Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
AVideo: CSRF on Player Skin Configuration via admin/playerUpdate.json.php CVE-2026-35181, GHSA-4q27-4rrq-fx95 | Medium | 0.1% | 03 Apr, 2026 | Packagist wwbn/avideo |
AVideo: Unauthenticated Instagram Graph API Proxy via publishInstagram.json.php CVE-2026-35179, GHSA-x9w5-xccw-5h9w | Medium | 0.2% | 03 Apr, 2026 | Packagist wwbn/avideo |
Roundcube Webmail: Insufficient CSS sanitization in HTML e-mail messages CVE-2026-35544, GHSA-xpqh-grpw-4xmg | Medium | 0.4% | 03 Apr, 2026 | Packagist roundcube/roundcubemail |
Roundcube Webmail: Bypass of remote image blocking via SVG content (with animate attributes) in an e-mail message CVE-2026-35543, GHSA-j2g6-8rvg-7mf6 | Medium | 0.4% | 03 Apr, 2026 | Packagist roundcube/roundcubemail |
Roundcube: Bypass of remote image blocking via crafted BODY background attribute CVE-2026-35542, GHSA-5hf6-crg4-fg59 | Medium | 0.4% | 03 Apr, 2026 | Packagist roundcube/roundcubemail |
Roundcube Webmail: Incorrect password comparison in the password plugin CVE-2026-35541, GHSA-46pv-mj2g-93gh | Medium | 0.2% | 03 Apr, 2026 | Packagist roundcube/roundcubemail |
Roundcube Webmail: Insufficient CSS sanitization in HTML e-mail messages CVE-2026-35540, GHSA-vxg2-hhgr-37fx | Medium | 0.4% | 03 Apr, 2026 | Packagist roundcube/roundcubemail |
Roundcube Webmail: Insufficient HTML attachment sanitization in preview mode CVE-2026-35539, GHSA-x4q5-8j5g-hpjc | Medium | 0.3% | 03 Apr, 2026 | Packagist roundcube/roundcubemail |
phpMyFAQ: SVG Sanitizer Bypass via HTML Entity Encoding Leads to Stored XSS and Privilege Escalation CVE-2026-34974, GHSA-5crx-pfhq-4hgg | Medium | 0.2% | 01 Apr, 2026 | Packagist thorsten/phpmyfaq |
phpMyFAQ has a LIKE Wildcard Injection in Search.php — Unescaped % and _ Metacharacters Enable Broad Content Disclosure CVE-2026-34973, GHSA-gcp9-5jc8-976x | Medium | 0.3% | 01 Apr, 2026 | Packagist thorsten/phpmyfaq |
AVideo has Stored XSS via Unescaped Menu Item Fields in TopMenu Plugin CVE-2026-56347, GHSA-gmpc-fxg2-vcmq | Medium | 0.2% | 01 Apr, 2026 | Packagist wwbn/avideo |
phpMyFAQ: Stored XSS via Regex Bypass in Filter::removeAttributes() CVE-2026-34729, GHSA-cv2g-8cj8-vgc7 | Medium | 0.2% | 01 Apr, 2026 | Packagist phpmyfaq/phpmyfaq |
YesWiki has Multiple Reflected Cross-site Scripting Vulnerabilities CVE-2026-104473, GHSA-5724-x3rh-5qqq | Medium | 0.2% | 01 Apr, 2026 | Packagist yeswiki/yeswiki |
phpMyFAQ is Vulnerable to Stored XSS via Unsanitized Email Field in Admin FAQ Editor CVE-2026-32629, GHSA-98gw-w575-h2ph | Medium | 0.3% | 31 Mar, 2026 | Packagist phpmyfaq/phpmyfaq Packagist thorsten/phpmyfaq |
AVideo: Stored SSRF via Video EPG Link Missing isSSRFSafeURL() Validation CVE-2026-34740, GHSA-x5vx-vrpf-r45f | Medium | 0.3% | 31 Mar, 2026 | Packagist wwbn/avideo |
AVideo: Reflected XSS via Unescaped ip Parameter in User_Location testIP.php CVE-2026-34739, GHSA-jqrj-chh6-8h78 | Medium | 0.2% | 31 Mar, 2026 | Packagist wwbn/avideo |
AVideo: Video Publishing Workflow Bypass via Unauthorized overrideStatus Request Parameter CVE-2026-34738, GHSA-m577-w9j8-ch7j | Medium | 0.2% | 31 Mar, 2026 | Packagist wwbn/avideo |
