Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Craft Commerce has stored XSS in Inventory Location Name CVE-2026-29176, GHSA-wj89-2385-gpx3 | Medium | 0.2% | 10 Mar, 2026 | Packagist craftcms/commerce |
Webauthn Framework: allowed_origins collapses URL-like origins to host-only values, bypassing exact origin validation CVE-2026-30964, GHSA-f7pm-6hr8-7ggm | Medium | 0.2% | 10 Mar, 2026 | Packagist web-auth/webauthn-framework Packagist web-auth/webauthn-lib Packagist web-auth/webauthn-symfony-bundle |
flarum/nicknames extension has display name injection in notification emails (autolink & markdown) CVE-2026-30913, GHSA-3c4m-j3g4-hh25 | Medium | 0.2% | 10 Mar, 2026 | Packagist flarum/nicknames |
Admidio: Event participation IDOR - non-leaders can register other users for events via user_uuid parameter CVE-2026-30927, GHSA-7pfv-hr63-h7cw | Medium | 0.3% | 09 Mar, 2026 | Packagist admidio/admidio |
AVideo has Unauthenticated IDOR - Playlist Information Disclosure CVE-2026-30885, GHSA-6w2r-cfpc-23r5 | Medium | 0.4% | 07 Mar, 2026 | Packagist wwbn/avideo |
Firefly III user API endpoints expose all users' information to any authenticated user (IDOR) GHSA-5q8v-j673-m5v4 | Medium | Not scored | 07 Mar, 2026 | Packagist grumpydictator/firefly-iii |
CommonMark has DisallowedRawHtml extension bypass via whitespace in HTML tag names CVE-2026-30838, GHSA-4v6x-c7xx-hw9f | Medium | 0.2% | 06 Mar, 2026 | Packagist league/commonmark |
EC-CUBE has a Vulnerability that Allows MFA Bypass in the Administrative Interface GHSA-7rhv-h82h-vpjh | Medium | Not scored | 05 Mar, 2026 | Packagist ec-cube/ec-cube |
Leantime has HTML injection through firstname and lastname fields GHSA-qrfh-cc86-vc8c | Medium | Not scored | 05 Mar, 2026 | Packagist leantime/leantime |
Kimai's API invoice endpoint missing customer-level access control (IDOR) CVE-2026-28685, GHSA-v33r-r6h2-8wr7 | Medium | 0.4% | 04 Mar, 2026 | Packagist kimai/kimai |
Concrete CMS has a stored Cross-site Scripting (XSS) vulnerability CVE-2026-3242, GHSA-w9qg-chfh-g3q9 | Medium | 0.2% | 04 Mar, 2026 | Packagist concrete5/concrete5 |
Concrete CMS has a stored Cross-site Scripting (XSS) vulnerability CVE-2026-3241, GHSA-f4vq-pj32-gr4q | Medium | 0.2% | 04 Mar, 2026 | Packagist concrete5/concrete5 |
Concrete CMS has a stored Cross-site Scripting (XSS) vulnerability CVE-2026-3240, GHSA-45fj-fvmm-xcc5 | Medium | 0.2% | 04 Mar, 2026 | Packagist concrete5/concrete5 |
Concrete CMS has a stored Cross-site Scripting (XSS) vulnerability CVE-2026-3244, GHSA-mm5f-5rqw-574f | Medium | 0.2% | 04 Mar, 2026 | Packagist concrete5/concrete5 |
Craft CMS has Permission Bypass and IDOR in Duplicate Entry Action CVE-2026-28782, GHSA-jxm3-pmm2-9gf6 | Medium | 0.2% | 03 Mar, 2026 | Packagist craftcms/cms |
Craft CMS Vulnerable to Stored XSS in Settings Names and Field Options CVE-2026-56393, GHSA-4mgv-366x-qxvx | Medium | 0.2% | 03 Mar, 2026 | Packagist craftcms/cms |
