Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Magento's X-Original-Url header can expose admin url CVE-2026-25523, GHSA-jg68-vhv3-9r8f | Medium | 0.3% | 02 Feb, 2026 | Packagist openmage/magento-lts |
Craft Commerce has Stored XSS in Shipping Zone (Name & Description) Fields Leading to Potential Privilege Escalation CVE-2026-25522, GHSA-h9r9-2pxg-cx9m | Medium | 0.3% | 02 Feb, 2026 | Packagist craftcms/commerce |
Craft Commerce has Stored XSS in Inventory Location Address Leading to Potential Privilege Escalation CVE-2026-25490, GHSA-wq2m-r96q-crrf | Medium | 0.3% | 02 Feb, 2026 | Packagist craftcms/commerce |
Craft Commerce has Stored XSS in Tax Zones (Name & Description) Leading to Potential Privilege Escalation CVE-2026-25489, GHSA-v585-mf6r-rqrc | Medium | 0.3% | 02 Feb, 2026 | Packagist craftcms/commerce |
Craft Commerce has Stored XSS in Tax Categories (Name & Description) Fields Leading to Potential Privilege Escalation CVE-2026-25488, GHSA-p6w8-q63m-72c8 | Medium | 0.3% | 02 Feb, 2026 | Packagist craftcms/commerce |
Craft CMS has Stored XSS in Tax Rates Name Leading to Potential Privilege Escalation CVE-2026-25487, GHSA-wqc5-485v-3hqh | Medium | 0.3% | 02 Feb, 2026 | Packagist craftcms/commerce |
Craft Commerce has Stored XSS in Shipping Methods Name Field Leading to Potential Privilege Escalation CVE-2026-25486, GHSA-g92v-wpv7-6w22 | Medium | 0.3% | 02 Feb, 2026 | Packagist craftcms/commerce |
Craft Commerce has Stored XSS in Shipping Categories (Name & Description) Fields Leading to Potential Privilege Escalation CVE-2026-25485, GHSA-w8gw-qm8p-j9j3 | Medium | 0.3% | 02 Feb, 2026 | Packagist craftcms/composer |
Craft Commerce has Stored XSS in Product Type Name CVE-2026-25484, GHSA-2h2m-v2mg-656c | Medium | 0.3% | 02 Feb, 2026 | Packagist craftcms/commerce |
Craft Commerce has Stored XSS via Order Status Message with potential database exfiltration CVE-2026-25483, GHSA-8478-rmjg-mjj5 | Medium | 0.3% | 02 Feb, 2026 | Packagist craftcms/commerce |
Craft Commerce has Stored DOM XSS in Order Status Name (Reflects in "Recent Orders" Dashboard Widget) CVE-2026-25482, GHSA-frj9-9rwc-pw9j | Medium | 0.4% | 02 Feb, 2026 | Packagist craftcms/commerce |
CI4MS Vulnerable to User Email Enumeration via Password Reset Flow CVE-2026-25509, GHSA-654x-9q7r-g966 | Medium | 0.4% | 02 Feb, 2026 | Packagist ci4-cms-erp/ci4ms |
FacturaScripts is Vulnerable to Reflected XSS CVE-2026-23476, GHSA-g6w2-q45f-xrp4 | Medium | 0.3% | 02 Feb, 2026 | Packagist facturascripts/facturascripts |
Symfony's incorrect argument escaping under MSYS2/Git Bash can lead to destructive file operations on Windows CVE-2026-24739, GHSA-r39x-jcww-82v6 | Medium | 0.2% | 28 Jan, 2026 | Packagist symfony/process Packagist symfony/symfony |
phpMyFAQ: /api/setup/backup accessible to any authenticated user (authz missing) CVE-2026-24421, GHSA-wm8h-26fv-mg7g | Medium | 1.7% | 23 Jan, 2026 | Packagist phpmyfaq/phpmyfaq Packagist thorsten/phpmyfaq |
