Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
AVideo Vulnerable to OS Command Injection via Unsanitized `users_id` and `liveTransmitionHistory_id` in Restreamer Log File Path CVE-2026-33648, GHSA-5m4q-5cvx-36mw | High | 0.6% | 23 Mar, 2026 | Packagist wwbn/avideo |
AVideo Vulnerable to Remote Code Execution via MIME/Extension Mismatch in ImageGallery File Upload CVE-2026-33647, GHSA-wxjw-phj6-g75w | High | 0.7% | 23 Mar, 2026 | Packagist wwbn/avideo |
HybridAuth Has Improper SSL Certificate Validation in Curl HTTP Client CVE-2026-4587, GHSA-r3hf-q3mf-7h6w | Medium | 0.2% | 23 Mar, 2026 | Packagist hybridauth/hybridauth |
AVideo has an Unauthenticated Local File Inclusion in API locale (RCE possible with writable PHP) CVE-2026-33513, GHSA-8fw8-q79c-fp9m | High | 0.8% | 20 Mar, 2026 | Packagist wwbn/avideo |
AVideo has an unauthenticated decrypt oracle leaking any ciphertext CVE-2026-33512, GHSA-mwjc-5j4x-r686 | High | 0.2% | 20 Mar, 2026 | Packagist wwbn/avideo |
AVideo Affected by CSRF on Plugin Import Endpoint Enables Unauthenticated Remote Code Execution via Malicious Plugin Upload CVE-2026-33507, GHSA-hv36-p4w4-6vmj | High | 0.4% | 20 Mar, 2026 | Packagist wwbn/avideo |
DreamFactory has a directory traversal CVE-2025-55988, GHSA-gv7f-w92j-383q | High | 0.9% | 20 Mar, 2026 | Packagist dreamfactory/df-core |
AVideo has Unauthenticated SSRF via plugin/Live/test.php CVE-2026-33502, GHSA-3fpm-8rjr-v5mc | Critical | 0.4% | 20 Mar, 2026 | Packagist wwbn/avideo |
AVideo has Unauthenticated Information Disclosure of User Group Permission Mappings via Permissions Plugin CVE-2026-33501, GHSA-96qp-8cmq-jvq8 | Medium | 0.4% | 20 Mar, 2026 | Packagist wwbn/avideo |
AVideo - Incomplete Fix for CVE-2026-27568: Stored XSS via Markdown `javascript:` URI Bypasses ParsedownSafeWithLinks Sanitization CVE-2026-33500, GHSA-72h5-39r7-r26j | Medium | 0.2% | 20 Mar, 2026 | Packagist wwbn/avideo |
AVideo has Reflected XSS via unlockPassword Parameter in forbiddenPage.php and warningPage.php CVE-2026-33499, GHSA-7292-w8qp-mhq2 | Medium | 0.2% | 20 Mar, 2026 | Packagist wwbn/avideo |
AVideo has a Path Traversal in import.json.php Allows Private Video Theft and Arbitrary File Read/Deletion via fileURI Parameter CVE-2026-33493, GHSA-83xq-8jxj-4rxm | High | 0.3% | 20 Mar, 2026 | Packagist wwbn/avideo |
AVideo has Session Fixation via GET PHPSESSID Parameter With Disabled Login Session Regeneration CVE-2026-33492, GHSA-x3pr-vrhq-vq43 | High | 0.3% | 20 Mar, 2026 | Packagist wwbn/avideo |
AVideo has a PGP 2FA Bypass via Cryptographically Broken 512-bit RSA Key Generation in LoginControl Plugin CVE-2026-33488, GHSA-6m5f-j7w2-w953 | High | 0.3% | 20 Mar, 2026 | Packagist wwbn/avideo |
AVideo has an Unauthenticated Blind SQL Injection in RTMP on_publish Callback via Stream Name Parameter CVE-2026-33485, GHSA-8p58-35c3-ccxx | High | 0.5% | 20 Mar, 2026 | Packagist wwbn/avideo |
