Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/cache CVE-2026-8412, GHSA-rv3q-xmfw-mcjv | Low | 0.1% | 21 May, 2026 | Packagist concrete5/concrete5 |
Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/delete CVE-2026-8411, GHSA-752x-23hp-jmv6 | Low | 0.1% | 21 May, 2026 | Packagist concrete5/concrete5 |
Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/logs/bulk/delete CVE-2026-8410, GHSA-v7c7-658v-hh7v | Low | 0.1% | 21 May, 2026 | Packagist concrete5/concrete5 |
Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/logs/delete CVE-2026-8409, GHSA-56c9-xq5g-xrf9 | Low | 0.1% | 21 May, 2026 | Packagist concrete5/concrete5 |
Concrete CMS is vulnerable to IDOR in surveys CVE-2026-8337, GHSA-8c7c-h7px-267g | Medium | 0.2% | 21 May, 2026 | Packagist concrete5/concrete5 |
Concrete CMS has a session-hardening bypass and allows password change without reauthorization CVE-2026-8327, GHSA-wmw3-3fv3-h54w | Medium | 0.2% | 21 May, 2026 | Packagist concrete5/concrete5 |
Concrete CMS is Vulnerable to Reflected XSS in Legacy Pagination CVE-2026-8245, GHSA-f73j-pm2c-rxvr | Medium | 0.1% | 21 May, 2026 | Packagist concrete5/concrete5 |
Concrete CMS is vulnerable to unauthenticated page metadata disclosure CVE-2026-8240, GHSA-vpgr-cwfx-pwfw | Medium | 0.2% | 21 May, 2026 | Packagist concrete5/concrete5 |
Concrete CMS is vulnerable to IDOR CVE-2026-8239, GHSA-2xp7-rpvc-pjwc | Medium | 0.2% | 21 May, 2026 | Packagist concrete5/concrete5 |
Concrete CMS is vulnerable to IDOR CVE-2026-8238, GHSA-qv3x-mffx-9gw8 | Medium | 0.2% | 21 May, 2026 | Packagist concrete5/concrete5 |
Concrete CMS is vulnerable to IDOR CVE-2026-8237, GHSA-xpgc-7vc2-8725 | Medium | 0.6% | 21 May, 2026 | Packagist concrete5/concrete5 |
Concrete CMS is vulnerable to IDOR combined with a missing authentication gate CVE-2026-8236, GHSA-58c8-vvqw-cm7m | Medium | 0.7% | 21 May, 2026 | Packagist concrete5/concrete5 |
Concrete CMS is vulnerable to Stored XSS via external-link page cvName CVE-2026-8139, GHSA-pcrh-gj77-j4mw | Low | 0.1% | 21 May, 2026 | Packagist concrete5/concrete5 |
Concrete CMS's RSS Displayer block accepts a feed URL from any page editor and fetches it server-side without validation CVE-2026-7890, GHSA-gjwq-9v8p-47w7 | Low | 0.2% | 21 May, 2026 | Packagist concrete5/concrete5 |
Concrete CMS: OAuth 2.0 Authorization-Code Handler Bypasses Account Status CVE-2026-7887, GHSA-f54h-78c9-c24h | Low | 0.2% | 21 May, 2026 | Packagist concrete5/concrete5 |
Concrete CMS is vulnerable to IDOR in AddMessage/UpdateMessage CVE-2026-7886, GHSA-p8p9-5953-h9jw | Low | 0.3% | 21 May, 2026 | Packagist concrete5/concrete5 |
Concrete CMS is vulnerable to unauthorized file deletion CVE-2026-7882, GHSA-66rg-92q4-6m8q | Low | 0.1% | 21 May, 2026 | Packagist concrete5/concrete5 |
Concrete CMS is subject to Insecure Direct Object Reference (IDOR) in the Express Entry Detail block CVE-2026-7881, GHSA-chfm-cm6h-q5x7 | Medium | 0.2% | 21 May, 2026 | Packagist concrete5/concrete5 |
