Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
MantisBT Vulnerable to Privilege Escalation from Manager to Administrator CVE-2026-34390, GHSA-frf7-jhp9-jxm6 | Medium | 0.4% | 11 May, 2026 | Packagist mantisbt/mantisbt |
MantisBT Has Authorization Bypass in Global Profile Creation CVE-2026-33052, GHSA-68w5-w573-q2r8 | Medium | 0.3% | 11 May, 2026 | Packagist mantisbt/mantisbt |
torrentpier has PHP Serialize Injections GHSA-h29g-c9cx-c73q | Critical | Not scored | 11 May, 2026 | Packagist torrentpier/torrentpier |
Grav: Twig sandbox allows editor-role users to exfiltrate all plugin secrets via Config::toArray() CVE-2026-44738, GHSA-j274-39qw-32c9 | High | 0.3% | 11 May, 2026 | Packagist getgrav/grav |
elFinder MySQL has a SQL Injection in its Volume Driver (elFinderVolumeMySQL) CVE-2026-44521, GHSA-c3gj-q88f-7hqj | High | 0.2% | 11 May, 2026 | Packagist studio-42/elfinder |
Snipe-IT has an open redirect vulnerability CVE-2026-44833, GHSA-mghp-5cq4-v6mg | High | 0.2% | 08 May, 2026 | Packagist snipe/snipe-it |
Snipe-IT has Privilege Escalation via API Permissions Assignment CVE-2026-44832, GHSA-hq28-crg7-95pr | High | 0.3% | 08 May, 2026 | Packagist snipe/snipe-it |
Snipe-IT has Stored XSS via Component Checkout Notes (v8.4.0) CVE-2026-44831, GHSA-r42m-953q-6vjx | Medium | 0.2% | 08 May, 2026 | Packagist snipe/snipe-it |
Grav: Stored XSS via page title (data[header][title]) in admin panel CVE-2026-44737, GHSA-fmg2-f5r9-24qc | Medium | 0.3% | 08 May, 2026 | Packagist getgrav/grav |
PrestaShop has a stored XSS executable in customer service view CVE-2026-44212, GHSA-w9f3-qc75-qgx9 | Critical | 0.4% | 08 May, 2026 | Packagist prestashop/prestashop |
Kimai has an arbitrary file read in its invoice PDF renderer (admin) CVE-2026-44298, GHSA-h5fh-7hwr-97mw | Medium | 0.3% | 08 May, 2026 | Packagist kimai/kimai |
Webauthn has a User Verification Downgrade via Default-Open ClientOverridePolicy GHSA-h4fw-6r7f-w494 | Low | Not scored | 07 May, 2026 | Packagist web-auth/webauthn-framework |
FacturaScripts Vulnerable to Authenticated Remote Code Execution (RCE) via GIF Image Upload in Product Images CVE-2026-42879, GHSA-vf3q-frmr-vrr9 | Medium | 0.2% | 07 May, 2026 | Packagist facturascripts/facturascripts |
FacturaScripts Vulnerable to Unauthenticated phpinfo() Disclosure via Installer Endpoint CVE-2026-42878, GHSA-vrxf-vrc4-22p7 | Medium | 0.9% | 07 May, 2026 | Packagist facturascripts/facturascripts |
FacturaScripts vulnerable to stored XSS via product reference in sales/purchases CVE-2026-42877, GHSA-r736-2678-fcrx | Medium | 0.2% | 07 May, 2026 | Packagist facturascripts/facturascripts |
FacturaScripts vulnerable to Reflected Cross-Site Scripting (XSS) via Cookie Manipulation CVE-2026-27964, GHSA-gq5c-rw37-g46c | Low | 0.1% | 07 May, 2026 | Packagist facturascripts/facturascripts |
FacturaScripts Vulnerable to Unstripped Image Metadata (EXIF) Leakage via Library Module File Upload/Download CVE-2026-27892, GHSA-q7f2-rv22-2xgr | Medium | 0.2% | 07 May, 2026 | Packagist facturascripts/facturascripts |
FacturaScripts Vulnerable to Remote Code Execution (RCE) via Zip Slip in Plugin Upload Mechanism CVE-2026-27891, GHSA-3pgc-xqg9-cfr6 | High | 0.5% | 07 May, 2026 | Packagist facturascripts/facturascripts |
