Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
TYPO3 Broken Access Control in Localization Handling GHSA-9rx9-7fmh-gj3g | Medium | Not scored | 30 May, 2024 | Packagist typo3/cms-core |
TYPO3 Cross-Site Scripting in Fluid ViewHelpers GHSA-22q7-cg4r-p9mx | Medium | Not scored | 30 May, 2024 | Packagist typo3/cms-fluid |
TYPO3 Denial of Service in Online Media Asset Handling GHSA-29m4-mx89-3mjg | Medium | Not scored | 30 May, 2024 | Packagist typo3/cms-core |
path traversal vulnerability was identified in the parisneo/lollms-webui CVE-2024-4330, GHSA-9p73-x86v-jw57, PYSEC-2026-1589 | Medium | 0.3% | 30 May, 2024 | PyPI lollms |
code injection vulnerability exists in the huggingface/text-generation-inference repository CVE-2024-3924, GHSA-qq99-p57r-g3v7, PYSEC-2026-1966 | Medium | 0.3% | 30 May, 2024 | PyPI text-generation |
TYPO3 Information Disclosure in Install Tool GHSA-66c2-7g4p-wx4p | Medium | Not scored | 30 May, 2024 | Packagist typo3/cms-core |
TYPO3 Cross-Site Scripting in Frontend User Login GHSA-8c25-vj2w-p72j | Medium | Not scored | 30 May, 2024 | Packagist typo3/cms-core |
TYPO3 Cross-Site Scripting in Backend Modal Component GHSA-g4c9-qfvw-fmr4 | Medium | Not scored | 30 May, 2024 | Packagist typo3/cms-core |
TYPO3 Cross-Site Scripting in Online Media Asset Rendering GHSA-wg8h-gxf4-g4gh | Medium | Not scored | 30 May, 2024 | Packagist typo3/cms-core |
Twig Path Traversal vulnerability in the filesystem loader GHSA-7cvr-xhm5-x998 | Medium | Not scored | 30 May, 2024 | Packagist twig/twig |
Thelia BackOffice default template vulnerable to Cross-site Scripting GHSA-pp7v-wxx9-hm6r | Medium | Not scored | 30 May, 2024 | Packagist thelia/backoffice-default-template |
Thelia Cross-site Scripting vulnerability in BackOffice GHSA-vq4j-qcx7-ppc6 | Medium | Not scored | 30 May, 2024 | Packagist thelia/thelia |
Symfony2 improper IP based access control GHSA-hx53-jchx-cr52 | Medium | Not scored | 30 May, 2024 | Packagist symfony/symfony |
Symfony may allow a user to switch to using another user's identity GHSA-7mx2-7q8p-pgmw | Medium | Not scored | 30 May, 2024 | Packagist symfony/symfony |
Symfony has unsafe methods in the Request class CVE-2015-2309, GHSA-p684-f7fh-jv2j | Medium | Not scored | 30 May, 2024 | Packagist symfony/http-foundation Packagist symfony/symfony |
Symfony has a security issue when parsing the Authorization header CVE-2014-6061, GHSA-h7v2-2qwg-h829 | Medium | Not scored | 30 May, 2024 | Packagist symfony/http-foundation Packagist symfony/symfony |
Symfony2 security issue when the trust proxy mode is enabled GHSA-vfm6-r2gc-pwww | Medium | Not scored | 30 May, 2024 | Packagist symfony/http-foundation Packagist symfony/symfony |
symbiote/silverstripe-multivaluefield Possible PHP Object Injection via Multi-Value Field Extension GHSA-g5vj-wj9x-4jg9 | Medium | Not scored | 29 May, 2024 | Packagist symbiote/silverstripe-multivaluefield |
Sylius Admin Bundle Cross-Site Request Forgery vulnerability GHSA-945h-6vcv-pc8h | Medium | Not scored | 29 May, 2024 | Packagist sylius/admin-bundle |
Sylius Resource Bundle Cross-Site Request Forgery vulnerability GHSA-65v7-wg35-2qpm | Medium | Not scored | 29 May, 2024 | Packagist sylius/resource-bundle |
MinIO information disclosure vulnerability CVE-2024-36107, GHSA-95fr-cm4m-q5p9, GO-2024-2886 | Medium | 0.6% | 29 May, 2024 | Go github.com/minio/minio |
Aimeos denial of service vulnerability in SaaS and marketplace setups CVE-2024-37294, GHSA-xjm6-jfmg-qc6p | Medium | 0.4% | 29 May, 2024 | Packagist aimeos/aimeos-core |
stormpath/sdk uses Insecure Random Number Generator GHSA-q8fc-v85f-78pw | Medium | Not scored | 29 May, 2024 | Packagist stormpath/sdk |
ScnSocialAuth Cross-site Scripting vulnerability in login redirect param GHSA-g6f5-4w43-2x63 | Medium | Not scored | 29 May, 2024 | Packagist socalnick/scn-social-auth |
Nautobot dynamic-group-members doesn't enforce permission restrictions on member objects CVE-2024-36112, GHSA-qmjf-wc2h-6x3q, PYSEC-2024-166 | Medium | 0.4% | 28 May, 2024 | PyPI nautobot |
