Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
matrix-media-repo (MMR) allows denial of service/high operating costs through unauthenticated downloads CVE-2024-36403, GHSA-vc2m-hw89-qjxf, GO-2025-3401 | Medium | Not scored | 16 Jan, 2025 | Go github.com/t2bot/matrix-media-repo |
matrix-media-repo (MMR) allows unauthenticated writes to the media repository, which may allow planting of problematic content CVE-2024-36402, GHSA-8vmr-h7h5-cqhg, GO-2025-3397 | Medium | Not scored | 16 Jan, 2025 | Go github.com/t2bot/matrix-media-repo |
Librenms has a reflected XSS on error alert CVE-2025-23201, GHSA-g84x-g96g-rcjc | Medium | 0.4% | 16 Jan, 2025 | Packagist librenms/librenms |
LibreNMS Misc Section Stored Cross-site Scripting vulnerability CVE-2025-23200, GHSA-c66p-64fj-jmc2 | Medium | 31.6% | 16 Jan, 2025 | Packagist librenms/librenms |
LibreNMS Ports Stored Cross-site Scripting vulnerability CVE-2025-23199, GHSA-27vf-3g4f-6jp7 | Medium | 1.3% | 16 Jan, 2025 | Packagist librenms/librenms |
LibreNMS Display Name Stored Cross-site Scripting vulnerability CVE-2025-23198, GHSA-pm8j-3v64-92cq | Medium | 0.4% | 16 Jan, 2025 | Packagist librenms/librenms |
LibreNMS Display Name 2 Stored Cross-site Scripting vulnerability CVE-2024-56144, GHSA-2f4w-6mc7-4w78 | Medium | 0.4% | 16 Jan, 2025 | Packagist librenms/librenms |
parse-uri Regular expression Denial of Service (ReDoS) CVE-2024-36751, GHSA-6fx8-h7jm-663j | Medium | 0.5% | 15 Jan, 2025 | npm parse-uri npm parseuri |
Mattermost fails to properly validate post props CVE-2025-20086, GHSA-5m7j-6gc4-ff5g, GO-2025-3392 | Medium | Not scored | 15 Jan, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost fails to properly validate post props CVE-2025-20088, GHSA-45v9-w9fh-33j6, GO-2025-3394 | Medium | Not scored | 15 Jan, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost Incorrect Type Conversion or Cast CVE-2025-21088, GHSA-8j3q-gc9x-7972, GO-2025-3393 | Medium | Not scored | 15 Jan, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Silverstripe Framework has a XSS in form messages CVE-2024-53277, GHSA-ff6q-3c9c-6cf5 | Medium | 0.3% | 14 Jan, 2025 | Packagist silverstripe/framework |
Silverstripe Framework has a XSS via insert media remote file oembed CVE-2024-47605, GHSA-7cmp-cgg8-4c82 | Medium | 1.2% | 14 Jan, 2025 | Packagist silverstripe/framework |
Mediawiki - DataTransfer Extension Cross-Site Request Forgery (CSRF) and Cross-site Scripting (XSS) CVE-2025-23081, GHSA-c3h5-h73c-29hq | Medium | 0.2% | 14 Jan, 2025 | Packagist mediawiki/data-transfer |
TYPO3 DB Check Module vulnerable to Cross-Site Request Forgery CVE-2024-55945, GHSA-8mv3-37rc-pvxj | Medium | 0.2% | 14 Jan, 2025 | Packagist typo3/cms-lowlevel |
TYPO3 Indexed Search Module vulnerable to Cross-Site Request Forgery CVE-2024-55923, GHSA-7r5q-4qgx-v545 | Medium | 0.2% | 14 Jan, 2025 | Packagist typo3/cms-indexed-search |
