Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Nodcms contains a cross-site request forgery vulnerability CVE-2016-20054, GHSA-3qcm-pj6q-w4c5 | Medium | 0.1% | 04 Apr, 2026 | Packagist khodakhah/nodcms |
AVideo: Unauthenticated Information Disclosure via Missing Auth on CloneSite client.log.php CVE-2026-35452, GHSA-99j6-hj87-6fcf | Medium | 0.4% | 04 Apr, 2026 | Packagist wwbn/avideo |
AVideo: Unauthenticated FFmpeg Remote Server Status Disclosure via check.ffmpeg.json.php CVE-2026-35450, GHSA-2vg4-rrx4-qcpq | Medium | 0.4% | 04 Apr, 2026 | Packagist wwbn/avideo |
AVideo: Unauthenticated Information Disclosure via Disabled CLI Guard in install/test.php CVE-2026-35449, GHSA-hg8q-8wqr-35xx | Medium | 0.3% | 04 Apr, 2026 | Packagist wwbn/avideo |
AVideo: Unauthenticated Access to Payment Order Data via BlockonomicsYPT check.php CVE-2026-35448, GHSA-3v7m-qg4x-58h9 | Low | 0.3% | 04 Apr, 2026 | Packagist wwbn/avideo |
AVideo: CSRF on Player Skin Configuration via admin/playerUpdate.json.php CVE-2026-35181, GHSA-4q27-4rrq-fx95 | Medium | 0.1% | 03 Apr, 2026 | Packagist wwbn/avideo |
AVideo: Unauthenticated Instagram Graph API Proxy via publishInstagram.json.php CVE-2026-35179, GHSA-x9w5-xccw-5h9w | Medium | 0.2% | 03 Apr, 2026 | Packagist wwbn/avideo |
OpenSTAManager has a SQL Injection via righe Parameter in confronta_righe Modals CVE-2026-35470, GHSA-mmm5-3g4x-qw39 | High | 0.4% | 03 Apr, 2026 | Packagist devcode-it/openstamanager |
Roundcube Webmail: Remote image blocking feature can be bypassed via SVG content in an e-mail message CVE-2026-35545, GHSA-w846-74jr-76cv | High | 0.4% | 03 Apr, 2026 | Packagist roundcube/roundcubemail |
Roundcube Webmail: Insufficient CSS sanitization in HTML e-mail messages CVE-2026-35544, GHSA-xpqh-grpw-4xmg | Medium | 0.4% | 03 Apr, 2026 | Packagist roundcube/roundcubemail |
Roundcube Webmail: Bypass of remote image blocking via SVG content (with animate attributes) in an e-mail message CVE-2026-35543, GHSA-j2g6-8rvg-7mf6 | Medium | 0.4% | 03 Apr, 2026 | Packagist roundcube/roundcubemail |
Roundcube: Bypass of remote image blocking via crafted BODY background attribute CVE-2026-35542, GHSA-5hf6-crg4-fg59 | Medium | 0.4% | 03 Apr, 2026 | Packagist roundcube/roundcubemail |
Roundcube Webmail: Incorrect password comparison in the password plugin CVE-2026-35541, GHSA-46pv-mj2g-93gh | Medium | 0.2% | 03 Apr, 2026 | Packagist roundcube/roundcubemail |
Roundcube Webmail: Insufficient CSS sanitization in HTML e-mail messages CVE-2026-35540, GHSA-vxg2-hhgr-37fx | Medium | 0.4% | 03 Apr, 2026 | Packagist roundcube/roundcubemail |
Roundcube Webmail: Insufficient HTML attachment sanitization in preview mode CVE-2026-35539, GHSA-x4q5-8j5g-hpjc | Medium | 0.3% | 03 Apr, 2026 | Packagist roundcube/roundcubemail |
Roundcube Webmail: Unsanitized IMAP SEARCH command arguments CVE-2026-35538, GHSA-8jr8-v43g-5c57 | Low | 0.4% | 03 Apr, 2026 | Packagist roundcube/roundcubemail |
Roundcube Webmail: Unsafe deserialization in the redis/memcache session handler CVE-2026-35537, GHSA-rxj3-rrwm-pj4r | High | 0.5% | 03 Apr, 2026 | Packagist roundcube/roundcubemail |