SimpleSAMLphp Information Disclosure vulnerability GHSA-ppm4-r2vc-pg74 | Medium | Not scored | 28 May, 2024 | Packagist simplesamlphp/simplesamlphp |
SimpleSAMLphp Reflected Cross-site Scripting vulnerability GHSA-vpr3-cw3h-prw8 | Medium | Not scored | 28 May, 2024 | Packagist simplesamlphp/simplesamlphp |
SimpleSAMLphp exposes credentials in session storage GHSA-7wh8-jrq7-p27f | Medium | Not scored | 28 May, 2024 | Packagist simplesamlphp/simplesamlphp |
SimpleSAMLphp Link Injection vulnerability GHSA-v858-922f-fj9v | Medium | Not scored | 28 May, 2024 | Packagist simplesamlphp/simplesamlphp |
silverstripe/userforms file upload exposure on UserForms module GHSA-55pp-293f-3365 | Medium | Not scored | 28 May, 2024 | Packagist silverstripe/userforms |
Denial of service of Minder Server from maliciously crafted GitHub attestations CVE-2024-35238, GHSA-8fmj-33gw-g7pw, GO-2024-2885 | Medium | 0.5% | 28 May, 2024 | Go github.com/stacklok/minder |
formwork Cross-site scripting vulnerability in Markdown fields CVE-2024-35621, GHSA-gx8m-f3mp-fg99 | Medium | 0.3% | 28 May, 2024 | Packagist getformwork/formwork |
Kaminari Insecure File Permissions Vulnerability CVE-2024-32978, GHSA-7r3j-qmr4-jfpj | Medium | 0.6% | 28 May, 2024 | RubyGems kaminari |
silverstripe/framework may disclose database credentials during connection failure GHSA-m2hh-2m46-x6j5 | Medium | Not scored | 28 May, 2024 | Packagist silverstripe/framework |
silverstripe/framework vulnerable to member disclosure in login form GHSA-crr3-h4m8-7f56 | Medium | Not scored | 27 May, 2024 | Packagist silverstripe/framework |
silverstripe/framework uploaded PHP script execution in assets GHSA-f43j-8hq4-2xj9 | Medium | Not scored | 27 May, 2024 | Packagist silverstripe/framework |
silverstripe/framework's install.php script discloses sensitive data by pre-populating DB credential forms GHSA-r3pr-fh25-wrfc | Medium | Not scored | 27 May, 2024 | Packagist silverstripe/framework |
silverstripe/framework Privilege Escalation Risk in Member Edit form GHSA-xpff-c35g-j3cr | Medium | Not scored | 27 May, 2024 | Packagist silverstripe/framework |
silverstripe/framework's URL parameters `isDev` and `isTest` unguarded GHSA-55qg-6c4m-mw6g | Medium | Not scored | 27 May, 2024 | Packagist silverstripe/framework |
silverstripe/framework users inadvertently passing sensitive data to LoginAttempt GHSA-ph62-fv59-vf9h | Medium | Not scored | 27 May, 2024 | Packagist silverstripe/framework |
silverstripe/framework has Cross-site Scripting vulnerability in page history comparison GHSA-c4c3-j73v-634r | Medium | Not scored | 27 May, 2024 | Packagist silverstripe/framework |
silverstripe/framework has Cross-site Scripting vulnerability in RedirectorPage GHSA-pp7q-6j3f-74vj | Medium | Not scored | 27 May, 2024 | Packagist silverstripe/framework |
silverstripe/framework has Cross-site Scripting vulnerability in CMSSecurity BackURL GHSA-r85g-7jpv-8xrx | Medium | Not scored | 27 May, 2024 | Packagist silverstripe/framework |
silverstripe/framework has Cross-site Scripting vulnerability in page name GHSA-hhvj-mcrx-3vcf | Medium | Not scored | 27 May, 2024 | Packagist silverstripe/framework |
silverstripe/framework member disclosure in login form GHSA-g84q-cq55-xwgp | Medium | Not scored | 27 May, 2024 | Packagist silverstripe/framework |
silverstripe/framework vulnerable to Cross-site Scripting In `OptionsetField` and `CheckboxSetField` GHSA-468j-6jrc-2rjx | Medium | Not scored | 27 May, 2024 | Packagist silverstripe/framework |
silverstripe/framework's `Member.Name` is not escaped GHSA-r9vp-fp72-xgf7 | Medium | Not scored | 27 May, 2024 | Packagist silverstripe/framework |
silverstripe/framework missing ACL on reports GHSA-52cx-hpc5-cxwc | Medium | Not scored | 27 May, 2024 | Packagist silverstripe/framework |
silverstripe/framework ChangePasswordForm does not check `Member::canLogIn()` GHSA-p5h2-vr99-xm99 | Medium | Not scored | 27 May, 2024 | Packagist silverstripe/framework |
SilverStripe comments module includes version of jQuery vulnerable to Cross-site Scripting GHSA-frm9-7pm9-5rgc | Medium | Not scored | 27 May, 2024 | Packagist silverstripe/comments |