TYPO3 Form Framework Module vulnerable to Cross-Site Request Forgery CVE-2024-55922, GHSA-ww7h-g2qf-7xv6 | Medium | 0.2% | 14 Jan, 2025 | Packagist typo3/cms-form |
TYPO3 Cross-Site Request Forgery in Dashboard Module CVE-2024-55920, GHSA-qwx7-39pw-2mhr | Medium | 0.2% | 14 Jan, 2025 | Packagist typo3/cms-dashboard |
TYPO3 Cross-Site Request Forgery in Backend User Module CVE-2024-55894, GHSA-6w4x-gcx3-8p7v | Medium | 0.3% | 14 Jan, 2025 | Packagist typo3/cms-beuser |
TYPO3 Cross-Site Request Forgery in Log Module CVE-2024-55893, GHSA-cjfr-9f5r-3q93 | Medium | 0.3% | 14 Jan, 2025 | Packagist typo3/cms-belog |
TYPO3 Potential Open Redirect via Parsing Differences CVE-2024-55892, GHSA-2fx5-pggv-6jjr | Medium | 0.2% | 14 Jan, 2025 | Packagist typo3/cms-core |
TYPO3 Information Disclosure via Exception Handling/Logger CVE-2024-55891, GHSA-38x7-cc6w-j27q | Medium | 0.3% | 14 Jan, 2025 | Packagist typo3/cms-install |
OpenFGA Authorization Bypass CVE-2024-56323, GHSA-32q6-rr98-cjqv, GO-2025-3384 | Medium | Not scored | 13 Jan, 2025 | Go github.com/openfga/openfga |
notation-go's timestamp signature generation lacks certificate revocation check CVE-2024-56138, GHSA-45v3-38pc-874v, GO-2025-3381 | Medium | Not scored | 13 Jan, 2025 | Go github.com/notaryproject/notation-go |
Microweber Cross-site Scripting vulnerability CVE-2024-33299, GHSA-97h9-p9f8-4p3r | Medium | 1.2% | 10 Jan, 2025 | Packagist microweber/microweber |
Microweber Cross-site Scripting vulnerability CVE-2024-33298, GHSA-w5g5-4jj3-8f6v | Medium | 0.9% | 10 Jan, 2025 | Packagist microweber/microweber |
Microweber Cross-site Scripting vulnerability CVE-2024-33297, GHSA-j4v9-cm37-h7c2 | Medium | 1.2% | 10 Jan, 2025 | Packagist microweber/microweber |
Mattermost Improper Validation of Specified Type of Input vulnerability CVE-2025-20033, GHSA-2549-xh72-qrpm, GO-2025-3379 | Medium | Not scored | 09 Jan, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Stored XSS in REDAXO CVE-2024-13209, GHSA-7wj8-856p-qc9m | Medium | 0.4% | 09 Jan, 2025 | Packagist redaxo/source |
Carbon has an arbitrary file include via unvalidated input passed to Carbon::setLocale CVE-2025-22145, GHSA-j3f9-p6hm-5w6q | Medium | 0.8% | 08 Jan, 2025 | Packagist nesbot/carbon |
Composio Command Execution vulnerability CVE-2024-53526, GHSA-8h93-28hg-fj84, PYSEC-2026-1268, PYSEC-2026-2428, PYSEC-2026-2429 | Medium | 0.6% | 08 Jan, 2025 | PyPI composio-claude PyPI composio-julep PyPI composio-openai |
The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: [https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai...](https://www.drupal CVE-2025-3059, DRUPAL-CONTRIB-2025-002 | Medium | 0.5% | 08 Jan, 2025 | Packagist:https://packages.drupal.org/8 drupal/profile_private |
keras Path Traversal vulnerability CVE-2024-55459, GHSA-cjgq-5qmw-rcj6, PYSEC-2025-121 | Medium | 0.2% | 08 Jan, 2025 | PyPI keras |
