Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Magento Improper Access Control vulnerability CVE-2025-24427, GHSA-v3hq-g424-5mgg | Medium | 0.6% | 11 Feb, 2025 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento Business Logic Error vulnerability CVE-2025-24425, GHSA-6ff8-jrfg-43hh | Medium | 0.6% | 11 Feb, 2025 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento Improper Access Control vulnerability CVE-2025-24424, GHSA-539v-w87w-w62c | Medium | 0.8% | 11 Feb, 2025 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento Incorrect Authorization vulnerability CVE-2025-24421, GHSA-v6r2-425c-hfrr | Medium | 0.5% | 11 Feb, 2025 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento Information Exposure vulnerability CVE-2025-24408, GHSA-3cfg-w257-cgf8 | Medium | 1.0% | 11 Feb, 2025 | Packagist magento/community-edition Packagist magento/project-community-edition |
Vulnerable OpenSSL included in cryptography wheels CVE-2024-12797, GHSA-79v4-65xg-pq4g, PYSEC-2026-1284 | Medium | 2.5% | 11 Feb, 2025 | PyPI cryptography |
Apple iOS and iPadOS Incorrect Authorization Vulnerability CVE-2025-24200 | MediumExploited | 4.5% | 10 Feb, 2025 | |
esbuild enables any website to send any requests to the development server and read the response GHSA-67mh-4wv8-2f99 | Medium | Not scored | 10 Feb, 2025 | npm esbuild |
Cross-site Scripting (XSS) in serialize-javascript CVE-2024-11831, GHSA-76p7-773f-r4q5 | Medium | 1.1% | 10 Feb, 2025 | npm serialize-javascript |
Connect-CMS Access control vulnerability GHSA-5rjc-jc28-cwgg | Medium | Not scored | 07 Feb, 2025 | Packagist opensource-workshop/connect-cms |
xml2rfc has file inclusion irregularities GHSA-432c-wxpg-m4q3 | Medium | Not scored | 07 Feb, 2025 | PyPI xml2rfc |
Pimcore Admin Classic Bundle allows user enumeration CVE-2025-24980, GHSA-vr5f-php7-rg24 | Medium | 0.5% | 07 Feb, 2025 | Packagist pimcore/admin-ui-classic-bundle |
Better Auth URL parameter HTML Injection (Reflected Cross-Site scripting) CVE-2025-71404, GHSA-9x4v-xfq5-m8x5 | Medium | 0.7% | 05 Feb, 2025 | npm better-auth |
Drupal OAuth2 Client Cross-Site Request Forgery (CSRF) CVE-2025-31684, DRUPAL-CONTRIB-2025-013, GHSA-6chf-hhqf-749c | Medium | 0.2% | 05 Feb, 2025 | Packagist drupal/oauth2_client Packagist:https://packages.drupal.org/8 drupal/oauth2_client |
Browsershot Local File Inclusion CVE-2025-1026, GHSA-f2q5-6mx7-q9qq | Medium | 0.5% | 05 Feb, 2025 | Packagist spatie/browsershot |
ZX Allows Environment Variable Injection for dotenv API CVE-2025-24959, GHSA-qwp8-x4ff-5h87 | Medium | 0.2% | 03 Feb, 2025 | npm zx |
lunasvg v3.0.1 was discovered to contain a segmentation violation via the component gray_find_cell CVE-2024-55456, PYSEC-2025-127 | Medium | 0.4% | 03 Feb, 2025 | PyPI lunasvg |
PhpSpreadsheet allows bypassing of XSS sanitizer using the javascript protocol and special characters CVE-2025-23210, GHSA-r57h-547h-w24f | Medium | 0.4% | 03 Feb, 2025 | Packagist phpoffice/phpexcel Packagist phpoffice/phpspreadsheet |