phpMyFAQ: Attachment download allowed without dlattachment right (broken access control) CVE-2026-24420, GHSA-7p9h-m7m8-vhhv | Medium | 0.5% | 23 Jan, 2026 | Packagist phpmyfaq/phpmyfaq Packagist thorsten/phpmyfaq |
LavaLite CMS affected by a stored cross-site scripting vulnerability CVE-2025-71177, GHSA-w7rq-fgx4-4xcm | Medium | 0.2% | 23 Jan, 2026 | Packagist lavalite/cms |
Freeform Craft Plugin CP UI (builder/integrations) has Stored Cross-Site Scripting (XSS) issue CVE-2026-26188, GHSA-jp3q-wwp3-pwv9 | Medium | 0.3% | 22 Jan, 2026 | Packagist solspace/craft-freeform |
CoreShop Vulnerable to SQL Injection via Admin customer-company-modifier CVE-2026-23959, GHSA-fqcv-8859-86x2 | Medium | 0.4% | 21 Jan, 2026 | Packagist coreshop/core-shop |
mailqueue TYPO3 extension affected by Insecure Deserialization in QueueableFileTransport CVE-2026-0895, GHSA-ggff-9mj3-7246 | Medium | 0.1% | 20 Jan, 2026 | Packagist cpsit/typo3-mailqueue |
MineAdmin May Expose Sensitive Information to an Unauthorized Actor CVE-2026-1194, GHSA-7f7m-83r3-p644 | Medium | 0.8% | 20 Jan, 2026 | Packagist mineadmin/mineadmin |
Pterodactyl improperly locks resources allowing raced queries to create more resources than alloted CVE-2025-69198, GHSA-jw2v-cq5x-q68g | Medium | 0.2% | 19 Jan, 2026 | Packagist pterodactyl/panel |
Kimai has an Authenticated Server-Side Template Injection (SSTI) CVE-2026-23626, GHSA-jg2j-2w24-54cg | Medium | 0.5% | 18 Jan, 2026 | Packagist kimai/kimai |
CakePHP PaginatorHelper::limitControl() vulnerable to reflected cross-site-scripting CVE-2026-23643, GHSA-qh8m-9qxx-53m5 | Medium | 0.3% | 16 Jan, 2026 | Packagist cakephp/cakephp |
Pimcore Web2Print Tools Bundle "Favourite Output Channel Configuration" Missing Function Level Authorization CVE-2026-23496, GHSA-4wg4-p27p-5q2r | Medium | 0.3% | 15 Jan, 2026 | Packagist pimcore/web2print-tools-bundle |
Pimcore's Admin Classic Bundle is Missing Function Level Authorization on "Predefined Properties" Listing CVE-2026-23495, GHSA-hqrp-m84v-2m2f | Medium | 0.4% | 15 Jan, 2026 | Packagist pimcore/admin-ui-classic-bundle |
Pimcore is Vulnerable to Broken Access Control: Missing Function Level Authorization on "Static Routes" Listing CVE-2026-23494, GHSA-m3r2-724c-pwgf | Medium | 0.3% | 15 Jan, 2026 | Packagist pimcore/pimcore |
Algolia Search & Discovery for Magento 2 Has Untrusted Data Handling GHSA-595p-g7xc-c333 | Medium | Not scored | 14 Jan, 2026 | Packagist algolia/algoliasearch-magento-2 |
pH7-Social-Dating-CMS affected by a stored cross-site scripting (XSS) vulnerability CVE-2025-63644, GHSA-657c-wxg6-jmqv | Medium | 0.3% | 14 Jan, 2026 | Packagist ph7software/ph7builder |
Concrete5 CMS contains an XPath injection vulnerability CVE-2022-50807, GHSA-r7vr-wg3f-8hr9 | Medium | Not scored | 14 Jan, 2026 | Packagist concrete5/concrete5 |
TYPO3 CMS Allows Insecure Deserialization via Mailer File Spool CVE-2026-0859, GHSA-7vp9-x248-9vr9 | Medium | 0.2% | 13 Jan, 2026 | Packagist typo3/cms-core |
TYPO3 CMS Allows Broken Access Control in Redirects Module CVE-2025-59021, GHSA-6c46-p6j5-3f49 | Medium | 0.3% | 13 Jan, 2026 | Packagist typo3/cms-redirects |
