Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
AVideo: Reflected XSS via Unescaped ip Parameter in User_Location testIP.php CVE-2026-34739, GHSA-jqrj-chh6-8h78 | Medium | 0.2% | 31 Mar, 2026 | Packagist wwbn/avideo |
AVideo: Video Publishing Workflow Bypass via Unauthorized overrideStatus Request Parameter CVE-2026-34738, GHSA-m577-w9j8-ch7j | Medium | 0.2% | 31 Mar, 2026 | Packagist wwbn/avideo |
AVideo: Arbitrary Stripe Subscription Cancellation via Debug Endpoint and retrieveSubscriptions() Bug CVE-2026-34737, GHSA-38rh-4v39-vfxv | Medium | 0.3% | 31 Mar, 2026 | Packagist wwbn/avideo |
AVideo: Unauthenticated File Deletion via PHP Operator Precedence Bug in CLI Guard CVE-2026-34733, GHSA-wwpw-hrx8-79r5 | High | 0.3% | 31 Mar, 2026 | Packagist wwbn/avideo |
AVideo: Missing Authentication in CreatePlugin list.json.php Template Affects 21 Endpoints CVE-2026-34732, GHSA-g2mg-cgr6-vmv7 | High | 0.4% | 31 Mar, 2026 | Packagist wwbn/avideo |
AVideo: Unauthenticated Live Stream Termination via RTMP Callback on_publish_done.php CVE-2026-34731, GHSA-4jcg-jxpf-5vq3 | High | 0.5% | 31 Mar, 2026 | Packagist wwbn/avideo |
AVideo: DOM XSS via Unsanitized Display Name in WebSocket Call Notification CVE-2026-34716, GHSA-w4hp-w536-jg64 | Medium | 0.3% | 31 Mar, 2026 | Packagist wwbn/avideo |
AVideo: CSRF on Plugin Enable/Disable Endpoint Allows Disabling Security Plugins CVE-2026-34613, GHSA-hqxf-mhfw-rc44 | Medium | 0.2% | 31 Mar, 2026 | Packagist wwbn/avideo |
AVideo: CSRF on emailAllUsers.json.php Enables Mass Phishing Email to All Users CVE-2026-34611, GHSA-c4xj-x7p8-3x7q | Medium | 0.2% | 31 Mar, 2026 | Packagist wwbn/avideo |
AVideo has Stored XSS via Unescaped Plugin Configuration Values in Admin Panel CVE-2026-34396, GHSA-v4h7-3x43-qqw4 | Medium | 0.2% | 31 Mar, 2026 | Packagist wwbn/avideo |
AVideo vulnerable to Mass User PII Disclosure via Missing Authorization in YPTWallet users.json.php CVE-2026-34395, GHSA-77jp-mgcw-rfmr | Medium | 0.3% | 31 Mar, 2026 | Packagist wwbn/avideo |
AVideo's CSRF on Admin Plugin Configuration Enables Payment Credential Hijacking CVE-2026-34394, GHSA-4wwr-7h7c-chqr | High | 0.2% | 31 Mar, 2026 | Packagist wwbn/avideo |
Admidio has Missing CSRF Protection on Registration Approval Actions CVE-2026-34384, GHSA-ph84-r98x-2j22 | High | 0.2% | 31 Mar, 2026 | Packagist admidio/admidio |
Admidio has CSRF and Form Validation Bypass in Inventory Item Save via `imported` Parameter CVE-2026-34383, GHSA-4rwm-c5mj-wh7x | Medium | 0.1% | 31 Mar, 2026 | Packagist admidio/admidio |
Admidio has Missing CSRF Protections on Custom List Deletion in mylist_function.php CVE-2026-34382, GHSA-g3mx-8jm6-rc85 | Medium | 0.1% | 31 Mar, 2026 | Packagist admidio/admidio |
Admidio allows Unauthenticated Access to Role-Restricted documents via neutralized .htaccess CVE-2026-34381, GHSA-7fh7-8xqm-3g88 | High | 0.6% | 31 Mar, 2026 | Packagist admidio/admidio |
baserCMS is Vulnerable to Cross-site Scripting CVE-2026-32734, GHSA-677c-xv24-crgx | High | 0.3% | 31 Mar, 2026 | Packagist baserproject/basercms |
