Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Cross-Site Scripting (XSS) vulnerability in generateNavigation() function in PhpSpreadsheet CVE-2025-22131, GHSA-79xx-vf93-p7cx | Medium | 0.4% | 20 Jan, 2025 | Packagist phpoffice/phpexcel Packagist phpoffice/phpspreadsheet |
Librenms has a reflected XSS on error alert CVE-2025-23201, GHSA-g84x-g96g-rcjc | Medium | 0.4% | 16 Jan, 2025 | Packagist librenms/librenms |
LibreNMS Misc Section Stored Cross-site Scripting vulnerability CVE-2025-23200, GHSA-c66p-64fj-jmc2 | Medium | 31.6% | 16 Jan, 2025 | Packagist librenms/librenms |
LibreNMS Ports Stored Cross-site Scripting vulnerability CVE-2025-23199, GHSA-27vf-3g4f-6jp7 | Medium | 1.3% | 16 Jan, 2025 | Packagist librenms/librenms |
LibreNMS Display Name Stored Cross-site Scripting vulnerability CVE-2025-23198, GHSA-pm8j-3v64-92cq | Medium | 0.4% | 16 Jan, 2025 | Packagist librenms/librenms |
LibreNMS Display Name 2 Stored Cross-site Scripting vulnerability CVE-2024-56144, GHSA-2f4w-6mc7-4w78 | Medium | 0.4% | 16 Jan, 2025 | Packagist librenms/librenms |
parse-uri Regular expression Denial of Service (ReDoS) CVE-2024-36751, GHSA-6fx8-h7jm-663j | Medium | 0.5% | 15 Jan, 2025 | npm parse-uri npm parseuri |
Silverstripe Framework has a XSS in form messages CVE-2024-53277, GHSA-ff6q-3c9c-6cf5 | Medium | 0.3% | 14 Jan, 2025 | Packagist silverstripe/framework |
Silverstripe Framework has a XSS via insert media remote file oembed CVE-2024-47605, GHSA-7cmp-cgg8-4c82 | Medium | 1.2% | 14 Jan, 2025 | Packagist silverstripe/framework |
Mediawiki - DataTransfer Extension Cross-Site Request Forgery (CSRF) and Cross-site Scripting (XSS) CVE-2025-23081, GHSA-c3h5-h73c-29hq | Medium | 0.2% | 14 Jan, 2025 | Packagist mediawiki/data-transfer |
TYPO3 DB Check Module vulnerable to Cross-Site Request Forgery CVE-2024-55945, GHSA-8mv3-37rc-pvxj | Medium | 0.2% | 14 Jan, 2025 | Packagist typo3/cms-lowlevel |
TYPO3 Indexed Search Module vulnerable to Cross-Site Request Forgery CVE-2024-55923, GHSA-7r5q-4qgx-v545 | Medium | 0.2% | 14 Jan, 2025 | Packagist typo3/cms-indexed-search |
TYPO3 Form Framework Module vulnerable to Cross-Site Request Forgery CVE-2024-55922, GHSA-ww7h-g2qf-7xv6 | Medium | 0.2% | 14 Jan, 2025 | Packagist typo3/cms-form |
TYPO3 Cross-Site Request Forgery in Dashboard Module CVE-2024-55920, GHSA-qwx7-39pw-2mhr | Medium | 0.2% | 14 Jan, 2025 | Packagist typo3/cms-dashboard |
TYPO3 Cross-Site Request Forgery in Backend User Module CVE-2024-55894, GHSA-6w4x-gcx3-8p7v | Medium | 0.3% | 14 Jan, 2025 | Packagist typo3/cms-beuser |
TYPO3 Cross-Site Request Forgery in Log Module CVE-2024-55893, GHSA-cjfr-9f5r-3q93 | Medium | 0.3% | 14 Jan, 2025 | Packagist typo3/cms-belog |
TYPO3 Potential Open Redirect via Parsing Differences CVE-2024-55892, GHSA-2fx5-pggv-6jjr | Medium | 0.2% | 14 Jan, 2025 | Packagist typo3/cms-core |
