Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Grav: Page editors can inject arbitrary script into rendered pages via the Twig sandbox's assets.addJs/addCss allowlist, escalating to super-admin CVE-2026-86197, GHSA-8hgv-xc77-jmcr | Medium | 0.4% | 21 Aug, 2026 | Packagist getgrav/grav |
Winter: Reflected XSS through the search query parameter in the backend Table widget GHSA-hq84-x37p-j6q5 | Medium | Not scored | 20 Aug, 2026 | Packagist winter/wn-backend-module |
Winter: CSRF through AJAX handler names reachable as backend page actions GHSA-p2ch-c2c3-4xm5 | Medium | Not scored | 20 Aug, 2026 | Packagist winter/wn-backend-module |
Winter: Stored XSS through cached Brand Settings and Editor Settings custom styles GHSA-5cwr-5jxg-pcf6 | Medium | Not scored | 20 Aug, 2026 | Packagist winter/wn-backend-module |
Winter: My Account preview exposes another backend user's profile by record ID GHSA-mpmw-f6h6-3g26 | Medium | Not scored | 20 Aug, 2026 | Packagist winter/wn-backend-module |
Winter: Local File Inclusion through =include directives in JavaScript asset compilation CVE-2026-79773, GHSA-2223-f22x-24cq | Medium | 0.5% | 20 Aug, 2026 | Packagist winter/wn-system-module |
Winter: Local File Inclusion through @import directives in LESS compilation of backend customizable stylesheets and theme assets CVE-2026-63179, GHSA-58fp-mcx6-7qf9 | Medium | 0.5% | 20 Aug, 2026 | Packagist winter/wn-backend-module |
Laravel Backpack CRUD: HasMany/MorphMany relation fields allow cross-tenant record re-parenting (IDOR) via attachManyRelation CVE-2026-57570, GHSA-42vx-43vc-x6pr | Medium | 0.4% | 20 Aug, 2026 | Packagist backpack/crud |
Winter: Authenticated IDOR in backend FileUpload widget allows cross-user access to attachment metadata CVE-2026-54256, GHSA-3277-h8g9-qj5f | Medium | 0.2% | 20 Aug, 2026 | Packagist winter/wn-backend-module |
Laravel Backpack CRUD: Stored XSS in the color column — the `@if($column['escaped'])` branches are inverted CVE-2026-54181, GHSA-mmg4-322v-6jvc | Medium | 0.3% | 20 Aug, 2026 | Packagist backpack/crud |
Laravel Backpack CRUD: SingleBase64Image accepts any base64 payload behind a `data:image` prefix — SVG-with-script lands on the public disk CVE-2026-54179, GHSA-8hw4-7qjr-3wxg | Medium | 0.3% | 20 Aug, 2026 | Packagist backpack/crud |
Laravel Backpack CRUD: HasUploadFields keeps the attacker-supplied file extension — public-disk uploads of `shell.php` reach the webserver CVE-2026-54177, GHSA-8q2w-pv9p-mjvc | Medium | 0.9% | 20 Aug, 2026 | Packagist backpack/crud |
Laravel Backpack CRUD: MyAccountController allows changing the login email without a current-password check CVE-2026-54176, GHSA-9fw9-8c49-qch8 | Medium | 0.7% | 20 Aug, 2026 | Packagist backpack/crud |
Snipe-IT: Stored DOM XSS via table selected-count IDs CVE-2026-61807, GHSA-c8qc-wf67-342w | Medium | 0.2% | 19 Aug, 2026 | Packagist snipe/snipe-it |
Snipe-IT: Maintenance Record Disclosure via Missing Authorization on GET CVE-2026-55703, GHSA-r9r3-g9fp-3q4q | Medium | 0.3% | 19 Aug, 2026 | Packagist snipe/snipe-it |
Grav: Authenticated ReDoS via regex_replace in Twig Sandbox CVE-2026-62237, CVE-2026-62672, GHSA-37f3-6p89-6qr9 | Medium | 0.4% | 19 Aug, 2026 | Packagist getgrav/grav |