AVideo Affected by Unauthenticated Disk Space Exhaustion via Unlimited Temp File Creation in aVideoEncoderChunk.json.php CVE-2026-33483, GHSA-vv7w-qf5c-734w | High | 0.6% | 20 Mar, 2026 | Packagist wwbn/avideo |
AVideo has an OS Command Injection via $() Shell Substitution Bypass in sanitizeFFmpegCommand() CVE-2026-33482, GHSA-pmj8-r2j7-xg6c | High | 4.3% | 20 Mar, 2026 | Packagist wwbn/avideo |
AVideo has a SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses in Unauthenticated LiveLinks Proxy CVE-2026-33480, GHSA-p3gr-g84w-g8hh | High | 0.3% | 20 Mar, 2026 | Packagist wwbn/avideo |
AVideo has PHP Code Injection via eval() in Gallery saveSort.json.php Exploitable Through CSRF Against Admin CVE-2026-33479, GHSA-xggw-g9pm-9qhh | High | 0.5% | 20 Mar, 2026 | Packagist wwbn/avideo |
AVideo Multi-Chain Attack: Unauthenticated Remote Code Execution via Clone Key Disclosure, Database Dump, and Command Injection CVE-2026-33478, GHSA-687q-32c6-8x68 | Critical | 13.3% | 20 Mar, 2026 | Packagist wwbn/avideo |
The Query Monitor plugin for WordPress has Reflected Cross-Site Scripting via Request URI CVE-2026-4267, GHSA-2xr4-chcf-vmvf | High | 0.3% | 19 Mar, 2026 | Packagist johnbillion/query-monitor |
AVideo has an authenticated arbitrary local file read via `chunkFile` path injection in `aVideoEncoder.json.php` CVE-2026-33354, GHSA-4jw9-5hrc-m4j6 | High | 0.3% | 19 Mar, 2026 | Packagist wwbn/avideo |
AVideo has an Unauthenticated SQL Injection via `doNotShowCats` Parameter (Backslash Escape Bypass) CVE-2026-33352, GHSA-mcj5-6qr4-95fj | Critical | 0.5% | 19 Mar, 2026 | Packagist wwbn/avideo |
AVideo has Unauthenticated SSRF via `webSiteRootURL` Parameter in saveDVR.json.php, Chaining to Verification Bypass CVE-2026-33351, GHSA-5f7v-4f6g-74rj | Critical | 0.4% | 19 Mar, 2026 | Packagist wwbn/avideo |
league/commonmark has an embed extension allowed_domains bypass CVE-2026-33347, GHSA-hh8v-hgvp-g3f5 | Medium | 0.3% | 19 Mar, 2026 | Packagist league/commonmark |
AVideo: IDOR - Any Admin Can Set Another User's Channel Password via setPassword.json.php CVE-2026-33297, GHSA-6547-8hrg-c55m | Medium | 0.4% | 19 Mar, 2026 | Packagist wwbn/avideo |
AVideo has an Open Redirect via Unvalidated redirectUri in userLogin.php CVE-2026-33296, GHSA-hj5h-5623-gwhw | Low | 0.2% | 19 Mar, 2026 | Packagist wwbn/avideo |
AVideo Affected by Stored XSS via Unescaped Video Title in CDN downloadButtons.php CVE-2026-33295, GHSA-gc3m-4mcr-h3pv | High | 0.2% | 19 Mar, 2026 | Packagist wwbn/avideo |
AVideo Affected by SSRF in BulkEmbed Thumbnail Fetch Allows Reading Internal Network Resources CVE-2026-33294, GHSA-66cw-h2mj-j39p | Medium | 0.3% | 19 Mar, 2026 | Packagist wwbn/avideo |
AVideo Affected by Arbitrary File Deletion via Path Traversal in CloneSite deleteDump Parameter CVE-2026-33293, GHSA-xmjm-86qv-g226 | High | 0.5% | 19 Mar, 2026 | Packagist wwbn/avideo |
AVideo has an Authorization Bypass via Path Traversal in HLS Endpoint Allows Streaming Private/Paid Videos CVE-2026-33292, GHSA-pw4v-x838-w5pg | High | 0.7% | 19 Mar, 2026 | Packagist wwbn/avideo |
