Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Saloon is vulnerable to SSRF and credential leakage via absolute URL in endpoint overriding base URL CVE-2026-33182, GHSA-c83f-3xp6-hfcp | Medium | 0.4% | 25 Mar, 2026 | Packagist saloonphp/saloon |
AVideo: Full-Read SSRF Through Unvalidated statsURL Parameter in plugin/Live/test.php GHSA-wxjx-r2j2-96fx | Medium | Not scored | 25 Mar, 2026 | Packagist wwbn/avideo |
PrestaShop: Improper Use of Validation Framework CVE-2026-33674, GHSA-283w-xf3q-788v | Medium | 0.2% | 25 Mar, 2026 | Packagist prestashop/prestashop |
Invoice Ninja Denylist Bypass may Lead to Stored XSS via Invoice Line Items CVE-2026-33628, GHSA-98wm-cxpw-847p | Medium | 0.2% | 24 Mar, 2026 | Packagist invoiceninja/invoiceninja |
Craft CMS has an authorization bypass which allows any control panel user to move entries without permissions CVE-2026-33162, GHSA-f582-6gf6-gx4g | Medium | 0.3% | 24 Mar, 2026 | Packagist craftcms/cms |
Craft CMS: Unauthenticated Users Can Perform Restricted Project Config Sync Operations CVE-2026-33159, GHSA-6mrr-q3pj-h53w | Medium | 0.3% | 24 Mar, 2026 | Packagist craftcms/cms |
Craft CMS: Low-privilege users could read private asset contents when editing an asset (IDOR) CVE-2026-33158, GHSA-3pvf-vxrv-hh9c | Medium | 0.4% | 24 Mar, 2026 | Packagist craftcms/cms |
ConcreteCMS is vulnerable to Denial of Service During Bulk Downloads CVE-2026-30662, GHSA-p68c-rmfh-j48h | Medium | 0.3% | 24 Mar, 2026 | Packagist concrete5/concrete5 |
Roadiz has Server-Side Request Forgery (SSRF) in roadiz/documents CVE-2026-33486, GHSA-rc55-58f4-687g | Medium | 0.4% | 23 Mar, 2026 | Packagist roadiz/documents |
Connect CMS has SSRF in the External Page Migration Feature of its Page Management Plugin CVE-2026-32279, GHSA-jh46-85jr-6ph9 | Medium | 0.4% | 23 Mar, 2026 | Packagist opensource-workshop/connect-cms |
Sprig Plugin for Craft CMS potentially discloses sensitive information via Sprig Playground CVE-2026-27131, GHSA-m59h-42jf-cphr | Medium | 0.3% | 23 Mar, 2026 | Packagist putyourlightson/craft-sprig |
AVideo vulnerable to IP Address Spoofing via Untrusted HTTP Headers in getRealIpAddr() CVE-2026-33690, GHSA-8p2x-5cpm-qrqw | Medium | 0.2% | 23 Mar, 2026 | Packagist wwbn/avideo |
AVideo has Pre-Captcha User Enumeration and Account Status Disclosure in Password Recovery Endpoint CVE-2026-33688, GHSA-m99f-mmvg-3xmx | Medium | 0.3% | 23 Mar, 2026 | Packagist wwbn/avideo |
AVideo Allows Unauthenticated Access to AD_Server reports.json.php that Exposes Ad Campaign Analytics and User Data CVE-2026-33685, GHSA-j36m-74g2-7m95 | Medium | 0.3% | 23 Mar, 2026 | Packagist wwbn/avideo |
AVideo vulnerable to Stored XSS via html_entity_decode() Reversing xss_esc() Sanitization in Channel About Field CVE-2026-33683, GHSA-ghx5-7jjg-q2j7 | Medium | 0.2% | 23 Mar, 2026 | Packagist wwbn/avideo |
HybridAuth Has Improper SSL Certificate Validation in Curl HTTP Client CVE-2026-4587, GHSA-r3hf-q3mf-7h6w | Medium | 0.2% | 23 Mar, 2026 | Packagist hybridauth/hybridauth |
