Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Symfony's HtmlSanitizer UrlAttributeSanitizer Omits action/formaction/poster/cite — `javascript`: URI Survives Sanitization (XSS) CVE-2026-45753, GHSA-hhg7-c65m-h7ff | Low | 0.3% | 28 May, 2026 | Packagist symfony/html-sanitizer Packagist symfony/symfony |
TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments CVE-2026-47762, GHSA-v98h-vmpc-fpqv | High | 0.3% | 28 May, 2026 | NuGet TinyMCE Packagist tinymce/tinymce npm tinymce |
TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection CVE-2026-47761, GHSA-vg35-5wq7-3x7w | High | 0.3% | 28 May, 2026 | NuGet TinyMCE Packagist tinymce/tinymce npm tinymce |
TinyMCE Cross-Site Scripting (XSS) vulnerability using sanitization bypass through nested SVGs CVE-2026-47760, GHSA-mh5m-5hw4-5c69 | High | 0.2% | 28 May, 2026 | NuGet TinyMCE Packagist tinymce/tinymce npm tinymce |
TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes CVE-2026-47759, GHSA-q742-qvgc-gc2f | High | 0.3% | 28 May, 2026 | NuGet TinyMCE Packagist tinymce/tinymce npm tinymce |
Pimcore has a CustomReports Share Bypass CVE-2026-45704, GHSA-jwcc-gv4m-93x6 | High | 0.4% | 27 May, 2026 | Packagist pimcore/pimcore |
Pimcore has a WordExport Authorization Bypass for Unauthorized Document Export CVE-2026-45703, GHSA-332x-r494-54fq | Medium | 0.3% | 27 May, 2026 | Packagist pimcore/pimcore |
Symfony's YAML Parser has a ReDoS via Catastrophic Backtracking in Parser::cleanup() Regex CVE-2026-45305, GHSA-9frc-8383-795m | High | 0.7% | 27 May, 2026 | Packagist symfony/symfony Packagist symfony/yaml |
Symfony's YAML Parser Vulnerable to Exponential Memory Allocation via Recursive Collection-Alias Expansion ("Billion Laughs") CVE-2026-45304, GHSA-4qpc-3hr4-r2p4 | High | 0.7% | 27 May, 2026 | Packagist symfony/symfony Packagist symfony/yaml |
Symfony hardened the parser when handling untrusted input CVE-2026-45133, GHSA-c2p3-7m5p-cv8x | High | 0.6% | 27 May, 2026 | Packagist symfony/symfony Packagist symfony/yaml |
Automad has Broken Access Control: Unauthenticated exposure of administrator bcrypt password hashes and TOTP secrets via public API endpoint CVE-2026-45332, GHSA-xm76-r88j-vm3g | High | 1.4% | 27 May, 2026 | Packagist automad/automad |
Symfony has Unauthenticated PHP Object Deserialization in MonologBridge server:log Listener CVE-2026-45077, GHSA-m7v2-7gxm-vc2v | High | 0.7% | 27 May, 2026 | Packagist symfony/monolog-bridge Packagist symfony/symfony |
Symfony's HEAD Request Bypasses methods: ['GET'] Filter in #[IsGranted] / #[IsSignatureValid] / #[IsCsrfTokenValid] CVE-2026-45075, GHSA-6439-2f28-8p8q | High | 0.4% | 27 May, 2026 | Packagist symfony/http-kernel Packagist symfony/security-http Packagist symfony/symfony |
Symfony's Cas2Handler Derives CAS service URL from Client Host Header → Cross-Service Ticket Replay CVE-2026-45074, GHSA-j8gj-9rm5-4xhx | High | 0.5% | 27 May, 2026 | Packagist symfony/security-http Packagist symfony/symfony |
Symfony Vulnerable to SQL Injection in PdoAdapter::doClear() via Unsanitized $prefix CVE-2026-45073, GHSA-6qh9-h6wf-jgqc | Medium | 0.5% | 27 May, 2026 | Packagist symfony/cache Packagist symfony/symfony |
