Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Shopware: Unauthorized Payment Trigger for Foreign Orders via /store-api/handle-payment CVE-2026-48016, GHSA-9v5m-39wh-5chq | Medium | 0.4% | 04 Jun, 2026 | Packagist shopware/core Packagist shopware/platform |
Shopware: Admin API ACL Bypass in Order State Transition Endpoints CVE-2026-48014, GHSA-f8q6-3g5w-jjr6 | Medium | 0.4% | 04 Jun, 2026 | Packagist shopware/core Packagist shopware/platform |
Shopware SSO referer trust leading to an arbitrary redirect target CVE-2026-48012, GHSA-4x3x-869w-xx3m | Medium | 0.3% | 04 Jun, 2026 | Packagist shopware/core Packagist shopware/platform |
Shopware: Timing-attack on admin panel allowing enumeration of administrator usernames CVE-2026-48011, GHSA-7w52-7jvm-m9vw | Low | 0.2% | 04 Jun, 2026 | Packagist shopware/core Packagist shopware/platform |
Shopware: Privilege escalation: non-admin user with user:create ACL can create admin accounts CVE-2026-48010, GHSA-v39m-97p8-gqg7 | Medium | 0.5% | 04 Jun, 2026 | Packagist shopware/core Packagist shopware/platform |
Shopware: Admin Account Takeover via User Recovery Hash Exposure CVE-2026-48009, GHSA-8v9p-g828-v98f | Medium | 0.5% | 04 Jun, 2026 | Packagist shopware/core Packagist shopware/platform |
Shopware: Privilege Escalation via Sync API Integration Admin Flag Bypass CVE-2026-48008, GHSA-gv8p-48fr-4fxg | Medium | 0.5% | 04 Jun, 2026 | Packagist shopware/core Packagist shopware/platform |
WWBN AVideo: Unauthenticated Stored DOM Cross-Site Scripting via Per-Client Metadata Broadcast in YPTSocket Plugin CVE-2026-54458, GHSA-8whc-2wmv-ww35 | Critical | 0.4% | 04 Jun, 2026 | Packagist WWBN/AVideo |
WWBN AVideo: Stored XSS via Hostile YouTube Video Title in AVideo YouTubeAPI Gallery Section CVE-2026-50183, GHSA-66q5-cj5g-wrfx | Medium | 0.2% | 04 Jun, 2026 | Packagist WWBN/AVideo |
WWBN AVideo: Unauthenticated Reflected XSS via $_GET['search'] in AVideo YouTubeAPI Gallery Pagination CVE-2026-50182, GHSA-hgjh-6wj8-gcgf | Medium | 0.2% | 04 Jun, 2026 | Packagist WWBN/AVideo |
WWBN AVideo: Stored XSS via autoEvalCodeOnHTML Bypass in MessageSQLite WebSocket Handler (CVE-2026-43874 Bypass) CVE-2026-49279, GHSA-2fhx-q92v-5fhv | High | 0.4% | 04 Jun, 2026 | Packagist wwbn/avideo |
Froxlor's API Authentication bypasses 2FA Authentication CVE-2026-52793, GHSA-f9rx-7wf7-jr36 | High | 0.3% | 03 Jun, 2026 | Packagist froxlor/froxlor |
Froxlor: BIND Zone File Injection via TXT Record Content CVE-2026-41234, GHSA-37m5-m4q3-fc6x | High | 0.3% | 03 Jun, 2026 | Packagist froxlor/froxlor |
Concrete CMS is vulnerable to PHP Object Injection via unserialize() calls in the Workflow, Form block, and File/Set components CVE-2026-7888, GHSA-52pr-7vmf-2w7x | High | 0.2% | 03 Jun, 2026 | Packagist concrete5/concrete5 |
backpack/crud is vulnerable to Cross-Site Scripting (XSS) CVE-2022-31114, GHSA-m8xx-3x29-84h8 | Medium | 0.3% | 03 Jun, 2026 | Packagist backpack/crud |
Dolibarr ERP CRM is vulnerable to Improper Authorization through its Leave Request REST API CVE-2026-10215, GHSA-7fg5-vc77-69fp | Low | 0.3% | 01 Jun, 2026 | Packagist dolibarr/dolibarr |
