Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Neos Flow Information disclosure in entity security GHSA-9cw3-j7wg-jwj8 | Medium | Not scored | 17 May, 2024 | Packagist neos/flow |
Neos Flow Arbitrary file upload and XML External Entity processing GHSA-5vv7-j593-mgjc | Medium | Not scored | 17 May, 2024 | Packagist neos/flow |
Submariner Operator sets unnecessary RBAC permissions CVE-2024-5042, GHSA-2rhx-qhxp-5jpw, GO-2024-2866 | Medium | 0.5% | 17 May, 2024 | Go github.com/submariner-io/submariner-operator |
Denial of service of Minder Server with attacker-controlled REST endpoint CVE-2024-35185, GHSA-fjw8-3gp8-4cvx, GO-2024-2864 | Medium | 0.5% | 16 May, 2024 | Go github.com/stacklok/minder |
REXML contains a denial of service vulnerability CVE-2024-35176, GHSA-vg3r-rm7w-2xgh | Medium | 2.1% | 16 May, 2024 | RubyGems rexml |
MLflow allows low privilege users to delete any artifact BIT-mlflow-2024-4263, CVE-2024-4263, GHSA-p4jx-q62p-x5jr, PYSEC-2024-51 | Medium | 0.3% | 16 May, 2024 | PyPI mlflow |
Magento Cross-Site Scripting (XSS) vulnerability GHSA-mcfc-67vm-j568 | Medium | Not scored | 15 May, 2024 | Packagist magento/community-edition |
Data Leakage Vulnerability in livewire/livewire GHSA-qwvp-268g-jjm8 | Medium | Not scored | 15 May, 2024 | Packagist livewire/livewire |
Insecure State Generation in laravel/socialite GHSA-h97c-qp24-439v | Medium | Not scored | 15 May, 2024 | Packagist laravel/socialite |
State Guessing Vulnerability in laravel/socialite GHSA-7fjv-25q9-2w88 | Medium | Not scored | 15 May, 2024 | Packagist laravel/socialite |
Laravel Guard bypass in Eloquent models GHSA-44pg-c29v-hp6r | Medium | Not scored | 15 May, 2024 | Packagist laravel/framework |
Laravel Cross-site Scripting (XSS) vulnerability in blade templating GHSA-vr95-p7q6-8m9q | Medium | Not scored | 15 May, 2024 | Packagist laravel/framework |
Laravel Encrypter Component Potential Decryption Failure Leading to Unintended Behavior GHSA-7852-w36x-6mf6 | Medium | Not scored | 15 May, 2024 | Packagist laravel/framework |
Laravel Hijacked authentication cookies vulnerability GHSA-p62r-7637-3wwc | Medium | Not scored | 15 May, 2024 | Packagist laravel/framework |
Laravel Risk of mass-assignment vulnerabilities GHSA-rj3w-99gc-8j58 | Medium | Not scored | 15 May, 2024 | Packagist laravel/framework |
Read private customer data reclaiming carts in Klaviyo Magento GHSA-hvgw-gg3p-295j | Medium | Not scored | 15 May, 2024 | Packagist klaviyo/magento2-extension |
Laravel Cross-site Scripting vulnerability in blade templating GHSA-297g-xg4h-7w4c | Medium | Not scored | 15 May, 2024 | Packagist illuminate/view |
Laravel Risk of mass-assignment vulnerabilities GHSA-cc2w-ghc5-m5qr | Medium | Not scored | 15 May, 2024 | Packagist illuminate/database |
Laravel Hijacked authentication cookies vulnerability GHSA-q4xf-7fw5-4x8v | Medium | Not scored | 15 May, 2024 | Packagist illuminate/auth |
fuel/core Crypt encryption compromised. GHSA-fgrx-4637-fcf5 | Medium | Not scored | 15 May, 2024 | Packagist fuel/core |
FOSUserBundle User Identity Validation Vulnerability GHSA-8wx3-8m4x-g5h4 | Medium | Not scored | 15 May, 2024 | Packagist friendsofsymfony/user-bundle |
FOSUserBundle Entropy is lost in the TokenGenerator GHSA-pjx8-984p-7p3x | Medium | Not scored | 15 May, 2024 | Packagist friendsofsymfony/user-bundle |
FOSRestBundle issue with broken validation of JSONP callbacks GHSA-p9fg-j6ww-953m | Medium | Not scored | 15 May, 2024 | Packagist friendsofsymfony/rest-bundle |
friendsofsymfony/oauth2-php open redirection in oauth GHSA-xm3x-4ph3-3x9c | Medium | Not scored | 15 May, 2024 | Packagist friendsofsymfony/oauth2-php |
