Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
TYPO3 CMS Stores Cleartext Password in User Settings Module CVE-2026-6553, GHSA-xvv6-p4wf-mvx7 | High | 0.2% | 21 Apr, 2026 | Packagist typo3/cms-backend |
OpenMage LTS: Customer File Upload Extension Blocklist Bypass → Remote Code Execution CVE-2026-40488, GHSA-3j5q-7q7h-2hhv | High | 0.7% | 20 Apr, 2026 | Packagist openmage/magento-lts |
OpenMage LTS: Cross-user wishlist import leads to private option & file disclosure CVE-2026-40098, GHSA-665x-ppc4-685w | Medium | 0.2% | 20 Apr, 2026 | Packagist openmage/magento-lts |
OpenMage LTS has a Path Traversal Filter Bypass in Dataflow Module CVE-2026-25525, GHSA-6vqf-6fhm-7rc6 | Medium | 0.5% | 20 Apr, 2026 | Packagist openmage/magento-lts |
OpenMage LTS: Phar Deserialization leads to Remote Code Execution CVE-2026-25524, GHSA-fg79-cr9c-7369 | High | 0.6% | 20 Apr, 2026 | Packagist openmage/magento-lts |
Cockpit has NoSQL Injection Through Content Aggregation Pipelines CVE-2026-6626, GHSA-5pv2-86qj-5jf9 | Low | 0.2% | 20 Apr, 2026 | Packagist cockpit-hq/cockpit |
YesWiki vulnerable to authenticated SQL Injection via id_fiche in EntryManager::formatDataBeforeSave() CVE-2026-41143, GHSA-f58v-p6j9-24c2 | High | 0.3% | 18 Apr, 2026 | Packagist yeswiki/yeswiki |
PHPUnit has Argument injection via newline in PHP INI values that are forwarded to child processes CVE-2026-41570, GHSA-qrr6-mg7r-m243 | High | 0.2% | 18 Apr, 2026 | Packagist phpunit/phpunit |
elFinder: Command injection in resize background color parameter when using ImageMagick CLI CVE-2026-41247, GHSA-8q4h-8crm-5cvc | High | 1.6% | 17 Apr, 2026 | Packagist studio-42/elfinder |
Kimai: Username enumeration via timing on X-AUTH-USER CVE-2026-80199, GHSA-jrc6-fmhw-fpq2 | Medium | 0.3% | 17 Apr, 2026 | Packagist kimai/kimai |
Dolibarr: OS Command Injection (RCE) via MAIN_ODT_AS_PDF configuration CVE-2026-23500, GHSA-w5j3-8fcr-h87w | Critical | 0.9% | 17 Apr, 2026 | Packagist dolibarr/dolibarr |
Craftql vulnerable to Server-Side Request Forgery CVE-2026-31317, GHSA-8wmw-prw8-2ggm | High | 0.5% | 17 Apr, 2026 | Packagist markhuot/craftql |
Unauthenticated Information Disclosure (IDOR) via Multisite switch_to_blog in My Calendar CVE-2026-40308, GHSA-2mvx-f5qm-v2ch | High | 0.9% | 16 Apr, 2026 | Packagist joedolson/my-calendar |
Statamic: Unsafe method invocation via query value resolution allows data destruction CVE-2026-41175, GHSA-4jjr-vmv7-wh4w | High | 0.3% | 16 Apr, 2026 | Packagist statamic/cms |
WWBN AVideo: RCE cause by clonesite plugin CVE-2026-41304, GHSA-xr6f-h4x7-r6qp | High | 2.2% | 16 Apr, 2026 | Packagist wwbn/avideo |
Silverstripe Assets Module has a DBFile::getURL() permission bypass CVE-2026-24749, GHSA-jgcf-rf45-2f8v | Medium | 0.4% | 16 Apr, 2026 | Packagist silverstripe/assets |
goodoneuz/pay-uz: the /payment/api/editable/update endpoint overwrites existing PHP payment hook files CVE-2026-31843, GHSA-m5wg-cjgh-223j | Critical | 1.4% | 16 Apr, 2026 | Packagist goodoneuz/pay-uz |
Froxlor has Local File Inclusion via path traversal in API `def_language` parameter leads to Remote Code Execution CVE-2026-41228, GHSA-w59f-67xm-rxx7 | Critical | 0.5% | 16 Apr, 2026 | Packagist froxlor/froxlor |