OpenSTAManager Affected by XSS in modifica_iva.php via righe parameter CVE-2026-24415, GHSA-jfgp-g7x7-j25j | Medium | 0.3% | 03 Mar, 2026 | Packagist devcode-it/openstamanager |
Statamic's missing authorization allows access to email addresses CVE-2026-28424, GHSA-w878-f8c6-7r63 | Medium | 0.3% | 27 Feb, 2026 | Packagist statamic/cms |
Craft CMS has Stored XSS in Table Field in its "Row Heading" Column Type CVE-2026-56383, GHSA-6j87-m5qx-9fqp | Medium | 0.2% | 25 Feb, 2026 | Packagist craftcms/cms |
TypiCMS Core has Stored Cross-Site Scripting (XSS) via SVG File Upload CVE-2026-27621, GHSA-xfvg-8v67-j7wp | Medium | 0.2% | 25 Feb, 2026 | Packagist typicms/core |
Pimcore vulnerable to SQL injection via unsanitized filter value in Dependency Dao RLIKE clause CVE-2026-27461, GHSA-vxg3-v4p6-f3fp | Medium | 0.5% | 24 Feb, 2026 | Packagist pimcore/pimcore |
Craft CMS: Cloud Metadata SSRF Protection Bypass via IPv6 Resolution CVE-2026-27129, GHSA-v2gc-rm6g-wrw9 | Medium | 0.5% | 24 Feb, 2026 | Packagist craftcms/cms |
Craft CMS Race condition in Token Service potentially allows for token usage greater than the token limit CVE-2026-27128, GHSA-6fx5-5cw5-4897 | Medium | 0.2% | 23 Feb, 2026 | Packagist craftcms/cms |
Craft CMS has Stored XSS in Table Field via "HTML" Column Type CVE-2026-27126, GHSA-3jh3-prx3-w6wc | Medium | 0.2% | 23 Feb, 2026 | Packagist craftcms/cms |
funadmin has Incorrect Privilege Assignment in its Configuration Handler CVE-2026-2896, GHSA-5m2g-4cf6-c3rg | Medium | 0.3% | 22 Feb, 2026 | Packagist funadmin/funadmin |
funadmin exposes sensitive information via getMember function CVE-2026-2894, GHSA-8hhx-xq9j-xwfj | Medium | 0.5% | 21 Feb, 2026 | Packagist funadmin/funadmin |
Moodle TeX formula editor is vulnerable to DoS through lack of execution time limits BIT-moodle-2026-26047, CVE-2026-26047, GHSA-cg8j-5cr2-568q | Medium | 0.5% | 21 Feb, 2026 | Packagist moodle/moodle |
AVideo has Stored Cross-Site Scripting via Markdown Comment Injection CVE-2026-27568, GHSA-rcqw-6466-3mv7 | Medium | 0.3% | 20 Feb, 2026 | Packagist wwbn/avideo |
LibreNMS has a Stored XSS in Alert Rule CVE-2026-26989, GHSA-6xmx-xr9p-58p7 | Medium | 0.3% | 18 Feb, 2026 | Packagist librenms/librenms |
LibreNMS has a Stored XSS in Custom OID - unit parameter missing strip_tags() CVE-2026-27016, GHSA-fqx6-693c-f55g | Medium | 0.3% | 18 Feb, 2026 | Packagist librenms/librenms |
LibreNMS /port-groups name Stored Cross-Site Scripting CVE-2026-26992, GHSA-93fx-g747-695x | Medium | 0.3% | 18 Feb, 2026 | Packagist librenms/librenms |
LibreNMS /device-groups name Stored Cross-Site Scripting CVE-2026-26991, GHSA-5pqf-54qp-32wx | Medium | 0.3% | 18 Feb, 2026 | Packagist librenms/librenms |
LibreNMS affected by reflected xss via email field CVE-2026-26987, GHSA-gqx7-99jw-6fpr | Medium | 0.3% | 18 Feb, 2026 | Packagist librenms/librenms |