Concrete CMS has an unauthorized file access issue CVE-2026-7879, GHSA-fqg3-8w8r-8g94 | Medium | 0.2% | 21 May, 2026 | Packagist concrete5/concrete5 |
Twig: Arbitrary PHP code execution via `_self.(<string>)` macro-reference compilation CVE-2026-46640, GHSA-45vw-wh46-2vx8 | High | 0.6% | 21 May, 2026 | Packagist twig/twig |
Twig: Sandbox property and method bypass via object-destructuring assignment CVE-2026-46639, GHSA-mm6w-gr99-p3jj | High | 0.4% | 21 May, 2026 | Packagist twig/twig |
Twig: `{% sandbox %}{% include %}` skips checkSecurity() on cached templates (incomplete fix for CVE-2024-45411) CVE-2026-46638, GHSA-7fxw-r6jv-74c8 | Medium | 0.5% | 21 May, 2026 | Packagist twig/twig |
Twig: HTML-output filters in twig/* extras incorrectly declared `is_safe => ['all']` CVE-2026-46637, GHSA-jv8m-2544-3pg3 | Medium | 0.3% | 21 May, 2026 | Packagist twig/cssinliner-extra Packagist twig/markdown-extra |
Twig: Sandbox property allowlist bypass via the `column` filter (array_column on objects) CVE-2026-46635, GHSA-vcc8-phrv-43wj | Medium | 0.3% | 21 May, 2026 | Packagist twig/twig |
Twig: `template_from_string()` escapes a SourcePolicy-driven sandbox via synthesized template name CVE-2026-46634, GHSA-24x9-r6q4-q93w | High | 0.6% | 21 May, 2026 | Packagist twig/twig |
Twig: PHP code injection via `{% use %}` template name CVE-2026-46633, GHSA-7p85-w9px-jpjp | Critical | 0.7% | 21 May, 2026 | Packagist twig/twig |
twig/intl-extra: Unbounded formatter memoisation in keyed on template-controlled arguments CVE-2026-46629, GHSA-35wc-cvqg-78fp | Medium | 0.5% | 21 May, 2026 | Packagist twig/intl-extra |
Twig: The `spaceless` filter implicitly marks its output as safe CVE-2026-46628, GHSA-4j38-f5cw-54h7 | Medium | 0.3% | 21 May, 2026 | Packagist twig/twig |
Concrete CMS is Vulnerable to Cross-Site Request Forgery CVE-2026-8428, GHSA-prxr-vjgc-2cq9 | High | 0.1% | 21 May, 2026 | Packagist concrete5/concrete5 |
Concrete CMS does not validate a CSRF token before processing requests to `/dashboard/extend/update/prepare_remote_upgrade/<remoteMPID>` CVE-2026-8426, GHSA-5rj5-gfmr-hrc3 | High | 0.2% | 21 May, 2026 | Packagist concrete5/concrete5 |
Concrete CMS contains a CSRF vulnerability CVE-2026-8421, GHSA-4c8m-6fwx-m7xq | High | 0.2% | 21 May, 2026 | Packagist concrete5/concrete5 |
Concrete does not validate a CSRF token before processing requests to `/dashboard/extend/update/do_update/<pkgHandle>` CVE-2026-8417, GHSA-jr5g-qv3g-rxxx | High | 0.1% | 21 May, 2026 | Packagist concrete5/concrete5 |
Concrete CMS is vulnerable to missing authorization in the bulk_user_assignment.php CVE-2026-8350, GHSA-g7xp-jf3x-wcx4 | High | 0.3% | 21 May, 2026 | Packagist concrete5/concrete5 |
Concrete CMS is vulnerable to authorization bypass in the Calendar Block CVE-2026-8205, GHSA-46xh-7854-f568 | Medium | 0.2% | 21 May, 2026 | Packagist concrete5/concrete5 |
