Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
AVideo: IDOR in AI Plugin Allows Stealing Other Users' AI-Generated Metadata and Transcriptions CVE-2026-33764, GHSA-g39v-qrj6-jxrh | Medium | 0.2% | 26 Mar, 2026 | Packagist wwbn/avideo |
AVideo has an Unauthenticated Video Password Brute-Force Vulnerability via Unrate-Limited Boolean Oracle CVE-2026-33763, GHSA-8prq-2jr2-cm92 | Medium | 0.3% | 26 Mar, 2026 | Packagist wwbn/avideo |
AVideo: Unauthenticated Access to Scheduler Plugin Endpoints Leaks Scheduled Tasks, Email Content, and User Mappings CVE-2026-33761, GHSA-j724-5c6c-68g5 | Medium | 0.4% | 26 Mar, 2026 | Packagist wwbn/avideo |
AVideo: Unauthenticated IDOR in playlistsVideos.json.php Exposes Private Playlist Contents CVE-2026-33759, GHSA-75qq-68m8-pvfr | Medium | 0.3% | 26 Mar, 2026 | Packagist wwbn/avideo |
LibreNMS is Vulnerable to Remote Code Execution by Arbitrary File Write CVE-2026-6204, GHSA-pr3g-phhr-h8fh | High | 7.5% | 26 Mar, 2026 | Packagist librenms/librenms |
Withdrawn Advisory: Kirby CMS has Persistent DoS via Malformed Image Upload CVE-2026-29905, GHSA-cw7v-45wm-mcf2 | Medium | 0.5% | 26 Mar, 2026 | Packagist getkirby/cms |
Craft CMS: Authorized asset "preview file" requests bypass allows users without asset access to retrieve private preview metadata CVE-2026-56385, GHSA-44px-qjjc-xrhq | Medium | 0.4% | 26 Mar, 2026 | Packagist craftcms/cms |
Saloon has insecure deserialization in AccessTokenAuthenticator CVE-2026-33942, GHSA-rf88-776r-rcq9 | High | 0.6% | 26 Mar, 2026 | Packagist saloonphp/saloon |
Saloon has a Fixture Name Path Traversal Vulnerability CVE-2026-33183, GHSA-f7xc-5852-fj99 | High | 0.6% | 25 Mar, 2026 | Packagist saloonphp/saloon |
Saloon is vulnerable to SSRF and credential leakage via absolute URL in endpoint overriding base URL CVE-2026-33182, GHSA-c83f-3xp6-hfcp | Medium | 0.4% | 25 Mar, 2026 | Packagist saloonphp/saloon |
Protobuf: Denial of Service issue through malicious messages containing negative varints or deep recursion CVE-2026-6409, GHSA-p2gh-cfq4-4wjc | High | 0.4% | 25 Mar, 2026 | Packagist google/protobuf |
Sharp is Vulnerable to Path Traversal via Unsanitized Extension in FileUtil CVE-2026-33686, GHSA-9ffq-6457-8958 | High | 0.6% | 25 Mar, 2026 | Packagist code16/sharp |
Sharp has Unrestricted File Upload via Client-Controlled Validation Rules CVE-2026-33687, GHSA-fr76-5637-w3g9 | High | 0.5% | 25 Mar, 2026 | Packagist code16/sharp |
AVideo: Full-Read SSRF Through Unvalidated statsURL Parameter in plugin/Live/test.php GHSA-wxjx-r2j2-96fx | Medium | Not scored | 25 Mar, 2026 | Packagist wwbn/avideo |
PrestaShop has multiple stored XSS vulnerabilities via unprotected Template variables CVE-2026-33673, GHSA-35pf-37c6-jxjv | High | 0.3% | 25 Mar, 2026 | Packagist prestashop/prestashop |
PrestaShop: Improper Use of Validation Framework CVE-2026-33674, GHSA-283w-xf3q-788v | Medium | 0.2% | 25 Mar, 2026 | Packagist prestashop/prestashop |
WeChat Pay callback signature verification bypassed when Host header is localhost CVE-2026-33661, GHSA-q938-ghwv-8gvc | High | 0.5% | 25 Mar, 2026 | Packagist yansongda/pay |
