Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
AVideo has Authenticated Server-Side Request Forgery via downloadURL in aVideoEncoder.json.php CVE-2026-27732, GHSA-h39h-7cvg-q7j6 | High | 0.3% | 24 Feb, 2026 | Packagist wwbn/avideo |
Craft CMS has Cloud Metadata SSRF Protection Bypass via DNS Rebinding CVE-2026-27127, GHSA-gp2f-7wcm-5fhx | High | 0.5% | 23 Feb, 2026 | Packagist craftcms/cms |
Moodle has a Remote Code Execution risk via file restore BIT-moodle-2026-26045, CVE-2026-26045, GHSA-ggxq-2mg9-8966 | High | 0.6% | 21 Feb, 2026 | Packagist moodle/moodle |
Zumba Json Serializer has a potential PHP Object Injection via Unrestricted @type in unserialize() CVE-2026-27206, GHSA-v7m3-fpcr-h7m2 | High | 0.8% | 19 Feb, 2026 | Packagist zumba/json-serializer |
Formwork Improperly Managed Privileges in User creation CVE-2026-27198, GHSA-34p4-7w83-35g2 | High | 0.5% | 19 Feb, 2026 | Packagist getformwork/formwork |
Statamic affected by privilege escalation via stored cross-site scripting CVE-2026-27196, GHSA-8r7r-f4gm-wcpq | High | 0.3% | 19 Feb, 2026 | Packagist statamic/cms |
LibreNMS has a Time-Based Blind SQL Injection in address-search.inc.php CVE-2026-26990, GHSA-79q9-wc6p-cf92 | High | 4.5% | 18 Feb, 2026 | Packagist librenms/librenms |
Pterodactyl Panel's SFTP sessions remain active after user account deletion or password change GHSA-hr7j-63v7-vj7g, GO-2026-4497 | High | Not scored | 17 Feb, 2026 | Go github.com/pterodactyl/wings Packagist pterodactyl/panel |
MagicLink: Insecure Deserialization of MagicLink Actions Leads to Remote Code Execution CVE-2026-61701, GHSA-r33w-fg8j-9c94 | High | 0.8% | 12 Feb, 2026 | Packagist cesargb/laravel-magiclink |
Statamic CMS vulnerable to privilege escalation via stored cross-site scripting CVE-2026-25759, GHSA-ff9r-ww9c-43x8 | High | 0.3% | 11 Feb, 2026 | Packagist statamic/cms |
Adminer has an Unauthenticated Persistent DoS via Array Injection in ?script=version Endpoint CVE-2026-25892, GHSA-q4f2-39gr-45jh | High | 1.7% | 09 Feb, 2026 | Packagist vrana/adminer |
Craft CMS Vulnerable to potential authenticated Remote Code Execution via malicious attached Behavior CVE-2026-25498, GHSA-7jx7-3846-m7w7 | High | 1.1% | 09 Feb, 2026 | Packagist craftcms/cms |
Craft CMS: GraphQL Asset Mutation Privilege Escalation CVE-2026-25497, GHSA-fxp3-g6gw-4r4v | High | 0.5% | 09 Feb, 2026 | Packagist craftcms/cms |
Craft CMS Vulnerable to SQL Injection in Element Indexes via `criteria[orderBy]` CVE-2026-25495, GHSA-2453-mppf-46cj | High | 0.6% | 09 Feb, 2026 | Packagist craftcms/cms |
OpenSTAManager has a SQL Injection vulnerability in the Scadenzario bulk operations module CVE-2026-24418, GHSA-4xwv-49c8-fvhq | High | 0.4% | 06 Feb, 2026 | Packagist devcode-it/openstamanager |
OpenSTAManager has a Time-Based Blind SQL Injection with Amplified Denial of Service CVE-2026-24417, GHSA-4hc4-8599-xh2h | High | 0.4% | 06 Feb, 2026 | Packagist devcode-it/openstamanager |
