Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Project Firefly III has incorrect access control in the webhook management component CVE-2026-50886, GHSA-9mmg-q95p-gp67 | Critical | 0.3% | 15 Jun, 2026 | Packagist grumpydictator/firefly-iii |
Symfony: UrlGenerator Dot-Segment Encoding Skips Every Other Chained `../` or `./` → Generated URL Collapses Off-Route Under RFC 3986 Normalization CVE-2026-48784, GHSA-h5x3-xfc9-m39h | Medium | 0.3% | 15 Jun, 2026 | Packagist symfony/routing Packagist symfony/symfony |
Symfony: HtmlSanitizer URL Parser Deny Gates Underinclusive: Percent-Encoded BiDi Marks and Unicode Whitespace Bypass Visual-Spoofing Defense CVE-2026-48760, GHSA-v3wm-qf9p-c549 | Medium | 0.3% | 15 Jun, 2026 | Packagist symfony/html-sanitizer Packagist symfony/symfony |
Symfony: Mailomat Mailer Webhook Parser Reads the HMAC Algorithm from the Request: Signature Algorithm Downgrade CVE-2026-48747, GHSA-rrj9-5q2j-4gvr | Medium | 0.2% | 15 Jun, 2026 | Packagist symfony/mailomat-mailer Packagist symfony/symfony |
Symfony: IpUtils::PRIVATE_SUBNETS Omits IPv6 Transition Forms (6to4, NAT64, Teredo, IPv4-compatible): SSRF Bypass in NoPrivateNetworkHttpClient CVE-2026-48736, GHSA-38cx-cq6f-5755 | Medium | 0.6% | 15 Jun, 2026 | Packagist symfony/http-client Packagist symfony/http-foundation Packagist symfony/symfony |
Symfony: Security Firewall Bypass via failure_forward Subrequest: Unauthenticated Access to access_control-Protected GET Routes CVE-2026-48489, GHSA-6h46-9jf5-q59x | High | 0.6% | 15 Jun, 2026 | Packagist symfony/security-http Packagist symfony/symfony |
Symfony: HtmlSanitizer UrlAttributeSanitizer Misses URL Attributes CVE-2026-48761, GHSA-x5qj-865h-mgvm | Medium | 0.3% | 15 Jun, 2026 | Packagist symfony/html-sanitizer Packagist symfony/symfony |
Subrion CMS vulnerable to Cross-site Scripting CVE-2026-12202, GHSA-wrcg-234w-hfhq | Low | 0.2% | 15 Jun, 2026 | Packagist intelliants/subrion |
Microweber vulnerable to Path Traversal CVE-2026-12198, GHSA-vv4x-qcpq-wgrg | Medium | 0.5% | 15 Jun, 2026 | Packagist microweber/microweber |
Koel: Server-Side Request Forgery (SSRF) in radio station creation due to missing validation bail CVE-2026-50552, GHSA-jr4p-4xjh-fwvw | Medium | 0.2% | 12 Jun, 2026 | Packagist phanan/koel |
jmespath.php has CompilerRuntime code injection via unescaped function names CVE-2026-54133, GHSA-pcw8-m77r-2528 | Critical | 0.4% | 12 Jun, 2026 | Packagist mtdowling/jmespath.php |
Firefly II has Stored XSS in Audit Log Entry view via piggy bank name (ale.twig) GHSA-6jq6-x4cx-qvcm | Medium | Not scored | 12 Jun, 2026 | Packagist grumpydictator/firefly-iii |
Filament has inconsistent scope enforcement for its AttachAction and AssociateAction Select fields CVE-2026-48067, GHSA-7q3w-xqjw-g3cr | Medium | 0.3% | 11 Jun, 2026 | Packagist filament/actions Packagist filament/tables |
CodeIgniter4 has a validation bypass when uploading file extensions via `ext_in` rule CVE-2026-48062, GHSA-2gr4-ppc7-7mhx | Critical | 0.8% | 11 Jun, 2026 | Packagist codeigniter4/framework |