Invoice Ninja Denylist Bypass may Lead to Stored XSS via Invoice Line Items CVE-2026-33628, GHSA-98wm-cxpw-847p | Medium | 0.2% | 24 Mar, 2026 | Packagist invoiceninja/invoiceninja |
Craft CMS has an authorization bypass which allows any control panel user to move entries without permissions CVE-2026-33162, GHSA-f582-6gf6-gx4g | Medium | 0.3% | 24 Mar, 2026 | Packagist craftcms/cms |
Craft CMS' anonymous "assets/image-editor" calls return private asset editor metadata to unauthorized users CVE-2026-33161, GHSA-vgjg-248p-rfm2 | Low | 0.2% | 24 Mar, 2026 | Packagist craftcms/cms |
Craft CMS may expose private assets through anonymous "generate transform" calls via transform URL CVE-2026-33160, GHSA-5pgf-h923-m958 | Low | 0.4% | 24 Mar, 2026 | Packagist craftcms/cms |
Craft CMS: Unauthenticated Users Can Perform Restricted Project Config Sync Operations CVE-2026-33159, GHSA-6mrr-q3pj-h53w | Medium | 0.3% | 24 Mar, 2026 | Packagist craftcms/cms |
Craft CMS: Low-privilege users could read private asset contents when editing an asset (IDOR) CVE-2026-33158, GHSA-3pvf-vxrv-hh9c | Medium | 0.4% | 24 Mar, 2026 | Packagist craftcms/cms |
Craft CMS is Vulnerable to Authenticated Remote Code Execution via Malicious Attached Behavior CVE-2026-33157, GHSA-2fph-6v5w-89hh | High | 1.1% | 24 Mar, 2026 | Packagist craftcms/cms |
Froxlor is vulnerable to BIND zone file injection via unsanitized DNS record content in DomainZones API CVE-2026-30932, GHSA-x6w6-2xwp-3jh6 | High | 0.6% | 24 Mar, 2026 | Packagist froxlor/froxlor |
ConcreteCMS is vulnerable to Denial of Service During Bulk Downloads CVE-2026-30662, GHSA-p68c-rmfh-j48h | Medium | 0.3% | 24 Mar, 2026 | Packagist concrete5/concrete5 |
Roadiz has Server-Side Request Forgery (SSRF) in roadiz/documents CVE-2026-33486, GHSA-rc55-58f4-687g | Medium | 0.4% | 23 Mar, 2026 | Packagist roadiz/documents |
Connect CMS: Improper Authorization in the My Page Profile Update Feature Allows Modification of Arbitrary User Information CVE-2026-32300, GHSA-qr6x-wvxr-8hm9 | High | 0.3% | 23 Mar, 2026 | Packagist opensource-workshop/connect-cms |
Connect CMS: Information Disclosure Due to Improper Authorization through the Page Content Retrieval Feature CVE-2026-32299, GHSA-62ch-j6x7-722j | High | 0.3% | 23 Mar, 2026 | Packagist opensource-workshop/connect-cms |
Connect CMS has SSRF in the External Page Migration Feature of its Page Management Plugin CVE-2026-32279, GHSA-jh46-85jr-6ph9 | Medium | 0.4% | 23 Mar, 2026 | Packagist opensource-workshop/connect-cms |
Connect CMS has Stored Cross-site Scripting (XSS) in the File Field of its Form Plugin CVE-2026-32278, GHSA-mv3p-7p89-wq9p | High | 0.2% | 23 Mar, 2026 | Packagist opensource-workshop/connect-cms |
Connect-CMS has DOM-based Cross-Site Scripting (XSS) in the Cabinet Plugin List View CVE-2026-32277, GHSA-cmfh-mpmf-fmq4 | High | 0.3% | 23 Mar, 2026 | Packagist opensource-workshop/connect-cms |
Connect-CMS has Arbitrary Code Execution by an Authenticated User in its Code Study Plugin CVE-2026-32276, GHSA-hxqw-6qv7-cqfv | High | 0.5% | 23 Mar, 2026 | Packagist opensource-workshop/connect-cms |
MantisBT has Stored HTML Injection/XSS when displaying Tags in Timeline CVE-2026-33548, GHSA-73vx-49mv-v8w5 | High | 0.2% | 23 Mar, 2026 | Packagist mantisbt/mantisbt |