Symfony Vulnerable to stored XSS in WebProfiler CodeExtension::fileExcerpt() — Unescaped Non-PHP File Rendering CVE-2026-45072, GHSA-hmr5-2xcr-v8pp | Low | 0.3% | 27 May, 2026 | Packagist symfony/symfony Packagist symfony/twig-bridge Packagist symfony/web-profiler-bundle |
Symfony has XXE (Local File Disclosure) in DomCrawler::addXmlContent() via validateOnParse = true CVE-2026-45071, GHSA-x6g4-fwcc-jj8w | High | 0.6% | 27 May, 2026 | Packagist symfony/dom-crawler Packagist symfony/symfony |
Symfony has Email Header Injection via Non-Token Characters in Mime Parameter Names CVE-2026-45070, GHSA-vqc8-7275-q272 | Medium | 0.4% | 27 May, 2026 | Packagist symfony/mime Packagist symfony/symfony |
Symfony's OidcTokenHandler Accepts JWTs Missing aud/iss/exp Claims CVE-2026-45069, GHSA-29fc-p6c4-24cg | High | 0.3% | 27 May, 2026 | Packagist symfony/security-http Packagist symfony/symfony |
Symfony has an Argument Injection in SendmailTransport via Dash-Prefixed Recipient Address CVE-2026-45068, GHSA-xx3c-qf5g-hc39 | High | 0.5% | 27 May, 2026 | Packagist symfony/mailer Packagist symfony/symfony |
Symfony has Email Header / SMTP Command Injection via CRLF in Symfony\Component\Mime\Address CVE-2026-45067, GHSA-qpmx-3rfj-7rhv | High | 0.6% | 27 May, 2026 | Packagist symfony/mime Packagist symfony/symfony |
Symfony has an HtmlSanitizer allowLinkHosts() / allowMediaHosts() Bypass via URL-Parser Differentials and <area> Misclassification CVE-2026-45066, GHSA-qc95-4862-92fh | Medium | 0.3% | 27 May, 2026 | Packagist symfony/html-sanitizer Packagist symfony/symfony |
Symfony's HtmlSanitizer URL Attributes Pass Through BiDi Override Characters → Visual href Spoofing CVE-2026-45064, GHSA-h5vq-qfcg-4m6p | Medium | 0.3% | 27 May, 2026 | Packagist symfony/html-sanitizer Packagist symfony/symfony |
Kirby CMS vulnerable to cross-site scripting (XSS) from links in KirbyTags and image blocks in the site frontend CVE-2026-45368, GHSA-qvjf-922g-pj44 | High | 0.5% | 27 May, 2026 | Packagist getkirby/cms |
Kirby CMS's content locks disclose IDs and emails of inaccessible users from `users.access/list` permissions CVE-2026-45334, GHSA-39vq-49qm-r2mc | Medium | 0.4% | 27 May, 2026 | Packagist getkirby/cms |
Pimcore: Missing Authorization in WebDAV MOVE via unchecked asset move handling CVE-2026-45260, GHSA-wc7j-g8wx-m2qx | High | 0.6% | 27 May, 2026 | Packagist pimcore/pimcore |
Pimcore has Unsafe PHP Deserialization in Multiple Locations Without allowed_classes Restriction CVE-2026-45162, GHSA-36fc-7wjg-mfvj | High | 1.0% | 27 May, 2026 | Packagist pimcore/pimcore |
Symfony has a UrlGenerator Route-Requirement Bypass via Unanchored Regex Alternation → Off-Site //host URL Injection CVE-2026-45065, GHSA-72xp-p242-47p9 | Medium | 0.3% | 27 May, 2026 | Packagist symfony/routing Packagist symfony/symfony |
Symfony Vulnerable to Identity Spoofing via Unanchored DN Regex in X509Authenticator CVE-2026-45063, GHSA-ph86-p8f6-f9r2 | Critical | 0.4% | 27 May, 2026 | Packagist symfony/security-http Packagist symfony/symfony |
Pimcore Admin Classic Bundle Vulnerable to SQL Injection in Translation Grid Date Filter via Unsanitized Property Parameter CVE-2026-44741, GHSA-h4ph-crvj-9h92 | High | 0.5% | 27 May, 2026 | Packagist pimcore/admin-ui-classic-bundle |
Pimcore Vulnerable to SQL Injection in Custom Reports Column Configuration CVE-2026-44739, GHSA-3234-gxc3-pq6f | High | 0.4% | 27 May, 2026 | Packagist pimcore/pimcore |