DevDojo Voyager Arbitrary File Write CVE-2024-55417, GHSA-35p2-5vrh-m3p6 | Medium | 14.1% | 30 Jan, 2025 | Packagist tcg/voyager |
files.photo.gallery command injection CVE-2024-53615, GHSA-5wjw-qjhm-v43h | Medium | 1.3% | 30 Jan, 2025 | npm files.photo.gallery |
snowflake-connector-python vulnerable to insecure cache files permissions CVE-2025-24795, GHSA-r2x6-cjg7-8r43, PYSEC-2025-28 | Medium | 0.1% | 29 Jan, 2025 | PyPI snowflake-connector-python |
Drupal Google Tag Cross-Site Request Forgery (CSRF) CVE-2025-31683, DRUPAL-CONTRIB-2025-012, GHSA-qchr-8m24-7v66 | Medium | 0.2% | 29 Jan, 2025 | Packagist drupal/google_tag Packagist:https://packages.drupal.org/8 drupal/google_tag |
snowflake-sdk may incorrectly validate temporary credential cache file permissions CVE-2025-24791, GHSA-xfhv-wqj6-rx99 | Medium | 0.1% | 29 Jan, 2025 | npm snowflake-sdk |
Drupal Google Tag Cross-Site Scripting (XSS) vulnerability CVE-2025-31682, DRUPAL-CONTRIB-2025-011, GHSA-36vv-q5jv-94cj | Medium | 0.2% | 29 Jan, 2025 | Packagist drupal/google_tag Packagist:https://packages.drupal.org/8 drupal/google_tag |
The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: [https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai...](https://www.drupal CVE-2025-3062, DRUPAL-CONTRIB-2025-010 | Medium | 0.5% | 29 Jan, 2025 | Packagist:https://packages.drupal.org/8 drupal/druadmin_lte_theme |
Twig security issue where escaping was missing when using null coalesce operator CVE-2025-24374, GHSA-3xg3-cgvq-2xwr | Medium | 0.3% | 29 Jan, 2025 | Packagist twig/twig |
Drupal Matomo Analytics Cross-Site Request Forgery (CSRF) vulnerability CVE-2025-31680, DRUPAL-CONTRIB-2025-008, GHSA-jh66-rjx8-8qqc | Medium | 0.2% | 29 Jan, 2025 | Packagist drupal/matomo Packagist:https://packages.drupal.org/8 drupal/matomo |
TYPO3-EXT-SA-2025-001: Account Takeover in extension "OpenID Connect Authentication" (oidc) CVE-2025-24856, GHSA-hj78-p4h7-m5fv | Medium | 0.2% | 28 Jan, 2025 | Packagist causal/oidc |
pimcore/customer-data-framework vulnerable to SQL Injection CVE-2024-11956, GHSA-q53r-9hh9-w277 | Medium | 0.9% | 28 Jan, 2025 | Packagist pimcore/customer-management-framework-bundle |
Opening a malicious website while running a Nuxt dev server could allow read-only access to code CVE-2025-24361, GHSA-4gf7-ff8x-hq99 | Medium | 0.3% | 25 Jan, 2025 | npm @nuxt/rspack-builder npm @nuxt/webpack-builder |
Opening a malicious website while running a Nuxt dev server could allow read-only access to code CVE-2025-24360, GHSA-2452-6xj8-jh47 | Medium | 0.6% | 25 Jan, 2025 | npm @nuxt/vite-builder |
NodeBB Cross-site scripting (XSS) vulnerability CVE-2024-57041, GHSA-vqr3-vrrg-f3jh | Medium | 40.1% | 24 Jan, 2025 | npm nodebb |
Cross Site Scripting vulnerability in store2 CVE-2024-57556, GHSA-w5hq-hm5m-4548 | Medium | 0.4% | 23 Jan, 2025 | npm store2 |
Directus allows privilege escalation using Share feature CVE-2025-24353, GHSA-pmf4-v838-29hg | Medium | 0.4% | 23 Jan, 2025 | npm @directus/app npm directus |