Concrete CMS is vulnerable to authorization bypass in the Calendar Event Frontend Dialog CVE-2026-8204, GHSA-x2fp-hj8c-mmxh | Medium | 0.2% | 21 May, 2026 | Packagist concrete5/concrete5 |
Concrete CMS has Stored XSS through its height parameter CVE-2026-8203, GHSA-9v2g-37mp-qpxf | High | 0.1% | 21 May, 2026 | Packagist concrete5/concrete5 |
Concrete CMS is vulnerable to Stored XSS via OAuth integration name CVE-2026-8197, GHSA-h72c-xx3w-w8h7 | High | 0.2% | 21 May, 2026 | Packagist concrete5/concrete5 |
Concrete CMS is Vulnerable to Cross-Site Request Forgery CVE-2026-8140, GHSA-r42c-3rr2-jrfp | High | 0.1% | 21 May, 2026 | Packagist concrete5/concrete5 |
Concrete CMS Vulnerable to Deserialization of Untrusted Data CVE-2026-8135, GHSA-pv2v-6w2v-97x6 | High | 0.5% | 21 May, 2026 | Packagist concrete5/concrete5 |
Concrete CMS Vulnerable to Relative Path Traversal CVE-2026-8134, GHSA-645j-cm4x-3xvw | Critical | 0.7% | 21 May, 2026 | Packagist concrete5/concrete5 |
Concrete CMS is vulnerable to unauthenticated file usage disclosure CVE-2026-6826, GHSA-4g7q-44qp-cc5c | Medium | 1.5% | 21 May, 2026 | Packagist concrete5/concrete5 |
Snappy: Binary path is never shell-escaped due to an inverted is_executable check CVE-2026-46643, GHSA-vpr4-p6fq-85jc | High | 0.2% | 21 May, 2026 | Packagist KnpLabs/knp-snappy |
Snappy : SSRF and local file read via the xsl-style-sheet option CVE-2026-46683, GHSA-c5fp-p67m-gq56 | Medium | 0.2% | 21 May, 2026 | Packagist knplabs/knp-snappy |
Drupal Core has a SQL Injection issue BIT-drupal-2026-9082, CVE-2026-9082, DRUPAL-CORE-2026-004, GHSA-ghwc-95x2-682j | CriticalExploited | 89.4% | 20 May, 2026 | Packagist drupal/core |
phpMyFAQ: Missing Password Reset Token Allows Account Takeover via Username/Email Enumeration CVE-2026-35675, GHSA-w9xh-5f39-vq89 | High | 0.4% | 20 May, 2026 | Packagist phpmyfaq/phpmyfaq Packagist thorsten/phpmyfaq |
phpMyFAQ: Default Empty API Token Authentication Bypass CVE-2026-35672, GHSA-gp95-j463-vv28 | High | 0.5% | 20 May, 2026 | Packagist phpmyfaq/phpmyfaq Packagist thorsten/phpmyfaq |
phpMyFAQ: IDOR Account Takeover CVE-2026-35671, GHSA-xvp4-phqj-cjr3 | High | 0.4% | 20 May, 2026 | Packagist phpmyfaq/phpmyfaq Packagist thorsten/phpmyfaq |
phpMyFAQ: Unauthenticated Password Reset Endpoint Allows User Enumeration and Forced Password Change Without Token Validation CVE-2026-35676, GHSA-9qv9-8xv6-5p35 | High | 0.3% | 20 May, 2026 | Packagist phpmyfaq/phpmyfaq Packagist thorsten/phpmyfaq |
Twig: Possible sandbox bypass when using a source policy CVE-2026-24425, GHSA-2q52-x2ff-qgfr | High | 0.8% | 20 May, 2026 | Packagist twig/twig |
FPDI: Memory Exhaustion and Endless Loop in FPDI leads to Denial of Service CVE-2026-45802, GHSA-2mgw-7q6p-8grg | Medium | 0.3% | 19 May, 2026 | Packagist setasign/fpdi |