Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
AVideo has an authenticated arbitrary local file read via `chunkFile` path injection in `aVideoEncoder.json.php` CVE-2026-33354, GHSA-4jw9-5hrc-m4j6 | High | 0.3% | 19 Mar, 2026 | Packagist wwbn/avideo |
AVideo Affected by Stored XSS via Unescaped Video Title in CDN downloadButtons.php CVE-2026-33295, GHSA-gc3m-4mcr-h3pv | High | 0.2% | 19 Mar, 2026 | Packagist wwbn/avideo |
AVideo Affected by Arbitrary File Deletion via Path Traversal in CloneSite deleteDump Parameter CVE-2026-33293, GHSA-xmjm-86qv-g226 | High | 0.5% | 19 Mar, 2026 | Packagist wwbn/avideo |
AVideo has an Authorization Bypass via Path Traversal in HLS Endpoint Allows Streaming Private/Paid Videos CVE-2026-33292, GHSA-pw4v-x838-w5pg | High | 0.7% | 19 Mar, 2026 | Packagist wwbn/avideo |
phpseclib's AES-CBC unpadding susceptible to padding oracle timing attack CVE-2026-32935, GHSA-94g3-g5v7-q4jg | High | 0.4% | 19 Mar, 2026 | Packagist phpseclib/phpseclib |
AVideo has an OS Command Injection via Unescaped URL in LinkedIn Video Upload Shell Command CVE-2026-33319, GHSA-w5ff-2mjc-4phc | High | 0.3% | 19 Mar, 2026 | Packagist wwbn/avideo |
SimpleJWT has an Unauthenticated Denial of Service via JWE header tampering CVE-2026-33204, GHSA-xw36-67f8-339x | High | 0.5% | 18 Mar, 2026 | Packagist kelvinmo/simplejwt |
Filament Unvalidated Range and Values summarizer values can be used for XSS CVE-2026-33080, GHSA-vv3x-j2x5-36jc | High | 0.3% | 18 Mar, 2026 | Packagist filament/tables |
Statamic has Stored XSS via SVG Sanitization Bypass CVE-2026-33172, GHSA-7rcv-55mj-chg7 | High | 0.3% | 18 Mar, 2026 | Packagist statamic/cms |
AVideo vulnerable to unauthenticated SSRF via HTTP redirect bypass in LiveLinks proxy CVE-2026-33039, GHSA-9x67-f2v7-63rw | High | 0.5% | 17 Mar, 2026 | Packagist wwbn/avideo |
AVideo affected by Session Hijacking via Unauthenticated Session ID Disclosure with Permissive CORS CVE-2026-33043, GHSA-qc3p-398r-p59j | High | 0.4% | 17 Mar, 2026 | Packagist wwbn/avideo |
AVideo affected by unauthenticated application takeover via exposed web installer on uninitialized deployments CVE-2026-33038, GHSA-2f9h-23f7-8gcx | High | 0.5% | 17 Mar, 2026 | Packagist wwbn/avideo |
Cockpit CMS has SQL Injection in MongoLite Aggregation Optimizer via toJsonExtractRaw() CVE-2026-31891, GHSA-7x5c-vfhj-9628 | High | 0.4% | 17 Mar, 2026 | Packagist cockpit-hq/cockpit |
Authentication Bypass in extension "E-Mail MFA Provider" (mfa_email) CVE-2026-4208, GHSA-29r8-gvx4-r9w3 | High | 0.3% | 17 Mar, 2026 | Packagist ralffreit/mfa-email |
Admidio has a Second-Order SQL Injection via List Configuration (lsc_special_field, lsc_sort, lsc_filter) CVE-2026-32813, GHSA-3x67-4c2c-w45m | High | 0.3% | 16 Mar, 2026 | Packagist admidio/admidio |
File Upload(RCE) Vulnerability in admidio CVE-2026-32756, GHSA-95cq-p4w2-32w5 | High | 1.0% | 16 Mar, 2026 | Packagist admidio/admidio |