TYPO3 CMS Allows Broken Access Control in Edit Document Controller CVE-2025-59020, GHSA-5j7q-wmh7-cqhg | Medium | 0.3% | 13 Jan, 2026 | Packagist typo3/cms-backend |
October CMS Vulnerable to Stored XSS via Branding Styles CVE-2025-61676, GHSA-wvpq-h33f-8rp6 | Medium | 0.3% | 09 Jan, 2026 | Packagist october/system |
October CMS Vulnerable to Stored XSS via Editor and Branding Styles CVE-2025-61674, GHSA-gxxc-m74c-f48x | Medium | 0.3% | 09 Jan, 2026 | Packagist october/system |
Kirby is missing permission checks in the content changes API CVE-2026-21896, GHSA-4j78-4xrm-cr2f | Medium | 0.2% | 08 Jan, 2026 | Packagist getkirby/cms |
CoreShop Vulnerable to SQL Injection via Admin Reports CVE-2026-22242, GHSA-ch7p-mpv4-4vg4 | Medium | 0.4% | 07 Jan, 2026 | Packagist coreshop/core-shop |
Pterodactyl TOTPs can be reused during validity window CVE-2025-69197, GHSA-rgmp-4873-r683 | Medium | 0.4% | 06 Jan, 2026 | Packagist pterodactyl/panel |
Craft CMS vulnerable to potential authenticated Remote Code Execution via Twig SSTI CVE-2025-68454, GHSA-742x-x762-7383 | Medium | 0.9% | 05 Jan, 2026 | Packagist craftcms/cms |
Craft CMS vulnerable to Server-Side Request Forgery (SSRF) via GraphQL Asset Upload Mutation CVE-2025-68437, GHSA-x27p-wfqw-hfcc | Medium | 0.5% | 05 Jan, 2026 | Packagist craftcms/cms |
Craft CMS vulnerable to potential information disclosure via unchecked asset relocation CVE-2025-68436, GHSA-53vf-c43h-j2x9 | Medium | 0.3% | 05 Jan, 2026 | Packagist craftcms/cms |
Bagisto has HTML Filter Bypass that Enables Stored XSS CVE-2026-21451, GHSA-2mwc-h2mg-v6p8 | Medium | 0.6% | 02 Jan, 2026 | Packagist bagisto/bagisto |
libsodium has Incomplete List of Disallowed Inputs CVE-2025-69277, GHSA-mrfv-m5wm-5w6w, PYSEC-2026-1448, PYSEC-2026-3002 | Medium | 0.2% | 31 Dec, 2025 | Packagist paragonie/sodium_compat PyPI PyNaCl PyPI hdwallet PyPI pynacl |
phpMyFAQ has Stored XSS in user list via admin-managed display_name CVE-2025-68951, GHSA-jv8r-hv7q-p6vc | Medium | 0.3% | 29 Dec, 2025 | Packagist thorsten/phpmyfaq |
LibreNMS Alert Rule API Cross-Site Scripting Vulnerability CVE-2025-68614, GHSA-c89f-8g7g-59wj | Medium | 3.9% | 23 Dec, 2025 | Packagist librenms/librenms |
phpMyFAQ contains a CSV injection vulnerability CVE-2023-53929, GHSA-x2v3-9p22-w3x6 | Medium | 0.5% | 17 Dec, 2025 | Packagist phpmyfaq/phpmyfaq Packagist thorsten/phpmyfaq |
AWS SDK for PHP's S3 Encryption Client has a Key Commitment Issue CVE-2025-14761, GHSA-x8cp-jf6f-r4xh | Medium | 0.2% | 17 Dec, 2025 | Packagist aws/aws-sdk-php |
Auth0 WordPress has Improper Audience Validation via Auth0-PHP SDK Dependency GHSA-vvg7-8rmq-92g7 | Medium | Not scored | 17 Dec, 2025 | Packagist auth0/wordpress |
Auth0 Symfony SDK has Improper Audience Validation via Auth0-PHP SDK GHSA-f3r2-88mq-9v4g | Medium | Not scored | 17 Dec, 2025 | Packagist auth0/symfony |
Auth0 Laravel SDK has Improper Audience Validation via Auth0-PHP SDK dependency GHSA-7hh9-gp72-wh7h | Medium | Not scored | 17 Dec, 2025 | Packagist auth0/login |