Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Kirby CMS's `pages.access/list` and `files.access/list` permissions are not consistently checked in the Panel and REST API CVE-2026-42137, GHSA-85x2-r8xv-ww8c | High | 0.3% | 30 Apr, 2026 | Packagist getkirby/cms |
ps_checkout allows unauthorized method invocation through unvalidated parameter GHSA-mqq7-wxx5-mp8h | Low | Not scored | 30 Apr, 2026 | Packagist prestashop/ps_checkout |
Krayin CRM allows a remote attacker to execute arbitrary code via compose email function CVE-2026-36340, GHSA-32px-ccfx-cxq3 | High | 0.6% | 30 Apr, 2026 | Packagist krayin/laravel-crm |
Admidio: OIDC Token Introspection Endpoint Returns Active for All Tokens Without Validation CVE-2026-41671, GHSA-9xx5-cv6j-x533 | Medium | 0.3% | 29 Apr, 2026 | Packagist admidio/admidio |
Admidio Sends SAML Response to Unvalidated Assertion Consumer Service URL from AuthnRequest CVE-2026-41670, GHSA-p9w9-87c8-m235 | High | 0.3% | 29 Apr, 2026 | Packagist admidio/admidio |
Admidio Ignores SAML Signature Validation Result, Processes Forged AuthnRequests and LogoutRequests CVE-2026-41669, GHSA-25cw-98hg-g3cg | High | 0.2% | 29 Apr, 2026 | Packagist admidio/admidio |
Admidio has CSRF on Admin Preferences that Triggers Unauthorized Backup, .htaccess Write, and Email Send CVE-2026-41663, GHSA-rw74-vc9h-534j | Low | 0.1% | 29 Apr, 2026 | Packagist admidio/admidio |
Admidio Missing Minimum Administrator Check in Role Membership Removal CVE-2026-41662, GHSA-c7xm-r6vj-8vg6 | Medium | 0.3% | 29 Apr, 2026 | Packagist admidio/admidio |
Admidio vulnerable to reflected XSS in msg_window.php via Square Bracket to HTML Tag Conversion CVE-2026-41661, GHSA-gq27-fc8w-vcmp | Medium | 0.2% | 29 Apr, 2026 | Packagist admidio/admidio |
Admidio has Inverted 2FA Reset Authorization Check that Lets Group Leaders Strip Admin TOTP CVE-2026-41660, GHSA-rh3w-4ccx-prf9 | High | 0.3% | 29 Apr, 2026 | Packagist admidio/admidio |
Admidio Leaks Hidden Profile Field Values via Blind Search Oracle in Member Assignment CVE-2026-41659, GHSA-68pr-7prh-mpv4 | Low | 0.3% | 29 Apr, 2026 | Packagist admidio/admidio |
Admidio's Missing Authorization on Inventory Module Destructive Endpoints Allows Any Authenticated User to Delete Items CVE-2026-41658, GHSA-xqv4-xm7h-52cv | Medium | 0.2% | 29 Apr, 2026 | Packagist admidio/admidio |
Admidio Exposes Cross-Organization Member Data via Permission Check Mismatch in contacts_data.php CVE-2026-41657, GHSA-g8p8-94f2-28gr | Medium | 0.3% | 29 Apr, 2026 | Packagist admidio/admidio |
Admidio has Path Traversal via Unvalidated `name` Parameter in Document Add Mode that Enables Arbitrary Server File Read CVE-2026-41656, GHSA-m9h6-8pqm-xrhf | Medium | 0.4% | 29 Apr, 2026 | Packagist admidio/admidio |
Admidio has Path Traversal in ECard Preview that Allows Reading Arbitrary Server Files Including Database Credentials CVE-2026-41655, GHSA-m3vp-3jjm-gpmx | Medium | 0.3% | 29 Apr, 2026 | Packagist admidio/admidio |