ProcessWire: server-side request forgery vulnerability in the admin panel's 'Add Module From URL' feature CVE-2026-40500, GHSA-gmwr-9j4p-96vm | Medium | Not scored | 16 Apr, 2026 | Packagist processwire/processwire |
Froxlor has a PHP Code Injection via Unescaped Single Quotes in userdata.inc.php Generation (MysqlServer API) CVE-2026-41229, GHSA-gc9w-cc93-rjv8 | Critical | 0.5% | 16 Apr, 2026 | Packagist froxlor/froxlor |
Froxlor has a BIND Zone File Injection via Unsanitized DNS Record Content in DomainZones::add() CVE-2026-41230, GHSA-47hf-23pw-3m8c | High | 0.3% | 16 Apr, 2026 | Packagist froxlor/froxlor |
Froxlor has Incomplete Symlink Validation in DataDump.add() Allows Arbitrary Directory Ownership Takeover via Cron CVE-2026-41231, GHSA-75h4-c557-j89r | High | 0.4% | 16 Apr, 2026 | Packagist froxlor/froxlor |
Froxlor has an Email Sender Alias Domain Ownership Bypass via Wrong Array Index Allows Cross-Customer Email Spoofing CVE-2026-41232, GHSA-vmjj-qr7v-pxm6 | Medium | 0.2% | 16 Apr, 2026 | Packagist froxlor/froxlor |
Froxlor has a Reseller Domain Quota Bypass via Unvalidated adminid Parameter in Domains.add() CVE-2026-41233, GHSA-jvx4-xv3m-hrj4 | Medium | 0.3% | 16 Apr, 2026 | Packagist froxlor/froxlor |
Kimai's User Preferences API allows standard users to modify restricted attributes: hourly_rate, internal_rate CVE-2026-40486, GHSA-qh43-xrjm-4ggp | Medium | 0.3% | 15 Apr, 2026 | Packagist kimai/kimai |
Kimai has Stored XSS via Incomplete HTML Attribute Escaping in Team Member Widget CVE-2026-40479, GHSA-g82g-m9vx-vhjg | Medium | 0.2% | 15 Apr, 2026 | Packagist kimai/kimai |
PocketMine-MP has LogDoS by many junk properties in client data JWT in LoginPacket CVE-2026-86200, GHSA-xp4f-g2cm-rhg7 | Medium | 0.6% | 15 Apr, 2026 | Packagist pocketmine/pocketmine-mp |
Drupal core allows Cross-Site Scripting (XSS) BIT-drupal-2026-6367, CVE-2026-6367, DRUPAL-CORE-2026-003, GHSA-pw6f-3999-xp7g | Medium | 0.2% | 15 Apr, 2026 | Packagist drupal/core |
Drupal core allows Object Injection BIT-drupal-2026-6366, CVE-2026-6366, DRUPAL-CORE-2026-002, GHSA-xmjc-63pr-2mpg | Medium | 0.4% | 15 Apr, 2026 | Packagist drupal/core |
Drupal core is Vulnerable to Cross-Site Scripting BIT-drupal-2026-6365, CVE-2026-6365, DRUPAL-CORE-2026-001, GHSA-f3cj-mjqm-fhvj | Medium | 0.2% | 15 Apr, 2026 | Packagist drupal/core |
Craft CMS has a host header injection leading to SSRF via resource-js endpoint CVE-2026-41130, GHSA-95wr-3f2v-v2wh | Medium | 0.3% | 14 Apr, 2026 | Packagist craftcms/cms |
Server-Side Request Forgery (SSRF) in Craft CMS with Asset Uploads Mutations CVE-2026-41129, GHSA-3m9m-24vh-39wx | Medium | 0.3% | 14 Apr, 2026 | Packagist craftcms/cms |
Craft CMS has a Missing Authorization Check on User Group Removal via save-permissions Action CVE-2026-41128, GHSA-jq2f-59pj-p3m3 | Medium | 0.2% | 14 Apr, 2026 | Packagist craftcms/cms |
WWBN AVideo has an incomplete fix for CVE-2026-33502: Command Injection CVE-2026-41064, GHSA-pq8p-wc4f-vg7j | Critical | 0.3% | 14 Apr, 2026 | Packagist wwbn/avideo |
WWBN AVideo has an incomplete fix for CVE-2026-33500: XSS CVE-2026-41063, GHSA-m7r8-6q9j-m2hc | Medium | 0.2% | 14 Apr, 2026 | Packagist wwbn/avideo |
