Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/cache CVE-2026-8412, GHSA-rv3q-xmfw-mcjv | Low | 0.1% | 21 May, 2026 | Packagist concrete5/concrete5 |
Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/delete CVE-2026-8411, GHSA-752x-23hp-jmv6 | Low | 0.1% | 21 May, 2026 | Packagist concrete5/concrete5 |
Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/logs/bulk/delete CVE-2026-8410, GHSA-v7c7-658v-hh7v | Low | 0.1% | 21 May, 2026 | Packagist concrete5/concrete5 |
Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/logs/delete CVE-2026-8409, GHSA-56c9-xq5g-xrf9 | Low | 0.1% | 21 May, 2026 | Packagist concrete5/concrete5 |
Concrete CMS is vulnerable to Stored XSS via external-link page cvName CVE-2026-8139, GHSA-pcrh-gj77-j4mw | Low | 0.1% | 21 May, 2026 | Packagist concrete5/concrete5 |
Concrete CMS's RSS Displayer block accepts a feed URL from any page editor and fetches it server-side without validation CVE-2026-7890, GHSA-gjwq-9v8p-47w7 | Low | 0.2% | 21 May, 2026 | Packagist concrete5/concrete5 |
Concrete CMS: OAuth 2.0 Authorization-Code Handler Bypasses Account Status CVE-2026-7887, GHSA-f54h-78c9-c24h | Low | 0.2% | 21 May, 2026 | Packagist concrete5/concrete5 |
Concrete CMS is vulnerable to IDOR in AddMessage/UpdateMessage CVE-2026-7886, GHSA-p8p9-5953-h9jw | Low | 0.3% | 21 May, 2026 | Packagist concrete5/concrete5 |
Concrete CMS is vulnerable to unauthorized file deletion CVE-2026-7882, GHSA-66rg-92q4-6m8q | Low | 0.1% | 21 May, 2026 | Packagist concrete5/concrete5 |
Sulu: Used API Keys may be available via Admin API GHSA-9m6v-8fxc-4r44 | Low | Not scored | 18 May, 2026 | Packagist sulu/sulu |
Webauthn has a User Verification Downgrade via Default-Open ClientOverridePolicy GHSA-h4fw-6r7f-w494 | Low | Not scored | 07 May, 2026 | Packagist web-auth/webauthn-framework |
FacturaScripts vulnerable to Reflected Cross-Site Scripting (XSS) via Cookie Manipulation CVE-2026-27964, GHSA-gq5c-rw37-g46c | Low | 0.1% | 07 May, 2026 | Packagist facturascripts/facturascripts |
Dolibarr has Insufficient Verification of Data Authenticity CVE-2026-7689, GHSA-jggh-5rmh-r6h5 | Low | 0.1% | 03 May, 2026 | Packagist dolibarr/dolibarr |
Dolibarr has an Injection issue CVE-2026-7688, GHSA-rvwr-q5hj-wq7g | Low | 0.2% | 03 May, 2026 | Packagist dolibarr/dolibarr |
ps_checkout allows unauthorized method invocation through unvalidated parameter GHSA-mqq7-wxx5-mp8h | Low | Not scored | 30 Apr, 2026 | Packagist prestashop/ps_checkout |
Admidio has CSRF on Admin Preferences that Triggers Unauthorized Backup, .htaccess Write, and Email Send CVE-2026-41663, GHSA-rw74-vc9h-534j | Low | 0.1% | 29 Apr, 2026 | Packagist admidio/admidio |
Admidio Leaks Hidden Profile Field Values via Blind Search Oracle in Member Assignment CVE-2026-41659, GHSA-68pr-7prh-mpv4 | Low | 0.3% | 29 Apr, 2026 | Packagist admidio/admidio |
Grav has Insecure Deserialization in File Cache CVE-2026-7317, GHSA-gwfr-jfjf-92vv | Low | 0.2% | 28 Apr, 2026 | Packagist getgrav/grav |
Kimai has Missing Object-Level Authorization in the Team API CVE-2026-41498, GHSA-jv9x-w4gm-hwcm | Low | 0.2% | 24 Apr, 2026 | Packagist kimai/kimai |
Bagisto affected by Cross-site Scripting CVE-2026-6745, GHSA-65fp-7g2v-658r | Low | 0.2% | 21 Apr, 2026 | Packagist bagisto/bagisto |
Bagisto affected by Server-Side Request Forgery CVE-2026-6744, GHSA-x3f9-vcp2-hgcw | Low | 0.2% | 21 Apr, 2026 | Packagist bagisto/bagisto |
October CMS: Editor Sub-Permission Bypass for Asset and Blueprint File Operations CVE-2026-29179, GHSA-jvwg-phxx-j3rp | Low | 0.1% | 21 Apr, 2026 | Packagist october/system |
October CMS: Reflected XSS via DataTable Form Widget CVE-2026-27937, GHSA-jj38-h5w5-mvpf | Low | 0.1% | 21 Apr, 2026 | Packagist october/system |
Cockpit has NoSQL Injection Through Content Aggregation Pipelines CVE-2026-6626, GHSA-5pv2-86qj-5jf9 | Low | 0.2% | 20 Apr, 2026 | Packagist cockpit-hq/cockpit |
Kimai leaks API Token Hash via Invoice Twig Template CVE-2026-80201, GHSA-rh42-6rj2-xwmc | Low | 0.2% | 14 Apr, 2026 | Packagist kimai/kimai |
Craft Commerce has an unauthenticated information disclosure that can leak some customer order data on anonymous payments CVE-2026-32270, GHSA-3vxg-x5f8-f5qf | Low | 0.3% | 13 Apr, 2026 | Packagist craftcms/commerce |