CI4MS: Profile & User Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS CVE-2026-34989, GHSA-vr2g-rhm5-q4jr | Critical | 0.3% | 03 Apr, 2026 | Packagist ci4-cms-erp/ci4ms |
Auth0 Symfony SDK has Insufficient Entropy in Cookie Encryption GHSA-ghc5-95c2-vwcv | High | Not scored | 03 Apr, 2026 | Packagist auth0/symfony |
Auth0 WordPress Plugin has Insufficient Entropy in Cookie Encryption GHSA-vfpx-q664-h93m | High | Not scored | 03 Apr, 2026 | Packagist auth0/wordpress |
Auth0 laravel-auth0 SDK has Insufficient Entropy in Cookie Encryption GHSA-fmg6-246m-9g2v | High | Not scored | 03 Apr, 2026 | Packagist auth0/login |
Krayin CRM is vulnerable to Cross-site Scripting (XSS) CVE-2026-5370, GHSA-9m2v-hc5g-5jpv | Low | 0.2% | 02 Apr, 2026 | Packagist krayin/laravel-crm |
OpenSTAManager: SQL Injection via Aggiornamenti Module CVE-2026-35168, GHSA-2fr7-cc4f-wh98 | High | 0.7% | 02 Apr, 2026 | Packagist devcode-it/openstamanager |
phpMyFAQ: SVG Sanitizer Bypass via HTML Entity Encoding Leads to Stored XSS and Privilege Escalation CVE-2026-34974, GHSA-5crx-pfhq-4hgg | Medium | 0.2% | 01 Apr, 2026 | Packagist thorsten/phpmyfaq |
phpMyFAQ has a LIKE Wildcard Injection in Search.php — Unescaped % and _ Metacharacters Enable Broad Content Disclosure CVE-2026-34973, GHSA-gcp9-5jc8-976x | Medium | 0.3% | 01 Apr, 2026 | Packagist thorsten/phpmyfaq |
AVideo has Stored XSS via Unescaped Menu Item Fields in TopMenu Plugin CVE-2026-56347, GHSA-gmpc-fxg2-vcmq | Medium | 0.2% | 01 Apr, 2026 | Packagist wwbn/avideo |
phpMyFAQ: Stored XSS via Regex Bypass in Filter::removeAttributes() CVE-2026-34729, GHSA-cv2g-8cj8-vgc7 | Medium | 0.2% | 01 Apr, 2026 | Packagist phpmyfaq/phpmyfaq |
phpMyFAQ: Path Traversal - Arbitrary File Deletion in MediaBrowserController CVE-2026-34728, GHSA-38m8-xrfj-v38x | High | 0.7% | 01 Apr, 2026 | Packagist phpmyfaq/phpmyfaq |
CI4MS: Account Deactivation Module Grants Full Persistent Unauthorized Access for All‑Roles via Improper Session Invalidation (Logic Flaw) CVE-2026-34572, GHSA-8fq3-c5w3-pj3q | High | 0.5% | 01 Apr, 2026 | Packagist ci4-cms-erp/ci4ms |
CI4MS: Stored Cross‑Site Scripting (Stored XSS) in Backend User Management Allows Session Hijacking and Full Administrative Account Compromise CVE-2026-34571, GHSA-fc4p-p49v-r948 | Critical | 0.4% | 01 Apr, 2026 | Packagist ci4-cms-erp/ci4ms |
CI4MS: Account Deletion Module Grants Full Persistent Unauthorized Access for All‑Roles via Improper Session Invalidation (Logic Flaw) CVE-2026-34570, GHSA-4vxv-4xq4-p84h | High | 0.5% | 01 Apr, 2026 | Packagist ci4-cms-erp/ci4ms |
CI4MS: Blogs Categories Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS CVE-2026-34569, GHSA-fhrf-q333-82fm | Critical | 0.3% | 01 Apr, 2026 | Packagist ci4-cms-erp/ci4ms |
CI4MS: Blogs Posts Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS CVE-2026-34568, GHSA-x7wh-g25g-53vg | Critical | 0.3% | 01 Apr, 2026 | Packagist ci4-cms-erp/ci4ms |