AVideo has Unauthenticated Information Disclosure of User Group Permission Mappings via Permissions Plugin CVE-2026-33501, GHSA-96qp-8cmq-jvq8 | Medium | 0.4% | 20 Mar, 2026 | Packagist wwbn/avideo |
AVideo - Incomplete Fix for CVE-2026-27568: Stored XSS via Markdown `javascript:` URI Bypasses ParsedownSafeWithLinks Sanitization CVE-2026-33500, GHSA-72h5-39r7-r26j | Medium | 0.2% | 20 Mar, 2026 | Packagist wwbn/avideo |
AVideo has Reflected XSS via unlockPassword Parameter in forbiddenPage.php and warningPage.php CVE-2026-33499, GHSA-7292-w8qp-mhq2 | Medium | 0.2% | 20 Mar, 2026 | Packagist wwbn/avideo |
league/commonmark has an embed extension allowed_domains bypass CVE-2026-33347, GHSA-hh8v-hgvp-g3f5 | Medium | 0.3% | 19 Mar, 2026 | Packagist league/commonmark |
AVideo: IDOR - Any Admin Can Set Another User's Channel Password via setPassword.json.php CVE-2026-33297, GHSA-6547-8hrg-c55m | Medium | 0.4% | 19 Mar, 2026 | Packagist wwbn/avideo |
AVideo Affected by SSRF in BulkEmbed Thumbnail Fetch Allows Reading Internal Network Resources CVE-2026-33294, GHSA-66cw-h2mj-j39p | Medium | 0.3% | 19 Mar, 2026 | Packagist wwbn/avideo |
AVideo has Unauthenticated PGP Message Decryption via Public Endpoint CVE-2026-56346, GHSA-5x2w-37xf-7962 | Medium | 0.6% | 19 Mar, 2026 | Packagist wwbn/avideo |
AVideo has a Path Traversal in listFiles.json.php Enables Server Filesystem Enumeration CVE-2026-33238, GHSA-4wmm-6qxj-fpj4 | Medium | 0.4% | 19 Mar, 2026 | Packagist wwbn/avideo |
AVideo has SSRF in Scheduler Plugin via callbackURL Missing `isSSRFSafeURL()` Validation CVE-2026-33237, GHSA-v467-g7g7-hhfh | Medium | 0.4% | 19 Mar, 2026 | Packagist wwbn/avideo |
Statamic is missing authorization check on taxonomy term creation via fieldtype CVE-2026-33177, GHSA-wh3h-gvc4-cc2g | Medium | 0.2% | 18 Mar, 2026 | Packagist statamic/cms |
Statamic has a path traversal in file dictionary fieldtype CVE-2026-33171, GHSA-qm7r-wwq7-6f85 | Medium | 0.4% | 18 Mar, 2026 | Packagist statamic/cms |
Craft CMS Vulnerable to Stored XSS in Revision Context Menu CVE-2026-33051, GHSA-3x4w-mxpf-fhqq | Medium | 0.3% | 18 Mar, 2026 | Packagist craftcms/cms |
Yoast Duplicate Post has an Authenticated (Contributor+) Missing Authorization to Arbitrary Post Duplication and Overwrite CVE-2026-1217, GHSA-g9w4-m5fx-x3wv | Medium | 0.2% | 18 Mar, 2026 | Packagist yoast/duplicate-post |
Unauthenticated Reflected XSS via innerHTML in AVideo CVE-2026-33035, GHSA-wfq5-qgqp-hvhv | Medium | 0.3% | 17 Mar, 2026 | Packagist wwbn/avideo |
AVideo has an Unauthenticated Password Hash Oracle via encryptPass.json.php CVE-2026-33041, GHSA-px7x-gq96-rmp5 | Medium | 0.3% | 17 Mar, 2026 | Packagist wwbn/avideo |
The mailqueue TYPO3 extension has Insecure Deserialization in `TransportFailure` class CVE-2026-1323, GHSA-2pm6-9fhx-vvg3 | Medium | 0.2% | 17 Mar, 2026 | Packagist cpsit/typo3-mailqueue |