MantisBT Vulnerable to Stored HTML Injection in Tag Delete Confirmation CVE-2026-33517, GHSA-fh48-f69w-7vmp | High | 0.2% | 23 Mar, 2026 | Packagist mantisbt/mantisbt |
MantisBT is vulnerable to authentication bypass through the SOAP API on MySQL CVE-2026-30849, GHSA-phrq-pc6r-f6gh | Critical | 1.8% | 23 Mar, 2026 | Packagist mantisbt/mantisbt |
Sprig Plugin for Craft CMS potentially discloses sensitive information via Sprig Playground CVE-2026-27131, GHSA-m59h-42jf-cphr | Medium | 0.3% | 23 Mar, 2026 | Packagist putyourlightson/craft-sprig |
AVideo is Vulnerable to SQL Injection through Subscribe Endpoint via Unsanitized user_id Parameter CVE-2026-33723, GHSA-ffr8-fxhv-fv8h | High | 0.2% | 23 Mar, 2026 | Packagist wwbn/avideo |
AVideo: Unauthenticated CDN Configuration Takeover via Empty Default Key Bypass and Mass-Assignment CVE-2026-33719, GHSA-r64r-883r-wcwh | High | 0.4% | 23 Mar, 2026 | Packagist wwbn/avideo |
AVideo: Remote Code Execution via PHP Temp File in Encoder downloadURL CVE-2026-33717, GHSA-8wf4-c4x3-h952 | High | 0.4% | 23 Mar, 2026 | Packagist wwbn/avideo |
AVideo Allows Unauthenticated Live Stream Control via Token Verification URL Override in control.json.php CVE-2026-33716, GHSA-9hv9-gvwm-95f2 | Critical | 0.4% | 23 Mar, 2026 | Packagist wwbn/avideo |
AVideo vulnerable to IP Address Spoofing via Untrusted HTTP Headers in getRealIpAddr() CVE-2026-33690, GHSA-8p2x-5cpm-qrqw | Medium | 0.2% | 23 Mar, 2026 | Packagist wwbn/avideo |
AVideo has Pre-Captcha User Enumeration and Account Status Disclosure in Password Recovery Endpoint CVE-2026-33688, GHSA-m99f-mmvg-3xmx | Medium | 0.3% | 23 Mar, 2026 | Packagist wwbn/avideo |
AVideo Allows Unauthenticated Access to AD_Server reports.json.php that Exposes Ad Campaign Analytics and User Data CVE-2026-33685, GHSA-j36m-74g2-7m95 | Medium | 0.3% | 23 Mar, 2026 | Packagist wwbn/avideo |
AVideo vulnerable to Stored XSS via html_entity_decode() Reversing xss_esc() Sanitization in Channel About Field CVE-2026-33683, GHSA-ghx5-7jjg-q2j7 | Medium | 0.2% | 23 Mar, 2026 | Packagist wwbn/avideo |
AVideo has Path Traversal in pluginRunDatabaseScript.json.php Enables Arbitrary SQL File Execution via Unsanitized Plugin Name CVE-2026-33681, GHSA-3hwv-x8g3-9qpr | High | 0.5% | 23 Mar, 2026 | Packagist wwbn/avideo |
AVideo has a Blind SQL Injection in Live Schedule Reminder via Unsanitized live_schedule_id in Scheduler_commands::getAllActiveOrToRepeat() CVE-2026-33651, GHSA-pvw4-p2jm-chjm | High | 0.4% | 23 Mar, 2026 | Packagist wwbn/avideo |
AVideo: Video Moderator Privilege Escalation via Ownership Transfer Enables Arbitrary Video Deletion CVE-2026-33650, GHSA-8x77-f38v-4m5j | High | 0.2% | 23 Mar, 2026 | Packagist wwbn/avideo |
AVideo's GET-Based CSRF in setPermission.json.php Enables Privilege Escalation via Arbitrary Permission Modification CVE-2026-33649, GHSA-g8x9-7mgh-7cvj | High | 0.2% | 23 Mar, 2026 | Packagist wwbn/avideo |
AVideo Vulnerable to OS Command Injection via Unsanitized `users_id` and `liveTransmitionHistory_id` in Restreamer Log File Path CVE-2026-33648, GHSA-5m4q-5cvx-36mw | High | 0.6% | 23 Mar, 2026 | Packagist wwbn/avideo |