ImapEngine affected by command injection via the ID command parameters CVE-2026-2469, GHSA-rfq9-4wcm-64gh | Medium | 0.4% | 14 Feb, 2026 | Packagist directorytree/imapengine |
Statamic CMS's missing authorization allows access to assets CVE-2026-25633, GHSA-gwmx-9gcj-332h | Medium | 0.3% | 11 Feb, 2026 | Packagist statamic/cms |
Kimai 2 vulnerable to persistent cross-site scripting in the timesheet descriptions CVE-2019-25317, GHSA-9278-6hcj-2p4j | Medium | 0.3% | 11 Feb, 2026 | Packagist kimai/kimai |
Phraseanet vulnerable to stored cross-site scripting through crafted file names CVE-2018-25157, GHSA-gcpq-mrgg-v5f3 | Medium | 0.3% | 11 Feb, 2026 | Packagist phraseanet/phraseanet |
amphp/http-server affected by HTTP/2 DDoS vulnerability GHSA-8grv-jq2g-cfhw | Medium | Not scored | 10 Feb, 2026 | Packagist amphp/http-server |
FroshAdminer Adminer UI is accessible without admin session CVE-2026-25878, GHSA-f339-246p-wwjp | Medium | 0.4% | 09 Feb, 2026 | Packagist frosh/adminer-platform |
Craft CMS Vulnerable to Stored XSS in Number Prefix & Suffix Fields CVE-2026-25496, GHSA-9f5h-mmq6-2x78 | Medium | 0.4% | 09 Feb, 2026 | Packagist craftcms/cms |
Craft CMS Vulnerable to SSRF in GraphQL Asset Mutation via Alternative IP Notation CVE-2026-25494, GHSA-m5r2-8p9x-hp5m | Medium | 0.4% | 09 Feb, 2026 | Packagist craftcms/cms |
Craft CMS Vulnerable to SSRF in GraphQL Asset Mutation via HTTP Redirect CVE-2026-25493, GHSA-8jr8-7hr4-vhfx | Medium | 0.4% | 09 Feb, 2026 | Packagist craftcms/cms |
Craft CMS: save_images_Asset graphql mutation can be abused to exfiltrate AWS credentials of underlying host CVE-2026-25492, GHSA-96pq-hxpw-rgh8 | Medium | 0.5% | 09 Feb, 2026 | Packagist craftcms/craft |
Microweber Cross-site Scripting vulnerability CVE-2025-70792, GHSA-6w5w-jx4x-vjvw | Medium | 0.3% | 05 Feb, 2026 | Packagist microweber/microweber |
Microweber has a Cross-site Scripting vulnerability CVE-2025-70791, GHSA-5jg5-xqfw-rv92 | Medium | 0.3% | 05 Feb, 2026 | Packagist microweber/microweber |
PrestaShop affected by time based enumeration in FO login form CVE-2026-25597, GHSA-67v7-3g49-mxh2 | Medium | 0.3% | 03 Feb, 2026 | Packagist prestashop/prestashop |
Moodle Inserts Sensitive Information Into Sent Data BIT-moodle-2025-67857, CVE-2025-67857, GHSA-8jrv-wx83-w3xj | Medium | 0.4% | 03 Feb, 2026 | Packagist moodle/moodle |
Moodle vulnerable to Cross-site Scripting BIT-moodle-2025-67855, CVE-2025-67855, GHSA-vwhw-vp9v-q9c9 | Medium | 0.4% | 03 Feb, 2026 | Packagist moodle/moodle |
Moodle Open Redirect vulnerability BIT-moodle-2025-67852, CVE-2025-67852, GHSA-qv78-6gpp-hm68 | Medium | 0.3% | 03 Feb, 2026 | Packagist moodle/moodle |
Subrion CMS vulnerable to cross-site scripting CVE-2025-70958, GHSA-9jjm-mc56-3qxv | Medium | 0.3% | 02 Feb, 2026 | Packagist intelliants/subrion |