ipl/web is vulnerable to reflected XSS by malformed search requests CVE-2026-42224, GHSA-55wf-5m3q-6jjf | High | 0.3% | 29 Apr, 2026 | Packagist ipl/web |
OpenID Connect nonce generated but never validated — ID token replay attack CVE-2026-42206, GHSA-3gx8-q682-38mx | Medium | 0.2% | 29 Apr, 2026 | Packagist roadiz/openid |
CI4MS has Unrestricted PHP File Upload via Theme Installation that Leads to Authenticated Remote Code Execution CVE-2026-41587, GHSA-fw49-9xq4-gmx6 | High | 0.6% | 29 Apr, 2026 | Packagist ci4-cms-erp/ci4ms |
PhpSpreadsheet has CPU Denial of Service via Unbounded Row Number in XLSX Row Dimensions CVE-2026-40902, GHSA-7c6m-4442-2x6m | High | 0.4% | 29 Apr, 2026 | Packagist phpoffice/phpspreadsheet |
PhpSpreadsheet has CPU Denial of Service via Unbounded Row Index in SpreadsheetML XML Reader CVE-2026-40863, GHSA-84wq-86v6-x5j6 | High | 0.4% | 29 Apr, 2026 | Packagist phpoffice/phpspreadsheet |
PhpSpreadsheet has SSRF/RCE in IOFactory::load when $filename is user controlled CVE-2026-34084, GHSA-q4q6-r8wh-5cgh | Critical | 0.7% | 29 Apr, 2026 | Packagist phpoffice/phpspreadsheet |
Cockpit is vulnerable to directory traversal CVE-2026-38993, GHSA-p46p-7pmj-m34f | Medium | 0.8% | 29 Apr, 2026 | Packagist cockpit-hq/cockpit |
Cockpit Vulnerable to Unrestricted Upload of File with Dangerous Type CVE-2026-38991, GHSA-j2rx-4jg9-79mw | High | 0.4% | 29 Apr, 2026 | Packagist cockpit-hq/cockpit |
Cockpit is vulnerable to arbitrary code execution CVE-2026-38992, GHSA-fm6c-rhcf-7439 | Critical | 0.4% | 29 Apr, 2026 | Packagist cockpit-hq/cockpit |
PhpSpreadsheet has XSS via number format code with @ text placeholder bypasses htmlspecialchars in HTML writer CVE-2026-40296, GHSA-hrmw-qprp-wgmc | Medium | 0.2% | 28 Apr, 2026 | Packagist phpoffice/phpspreadsheet |
PhpSpreadsheet has XSS via NumberFormat @ Text Substitution in HTML Writer CVE-2026-35453, GHSA-6wpp-88cp-7q68 | Medium | 0.2% | 28 Apr, 2026 | Packagist phpoffice/phpspreadsheet |
FacturaScripts has Insecure Parameter Handling: Unauthorized Modification of Immutable 'nick' Field CVE-2026-32699, GHSA-pp79-hqv6-vmc3 | Medium | 0.3% | 28 Apr, 2026 | Packagist facturascripts/facturascripts |
Grav has Insecure Deserialization in File Cache CVE-2026-7317, GHSA-gwfr-jfjf-92vv | Low | 0.2% | 28 Apr, 2026 | Packagist getgrav/grav |
Pimcore has an authenticated Cross-site Scripting issue CVE-2026-5362, GHSA-7gxw-q9j5-mrj4 | Medium | 0.2% | 27 Apr, 2026 | Packagist pimcore/pimcore |
Pimcore Platform - SQL Injection in DataObject composite index handling during class definition import/save CVE-2026-5394, GHSA-r2f4-ff2p-xc64 | High | 0.4% | 27 Apr, 2026 | Packagist pimcore/pimcore |
ShowDoc has an Injection vulnerability CVE-2026-6982, GHSA-fm5r-cj7v-rj2c | Medium | 0.2% | 25 Apr, 2026 | Packagist showdoc/showdoc |
Kimai has Missing Object-Level Authorization in the Team API CVE-2026-41498, GHSA-jv9x-w4gm-hwcm | Low | 0.2% | 24 Apr, 2026 | Packagist kimai/kimai |