AVideo: Arbitrary Stripe Subscription Cancellation via Debug Endpoint and retrieveSubscriptions() Bug CVE-2026-34737, GHSA-38rh-4v39-vfxv | Medium | 0.3% | 31 Mar, 2026 | Packagist wwbn/avideo |
AVideo: DOM XSS via Unsanitized Display Name in WebSocket Call Notification CVE-2026-34716, GHSA-w4hp-w536-jg64 | Medium | 0.3% | 31 Mar, 2026 | Packagist wwbn/avideo |
AVideo: CSRF on Plugin Enable/Disable Endpoint Allows Disabling Security Plugins CVE-2026-34613, GHSA-hqxf-mhfw-rc44 | Medium | 0.2% | 31 Mar, 2026 | Packagist wwbn/avideo |
AVideo: CSRF on emailAllUsers.json.php Enables Mass Phishing Email to All Users CVE-2026-34611, GHSA-c4xj-x7p8-3x7q | Medium | 0.2% | 31 Mar, 2026 | Packagist wwbn/avideo |
AVideo has Stored XSS via Unescaped Plugin Configuration Values in Admin Panel CVE-2026-34396, GHSA-v4h7-3x43-qqw4 | Medium | 0.2% | 31 Mar, 2026 | Packagist wwbn/avideo |
AVideo vulnerable to Mass User PII Disclosure via Missing Authorization in YPTWallet users.json.php CVE-2026-34395, GHSA-77jp-mgcw-rfmr | Medium | 0.3% | 31 Mar, 2026 | Packagist wwbn/avideo |
Admidio has CSRF and Form Validation Bypass in Inventory Item Save via `imported` Parameter CVE-2026-34383, GHSA-4rwm-c5mj-wh7x | Medium | 0.1% | 31 Mar, 2026 | Packagist admidio/admidio |
Admidio has Missing CSRF Protections on Custom List Deletion in mylist_function.php CVE-2026-34382, GHSA-g3mx-8jm6-rc85 | Medium | 0.1% | 31 Mar, 2026 | Packagist admidio/admidio |
baserCMS has a cross-site scripting vulnerability in blog posts CVE-2026-30879, GHSA-jmq3-x8q7-j9qm | Medium | 0.2% | 31 Mar, 2026 | Packagist baserproject/basercms |
baserCMS has Mail Form Acceptance Bypass via Public API CVE-2026-30878, GHSA-8cr7-r8qw-gp3c | Medium | 0.4% | 31 Mar, 2026 | Packagist baserproject/basercms |
baserCMS has an SQL injection vulnerability in its blog post functionality CVE-2026-27697, GHSA-vh89-rjph-2g7p | Medium | 0.4% | 31 Mar, 2026 | Packagist baserproject/basercms |
Sulu checks fix permissions for subentities endpoints CVE-2026-34372, GHSA-6h7h-m7p5-hjqp | Medium | 0.3% | 30 Mar, 2026 | Packagist sulu/sulu |
AVideo has Video Password Protection Bypass via API Endpoints Returning Full Playback Sources Without Password Verification CVE-2026-34369, GHSA-q6jj-r49p-94fh | Medium | 0.4% | 27 Mar, 2026 | Packagist wwbn/avideo |
AVideo Vulnerable to Wallet Balance Double-Spend via TOCTOU Race Condition in transferBalance CVE-2026-34368, GHSA-h54m-c522-h6qr | Medium | 0.2% | 27 Mar, 2026 | Packagist wwbn/avideo |
AVideo has User Group-Based Category Access Control Bypass via Missing and Broken Group Filtering in categories.json.php CVE-2026-34364, GHSA-73gr-r64q-7jh4 | Medium | 0.3% | 27 Mar, 2026 | Packagist wwbn/avideo |
Dolibarr Core Discloses Sensitive Data via Authenticated Local File Inclusion in selectobject.php CVE-2026-34036, GHSA-2mfj-r695-5h9r | Medium | 1.5% | 27 Mar, 2026 | Packagist dolibarr/dolibarr |
AVideo's WebSocket Token Never Expires Due to Commented-Out Timeout Validation in verifyTokenSocket() CVE-2026-34362, GHSA-2mg4-pfgx-64cf | Medium | 0.3% | 27 Mar, 2026 | Packagist wwbn/avideo |