Azure Blob Storage for Craft CMS Potential Sensitive Information Disclosure vulnerability CVE-2026-32268, GHSA-q6fm-p73f-x862 | High | 0.4% | 16 Mar, 2026 | Packagist craftcms/azure-blob |
Craft CMS Vulnerable to Privilege Escalation/Bypass through UsersController->actionImpersonateWithToken() CVE-2026-32267, GHSA-cc7p-2j3x-x7xf | High | 9.4% | 16 Mar, 2026 | Packagist craftcms/cms |
Craft CMS vulnerable to behavior injection RCE ElementIndexesController and FieldsController CVE-2026-32264, GHSA-4484-8v2f-5748 | High | 0.5% | 16 Mar, 2026 | Packagist craftcms/cms |
Craft CMS vulnerable to behavior injection RCE via EntryTypesController CVE-2026-32263, GHSA-qx2q-q59v-wf3j | High | 0.5% | 16 Mar, 2026 | Packagist craftcms/cms |
RCE via SSTI for users with permissions to access the Craft CMS Webhooks plugin CVE-2026-32261, GHSA-8wg7-wm29-2rvg | High | 0.4% | 16 Mar, 2026 | Packagist craftcms/webhooks |
simplesamlphp/xml-security: Missing AES-GCM Authentication Tag Validation on Encrypted Nodes Allows for Unauthorized Decryption CVE-2026-32600, GHSA-r353-4845-pr5p | High | 0.2% | 13 Mar, 2026 | Packagist simplesamlphp/xml-security |
xmlseclibs: Missing AES-GCM Authentication Tag Validation on Encrypted Nodes Allows for Unauthorized Decryption CVE-2026-32313, GHSA-4v26-v6cg-g6f9 | High | 0.2% | 13 Mar, 2026 | Packagist robrichards/xmlseclibs |
Shopware vulnerable to a potential take over of app credentials CVE-2026-31889, GHSA-c4p7-rwrg-pf6p | High | 0.3% | 11 Mar, 2026 | Packagist shopware/core Packagist shopware/platform |
Shopware: Unauthenticated data extraction possible through store-api.order endpoint CVE-2026-31887, GHSA-7vvp-j573-5584 | High | 0.2% | 11 Mar, 2026 | Packagist shopware/core Packagist shopware/platform |
CraftCMS has an RCE vulnerability via relational conditionals in the control panel CVE-2026-31857, GHSA-fp5j-j7j4-mcxc | High | 0.9% | 11 Mar, 2026 | Packagist craftcms/cms |
CraftCMS's `ElementSearchController` Affected by Blind SQL Injection CVE-2026-31858, GHSA-g7j6-fmwx-7vp8 | High | 0.4% | 11 Mar, 2026 | Packagist craftcms/cms |
Sylius has a Promotion Usage Limit Bypass via Race Condition CVE-2026-31824, GHSA-7mp4-25j8-hp5q | High | 0.2% | 10 Mar, 2026 | Packagist sylius/sylius |
Sylius affected by IDOR in Cart and Checkout LiveComponents CVE-2026-31820, GHSA-2xc6-348p-c2x6 | High | 0.3% | 10 Mar, 2026 | Packagist sylius/sylius |
Craft Commerce has multiple Stored XSS in Commerce Inventory Page, Leading to Session Hijacking CVE-2026-29175, GHSA-cfpv-rmpf-f624 | High | 0.2% | 10 Mar, 2026 | Packagist craftcms/commerce |
Craft Commerce is vulnerable to SQL Injection in Commerce Inventory Table Sorting CVE-2026-29174, GHSA-pmgj-gmm4-jh6j | High | 0.5% | 10 Mar, 2026 | Packagist craftcms/commerce |
Craft Commerce is Vulnerable to SQL Injection in Commerce Purchasables Table Sorting CVE-2026-29172, GHSA-j3x5-mghf-xvfw | High | 0.4% | 10 Mar, 2026 | Packagist craftcms/commerce |
LimeSurvey is vulnerable to SQL injection CVE-2025-56421, GHSA-rccq-2fxq-7x3h | High | 0.5% | 10 Mar, 2026 | Packagist limesurvey/limesurvey |