guzzlehttp/guzzle-services' XML Request Serialization Vulnerable to XML Injection via CDATA Terminator CVE-2026-53723, GHSA-q8r6-5hfw-5jff | Medium | 0.2% | 11 Jun, 2026 | Packagist guzzlehttp/guzzle-services |
guzzlehttp/psr7 has Host Confusion via Authority Reinterpretation CVE-2026-48998, GHSA-34xg-wgjx-8xph | Medium | 0.2% | 11 Jun, 2026 | Packagist guzzlehttp/psr7 |
guzzlehttp/psr7 has CRLF Injection via URI Host Component CVE-2026-49214, GHSA-hq7v-mx3g-29hw | Medium | 0.2% | 11 Jun, 2026 | Packagist guzzlehttp/psr7 |
Sharp Missing Authorization Check in Quick Creation Command Endpoints CVE-2026-53634, GHSA-vmwx-m75v-qvch | Medium | 0.2% | 10 Jun, 2026 | Packagist code16/sharp |
Concrete CMS: PHP Object Injection via unserialize() calls CVE-2026-10721, GHSA-g82f-9pw7-773w | High | 0.1% | 10 Jun, 2026 | Packagist concrete5/concrete5 |
BuddyPress: Any authenticated attacker can enumerate another user's complete friend list via IDOR CVE-2026-53675, GHSA-wmjr-58rf-xgrc | Medium | 0.2% | 10 Jun, 2026 | Packagist buddypress/buddypress |
BuddyPress: Authenticated attackers can access arbitrary private message threads via user_id request parameter CVE-2026-53673, GHSA-j3j5-5m8v-7gvc | High | 0.4% | 10 Jun, 2026 | Packagist buddypress/buddypress |
Pheditor: OS Command Injection in terminal handler via unsanitized 'dir' parameter CVE-2026-48030, GHSA-jvc5-6g7q-c843 | Critical | 7.5% | 09 Jun, 2026 | Packagist pheditor/pheditor |
SymfonyRuntime CVE-2024-50340 Patch Bypass: Web Requests Can Still Set APP_ENV/APP_DEBUG via parse_str/SAPI Argv Mismatch CVE-2026-47767, GHSA-fqc7-9xjw-jrh3 | High | 0.7% | 09 Jun, 2026 | Packagist symfony/runtime Packagist symfony/symfony |
LimeSurvey has a SQL Injection issue CVE-2026-50636, GHSA-pr6f-87hf-hx24 | High | 0.4% | 09 Jun, 2026 | Packagist limesurvey/limesurvey |
LimeSurvey constructs account password-reset links from the client-supplied HTTP Host header without validating it. CVE-2026-50635, GHSA-5c37-5j7w-8mh8 | High | 0.4% | 09 Jun, 2026 | Packagist limesurvey/limesurvey |
TYPO3 CMS has Broken Access Control in its Media Module CVE-2026-49742, GHSA-chm7-4vch-h8vr | High | 0.3% | 09 Jun, 2026 | Packagist typo3/cms-core Packagist typo3/cms-filelist |
TYPO3 CMS has Privilege Escalation & SQL Injection in its Form Framework CVE-2026-49741, GHSA-jh32-v29g-68pq | High | 0.2% | 09 Jun, 2026 | Packagist typo3/cms-core Packagist typo3/cms-form |
TYPO3 CMS has Insecure Deserialization via Core API CVE-2026-49740, GHSA-c78m-c52x-jgwp | Medium | 0.2% | 09 Jun, 2026 | Packagist typo3/cms-core |
TYPO3 CMS has Broken Access Control in its File Abstraction Layer CVE-2026-49738, GHSA-jf56-v8jc-jcc5 | Low | 0.4% | 09 Jun, 2026 | Packagist typo3/cms-core |
TYPO3 CMS has Broken Access Control in Backend API CVE-2026-47352, GHSA-2j54-93q2-3hjq | Medium | 0.2% | 09 Jun, 2026 | Packagist typo3/cms-backend Packagist typo3/cms-core |
TYPO3 CMS: Broken Access Control in Media Module CVE-2026-47351, GHSA-q93m-25xv-94hh | Medium | 0.2% | 09 Jun, 2026 | Packagist typo3/cms-backend Packagist typo3/cms-core |
TYPO3 CMS has Broken Access Control in its DataHandler CVE-2026-47350, GHSA-qcmw-6rm2-5x78 | Medium | 0.2% | 09 Jun, 2026 | Packagist typo3/cms-core |