CI4MS: Blogs Posts (Categories) Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS CVE-2026-34567, GHSA-r33w-c82v-x5v7 | Critical | 0.3% | 01 Apr, 2026 | Packagist ci4-cms-erp/ci4ms |
CI4MS: Pages Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS CVE-2026-34566, GHSA-458r-h248-29c5 | Critical | 0.3% | 01 Apr, 2026 | Packagist ci4-cms-erp/ci4ms |
CI4MS: Menu Management (Posts) Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS CVE-2026-34565, GHSA-xgh5-w62m-8mpr | Critical | 0.3% | 01 Apr, 2026 | Packagist ci4-cms-erp/ci4ms |
CI4MS: Menu Management (Pages) Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS CVE-2026-34564, GHSA-g4pp-fhgf-8653 | Critical | 0.3% | 01 Apr, 2026 | Packagist ci4-cms-erp/ci4ms |
CI4MS: Backup Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM Blind XSS CVE-2026-34563, GHSA-85m8-g393-jcxf | Critical | 0.3% | 01 Apr, 2026 | Packagist ci4-cms-erp/ci4ms |
CI4MS: System Settings (Company Information) Full Platform Compromise & Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS CVE-2026-34562, GHSA-v897-c6vq-6cr3 | Critical | 0.3% | 01 Apr, 2026 | Packagist ci4-cms-erp/ci4ms |
CI4MS: System Settings (Social Media Management) Full Platform Compromise & Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS CVE-2026-34561, GHSA-gcfj-cf7j-vwgj | Critical | 0.2% | 01 Apr, 2026 | Packagist ci4-cms-erp/ci4ms |
CI4MS: Logs Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS CVE-2026-34560, GHSA-r4v5-rwr2-q7r4 | Critical | 0.4% | 01 Apr, 2026 | Packagist ci4-cms-erp/ci4ms |
CI4MS: Blogs Tags Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS CVE-2026-34559, GHSA-4333-387x-w245 | Critical | 0.3% | 01 Apr, 2026 | Packagist ci4-cms-erp/ci4ms |
OpenSTAManager Affected by Remote Code Execution via Insecure Deserialization in OAuth2 CVE-2026-29782, GHSA-whv5-4q2f-q68g | High | 0.6% | 01 Apr, 2026 | Packagist devcode-it/openstamanager |
OpenSTAManager has a Time-Based Blind SQL Injection via `options[stato]` Parameter CVE-2026-28805, GHSA-3gw8-3mg3-jmpc | High | 0.5% | 01 Apr, 2026 | Packagist devcode-it/openstamanager |
Auth0 PHP SDK has Insufficient Entropy in Cookie Encryption CVE-2026-34236, GHSA-w3wc-44p4-m4j7 | Critical | 0.2% | 01 Apr, 2026 | Packagist auth0/auth0-php |
YesWiki has Multiple Reflected Cross-site Scripting Vulnerabilities CVE-2026-104473, GHSA-5724-x3rh-5qqq | Medium | 0.2% | 01 Apr, 2026 | Packagist yeswiki/yeswiki |
YesWiki has Persistent Blind XSS at "/?BazaR&vue=consulter" CVE-2026-34598, GHSA-37fq-47qj-6j5j | High | 0.2% | 01 Apr, 2026 | Packagist yeswiki/yeswiki |
Graby has stored XSS via iframe srcdoc Attribute in htmLawed Sanitization Config GHSA-3h6j-9x8m-rg3g | Low | Not scored | 31 Mar, 2026 | Packagist j0k3r/graby |
phpMyFAQ is Vulnerable to Stored XSS via Unsanitized Email Field in Admin FAQ Editor CVE-2026-32629, GHSA-98gw-w575-h2ph | Medium | 0.3% | 31 Mar, 2026 | Packagist phpmyfaq/phpmyfaq Packagist thorsten/phpmyfaq |
AVideo: Stored SSRF via Video EPG Link Missing isSSRFSafeURL() Validation CVE-2026-34740, GHSA-x5vx-vrpf-r45f | Medium | 0.3% | 31 Mar, 2026 | Packagist wwbn/avideo |