nova-toggle-5: Improper authorization on toggle endpoint allowed non-Nova users to modify boolean fields CVE-2026-42202, GHSA-f5c8-m5vw-rmgq | Medium | 0.2% | 24 Apr, 2026 | Packagist almirhodzic/nova-toggle-5 |
Kirby is vulnerable to authorization bypass during page, file and user creation via blueprint injection CVE-2026-41325, GHSA-6gqr-mx34-wh8r | High | 0.4% | 24 Apr, 2026 | Packagist getkirby/cms |
Kirby's page creation API bypasses the changeStatus permission check via unfiltered isDraft parameter CVE-2026-40099, GHSA-w942-j9r6-hr6r | Medium | 0.3% | 23 Apr, 2026 | Packagist getkirby/cms |
Kirby has Server-Side Template Injection (SSTI) via double template resolution in option rendering CVE-2026-34587, GHSA-jcjw-58rv-c452 | High | 0.3% | 23 Apr, 2026 | Packagist getkirby/cms |
Kirby has XML injection in its XML creator toolkit CVE-2026-32870, GHSA-9wfj-c55w-j9qr | Medium | 0.3% | 23 Apr, 2026 | Packagist getkirby/cms |
Flarum: Path traversal in LESS parser via theme color settings (incomplete fix for CVE-2023-27577) CVE-2026-41887, GHSA-xjvc-pw2r-6878 | Medium | 0.5% | 22 Apr, 2026 | Packagist flarum/core |
CI4MS Theme::upload is vulnerable to Zip Slip leading to RCE CVE-2026-41203, GHSA-xv3r-vr59-95rg | Critical | 0.6% | 22 Apr, 2026 | Packagist ci4-cms-erp/ci4ms |
CI4MS Backup::restore is vulnerable to Zip Slip leading to RCE CVE-2026-41202, GHSA-xp9f-pvvc-57p4 | Critical | 0.7% | 22 Apr, 2026 | Packagist ci4-cms-erp/ci4ms |
CI4MS: Backup Management Full Account Takeover for All Roles & Privilege Escalation via Stored DOM Blind XSS CVE-2026-41201, GHSA-qxpq-82f3-xj47 | Critical | 0.3% | 22 Apr, 2026 | Packagist ci4-cms-erp/ci4ms |
PHPUnit: Argument injection via newline in PHP INI values forwarded to child processes GHSA-mh6w-vxff-9wqp | High | Not scored | 22 Apr, 2026 | Packagist phpunit/phpunit |
Bagisto affected by Cross-site Scripting CVE-2026-6745, GHSA-65fp-7g2v-658r | Low | 0.2% | 21 Apr, 2026 | Packagist bagisto/bagisto |
Bagisto affected by Server-Side Request Forgery CVE-2026-6744, GHSA-x3f9-vcp2-hgcw | Low | 0.2% | 21 Apr, 2026 | Packagist bagisto/bagisto |
October CMS: Editor Sub-Permission Bypass for Asset and Blueprint File Operations CVE-2026-29179, GHSA-jvwg-phxx-j3rp | Low | 0.1% | 21 Apr, 2026 | Packagist october/system |
October CMS: Reflected XSS via DataTable Form Widget CVE-2026-27937, GHSA-jj38-h5w5-mvpf | Low | 0.1% | 21 Apr, 2026 | Packagist october/system |
October CMS has Safe Mode Bypass via Twig Database Write Operations CVE-2026-26274, GHSA-h6jm-f4hh-fw27 | Medium | 0.2% | 21 Apr, 2026 | Packagist october/october |
October CMS has Safe Mode Bypass via CSS Preprocessor Compilers CVE-2026-26067, GHSA-3888-q23f-x7qh | Medium | 0.2% | 21 Apr, 2026 | Packagist october/system |
Dolibarr user with permission to edit PHP content can bypass filtering to restrict dangerous PHP functions CVE-2026-31019, GHSA-j2g9-rprv-hrhc | High | 0.6% | 21 Apr, 2026 | Packagist dolibarr/dolibarr |
Dolibarr Allows Code Injection through its Website Module CVE-2026-31018, GHSA-676v-wh57-p375 | High | 0.3% | 21 Apr, 2026 | Packagist dolibarr/dolibarr |