Snipe-IT has insecure permissions in file uploads CVE-2026-37709, GHSA-xg82-2hrv-hf64 | Critical | 0.6% | 07 May, 2026 | Packagist snipe/snipe-it |
Compromised tag of intercom-php published via GitHub GHSA-gr3r-crp5-qrrm | Critical | Not scored | 07 May, 2026 | Packagist intercom/intercom-php |
Webkul Krayin CRM is Vulnerable to Cross-Site Scripting in the /admin/activities/create endpoint CVE-2026-36341, GHSA-j822-46r5-h4qx | Medium | 0.2% | 07 May, 2026 | Packagist krayin/laravel-crm |
Grav Form Plugin has an Anonymous Page Content Overwrite via Form File Upload filename Override CVE-2026-42845, GHSA-w4rc-p66m-x6qq | High | 0.7% | 06 May, 2026 | Packagist getgrav/grav-plugin-form |
Flight vulnerable to sensitive information disclosure via default error handler CVE-2026-42552, GHSA-qrch-52m5-vv85 | High | 0.3% | 06 May, 2026 | Packagist flightphp/core |
Flight: HTTP method override enabled by default, facilitating CSRF escalation and middleware bypass CVE-2026-42551, GHSA-vxrr-w42w-w76g | High | 0.4% | 06 May, 2026 | Packagist flightphp/core |
Flight vulnerable to SQL Injection via unvalidated identifiers in SimplePdo::insert / update / delete CVE-2026-42550, GHSA-xwqr-rcqg-22mr | High | 0.5% | 06 May, 2026 | Packagist flightphp/core |
Flight has path traversal in `make:controller` CLI that creates arbitrary directories outside project root CVE-2026-42549, GHSA-3xjv-pmf2-gf2q | Medium | 0.2% | 06 May, 2026 | Packagist flightphp/core |
Flight has reflected XSS through an unvalidated JSONP callback in Flight::jsonp() CVE-2026-42548, GHSA-fcx8-ph5r-mxr4 | High | 0.4% | 06 May, 2026 | Packagist flightphp/core |
Low-privileged Grav API users can create super-admin accounts via blueprint-upload CVE-2026-42844, GHSA-6xx2-m8wv-756h | High | 0.3% | 06 May, 2026 | Packagist getgrav/grav |
Magento LTS: Reflected XSS - Import -> Data Flow (profiles) CVE-2026-42458, GHSA-x8jv-q8j2-487c | Medium | 0.3% | 06 May, 2026 | Packagist openmage/magento-lts |
Statamic CMS vulnerable to email enumeration via forgot password endpoint CVE-2026-44306, GHSA-m24v-f7g5-gq67 | Medium | 0.2% | 06 May, 2026 | Packagist statamic/cms |
phpMyFAQ has unauthenticated SQL injection via User-Agent header in BuiltinCaptcha CVE-2026-46364, GHSA-289f-fq7w-6q2w | Critical | 1.7% | 06 May, 2026 | Packagist phpmyfaq/phpmyfaq Packagist thorsten/phpmyfaq |
phpMyFAQ: Path Traversal in Client::deleteClientFolder enables arbitrary directory deletion by non-super-admin admins CVE-2026-45008, GHSA-gh9p-q46p-57g2 | High | 0.3% | 06 May, 2026 | Packagist phpmyfaq/phpmyfaq Packagist thorsten/phpmyfaq |
phpMyFAQ has unauthenticated FAQ permission bypass via getFaqBySolutionId fallback query CVE-2026-46366, GHSA-99qv-g4x9-mgc3 | High | 0.3% | 06 May, 2026 | Packagist phpmyfaq/phpmyfaq Packagist thorsten/phpmyfaq |
phpMyFAQ has SQL Injection in CurrentUser::setTokenData through unescaped OAuth token fields CVE-2026-46359, GHSA-pm8c-3qq3-72w7 | High | 0.3% | 06 May, 2026 | Packagist phpmyfaq/phpmyfaq Packagist thorsten/phpmyfaq |
phpMyFAQ enables unauthenticated 2FA brute-force attack via /admin/check acceptance of arbitrary user-id CVE-2026-45010, GHSA-9pq7-mfwh-xx2j | Critical | 0.4% | 06 May, 2026 | Packagist phpmyfaq/phpmyfaq Packagist thorsten/phpmyfaq |