TYPO3 Information Disclosure via Exception Handling/Logger CVE-2024-55891, GHSA-38x7-cc6w-j27q | Medium | 0.3% | 14 Jan, 2025 | Packagist typo3/cms-install |
Microweber Cross-site Scripting vulnerability CVE-2024-33299, GHSA-97h9-p9f8-4p3r | Medium | 1.2% | 10 Jan, 2025 | Packagist microweber/microweber |
Microweber Cross-site Scripting vulnerability CVE-2024-33298, GHSA-w5g5-4jj3-8f6v | Medium | 0.9% | 10 Jan, 2025 | Packagist microweber/microweber |
Microweber Cross-site Scripting vulnerability CVE-2024-33297, GHSA-j4v9-cm37-h7c2 | Medium | 1.2% | 10 Jan, 2025 | Packagist microweber/microweber |
Stored XSS in REDAXO CVE-2024-13209, GHSA-7wj8-856p-qc9m | Medium | 0.4% | 09 Jan, 2025 | Packagist redaxo/source |
Carbon has an arbitrary file include via unvalidated input passed to Carbon::setLocale CVE-2025-22145, GHSA-j3f9-p6hm-5w6q | Medium | 0.8% | 08 Jan, 2025 | Packagist nesbot/carbon |
Composio Command Execution vulnerability CVE-2024-53526, GHSA-8h93-28hg-fj84, PYSEC-2026-1268, PYSEC-2026-2428, PYSEC-2026-2429 | Medium | 0.6% | 08 Jan, 2025 | PyPI composio-claude PyPI composio-julep PyPI composio-openai |
The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: [https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai...](https://www.drupal CVE-2025-3059, DRUPAL-CONTRIB-2025-002 | Medium | 0.5% | 08 Jan, 2025 | Packagist:https://packages.drupal.org/8 drupal/profile_private |
keras Path Traversal vulnerability CVE-2024-55459, GHSA-cjgq-5qmw-rcj6, PYSEC-2025-121 | Medium | 0.2% | 08 Jan, 2025 | PyPI keras |
Guzzle OAuth Subscriber has insufficient nonce entropy CVE-2025-21617, GHSA-237r-r8m4-4q88 | Medium | 0.5% | 06 Jan, 2025 | Packagist guzzlehttp/oauth-subscriber |
REDAXO CMS Cross-site Scripting vulnerability CVE-2024-46209, GHSA-2p95-8xvm-2pjx | Medium | 0.4% | 06 Jan, 2025 | Packagist redaxo/source |
Grav Cross-site Scripting vulnerability CVE-2024-35498, GHSA-m78c-qx99-mvw9 | Medium | 0.4% | 06 Jan, 2025 | Packagist getgrav/grav |
Next.js Allows a Denial of Service (DoS) with Server Actions CVE-2024-56332, GHSA-7m27-7ghc-44w9 | Medium | 0.8% | 03 Jan, 2025 | npm next |
PhpSpreadsheet allows bypass XSS sanitizer using the javascript protocol and special characters CVE-2024-56412, GHSA-q9jv-mm3r-j47r | Medium | 0.4% | 03 Jan, 2025 | Packagist phpoffice/phpexcel Packagist phpoffice/phpspreadsheet |
PhpSpreadsheet has a Cross-Site Scripting (XSS) vulnerability of the hyperlink base in the HTML page header CVE-2024-56411, GHSA-hwcp-2h35-p66w | Medium | 0.4% | 03 Jan, 2025 | Packagist phpoffice/phpexcel Packagist phpoffice/phpspreadsheet |
PhpSpreadsheet has a Cross-Site Scripting (XSS) vulnerability in custom properties CVE-2024-56410, GHSA-wv23-996v-q229 | Medium | 0.3% | 03 Jan, 2025 | Packagist phpoffice/phpexcel Packagist phpoffice/phpspreadsheet |
Trix allows Cross-site Scripting via `javascript:` url in a link CVE-2025-21610, GHSA-j386-3444-qgwg | Medium | 0.4% | 03 Jan, 2025 | npm trix |