Admidio is Missing Authorization on Forum Topic and Post Deletion CVE-2026-32818, GHSA-g375-5wmp-xr78 | Medium | 0.2% | 16 Mar, 2026 | Packagist admidio/admidio |
Admidio has an HTMLPurifier Bypass in eCard Message Allows HTML Email Injection CVE-2026-32757, GHSA-4wr4-f2qf-x5wj | Medium | 0.2% | 16 Mar, 2026 | Packagist admidio/admidio |
Admidio Vulnerable to SSRF and Local File Read via Unrestricted URL Fetch in SSO Metadata Endpoint CVE-2026-32812, GHSA-6j68-gcc3-mq73 | Medium | 0.4% | 16 Mar, 2026 | Packagist admidio/admidio |
Admidio is Missing CSRF Protection on Role Membership Date Changes CVE-2026-32755, GHSA-h8gr-qwr6-m9gx | Medium | 0.2% | 16 Mar, 2026 | Packagist admidio/admidio |
Admidio is Missing CSRF Validation on Role Delete, Activate, and Deactivate Actions CVE-2026-32816, GHSA-wwg8-6ffr-h4q2 | Medium | 0.1% | 16 Mar, 2026 | Packagist admidio/admidio |
Amazon S3 for Craft CMS has an Information Disclosure vulnerability CVE-2026-32265, GHSA-hwj7-4vgc-j3v9 | Medium | 0.4% | 16 Mar, 2026 | Packagist craftcms/aws-s3 |
Craft CMS has a Path Traversal Vulnerability in AssetsController CVE-2026-32262, GHSA-472v-j2g4-g9h2 | Medium | 0.3% | 16 Mar, 2026 | Packagist craftcms/cms |
Aureus ERP vulnerable to cross-site scripting in the Chatter Message Handler CVE-2026-4175, GHSA-76c2-3q6g-xvpm | Medium | 0.3% | 16 Mar, 2026 | Packagist aureuserp/aureuserp |
Statamic vulnerable to privilege escalation via stored cross-site scripting CVE-2026-32612, GHSA-hcch-w73c-jp4m | Medium | 0.2% | 13 Mar, 2026 | Packagist statamic/cms |
Shopware has user enumeration via distinct error codes on Store API login endpoint CVE-2026-31888, GHSA-gqc5-xv7m-gcjq | Medium | 0.2% | 11 Mar, 2026 | Packagist shopware/core Packagist shopware/platform |
Craft CMS Vulnerable to Stored XSS via User Group Name in User Permissions Page CVE-2026-56381, GHSA-g3hp-vvqf-8vw6 | Medium | 0.2% | 11 Mar, 2026 | Packagist craftcms/cms |
CraftCMS vulnerable to reflective XSS via incomplete return URL sanitization CVE-2026-31859, GHSA-fvwq-45qv-xvhv | Medium | 0.2% | 11 Mar, 2026 | Packagist craftcms/cms |
Sylius has a DQL Injection via API Order Filters CVE-2026-31825, GHSA-xcwx-r2gw-w93m | Medium | 0.2% | 10 Mar, 2026 | Packagist sylius/sylius |
Sylius Vulnerable to Authenticated Stored XSS CVE-2026-31823, GHSA-mx4q-xxc9-pf5q | Medium | 0.2% | 10 Mar, 2026 | Packagist sylius/sylius |
Sylius has a XSS vulnerability in checkout login form CVE-2026-31822, GHSA-vgh8-c6fp-7gcg | Medium | 0.2% | 10 Mar, 2026 | Packagist sylius/sylius |
Sylius is Missing Authorization in API v2 Add Item Endpoint CVE-2026-31821, GHSA-wjmg-4cq5-m8hg | Medium | 0.2% | 10 Mar, 2026 | Packagist sylius/sylius |
Sylius has an Open Redirect via Referer Header CVE-2026-31819, GHSA-9ffx-f77r-756w | Medium | 0.2% | 10 Mar, 2026 | Packagist sylius/sylius |
Craft Commerce: Potential IDOR in Commerce carts CVE-2026-31867, GHSA-vff3-pqq8-4cpq | Medium | 0.3% | 10 Mar, 2026 | Packagist craftcms/commerce |