageredirect |
Grav Server Side Template Injection (SSTI) vulnerability CVE-2023-34251, GHSA-f9jf-4cp4-4fq5 | Critical | 2.3% | 14 Jun, 2023 | Packagist getgrav/grav |
Froxlor vulnerable to Improper Restriction of Excessive Authentication Attempts CVE-2023-3173, GHSA-chw4-88xc-79w6 | Critical | 1.1% | 09 Jun, 2023 | Packagist froxlor/froxlor |
TeamPass vulnerable to stored Cross-site Scripting CVE-2023-3086, GHSA-j245-v2mh-5h6f | Critical | 0.9% | 03 Jun, 2023 | Packagist nilsteampassnet/teampass |
Remote Code Execution Vulnerability in Validation Placeholders in CodeIgniter4 BIT-codeigniter-2023-32692, CVE-2023-32692, GHSA-m6m8-6gq8-c9fj | Critical | 1.1% | 22 May, 2023 | Packagist codeigniter4/framework |
LavaLite vulnerable to web cache poisoning CVE-2023-27238, GHSA-6vcf-cfjp-qxcw | Critical | 0.9% | 12 May, 2023 | Packagist lavalite/cms |
AzuraCast missing brute force prevention CVE-2023-2531, GHSA-4m7v-wr6v-2mw5 | Critical | 0.8% | 05 May, 2023 | Packagist azuracast/azuracast |
phpMyFAQ Improper Access Control vulnerability CVE-2023-2429, GHSA-r69v-q48g-3966 | Critical | 0.5% | 30 Apr, 2023 | Packagist thorsten/phpmyfaq |