Kirby CMS has pre-authentication path traversal and PHP file inclusion during user lookup CVE-2026-44177, GHSA-9hx7-c53c-v6x8 | High | 1.8% | 26 May, 2026 | Packagist getkirby/cms |
Kirby CMS's `pages.access` permission is not checked during rendering of page drafts CVE-2026-44176, GHSA-2xw4-v2wx-hqq9 | Medium | 0.4% | 26 May, 2026 | Packagist getkirby/cms |
Kirby CMS vulnerable to cross-site scripting (XSS) from list field content in the site frontend CVE-2026-44175, GHSA-5fhx-9q32-q257 | High | 0.4% | 26 May, 2026 | Packagist getkirby/cms |
Kirby CMS has an Arbitrary Method Call via REST API Search and Collection Query Endpoints CVE-2026-44174, GHSA-86rh-h242-j8xp | High | 0.5% | 26 May, 2026 | Packagist getkirby/cms |
Pterodactyl has a database resource limit bypass via race condition in Client API CVE-2026-35202, GHSA-fgmm-w5cx-vrfw | Low | 0.2% | 26 May, 2026 | Packagist pterodactyl/panel |
Dolibarr ERP CRM contains a remote code evaluation vulnerability CVE-2018-25357, GHSA-hxmh-2xc4-c894 | Critical | 1.7% | 23 May, 2026 | Packagist dolibarr/dolibarr |
YesWiki: Unauthenticated SQL Injection CVE-2026-46670, GHSA-jwvv-qr7q-cv8j | Critical | 2.0% | 22 May, 2026 | Packagist yeswiki/yeswiki |
Concrete CMS is vulnerable to Stored XSS via page name in the Atomik theme CVE-2026-8353, GHSA-q9fm-mpg8-8jqm | Low | 0.1% | 22 May, 2026 | Packagist concrete5/concrete5 |
Concrete CMS is vulnerable to IDOR + wrong-authorization-level in the Express association Reorder dialog CVE-2026-8347, GHSA-jqvq-gv67-3567 | Low | 0.2% | 22 May, 2026 | Packagist concrete5/concrete5 |
Concrete CMS is vulnerable to CSRF via Backend\File::approveVersion CVE-2026-8340, GHSA-xjg6-5v39-v7fc | Low | 0.1% | 22 May, 2026 | Packagist concrete5/concrete5 |
Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file approveVersion() CVE-2026-8435, GHSA-44q4-354f-c826 | Low | 0.1% | 21 May, 2026 | Packagist concrete5/concrete5 |
Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file rescanMultiple() CVE-2026-8434, GHSA-6qjh-p324-694f | Low | 0.1% | 21 May, 2026 | Packagist concrete5/concrete5 |
Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file rescan() CVE-2026-8433, GHSA-6fxm-r8p3-mx5c | Low | 0.1% | 21 May, 2026 | Packagist concrete5/concrete5 |
Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file star() CVE-2026-8432, GHSA-97jw-gr4m-c5v8 | Low | 0.1% | 21 May, 2026 | Packagist concrete5/concrete5 |
Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file removeFavoriteFolder($id) CVE-2026-8427, GHSA-67hj-8239-cmf5 | Low | 0.1% | 21 May, 2026 | Packagist concrete5/concrete5 |
Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file addFavoriteFolder($id) CVE-2026-8416, GHSA-qj94-6rx6-27fr | Low | 0.1% | 21 May, 2026 | Packagist concrete5/concrete5 |
Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/express/association/reorder CVE-2026-8415, GHSA-xj25-753j-wgp9 | Low | 0.1% | 21 May, 2026 | Packagist concrete5/concrete5 |
Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/event/duplicate CVE-2026-8414, GHSA-98qf-jvwj-2r5f | Low | 0.1% | 21 May, 2026 | Packagist concrete5/concrete5 |
Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/design CVE-2026-8413, GHSA-mpq2-mv8p-9wm6 | Low | 0.1% | 21 May, 2026 | Packagist concrete5/concrete5 |