eZ Platform Admin UI is vulnerable to Cross-site Scripting (XSS) GHSA-w9p3-26fx-5mp3 | Medium | Not scored | 15 May, 2024 | Packagist ezsystems/platform-ui-assets-bundle |
Ez Platform Object Injection in legacy shop module GHSA-39j2-4p9j-5w4j | Medium | Not scored | 15 May, 2024 | Packagist ezsystems/ezpublish-legacy |
Ez Platform and Legacy are prone to an insecure interpretation of PHP/PHAR uploads GHSA-pqjm-xcp8-wgmm | Medium | Not scored | 15 May, 2024 | Packagist ezsystems/ezpublish-legacy |
eZ Publish Legacy Cross-site Scripting (XSS) in 'disabled module' error template GHSA-2vh3-cj9j-mcj5 | Medium | Not scored | 15 May, 2024 | Packagist ezsystems/ezpublish-legacy |
eZ Platform Prevent accepting app.php in URL in Platform.sh GHSA-qhjc-hg94-245v | Medium | Not scored | 15 May, 2024 | Packagist ezsystems/ezplatform |
eZ Platform REST API returns list of all SiteAccesses GHSA-9wwx-c723-vm8x | Medium | Not scored | 15 May, 2024 | Packagist ezsystems/ezpublish-kernel |
eZ Platform Rules to disable executable access are ignored on Platform.sh (eZ Cloud) GHSA-6xch-2vxx-5pvr | Medium | Not scored | 15 May, 2024 | Packagist ezsystems/ezplatform |
eZ Platform Editor Cross-site Scripting (XSS) GHSA-4c2w-v5rq-5mx7 | Medium | Not scored | 15 May, 2024 | Packagist ezsystems/ezplatform-admin-ui-assets |
eZ Platform Bundled jQuery affected by CVE-2019-11358 GHSA-jrpw-8884-2747 | Medium | Not scored | 15 May, 2024 | Packagist ezsystems/ezplatform-admin-ui-assets |
ezsystems/ez-support-tools Failing access control in system info view GHSA-xmp3-7745-g4vj | Medium | Not scored | 15 May, 2024 | Packagist ezsystems/ez-support-tools |
endroid/qr-code-bundle File Disclosure via logo_path query parameter GHSA-mvf6-3f2g-xfxf | Medium | Not scored | 15 May, 2024 | Packagist endroid/qr-code-bundle |
Drupal Cross-Site Scripting (XSS) affecting CKEditor Third-party library GHSA-qf65-hph9-453r | Medium | Not scored | 15 May, 2024 | Packagist drupal/drupal |
Drupal core uses a vulnerable Third-party library CKEditor GHSA-337w-fxpq-5m34 | Medium | Not scored | 15 May, 2024 | Packagist drupal/drupal |
Drupal core Open Redirect vulnerability GHSA-wxfg-253g-m7r4 | Medium | Not scored | 15 May, 2024 | Packagist drupal/drupal |
Drupal core Access control bypass GHSA-5x28-3f32-x523 | Medium | Not scored | 15 May, 2024 | Packagist drupal/drupal |
Drupal core Denial of Service GHSA-w333-5f96-mjrr | Medium | Not scored | 15 May, 2024 | Packagist drupal/drupal |
Drupal Malicious file upload with filenames stating with dot GHSA-58xv-7h9r-mx3c | Medium | Not scored | 15 May, 2024 | Packagist drupal/drupal |
Drupal Anonymous Open Redirect GHSA-x6v2-xmrq-574j | Medium | Not scored | 15 May, 2024 | Packagist drupal/drupal |
Drupal Content moderation Access bypass GHSA-86xw-vmcx-9mj4 | Medium | Not scored | 15 May, 2024 | Packagist drupal/drupal |
Drupal External URL injection through URL aliases leading to Open Redirect GHSA-r67r-42wx-c8r7 | Medium | Not scored | 15 May, 2024 | Packagist drupal/drupal |
Drupal core Cross-Site Scripting (XSS) vulnerabilities GHSA-vfgc-c76h-mwh4 | Medium | Not scored | 15 May, 2024 | Packagist drupal/core |
Drupal core Open Redirect vulnerability GHSA-6gf6-24h2-66j4 | Medium | Not scored | 15 May, 2024 | Packagist drupal/core |
Drupal core uses a vulnerable Third-party library CKEditor GHSA-v273-j5hq-26xp | Medium | Not scored | 15 May, 2024 | Packagist drupal/core |
Drupal core Access bypass GHSA-mh4h-27gq-cxwj | Medium | Not scored | 15 May, 2024 | Packagist drupal/core |
Drupal core unrestricted file upload GHSA-7gwj-7fhm-vw4w | Medium | Not scored | 15 May, 2024 | Packagist drupal/core |
Drupal core Denial of Service GHSA-pr99-c33p-fwf6 | Medium | Not scored | 15 May, 2024 | Packagist drupal/core |