baserCMS Path Traversal Leads to Arbitrary File Write and RCE via Theme File API CVE-2026-30940, GHSA-c5c6-37vq-pjcq | High | 1.1% | 31 Mar, 2026 | Packagist baserproject/basercms |
baserCMS has OS command injection vulnerability in installer CVE-2026-30880, GHSA-6hpg-8rx3-cwgv | Critical | 2.1% | 31 Mar, 2026 | Packagist baserproject/basercms |
baserCMS has a cross-site scripting vulnerability in blog posts CVE-2026-30879, GHSA-jmq3-x8q7-j9qm | Medium | 0.2% | 31 Mar, 2026 | Packagist baserproject/basercms |
baserCMS has Mail Form Acceptance Bypass via Public API CVE-2026-30878, GHSA-8cr7-r8qw-gp3c | Medium | 0.4% | 31 Mar, 2026 | Packagist baserproject/basercms |
baserCMS Update Functionality Vulnerable to OS Command Injection CVE-2026-30877, GHSA-m9g7-rgfc-jcm7 | Critical | 1.5% | 31 Mar, 2026 | Packagist baserproject/basercms |
baserCMS has an SQL injection vulnerability in its blog post functionality CVE-2026-27697, GHSA-vh89-rjph-2g7p | Medium | 0.4% | 31 Mar, 2026 | Packagist baserproject/basercms |
baserCMS has OS Command Injection Leading to Remote Code Execution (RCE) CVE-2026-21861, GHSA-qxmc-6f24-g86g | Critical | 2.3% | 31 Mar, 2026 | Packagist baserproject/basercms |
baserCMS has Unsafe File Upload Leading to Remote Code Execution (RCE) CVE-2025-32957, GHSA-hv78-cwp4-8r7r | High | 0.6% | 31 Mar, 2026 | Packagist baserproject/basercms |
CI4MS: Methods Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS CVE-2026-34558, GHSA-v77r-xg3p-75g7 | Critical | 0.3% | 30 Mar, 2026 | Packagist ci4-cms-erp/ci4ms |
CI4MS: Permissions Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS CVE-2026-34557, GHSA-rpjr-985c-qhvm | Critical | 0.3% | 30 Mar, 2026 | Packagist ci4-cms-erp/ci4ms |
Sulu checks fix permissions for subentities endpoints CVE-2026-34372, GHSA-6h7h-m7p5-hjqp | Medium | 0.3% | 30 Mar, 2026 | Packagist sulu/sulu |
ci4-cms-erp/ci4ms: System Settings (Mail Settings) Full Platform Compromise & Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS CVE-2026-27599, GHSA-66m2-v9v9-95c3 | Critical | 0.4% | 30 Mar, 2026 | Packagist ci4-cms-erp/ci4ms |
AVideo: Unauthenticated Access to Payment Log DataTables Endpoints Exposes Transaction Data, PayPal Tokens, and User Financial Records CVE-2026-56341, GHSA-wprj-9cvc-5w37 | High | 0.5% | 29 Mar, 2026 | Packagist wwbn/avideo |
AWS SDK for PHP has CloudFront Policy Document Injection via Special Characters GHSA-27qh-8cxx-2cr5 | High | Not scored | 27 Mar, 2026 | Packagist aws/aws-sdk-php |
AVideo Vulnerable to Reflected XSS via Unsanitized plugin Parameter in YPTWallet Stripe Payment Page CVE-2026-34375, GHSA-pm37-62g7-p768 | High | 0.3% | 27 Mar, 2026 | Packagist wwbn/avideo |
AVideo has Video Password Protection Bypass via API Endpoints Returning Full Playback Sources Without Password Verification CVE-2026-34369, GHSA-q6jj-r49p-94fh | Medium | 0.4% | 27 Mar, 2026 | Packagist wwbn/avideo |
AVideo Vulnerable to Wallet Balance Double-Spend via TOCTOU Race Condition in transferBalance CVE-2026-34368, GHSA-h54m-c522-h6qr | Medium | 0.2% | 27 Mar, 2026 | Packagist wwbn/avideo |