WWBN AVideo has an Incomplete fix: Directory traversal bypass via query string in ReceiveImage downloadURL parameters CVE-2026-41062, GHSA-m63r-m9jh-3vc6 | Medium | 0.7% | 14 Apr, 2026 | Packagist wwbn/avideo |
WWBN AVideo has Stored XSS via Unanchored Duration Regex in Video Encoder Receiver CVE-2026-41061, GHSA-8pv3-29pp-pf8f | Medium | 0.2% | 14 Apr, 2026 | Packagist wwbn/avideo |
WWBN AVideo has a SSRF via same-domain hostname with alternate port bypasses isSSRFSafeURL CVE-2026-41060, GHSA-j432-4w3j-3w8j | High | 0.3% | 14 Apr, 2026 | Packagist wwbn/avideo |
WWBN AVideo has an incomplete fix for CVE-2026-33293: Path Traversal CVE-2026-41058, GHSA-5879-4fmr-xwf2 | High | 0.5% | 14 Apr, 2026 | Packagist wwbn/avideo |
WWBN AVideo has a CORS Origin Reflection Bypass via plugin/API/router.php and allowOrigin(true) Exposes Authenticated API Responses CVE-2026-41057, GHSA-ff5q-cc22-fgp4 | High | 0.1% | 14 Apr, 2026 | Packagist wwbn/avideo |
WWBN AVideo has CORS Origin Reflection with Credentials on Sensitive API Endpoints Enables Cross-Origin Account Takeover CVE-2026-41056, GHSA-ccq9-r5cw-5hwq | High | 0.3% | 14 Apr, 2026 | Packagist wwbn/avideo |
WWBN AVideo has an incomplete fix for CVE-2026-33039: SSRF CVE-2026-41055, GHSA-793q-xgj6-7frp | Medium | 0.4% | 14 Apr, 2026 | Packagist wwbn/avideo |
CAPTCHA Bypass in WWBN/AVideo via Attacker-Controlled Length Parameter and Missing Token Invalidation on Failure CVE-2026-40935, GHSA-hg7g-56h5-5pqr | Medium | 0.2% | 14 Apr, 2026 | Packagist wwbn/avideo |
WWBN AVideo is missing CSRF protection in objects/commentDelete.json.php enables mass comment deletion against moderators and content creators CVE-2026-40929, GHSA-8qm8-g55h-xmqr | Medium | 0.1% | 14 Apr, 2026 | Packagist wwbn/avideo |
WWBN AVideo: Missing CSRF Protection on State-Changing JSON Endpoints Enables Forced Comment Creation, Vote Manipulation, and Category Asset Deletion CVE-2026-40928, GHSA-x2pw-9c38-cp2j | Medium | 0.1% | 14 Apr, 2026 | Packagist wwbn/avideo |
WWBN AVideo has Multiple CSRF Vulnerabilities in Admin JSON Endpoints (Category CRUD, Plugin Update Script) CVE-2026-40926, GHSA-ffw8-fwxp-h64w | High | 0.2% | 14 Apr, 2026 | Packagist wwbn/avideo |
WWBN AVideo has CSRF in configurationUpdate.json.php Enables Full Site Configuration Takeover Including Encoder URL and SMTP Credentials CVE-2026-40925, GHSA-vvfw-4m39-fjqf | High | 0.2% | 14 Apr, 2026 | Packagist wwbn/avideo |
WWBN AVideo YPTSocket WebSocket Broadcast Relay Leads to Unauthenticated Cross-User JavaScript Execution via Client-Side eval() Sinks CVE-2026-40911, GHSA-gph2-j4c9-vhhr | Critical | 0.6% | 14 Apr, 2026 | Packagist wwbn/avideo |
WWBN AVideo has a Path Traversal in Locale Save Endpoint Enables Arbitrary PHP File Write to Any Web-Accessible Directory (RCE) CVE-2026-40909, GHSA-6rc6-p838-686f | High | 0.7% | 14 Apr, 2026 | Packagist wwbn/avideo |
WWBN AVideo has an Unauthenticated Information Disclosure via git.json.php Exposes Developer Emails and Deployed Version CVE-2026-40908, GHSA-52hf-63q4-r926 | Medium | 0.3% | 14 Apr, 2026 | Packagist wwbn/avideo |