AVideo: IDOR in uploadPoster.php Allows Any Authenticated User to Overwrite Scheduled Live Stream Posters and Trigger False Socket Notifications CVE-2026-34247, GHSA-g3hj-mf85-679g | Medium | 0.2% | 27 Mar, 2026 | Packagist wwbn/avideo |
AVideo: Missing Authorization in Playlist Schedule Creation Allows Cross-User Broadcast Hijacking CVE-2026-34245, GHSA-2rm7-j397-3fqg | Medium | 0.3% | 27 Mar, 2026 | Packagist wwbn/avideo |
TSPortal's Uncontrolled User Creation via Validation Side Effects Leads to Potential Denial of Service CVE-2026-33541, GHSA-f346-8rp3-4h9h | Medium | 0.3% | 26 Mar, 2026 | Packagist miraheze/ts-portal |
Statamic allows unauthorized content access through missing authorization in its revision controllers CVE-2026-33887, GHSA-4hp7-3wxg-cv9q | Medium | 0.1% | 26 Mar, 2026 | Packagist statamic/cms |
Statamic's sensitive configuration values are exposed to content editors via Antlers-enabled fields CVE-2026-33886, GHSA-gcqf-5x9f-hq7f | Medium | 0.2% | 26 Mar, 2026 | Packagist statamic/cms |
Statamic has an Open Redirect on unauthenticated endpoints via URL parsing differential CVE-2026-33885, GHSA-7f74-7q5w-hj4r | Medium | 0.2% | 26 Mar, 2026 | Packagist statamic/cms |
Statamic's live preview token bypasses content protection for unrelated entries CVE-2026-33884, GHSA-8vwx-ccf6-5wg2 | Medium | 0.2% | 26 Mar, 2026 | Packagist statamic/cms |
Statamic has Reflected XSS via unescaped redirect parameter in its password reset form tag CVE-2026-33883, GHSA-3jg4-p23x-p4qx | Medium | 0.2% | 26 Mar, 2026 | Packagist statamic/cms |
Statamic's Markdown preview endpoint exposes sensitive user data CVE-2026-33882, GHSA-cvh3-23vq-w7h4 | Medium | 0.3% | 26 Mar, 2026 | Packagist statamic/cms |
AVideo has SSRF Protection Bypass via HTTP Redirect in Image Download Endpoints CVE-2026-33766, GHSA-f359-r3pv-2phf | Medium | 0.2% | 26 Mar, 2026 | Packagist wwbn/avideo |
AVideo: IDOR in AI Plugin Allows Stealing Other Users' AI-Generated Metadata and Transcriptions CVE-2026-33764, GHSA-g39v-qrj6-jxrh | Medium | 0.2% | 26 Mar, 2026 | Packagist wwbn/avideo |
AVideo has an Unauthenticated Video Password Brute-Force Vulnerability via Unrate-Limited Boolean Oracle CVE-2026-33763, GHSA-8prq-2jr2-cm92 | Medium | 0.3% | 26 Mar, 2026 | Packagist wwbn/avideo |
AVideo: Unauthenticated Access to Scheduler Plugin Endpoints Leaks Scheduled Tasks, Email Content, and User Mappings CVE-2026-33761, GHSA-j724-5c6c-68g5 | Medium | 0.4% | 26 Mar, 2026 | Packagist wwbn/avideo |
AVideo: Unauthenticated IDOR in playlistsVideos.json.php Exposes Private Playlist Contents CVE-2026-33759, GHSA-75qq-68m8-pvfr | Medium | 0.3% | 26 Mar, 2026 | Packagist wwbn/avideo |
Withdrawn Advisory: Kirby CMS has Persistent DoS via Malformed Image Upload CVE-2026-29905, GHSA-cw7v-45wm-mcf2 | Medium | 0.5% | 26 Mar, 2026 | Packagist getkirby/cms |
Craft CMS: Authorized asset "preview file" requests bypass allows users without asset access to retrieve private preview metadata CVE-2026-56385, GHSA-44px-qjjc-xrhq | Medium | 0.4% | 26 Mar, 2026 | Packagist craftcms/cms |