Soft Serve vulnerable to path traversal attacks CVE-2025-22130, GHSA-j4jw-m6xr-fv6c, GO-2025-3374 | Medium | Not scored | 08 Jan, 2025 | Go github.com/charmbracelet/soft-serve |
Guzzle OAuth Subscriber has insufficient nonce entropy CVE-2025-21617, GHSA-237r-r8m4-4q88 | Medium | 0.5% | 06 Jan, 2025 | Packagist guzzlehttp/oauth-subscriber |
REDAXO CMS Cross-site Scripting vulnerability CVE-2024-46209, GHSA-2p95-8xvm-2pjx | Medium | 0.4% | 06 Jan, 2025 | Packagist redaxo/source |
Grav Cross-site Scripting vulnerability CVE-2024-35498, GHSA-m78c-qx99-mvw9 | Medium | 0.4% | 06 Jan, 2025 | Packagist getgrav/grav |
Next.js Allows a Denial of Service (DoS) with Server Actions CVE-2024-56332, GHSA-7m27-7ghc-44w9 | Medium | 0.8% | 03 Jan, 2025 | npm next |
PhpSpreadsheet allows bypass XSS sanitizer using the javascript protocol and special characters CVE-2024-56412, GHSA-q9jv-mm3r-j47r | Medium | 0.4% | 03 Jan, 2025 | Packagist phpoffice/phpexcel Packagist phpoffice/phpspreadsheet |
PhpSpreadsheet has a Cross-Site Scripting (XSS) vulnerability of the hyperlink base in the HTML page header CVE-2024-56411, GHSA-hwcp-2h35-p66w | Medium | 0.4% | 03 Jan, 2025 | Packagist phpoffice/phpexcel Packagist phpoffice/phpspreadsheet |
PhpSpreadsheet has a Cross-Site Scripting (XSS) vulnerability in custom properties CVE-2024-56410, GHSA-wv23-996v-q229 | Medium | 0.3% | 03 Jan, 2025 | Packagist phpoffice/phpexcel Packagist phpoffice/phpspreadsheet |
Trix allows Cross-site Scripting via `javascript:` url in a link CVE-2025-21610, GHSA-j386-3444-qgwg | Medium | 0.4% | 03 Jan, 2025 | npm trix |
Karmada Tar Slips in CRDs archive extraction CVE-2024-56514, GHSA-cwrh-575j-8vr3, GO-2025-3363 | Medium | Not scored | 03 Jan, 2025 | Go github.com/karmada-io/karmada |
The wp-enable-svg WordPress plugin does not sanitize SVG files when uploaded CVE-2024-11184, GHSA-j77f-79w9-rghc | Medium | 0.4% | 02 Jan, 2025 | Packagist mwdelaney/wp-enable-svg |
LGSL has a reflected XSS at /lgsl_files/lgsl_list.php CVE-2024-56517, GHSA-ggwq-xc72-33r3 | Medium | 0.6% | 30 Dec, 2024 | Packagist tltneon/lgsl |
Password Pusher Allows Session Token Interception Leading to Potential Hijacking CVE-2024-56733, GHSA-4fwj-m62q-pp47 | Medium | Not scored | 30 Dec, 2024 | RubyGems pwpush |
khoj has an IDOR in subscription management allows unauthorized subscription modifications CVE-2024-52294, GHSA-hq4h-w933-jm6c, PYSEC-2026-1493 | Medium | 0.4% | 30 Dec, 2024 | PyPI khoj |
TeamPass mail_me operation authorization issue CVE-2024-50702, GHSA-7rm3-4w6j-8xx4 | Medium | 0.3% | 30 Dec, 2024 | Packagist nilsteampassnet/teampass |
TeamPass does not properly check whether a folder is in a user's allowed folders list CVE-2024-50701, GHSA-2697-96mv-3gfm | Medium | 0.3% | 30 Dec, 2024 | Packagist nilsteampassnet/teampass |
Dcat-Admin Cross-Site Scripting (XSS) vulnerability CVE-2024-54775, GHSA-37x3-j9jq-vrjx | Medium | 0.3% | 27 Dec, 2024 | Packagist dcat/laravel-admin |