Admidio: Any logged-in user can delete inventory fields via `mode=field_delete` — incomplete fix of #2024 CVE-2026-47233, GHSA-xw54-c3mx-9pm3 | Medium | 0.3% | 29 May, 2026 | Packagist admidio/admidio |
Admidio writes session IDs and auto-login cookie values to application logs CVE-2026-47234, GHSA-mch8-wf3h-6x88 | Medium | 0.2% | 29 May, 2026 | Packagist admidio/admidio |
Admidio PKCS#12 private key export action lacks CSRF protection CVE-2026-47232, GHSA-4rgq-38mh-9xqg | Medium | 0.1% | 29 May, 2026 | Packagist admidio/admidio |
Admidio has IDOR in `documents-files.php` `mode=move_save` that lets any folder-uploader exfiltrate files from private folders CVE-2026-47231, GHSA-x628-457g-2pw9 | High | 0.4% | 29 May, 2026 | Packagist admidio/admidio |
Admidio: IDOR in documents-files.php allows cross-folder file rename and description changes by unauthorized uploaders CVE-2026-47230, GHSA-q6w3-hpfv-rg36 | Medium | 0.3% | 29 May, 2026 | Packagist admidio/admidio |
Admidio: CSRF in SSO client `enable` action toggles SAML/OIDC clients without token validation CVE-2026-47229, GHSA-xg76-5qj2-2hhv | Medium | 0.1% | 29 May, 2026 | Packagist admidio/admidio |
Admidio's CSRF in registration `send_login` mode resets arbitrary user passwords CVE-2026-47228, GHSA-mx25-j3rc-6w2w | Medium | 0.2% | 29 May, 2026 | Packagist admidio/admidio |
Admidio module-administrator can delete or reorder categories owned by other modules via dead authorization check in `modules/categories.php` CVE-2026-47227, GHSA-rwjr-qjj3-mq2f | Medium | 0.3% | 29 May, 2026 | Packagist admidio/admidio |
Admidio: Authorization bypass in file_delete enables cross-folder file removal by authenticated users without delete privileges CVE-2026-47226, GHSA-qc4c-hrmc-4f78 | Medium | 0.3% | 29 May, 2026 | Packagist admidio/admidio |
Symfony: Twilio SMS Notifier allows unauthenticated webhook injection due to missing X-Twilio-Signature verification CVE-2026-47212, GHSA-55rj-x2vc-4whq | Medium | 1.5% | 29 May, 2026 | Packagist symfony/symfony Packagist symfony/twilio-notifier |
Spatie Laravel Media Library contains a file upload restriction bypass CVE-2026-48557, GHSA-3ggm-c5m7-hfv5 | High | 0.4% | 29 May, 2026 | Packagist spatie/laravel-medialibrary |
Spatie Laravel Media Library contains a server-side request forgery vulnerability CVE-2026-48555, GHSA-fggg-964j-3j7h | Medium | 0.2% | 29 May, 2026 | Packagist spatie/laravel-medialibrary |
formie's unauthenticated front-end submission editing can overwrite existing submissions CVE-2026-47266, GHSA-pgxq-p76c-x9cg | High | 0.3% | 29 May, 2026 | Packagist verbb/formie |
Koel Vulnerable to SSRF via Podcast Episode Enclosure URLs CVE-2026-47260, GHSA-7j2f-6h2r-6cqc | High | 0.3% | 29 May, 2026 | Packagist phanan/koel |
Shopper: Missing per-action authorization on PaymentMethods, Currencies and Carriers admin tables CVE-2026-47745, GHSA-fxqw-97cc-7g5c | Medium | 0.2% | 29 May, 2026 | Packagist shopper/framework |
Shopper: Authorization bypass and RBAC privilege escalation in team settings CVE-2026-47744, GHSA-c3qp-2ggw-xjg7 | Critical | 0.3% | 29 May, 2026 | Packagist shopper/framework |
Shopper: Missing authorization on Product admin Livewire sub-form components CVE-2026-47742, GHSA-h4mp-g9c6-xwph | Medium | 0.2% | 29 May, 2026 | Packagist shopper/framework |