phpMyAdmin XSS when checking tables BIT-phpmyadmin-2025-24530, CVE-2025-24530, GHSA-222v-cx2c-q2f5 | Medium | 0.4% | 23 Jan, 2025 | Packagist phpmyadmin/phpmyadmin |
lunasvg v3.0.0 was discovered to contain a segmentation violation via the component gray_record_cell. CVE-2024-57724, PYSEC-2025-133 | Medium | 0.4% | 23 Jan, 2025 | PyPI lunasvg |
lunasvg v3.0.0 was discovered to contain a segmentation violation via the component composition_source_over. CVE-2024-57723, PYSEC-2025-132 | Medium | 0.4% | 23 Jan, 2025 | PyPI lunasvg |
lunasvg v3.0.0 was discovered to contain a segmentation violation via the component plutovg_path_add_path. CVE-2024-57721, PYSEC-2025-130 | Medium | 0.4% | 23 Jan, 2025 | PyPI lunasvg |
lunasvg v3.0.0 was discovered to contain a segmentation violation via the component plutovg_blend. CVE-2024-57720, PYSEC-2025-129 | Medium | 0.4% | 23 Jan, 2025 | PyPI lunasvg |
lunasvg v3.0.0 was discovered to contain a segmentation violation via the component blend_transformed_tiled_argb.isra.0. CVE-2024-57719, PYSEC-2025-128 | Medium | 0.4% | 23 Jan, 2025 | PyPI lunasvg |
Drupal Ignition Cross-Site Scripting (XSS) vulnerability CVE-2025-31679, DRUPAL-CONTRIB-2025-007, GHSA-rhxm-r44m-4325 | Medium | 0.3% | 22 Jan, 2025 | Packagist drupal/ignition Packagist:https://packages.drupal.org/8 drupal/ignition |
The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: [https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai...](https://www.drupal CVE-2025-3061, DRUPAL-CONTRIB-2025-006 | Medium | 0.5% | 22 Jan, 2025 | Packagist:https://packages.drupal.org/8 drupal/material_admin |
The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: [https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai...](https://www.drupal CVE-2025-3060, DRUPAL-CONTRIB-2025-005 | Medium | 0.5% | 22 Jan, 2025 | Packagist:https://packages.drupal.org/8 drupal/flattern |
ps_contactinfo has a potential XSS due to usage of the nofilter tag in template CVE-2025-24027, GHSA-35pq-7pv2-2rfw | Medium | 0.4% | 22 Jan, 2025 | Packagist prestashop/ps_contactinfo |
MathLive's Lack of Escaping of HTML allows for XSS CVE-2025-29049, GHSA-qwj6-q94f-8425 | Medium | 0.6% | 21 Jan, 2025 | npm mathlive |
Use of Insufficiently Random Values in undici CVE-2025-22150, GHSA-c76h-2ccp-4975 | Medium | 0.8% | 21 Jan, 2025 | npm undici |
XSS/HTML Injection Vulnerability in Umbraco Backoffice Components CVE-2025-24012, GHSA-wv8v-rmw2-25wc | Medium | 0.3% | 21 Jan, 2025 | NuGet Umbraco.Cms.StaticAssets npm @umbraco-cms/backoffice |
Infinite loop and Blind SSRF found inside the Webfinger mechanism in @fedify/fedify CVE-2025-23221, GHSA-c59p-wq67-24wx | Medium | 0.6% | 20 Jan, 2025 | npm @fedify/fedify |
Missing validation of header name and value in codeigniter4/framework CVE-2025-24013, GHSA-x5mq-jjr3-vmx6 | Medium | 0.5% | 20 Jan, 2025 | Packagist codeigniter4/framework |
Websites were able to send any requests to the development server and read the response in vite CVE-2025-24010, GHSA-vg6x-rcgg-rjx6 | Medium | 0.3% | 20 Jan, 2025 | npm vite |