AVideo has User Group-Based Category Access Control Bypass via Missing and Broken Group Filtering in categories.json.php CVE-2026-34364, GHSA-73gr-r64q-7jh4 | Medium | 0.3% | 27 Mar, 2026 | Packagist wwbn/avideo |
Dolibarr Core Discloses Sensitive Data via Authenticated Local File Inclusion in selectobject.php CVE-2026-34036, GHSA-2mfj-r695-5h9r | Medium | 1.5% | 27 Mar, 2026 | Packagist dolibarr/dolibarr |
AVideo's WebSocket Token Never Expires Due to Commented-Out Timeout Validation in verifyTokenSocket() CVE-2026-34362, GHSA-2mg4-pfgx-64cf | Medium | 0.3% | 27 Mar, 2026 | Packagist wwbn/avideo |
AVideo: IDOR in uploadPoster.php Allows Any Authenticated User to Overwrite Scheduled Live Stream Posters and Trigger False Socket Notifications CVE-2026-34247, GHSA-g3hj-mf85-679g | Medium | 0.2% | 27 Mar, 2026 | Packagist wwbn/avideo |
AVideo: Missing Authorization in Playlist Schedule Creation Allows Cross-User Broadcast Hijacking CVE-2026-34245, GHSA-2rm7-j397-3fqg | Medium | 0.3% | 27 Mar, 2026 | Packagist wwbn/avideo |
TSPortal's Uncontrolled User Creation via Validation Side Effects Leads to Potential Denial of Service CVE-2026-33541, GHSA-f346-8rp3-4h9h | Medium | 0.3% | 26 Mar, 2026 | Packagist miraheze/ts-portal |
Statamic allows unauthorized content access through missing authorization in its revision controllers CVE-2026-33887, GHSA-4hp7-3wxg-cv9q | Medium | 0.1% | 26 Mar, 2026 | Packagist statamic/cms |
Statamic's sensitive configuration values are exposed to content editors via Antlers-enabled fields CVE-2026-33886, GHSA-gcqf-5x9f-hq7f | Medium | 0.2% | 26 Mar, 2026 | Packagist statamic/cms |
Statamic has an Open Redirect on unauthenticated endpoints via URL parsing differential CVE-2026-33885, GHSA-7f74-7q5w-hj4r | Medium | 0.2% | 26 Mar, 2026 | Packagist statamic/cms |
Statamic's live preview token bypasses content protection for unrelated entries CVE-2026-33884, GHSA-8vwx-ccf6-5wg2 | Medium | 0.2% | 26 Mar, 2026 | Packagist statamic/cms |
Statamic has Reflected XSS via unescaped redirect parameter in its password reset form tag CVE-2026-33883, GHSA-3jg4-p23x-p4qx | Medium | 0.2% | 26 Mar, 2026 | Packagist statamic/cms |
Statamic's Markdown preview endpoint exposes sensitive user data CVE-2026-33882, GHSA-cvh3-23vq-w7h4 | Medium | 0.3% | 26 Mar, 2026 | Packagist statamic/cms |
AVideo has Plaintext Video Password Storage CVE-2026-33867, GHSA-363v-5rh8-23wg | Critical | 0.2% | 26 Mar, 2026 | Packagist wwbn/avideo |
AVideo has SQL Injection in category.php fixCleanTitle() via Unparameterized clean_title and id Variables CVE-2026-33770, GHSA-584p-rpvq-35vf | High | 0.5% | 26 Mar, 2026 | Packagist wwbn/avideo |
AVideo has SQL Injection via Partial Prepared Statement — videos_id Concatenated Directly into Query CVE-2026-33767, GHSA-fj74-qxj7-r3vc | High | 0.5% | 26 Mar, 2026 | Packagist wwbn/avideo |
AVideo has SSRF Protection Bypass via HTTP Redirect in Image Download Endpoints CVE-2026-33766, GHSA-f359-r3pv-2phf | Medium | 0.2% | 26 Mar, 2026 | Packagist wwbn/avideo |