ezsystems/ezpublish-legacy has a SQL injection in dfscleanup CVE-2026-38739, GHSA-xg9x-h37w-h3r3 | High | Not scored | 29 May, 2026 | Packagist ezsystems/ezpublish-legacy |
Froxlor has an incomplete fix for CVE-2026-30932 CVE-2026-41237, GHSA-j6fm-9rfm-j5hx | High | 0.3% | 29 May, 2026 | Packagist froxlor/froxlor |
Froxlor has privilege escalation in SSH key synchronization via symlinked `authorized_keys` path CVE-2026-41236, GHSA-mq5v-pxpm-8jw2 | High | 0.4% | 29 May, 2026 | Packagist froxlor/froxlor |
Froxlor has an authorization bypass in FTP shell assignment via missing server-side `available_shells` enforcement CVE-2026-41235, GHSA-gcv3-5v9q-fmhh | High | 0.2% | 29 May, 2026 | Packagist froxlor/froxlor |
WWBN AVideo: Authenticated wallet credit bypass in AuthorizeNet processPayment endpoint CVE-2026-47696, GHSA-9392-pj54-qqf8 | High | 0.1% | 29 May, 2026 | Packagist WWBN/AVideo |
WWBN AVideo: Stored XSS via unescaped Gallery category description CVE-2026-47694, GHSA-c8h8-vq34-9fw2 | Medium | 0.2% | 29 May, 2026 | Packagist WWBN/AVideo |
Mautic has Stored Cross-Site Scripting (XSS) in Project Option Selector CVE-2026-9811, GHSA-5hvg-w58j-545m | Medium | 0.2% | 29 May, 2026 | Packagist mautic/core |
Mautic has Stored Cross-Site Scripting (XSS) in Projects Component CVE-2026-9809, GHSA-7h65-whp7-rgqf | High | 0.2% | 29 May, 2026 | Packagist mautic/core |
Mautic has an Authorization Bypass in API v2 Endpoints CVE-2026-9808, GHSA-2jrw-c95w-h43g | High | 0.2% | 29 May, 2026 | Packagist mautic/core |
Mautic vulnerable to Path Traversal via Campaign Import CVE-2026-9559, GHSA-6r9h-4h75-7q4x | Critical | 0.6% | 29 May, 2026 | Packagist mautic/core |
Mautic has Server-Side Template Injection (SSTI) in Theme Templates CVE-2026-9558, GHSA-9fx4-7cmj-47vg | Critical | 0.6% | 29 May, 2026 | Packagist mautic/core |
Mautic Focus component Vulnerable to SSRF CVE-2026-9557, GHSA-jmv8-8j9j-rcpc | Medium | 0.1% | 29 May, 2026 | Packagist mautic/core |
Mautic has SQL Injection in API Contact Filtering CVE-2026-4776, GHSA-fcmw-wx57-9p75 | High | 0.2% | 29 May, 2026 | Packagist mautic/core |
symfony/polyfill-intl-idn: xn-- labels with ASCII-only Punycode payloads are treated as equivalent to their decoded form CVE-2026-46644, GHSA-2xf4-cg6j-vhgq | Medium | 0.5% | 28 May, 2026 | Packagist symfony/polyfill Packagist symfony/polyfill-intl-idn |
Symfony's JsonPath Evaluates Attacker-Controlled Regular Expressions in match()/search() Without Limits — ReDoS CVE-2026-45756, GHSA-8v8v-g73j-492j | High | 0.6% | 28 May, 2026 | Packagist symfony/json-path Packagist symfony/symfony |
Symfony's Mailtrap Mailer Webhook Parser Never Verifies the X-Mt-Signature HMAC — Unauthenticated Webhook Event Injection CVE-2026-45755, GHSA-59f3-vp2f-mp9w | Medium | 0.3% | 28 May, 2026 | Packagist symfony/mailtrap-mailer Packagist symfony/symfony |
Symfony's Mailjet Mailer Webhook Parser Never Verifies the Configured Secret — Unauthenticated Webhook Event Injection CVE-2026-45754, GHSA-64hg-93w9-fc35 | Medium | 0.4% | 28 May, 2026 | Packagist symfony/lox24-notifier Packagist symfony/mailjet-mailer Packagist symfony/symfony |