TYPO3 CMS has Broken Access Control in the Recycler Module CVE-2026-47349, GHSA-f34x-rx2w-7pm3 | Medium | 0.2% | 09 Jun, 2026 | Packagist typo3/cms-core Packagist typo3/cms-recycler |
TYPO3 CMS has Cross-Site Scripting in Indexed Search CVE-2026-47348, GHSA-cg75-qfg2-w9hj | Medium | 0.3% | 09 Jun, 2026 | Packagist typo3/cms-core Packagist typo3/cms-indexed-search |
TYPO3 CMS has an Open Redirect Vulnerability via Core Utilities CVE-2026-47347, GHSA-3p42-w5ch-gg42 | Medium | 0.3% | 09 Jun, 2026 | Packagist typo3/cms-core |
TYPO3 CMS has Broken Access Control in its Form Framework CVE-2026-47346, GHSA-hwvq-2w67-rvxp | High | 0.3% | 09 Jun, 2026 | Packagist typo3/cms-core Packagist typo3/cms-form |
TYPO3 CMS: Destructive Actions on File Mount Folders CVE-2026-47343, GHSA-3v8v-4wg6-r7qh | High | 0.2% | 09 Jun, 2026 | Packagist typo3/cms-core |
TYPO3 CMS has Broken Access Control in its Form Framework CVE-2026-11607, GHSA-pjpj-v387-x4vq | High | 0.2% | 09 Jun, 2026 | Packagist typo3/cms-core Packagist typo3/cms-form |
Poweradmin: CSV Injection in log export endpoints allows formula execution in spreadsheet applications CVE-2026-47693, GHSA-3h6h-67x3-cv5x | Medium | 0.4% | 08 Jun, 2026 | Packagist poweradmin/poweradmin |
PHPSpreadsheet has a patch bypass for CVE-2026-34084 CVE-2026-45034, GHSA-87m4-826x-3crx | Critical | 0.5% | 08 Jun, 2026 | Packagist phpoffice/phpspreadsheet |
TYPO3 HTML Sanitizer allows Cross-site Scripting CVE-2026-47345, GHSA-p5j5-4j3q-8mq8 | Medium | 0.5% | 08 Jun, 2026 | Packagist typo3/html-sanitizer |
TYPO3 HTML Sanitizer allows Cross-site Scripting CVE-2026-47344, GHSA-jvf5-rxvv-3mcg | Low | 0.3% | 08 Jun, 2026 | Packagist typo3/html-sanitizer |
YesWiki has Unsafe eval() in its Formula Calculato, Leading to Remote Code Execution & Denial of Service CVE-2026-52778, GHSA-px5m-h76g-p7p8 | Critical | 0.8% | 08 Jun, 2026 | Packagist yeswiki/yeswiki |
Snipe-IT: Bulk editing users allowed `ldap_import` and `activated_in` bulk editing users CVE-2026-48507, GHSA-6f75-x745-xcpr | High | 0.2% | 08 Jun, 2026 | Packagist snipe/snipe-it |
phpMyFAQ has Weak Cryptography - SHA1 for Password Hashing CVE-2026-48488, GHSA-58fg-62fg-3fcj | Low | 0.2% | 08 Jun, 2026 | Packagist phpmyfaq/phpmyfaq Packagist thorsten/phpmyfaq |
Twig: Sandbox: multiple `__toString()` policy bypasses via unguarded string coercion points CVE-2026-47732, GHSA-pr2w-4gpj-cpq4 | High | 0.4% | 05 Jun, 2026 | Packagist twig/twig |
Twig: XSS in profiler HtmlDumper via unescaped template and profile names CVE-2026-47730, GHSA-2g2g-8p8h-fgwm | Medium | 0.3% | 05 Jun, 2026 | Packagist twig/twig |
Shopper: Multiple data integrity and disclosure issues in admin Livewire components CVE-2026-47743, GHSA-hr9v-r8r2-hg7j | High | 0.4% | 05 Jun, 2026 | Packagist shopper/framework |
Shopware: SSRF in Media External-Link Endpoint Bypasses IP Validation CVE-2026-48013, GHSA-gq96-5pfx-f4vc | Medium | 0.4% | 04 Jun, 2026 | Packagist shopware/core Packagist shopware/platform |
Shopware: Stored XSS via SVG file upload — no SVG sanitization CVE-2026-48015, GHSA-xvhc-gm7j-mhmc | Medium | 0.5% | 04 Jun, 2026 | Packagist shopware/core Packagist shopware/platform |