phpMyFAQ: Ordinary Authenticated User Can Access Admin-Only API Endpoints Due to Insufficient Authorization Check in phpMyFAQ CVE-2026-45009, GHSA-jrc5-w569-h7h5 | Medium | 0.2% | 06 May, 2026 | Packagist phpmyfaq/phpmyfaq Packagist thorsten/phpmyfaq |
phpMyFAQ has stored XSS via | raw Filter in search.twig — html_entity_decode(strip_tags()) Bypass in Search Result Rendering CVE-2026-46361, GHSA-pqh6-8fxf-jx22 | High | 0.3% | 06 May, 2026 | Packagist phpmyfaq/phpmyfaq Packagist thorsten/phpmyfaq |
phpMyFAQ's Missing CONFIGURATION_EDIT Permission Check on 12 Admin API Configuration Tab Endpoints Allows Information Disclosure by Any Authenticated User CVE-2026-45007, GHSA-rm98-82fr-mcfx | Medium | 0.3% | 06 May, 2026 | Packagist phpmyfaq/phpmyfaq Packagist thorsten/phpmyfaq |
phpMyFAQ has a SVG Sanitizer Entity Decoding Depth Limit Bypass Leading to Stored XSS CVE-2026-46360, GHSA-whqh-9pq5-c7r3 | Medium | 0.2% | 06 May, 2026 | Packagist phpmyfaq/phpmyfaq Packagist thorsten/phpmyfaq |
phpMyFAQ has Stored XSS in FAQ Question/Answer via Encode-Decode Bypass of removeAttributes() Sanitization CVE-2026-46363, GHSA-f5p7-2c9q-8896 | Medium | 0.2% | 06 May, 2026 | Packagist phpmyfaq/phpmyfaq Packagist thorsten/phpmyfaq |
phpMyFAQ's Missing Authorization on Tag Deletion Allows Any Authenticated User to Delete Tags CVE-2026-46365, GHSA-7cx3-2qx2-3g6w | Medium | 0.2% | 06 May, 2026 | Packagist phpmyfaq/phpmyfaq Packagist thorsten/phpmyfaq |
phpMyFAQ has an Authorization Bypass in All Admin Pages Due to Non-Terminating Permission Check CVE-2026-46362, GHSA-hpgw-ww76-c68r | High | 0.3% | 06 May, 2026 | Packagist phpmyfaq/phpmyfaq Packagist thorsten/phpmyfaq |
phpMyFAQ has stored XSS via Utils::parseUrl() in comment rendering CVE-2026-46367, GHSA-9525-27vj-c8r8 | High | 0.2% | 06 May, 2026 | Packagist phpmyfaq/phpmyfaq Packagist thorsten/phpmyfaq |
Scramble vulnerable to remote code execution via evaluation of user-controlled input in validation rules CVE-2026-44262, GHSA-4rm2-28vj-fj39 | Critical | 5.9% | 06 May, 2026 | Packagist dedoc/scramble |
Kimai's Twig function config() leaks server-wide secrets (LDAP bind password, SAML SP private key) via invoice/export templates CVE-2026-80198, GHSA-vrqv-52x7-rm4v | High | 0.4% | 06 May, 2026 | Packagist kimai/kimai |
Kimai has Missing Voter Check that Allows Cross-Team Timesheet Manipulation CVE-2026-80202, GHSA-9g2q-w3w2-vf7q | Critical | 0.4% | 06 May, 2026 | Packagist kimai/kimai |
Craft CMS's Missing Volume Permission Check in AssetsController::actionShowInFolder Allows Information Disclosure CVE-2026-44012, GHSA-33m5-hqp9-97pw | High | 0.3% | 06 May, 2026 | Packagist craftcms/cms |
Craft CMS has Potential Authenticated Remote Code Execution via Malicious Attached Behavior CVE-2026-44011, GHSA-qrgm-p9w5-rrfw | High | 0.6% | 06 May, 2026 | Packagist craftcms/cms |
Craft CMS's Missing Authorization in GraphQL Address Resolver Allows Cross-Scope PII Disclosure CVE-2026-44010, GHSA-gj2p-p9m4-c8gw | High | 0.4% | 06 May, 2026 | Packagist craftcms/cms |
AVideo Vulnerable to Exposure of Sensitive Information to an Unauthorized Actor and Missing Authorization CVE-2026-43885, GHSA-xr49-f4rh-qcjf | High | 0.3% | 05 May, 2026 | Packagist wwbn/avideo |