OpenSTAManager has a Time-Based Blind SQL Injection in Article Pricing Module CVE-2026-24416, GHSA-p864-fqgv-92q4 | High | 0.4% | 06 Feb, 2026 | Packagist devcode-it/openstamanager |
OpenSTAManager has a SQL Injection in the Prima Nota module CVE-2026-24419, GHSA-4j2x-jh4m-fqv6 | High | 0.4% | 06 Feb, 2026 | Packagist devcode-it/openstamanager |
OpenSTAManager has a SQL Injection in Scadenzario Print Template CVE-2025-69216, GHSA-q6g3-fv43-m2w6 | High | 0.4% | 06 Feb, 2026 | Packagist devcode-it/openstamanager |
OpenSTAManager has a SQL Injection in ajax_select.php (componenti endpoint) CVE-2025-69214, GHSA-qjv8-63xq-gq8m | High | 0.5% | 06 Feb, 2026 | Packagist devcode-it/openstamanager |
OpenSTAManager has an SQL Injection in the Stampe Module CVE-2025-69215, GHSA-qx9p-w3vj-q24q | High | 0.4% | 03 Feb, 2026 | Packagist devcode-it/openstamanager |
OpenSTAManager has a SQL Injection in ajax_complete.php (get_sedi endpoint) CVE-2025-69213, GHSA-w995-ff8h-rppg | High | 0.4% | 03 Feb, 2026 | Packagist devcode-it/openstamanager |
FacturaScripts has SQL Injection in Autocomplete Actions CVE-2026-25514, GHSA-pqqg-5f4f-8952 | High | 0.5% | 03 Feb, 2026 | Packagist facturascripts/facturascripts |
FacturaScripts has SQL Injection in API ORDER BY Clause CVE-2026-25513, GHSA-cjfx-qhwm-hf99 | High | 0.5% | 03 Feb, 2026 | Packagist facturascripts/facturascripts |
Moodle Affected by Improper Restriction of Excessive Authentication Attempts BIT-moodle-2025-67853, CVE-2025-67853, GHSA-5cx4-w4fh-fr57 | High | 0.5% | 03 Feb, 2026 | Packagist moodle/moodle |
Moodle formula injection vulnerability BIT-moodle-2025-67851, CVE-2025-67851, GHSA-qfh6-h7j6-fvjv | High | 0.3% | 03 Feb, 2026 | Packagist moodle/moodle |
Moodle vulnerable to Cross-site Scripting BIT-moodle-2025-67850, CVE-2025-67850, GHSA-6mmv-f6c6-v6q8 | High | 0.3% | 03 Feb, 2026 | Packagist moodle/moodle |
Moodle Cross-site Scripting (XSS) vulnerability BIT-moodle-2025-67849, CVE-2025-67849, GHSA-mhf6-pp52-8wqj | High | 0.3% | 03 Feb, 2026 | Packagist moodle/moodle |
Moodle authentication bypass vulnerability BIT-moodle-2025-67848, CVE-2025-67848, GHSA-j5jv-w5cw-j9ff | High | 0.4% | 03 Feb, 2026 | Packagist moodle/moodle |
RaspAP raspap-webgui contains an OS Command Injection vulnerability CVE-2026-24788, GHSA-4wwf-f7w3-94f5 | High | 1.4% | 02 Feb, 2026 | Packagist billz/raspap-webgui |
PsySH has Local Privilege Escalation via CWD .psysh.php auto-load CVE-2026-25129, GHSA-4486-gxhx-5mg7 | High | 0.3% | 30 Jan, 2026 | Packagist psy/psysh |
EGroupware has SQL Injection in Nextmatch Filter Processing CVE-2026-22243, GHSA-rvxj-7f72-mhrx | High | 0.4% | 28 Jan, 2026 | Packagist egroupware/egroupware |
PHPUnit Vulnerable to Unsafe Deserialization in PHPT Code Coverage Handling CVE-2026-24765, GHSA-vvj3-c3rp-c85p | High | 0.4% | 27 Jan, 2026 | Packagist phpunit/phpunit |