The wp-enable-svg WordPress plugin does not sanitize SVG files when uploaded CVE-2024-11184, GHSA-j77f-79w9-rghc | Medium | 0.4% | 02 Jan, 2025 | Packagist mwdelaney/wp-enable-svg |
LGSL has a reflected XSS at /lgsl_files/lgsl_list.php CVE-2024-56517, GHSA-ggwq-xc72-33r3 | Medium | 0.6% | 30 Dec, 2024 | Packagist tltneon/lgsl |
khoj has an IDOR in subscription management allows unauthorized subscription modifications CVE-2024-52294, GHSA-hq4h-w933-jm6c, PYSEC-2026-1493 | Medium | 0.4% | 30 Dec, 2024 | PyPI khoj |
TeamPass mail_me operation authorization issue CVE-2024-50702, GHSA-7rm3-4w6j-8xx4 | Medium | 0.3% | 30 Dec, 2024 | Packagist nilsteampassnet/teampass |
TeamPass does not properly check whether a folder is in a user's allowed folders list CVE-2024-50701, GHSA-2697-96mv-3gfm | Medium | 0.3% | 30 Dec, 2024 | Packagist nilsteampassnet/teampass |
Dcat-Admin Cross-Site Scripting (XSS) vulnerability CVE-2024-54775, GHSA-37x3-j9jq-vrjx | Medium | 0.3% | 27 Dec, 2024 | Packagist dcat/laravel-admin |
Dcat Admin Cross-site Scripting (XSS) vulnerability CVE-2024-54774, GHSA-9q34-7hfr-h8jm | Medium | 0.3% | 27 Dec, 2024 | Packagist dcat/laravel-admin |
DrayTek Vigor Routers OS Command Injection Vulnerability CVE-2024-12987 | MediumExploited | 98.2% | 27 Dec, 2024 | |
python-sql SQL injection vulnerability CVE-2024-9774, GHSA-pq9p-pc3p-9hm4, PYSEC-2026-1855 | Medium | 0.7% | 27 Dec, 2024 | PyPI python-sql |
OpenCTI is an open-source cyber threat intelligence platform. Before 6.3.0, general users can access information that can only be accessed by users with access privileges to admin and support information (SETTINGS_SUPPORT). This is due to inadequate access control for support information (http://<op CVE-2024-45805, GHSA-42mm-c8x3-g5q6, PYSEC-2024-298 | Medium | 0.3% | 26 Dec, 2024 | PyPI pycti |
Marp Core allows XSS by improper neutralization of HTML sanitization CVE-2024-56510, GHSA-x52f-h5g4-8qv5 | Medium | 0.3% | 26 Dec, 2024 | npm @marp-team/marp-core |
Koji Cross-site Scripting CVE-2024-9427, GHSA-g2vg-8hfg-79vj, PYSEC-2026-1501 | Medium | 0.3% | 24 Dec, 2024 | PyPI koji |
Cross-site Scripting vulnerability in SimpleXLSXEx::readThemeColors, SimpleXLSXEx::getColorValue and SimpleXLSX::toHTMLEx CVE-2024-56364, GHSA-r87q-fj25-f8jf | Medium | 0.3% | 23 Dec, 2024 | Packagist shuchkin/simplexlsx |
Jinja has a sandbox breakout through indirect reference to format method CVE-2024-56326, GHSA-q2x7-8rv6-6q7h, PYSEC-2026-1475 | Medium | 0.5% | 23 Dec, 2024 | PyPI jinja2 |
Jinja has a sandbox breakout through malicious filenames CVE-2024-56201, GHSA-gmj6-6f8f-6699, PYSEC-2026-1472 | Medium | 0.3% | 23 Dec, 2024 | PyPI jinja2 |
uptime-kuma vulnerable to Local File Inclusion (LFI) via Improper URL Handling in `Real-Browser` monitor CVE-2024-56331, GHSA-2qgm-m29m-cj2h | Medium | 1.8% | 20 Dec, 2024 | npm uptime-kuma |