Grav: Twig sandbox config exfiltration via grav.offsetGet + dump filter (CVE-2026-44738 bypass) CVE-2026-61450, CVE-2026-61842, GHSA-mc5q-6hpj-rp7j | Medium | 5.4% | 19 Aug, 2026 | Packagist getgrav/grav |
Grav: Decompression Bomb via ZipArchiver - Missing Extraction Limits CVE-2026-61455, CVE-2026-61690, GHSA-928x-9mpw-8h56 | Medium | 0.5% | 19 Aug, 2026 | Packagist getgrav/grav |
LibreNMS: Stored XSS via graph_descr admin config settings echoed without escaping to all authenticated users CVE-2026-84188, GHSA-7cj5-v4pp-v632 | Medium | 0.3% | 18 Aug, 2026 | Packagist librenms/librenms |
Froxlor has CSRF Vulnerability in AJAX Endpoint — Missing Cross-Site Request Forgery Protection CVE-2026-55593, GHSA-xpr4-8vp6-c87j | Medium | 0.3% | 18 Aug, 2026 | Packagist froxlor/froxlor |
Froxlor DomainZones.add allows DNS zone-file RR injection via record/type fields CVE-2026-54543, GHSA-5rw4-4665-cvwf | Medium | 0.4% | 18 Aug, 2026 | Packagist froxlor/froxlor |
Grav: Single invalid UTF-8 byte disables every rule in Security::detectXss(), bypassing the page-content XSS safety gate CVE-2026-75834, GHSA-q2j8-x8hf-63ch | Medium | 0.3% | 18 Aug, 2026 | Packagist getgrav/grav |
Grav: Stored XSS via Markdown audio/video media <source> URL CVE-2026-75831, GHSA-6qw9-4vv5-jr97 | Medium | 0.4% | 18 Aug, 2026 | Packagist getgrav/grav |
Grav: Stored XSS via quoted-attribute bypass in detectXss CVE-2026-72832, GHSA-269c-h76q-8cxw | Medium | 0.3% | 14 Aug, 2026 | Packagist getgrav/grav |
phpMyFAQ: SQL LIKE Wildcard Injection in Chat User Search Allows Authenticated User Enumeration CVE-2026-47132, GHSA-6pvm-2vjj-rx4w | Medium | 0.3% | 12 Aug, 2026 | Packagist thorsten/phpmyfaq |
LibreNMS: Reflected XSS via Proxmox instance/vmid GET parameters injected into document.title JavaScript assignment CVE-2026-45694, GHSA-jmqm-f8q4-v7wx | Medium | 0.2% | 12 Aug, 2026 | Packagist librenms/librenms |
Winter: Broken access control in `Cms\Controllers\Index` allows cross-template actions and unauthorized asset uploads CVE-2026-32639, GHSA-5c4f-9pq9-6c77 | Medium | 0.5% | 12 Aug, 2026 | Packagist winter/wn-cms-module |
Winter: SQL Injection in Backend Filter Widget numberrange Scope via numbersFromAjax CVE-2026-32593, GHSA-m7jc-g4rc-jmvh | Medium | 0.3% | 12 Aug, 2026 | Packagist winter/wn-backend-module |
Kirby: System path exposure from error messages in the REST API CVE-2026-69127, GHSA-rf2p-vh74-7vvh | Medium | 0.7% | 07 Aug, 2026 | Packagist getkirby/cms |
Smarty Security stream restriction bypass through stream: resource CVE-2026-62996, GHSA-rjhh-76wf-8xmw | Medium | 0.5% | 07 Aug, 2026 | Packagist smarty/smarty |
Smarty: Symlink path traversal out of trusted directories CVE-2026-62992, GHSA-f6wf-28g6-769x | Medium | 0.5% | 07 Aug, 2026 | Packagist smarty/smarty |
Craft CMS: Incorrect path validation could potentially lead to path traversal CVE-2026-72783, GHSA-7hxc-f267-h5q7 | Medium | 0.2% | 06 Aug, 2026 | Packagist craftcms/cms |
Craft CMS: Stored XSS in the control panel via unescaped draft name CVE-2026-72787, GHSA-2rp4-x2j7-qmcc | Medium | 0.3% | 06 Aug, 2026 | Packagist craftcms/cms |