AzuraCast: RCE via Liquidsoap string interpolation injection in station metadata and playlist URLs CVE-2026-100857, GHSA-93fx-5qgc-wr38 | High | 0.4% | 09 Mar, 2026 | Packagist azuracast/azuracast |
Meta Box Plugin for WordPress: Authenticated (Contributor+) Arbitrary File Deletion via ajax_delete_file CVE-2025-14675, GHSA-m4q3-832v-44j6 | High | 2.4% | 07 Mar, 2026 | Packagist wpmetabox/meta-box |
TSPortal: Any user can forge self-deletion requests for any account CVE-2026-29788, GHSA-gfhq-7499-f3f2 | High | 0.3% | 06 Mar, 2026 | Packagist miraheze/ts-portal |
Snipe-IT has sensitive user attributes related to account privileges that are insufficiently protected against mass assignment CVE-2025-15602, GHSA-5448-v74m-7mv7 | High | 0.5% | 06 Mar, 2026 | Packagist snipe/snipe-it |
Craft CMS has unauthenticated activation email trigger with potential user enumeration CVE-2026-29069, GHSA-234q-vvw3-mrfq | High | 0.3% | 04 Mar, 2026 | Packagist craftcms/cms |
Concrete CMS vulnerable to Remote Code Execution by stored PHP object injection CVE-2026-3452, GHSA-gj26-w59c-29mf | High | 0.6% | 04 Mar, 2026 | Packagist concrete5/concrete5 |
Craft CMS has potential authenticated Remote Code Execution via Twig SSTI CVE-2026-28784, GHSA-qc86-q28f-ggww | High | 0.5% | 03 Mar, 2026 | Packagist craftcms/cms |
Craft CMS: Entries Authorship Spoofing via Mass Assignment CVE-2026-28781, GHSA-2xfc-g69j-x2mp | High | 0.3% | 03 Mar, 2026 | Packagist craftcms/cms |
Craft CMS has IDOR via GraphQL @parseRefs CVE-2026-28696, GHSA-7x43-mpfg-r9wj | High | 0.5% | 03 Mar, 2026 | Packagist craftcms/cms |
Craft CMS Vulnerable to Authenticated RCE via Twig SSTI - create() function + Symfony Process gadget CVE-2026-28695, GHSA-94rc-cqvm-m4pw | High | 0.6% | 03 Mar, 2026 | Packagist craftcms/cms |
Idno Vulnerable to Remote Code Execution via Chained Import File Write and Template Path Traversal CVE-2026-28507, GHSA-37j7-56xc-c468 | High | 0.7% | 02 Mar, 2026 | Packagist idno/known |
Statamic vulnerable to privilege escalation via stored cross-site scripting CVE-2026-28426, GHSA-5vrj-wf7v-5wr7 | High | 0.3% | 27 Feb, 2026 | Packagist statamic/cms |
Statamic vulnerable to remote code execution via Antlers-enabled control panel inputs CVE-2026-28425, GHSA-cpv7-q2wx-m8rw | High | 0.5% | 27 Feb, 2026 | Packagist statamic/cms |
Statamic Vulnerable to Server-Side Request Forgery via Glide CVE-2026-28423, GHSA-cwpp-325q-2cvp | High | 0.4% | 27 Feb, 2026 | Packagist statamic/cms |
Statamic allows Authenticated Control Panel users to escalate privileges via elevated session bypass CVE-2026-27939, GHSA-rw9x-pxqx-q789 | High | 0.4% | 27 Feb, 2026 | Packagist statamic/cms |
phpMyFAQ Allows Unauthenticated Account Creation via WebAuthn Prepare Endpoint CVE-2026-27836, GHSA-w22q-m2fm-x9f4 | High | 0.5% | 27 Feb, 2026 | Packagist thorsten/phpmyfaq |
Mautic is Vulnerable to SQL Injection through Contact Activity API Sorting CVE-2026-3105, GHSA-r5j5-q42h-fc93 | High | 0.3% | 24 Feb, 2026 | Packagist mautic/core |