LibreNMS contains an authenticated SQL Injection vulnerability CVE-2020-36947, GHSA-qp2j-v5jg-hg68 | High | 0.5% | 27 Jan, 2026 | Packagist librenms/librenms |
phpMyFAQ: Public API endpoints expose emails and invisible questions CVE-2026-24422, GHSA-j4rc-96xj-gvqc | High | 0.4% | 23 Jan, 2026 | Packagist phpmyfaq/phpmyfaq Packagist thorsten/phpmyfaq |
Moodle affected by a code injection vulnerability BIT-moodle-2025-67847, CVE-2025-67847, GHSA-xvmh-25jw-gmmm | High | 0.6% | 23 Jan, 2026 | Packagist moodle/moodle |
phpPgAdmin contains a remote command execution vulnerability CVE-2021-47853, GHSA-86gh-c8r8-xwhq | High | Not scored | 21 Jan, 2026 | Packagist phppgadmin/phppgadmin |
alextselegidis/easyappointments is Vulnerable to CSRF Protection Bypass CVE-2026-23622, GHSA-54v4-4685-vwrj | High | 0.2% | 15 Jan, 2026 | Packagist alextselegidis/easyappointments |
Pimcore ENV Variables and Cookie Informations are exposed in http_error_log CVE-2026-23493, GHSA-q433-j342-rp9h | High | 0.4% | 15 Jan, 2026 | Packagist pimcore/pimcore |
Aimeos contains a SQL injection vulnerability in the json api 'sort' parameter CVE-2021-47763, GHSA-hm9j-cgmm-2w36 | High | 0.3% | 15 Jan, 2026 | Packagist aimeos/aimeos-laravel |
Pimcore Has an Incomplete Patch for CVE-2023-30848 CVE-2026-23492, GHSA-qvr7-7g55-69xj | High | 0.5% | 14 Jan, 2026 | Packagist pimcore/pimcore |
Shopware Has Improper Control of Generation of Code in Twig rendered views CVE-2026-23498, GHSA-7cw6-7h3h-v8pf | High | 0.4% | 14 Jan, 2026 | Packagist shopware/core Packagist shopware/shopware |
TYPO3 CMS Allows Broken Access Control in Recycler Module CVE-2025-59022, GHSA-p52w-7rhw-9m67 | High | 0.4% | 13 Jan, 2026 | Packagist typo3/cms-recycler |
Pterodactyl does not revoke SFTP access when server is deleted or permissions reduced CVE-2025-68954, GHSA-8c39-xppg-479c, GO-2026-4283 | High | 0.2% | 06 Jan, 2026 | Go github.com/pterodactyl/wings Packagist pterodactyl/panel |
Redaxo has Path Traversal in Backup Addon Leading to Arbitrary File Read CVE-2026-21857, GHSA-824x-88xg-cwrv | High | 0.5% | 05 Jan, 2026 | Packagist redaxo/source |
Craft CMS vulnerable to potential authenticated Remote Code Execution via malicious attached Behavior CVE-2025-68455, GHSA-255j-qw47-wjh5 | High | 1.0% | 05 Jan, 2026 | Packagist craftcms/cms |
Unauthenticated Craft CMS users can trigger a database backup CVE-2025-68456, GHSA-v64r-7wg9-23pr | High | 0.6% | 05 Jan, 2026 | Packagist craftcms/cms |
Bagisto SSTI vulnerability in type parameter can lead to RCE CVE-2026-21450, GHSA-9hvg-qw5q-wqwp | High | 1.4% | 02 Jan, 2026 | Packagist bagisto/bagisto |
Bagisto is vulnerable to SSTI via name parameters provided by non-admin low-privilege users CVE-2026-21449, GHSA-mqhg-v22x-pqj8 | High | 0.5% | 02 Jan, 2026 | Packagist bagisto/bagisto |
Bagisto has Normal & Blind SSTI from low-privilege user when ordering product CVE-2026-21448, GHSA-5j4h-4f72-qpm6 | High | 0.9% | 02 Jan, 2026 | Packagist bagisto/bagisto |