league/commonmark: Denial of service via deeply nested XML output GHSA-mj63-m3rc-8ppr | Medium | Not scored | 06 Aug, 2026 | Packagist league/commonmark |
league/commonmark: AttributesExtension href/src unsafe-link filter bypass via embedded control bytes CVE-2026-71478, GHSA-29pj-957v-52mc | Medium | 0.4% | 06 Aug, 2026 | Packagist league/commonmark |
Silverstripe: XSS in breadcrumbs in page list view CVE-2026-54717, GHSA-w3cp-g2pf-65wh | Medium | 0.3% | 06 Aug, 2026 | Packagist silverstripe/cms |
Statamic: Stored Cross-Site Scripting in Automagic Form Notification Email Template CVE-2026-71435, GHSA-vx89-p3j7-8xqc | Medium | 0.3% | 06 Aug, 2026 | Packagist statamic/cms |
Statamic: Missing file upload validation on frontend forms allows uploading disallowed file types CVE-2026-71434, GHSA-qhr7-v3xp-vw9m | Medium | 0.4% | 06 Aug, 2026 | Packagist statamic/cms |
Statamic: Missing authorization on navigation endpoint allows disclosure of restricted entries CVE-2026-64662, GHSA-qh8c-7588-qfrv | Medium | 0.4% | 06 Aug, 2026 | Packagist statamic/cms |
Statamic: Unsafe method invocation via Antlers template resolution allows data destruction CVE-2026-64663, GHSA-j2vp-f2pv-5rj4 | Medium | 0.4% | 06 Aug, 2026 | Packagist statamic/cms |
Statamic: Missing authorization on Control Panel endpoint allows disclosure of user existence CVE-2026-64664, GHSA-225x-3jhx-wh4q | Medium | 0.3% | 06 Aug, 2026 | Packagist statamic/cms |
Statamic CMS exposes two-factor recovery codes through dynamic Antlers rendering CVE-2026-71293, GHSA-jppw-r5j3-xf7x | Medium | 0.4% | 05 Aug, 2026 | Packagist statamic/cms |
Guzzle: Noncanonical cookie domain keeps subdomain scope CVE-2026-69245, GHSA-f7vp-7xgx-4w4r | Medium | 0.2% | 03 Aug, 2026 | Packagist guzzlehttp/guzzle |
WPGraphQL has deprecated `user` field on SendPasswordResetEmailPayload that leaks user existence + profile (defeats explicit anti-enumeration design) CVE-2026-54768, GHSA-jhh7-832h-f8hv | Medium | 0.4% | 31 Jul, 2026 | Packagist wp-graphql/wp-graphql |
CodeIgniter: Spoofable forwarded HTTPS headers in IncomingRequest::isSecure() CVE-2026-63220, GHSA-7wmf-pw8j-mc78 | Medium | 0.2% | 31 Jul, 2026 | Packagist codeigniter4/framework |
Sylius Mollie Plugin has unauthenticated IDOR that leaks order token and customer PII CVE-2026-68501, GHSA-x83g-979r-f5fh | Medium | 0.6% | 30 Jul, 2026 | Packagist sylius/mollie-plugin |
Dompdf: Embedded SVG images can leak existence of files and directories within the filesystem CVE-2026-59943, GHSA-j8qw-6jw8-r297 | Medium | 0.4% | 22 Jul, 2026 | Packagist dompdf/dompdf |
Dompdf: Denial of Service (DoS) via Resource Exhaustion using Oversized Image Bitmaps CVE-2026-59942, GHSA-f5gf-2cj8-52g2 | Medium | 0.9% | 22 Jul, 2026 | Packagist dompdf/dompdf |
Dompdf: Uncontrolled resource consumption based on declared BMP dimensions CVE-2026-59941, GHSA-8hg6-c449-896m | Medium | 0.6% | 22 Jul, 2026 | Packagist dompdf/dompdf |
Dompdf: Local file read due to improper file path validation in SVG images encoded as data-URI CVE-2026-56722, GHSA-cx96-42px-69fm | Medium | 0.4% | 22 Jul, 2026 | Packagist dompdf/dompdf |