phpseclib has a variable-time HMAC comparison in SSH2::get_binary_packet() using != instead of hash_equals() CVE-2026-40194, GHSA-r854-jrxh-36qx | Low | 0.4% | 10 Apr, 2026 | Packagist phpseclib/phpseclib |
REDAXO has reflected XSS backend packages API via function parameter (CSRF token required) CVE-2026-117538, GHSA-xq4j-g85q-wf97 | Low | 0.2% | 10 Apr, 2026 | Packagist redaxo/source |
REDAXO has reflected XSS in backend Metainfo API via type parameter (CSRF token required) CVE-2026-117537, GHSA-m662-8jrj-cw6v | Low | 0.2% | 10 Apr, 2026 | Packagist redaxo/source |
AVideo: Unauthenticated Access to Payment Order Data via BlockonomicsYPT check.php CVE-2026-35448, GHSA-3v7m-qg4x-58h9 | Low | 0.3% | 04 Apr, 2026 | Packagist wwbn/avideo |
Roundcube Webmail: Unsanitized IMAP SEARCH command arguments CVE-2026-35538, GHSA-8jr8-v43g-5c57 | Low | 0.4% | 03 Apr, 2026 | Packagist roundcube/roundcubemail |
Krayin CRM is vulnerable to Cross-site Scripting (XSS) CVE-2026-5370, GHSA-9m2v-hc5g-5jpv | Low | 0.2% | 02 Apr, 2026 | Packagist krayin/laravel-crm |
Graby has stored XSS via iframe srcdoc Attribute in htmLawed Sanitization Config GHSA-3h6j-9x8m-rg3g | Low | Not scored | 31 Mar, 2026 | Packagist j0k3r/graby |
Craft CMS' anonymous "assets/image-editor" calls return private asset editor metadata to unauthorized users CVE-2026-33161, GHSA-vgjg-248p-rfm2 | Low | 0.2% | 24 Mar, 2026 | Packagist craftcms/cms |
Craft CMS may expose private assets through anonymous "generate transform" calls via transform URL CVE-2026-33160, GHSA-5pgf-h923-m958 | Low | 0.4% | 24 Mar, 2026 | Packagist craftcms/cms |
AVideo has an Open Redirect via Unvalidated redirectUri in userLogin.php CVE-2026-33296, GHSA-hj5h-5623-gwhw | Low | 0.2% | 19 Mar, 2026 | Packagist wwbn/avideo |
Broken Access Control in extension "Redirect Tab" (redirect_tab) CVE-2026-4202, GHSA-755r-r738-mjgp | Low | 0.2% | 17 Mar, 2026 | Packagist ayacoo/redirect-tab |
Google Cloud Storage for Craft CMS has an Information Disclosure Vulnerability CVE-2026-32266, GHSA-67cr-jmh8-4jpq | Low | 0.4% | 16 Mar, 2026 | Packagist craftcms/google-cloud |
Craft Commerce has stored XSS in Craft Commerce Order Details Slideout CVE-2026-29177, GHSA-mj32-r678-7mvp | Low | 0.2% | 10 Mar, 2026 | Packagist craftcms/commerce |
Craft Commerce is Vulnerable to Stored XSS while updating Order Status from Orders Table CVE-2026-29173, GHSA-mqxf-2998-c6cp | Low | 0.3% | 10 Mar, 2026 | Packagist craftcms/commerce |
Craft CMS has a potential information disclosure vulnerability in preview tokens CVE-2026-29113, GHSA-vg3j-hpm9-8v5v | Low | 0.2% | 10 Mar, 2026 | Packagist craftcms/cms |
Concrete CMS vulnerable to Cross-Site Request Forgery (CSRF) CVE-2026-2994, GHSA-6mxw-2vhf-42g5 | Low | 0.2% | 04 Mar, 2026 | Packagist concrete5/concrete5 |
funadmin: Deserialization Vulnerability in Backend Endpoint via AuthCloudService getMember Function CVE-2026-2898, GHSA-gcxp-xg77-798j | Low | 0.3% | 22 Feb, 2026 | Packagist funadmin/funadmin |
funadmin: XSS through Value argument in Backend Interface component CVE-2026-2897, GHSA-rfh7-7v27-6p9r | Low | 0.2% | 22 Feb, 2026 | Packagist funadmin/funadmin |
funadmin has Weak Password Recovery Mechanism for Forgotten Password CVE-2026-2895, GHSA-fmr2-m7gc-577w | Low | 0.5% | 21 Feb, 2026 | Packagist funadmin/funadmin |
Craft CMS Vulnerable to Stored XSS in Entry Types Name CVE-2026-25491, GHSA-7pr4-wx9w-mqwr | Low | 0.4% | 09 Feb, 2026 | Packagist craftcms/cms |
Winter CMS has Stored Cross-site Scripting (XSS) in Asset Manager CVE-2026-22254, GHSA-m7gw-rffq-rxjm | Low | 0.3% | 04 Feb, 2026 | Packagist winter/wn-cms-module |
MineAdmin May Expose Sensitive Information to an Unauthorized Actor CVE-2026-1196, GHSA-wq8p-q8cq-94w5 | Low | 0.5% | 20 Jan, 2026 | Packagist mineadmin/mineadmin |
MineAdmin improperly refreshes tokens CVE-2026-1195, GHSA-43rr-x62x-q96w | Low | 0.3% | 20 Jan, 2026 | Packagist mineadmin/mineadmin |
MineAdmin has Incorrect Privilege Assignment CVE-2026-1193, GHSA-23hh-2f47-3p4h | Low | 0.3% | 19 Jan, 2026 | Packagist mineadmin/mineadmin |