phpseclib's AES-CBC unpadding susceptible to padding oracle timing attack CVE-2026-32935, GHSA-94g3-g5v7-q4jg | High | 0.4% | 19 Mar, 2026 | Packagist phpseclib/phpseclib |
AVideo has Unauthenticated PGP Message Decryption via Public Endpoint CVE-2026-56346, GHSA-5x2w-37xf-7962 | Medium | 0.6% | 19 Mar, 2026 | Packagist wwbn/avideo |
AVideo has an OS Command Injection via Unescaped URL in LinkedIn Video Upload Shell Command CVE-2026-33319, GHSA-w5ff-2mjc-4phc | High | 0.3% | 19 Mar, 2026 | Packagist wwbn/avideo |
AVideo has a Path Traversal in listFiles.json.php Enables Server Filesystem Enumeration CVE-2026-33238, GHSA-4wmm-6qxj-fpj4 | Medium | 0.4% | 19 Mar, 2026 | Packagist wwbn/avideo |
AVideo has SSRF in Scheduler Plugin via callbackURL Missing `isSSRFSafeURL()` Validation CVE-2026-33237, GHSA-v467-g7g7-hhfh | Medium | 0.4% | 19 Mar, 2026 | Packagist wwbn/avideo |
SimpleJWT has an Unauthenticated Denial of Service via JWE header tampering CVE-2026-33204, GHSA-xw36-67f8-339x | High | 0.5% | 18 Mar, 2026 | Packagist kelvinmo/simplejwt |
Filament Unvalidated Range and Values summarizer values can be used for XSS CVE-2026-33080, GHSA-vv3x-j2x5-36jc | High | 0.3% | 18 Mar, 2026 | Packagist filament/tables |
Statamic is missing authorization check on taxonomy term creation via fieldtype CVE-2026-33177, GHSA-wh3h-gvc4-cc2g | Medium | 0.2% | 18 Mar, 2026 | Packagist statamic/cms |
Statamic has a path traversal in file dictionary fieldtype CVE-2026-33171, GHSA-qm7r-wwq7-6f85 | Medium | 0.4% | 18 Mar, 2026 | Packagist statamic/cms |
Statamic has Stored XSS via SVG Sanitization Bypass CVE-2026-33172, GHSA-7rcv-55mj-chg7 | High | 0.3% | 18 Mar, 2026 | Packagist statamic/cms |
Craft CMS Vulnerable to Stored XSS in Revision Context Menu CVE-2026-33051, GHSA-3x4w-mxpf-fhqq | Medium | 0.3% | 18 Mar, 2026 | Packagist craftcms/cms |
Yoast Duplicate Post has an Authenticated (Contributor+) Missing Authorization to Arbitrary Post Duplication and Overwrite CVE-2026-1217, GHSA-g9w4-m5fx-x3wv | Medium | 0.2% | 18 Mar, 2026 | Packagist yoast/duplicate-post |
AVideo vulnerable to unauthenticated SSRF via HTTP redirect bypass in LiveLinks proxy CVE-2026-33039, GHSA-9x67-f2v7-63rw | High | 0.5% | 17 Mar, 2026 | Packagist wwbn/avideo |
Unauthenticated Reflected XSS via innerHTML in AVideo CVE-2026-33035, GHSA-wfq5-qgqp-hvhv | Medium | 0.3% | 17 Mar, 2026 | Packagist wwbn/avideo |
AVideo affected by Session Hijacking via Unauthenticated Session ID Disclosure with Permissive CORS CVE-2026-33043, GHSA-qc3p-398r-p59j | High | 0.4% | 17 Mar, 2026 | Packagist wwbn/avideo |
AVideo has an Unauthenticated Password Hash Oracle via encryptPass.json.php CVE-2026-33041, GHSA-px7x-gq96-rmp5 | Medium | 0.3% | 17 Mar, 2026 | Packagist wwbn/avideo |
AVideo affected by unauthenticated application takeover via exposed web installer on uninitialized deployments CVE-2026-33038, GHSA-2f9h-23f7-8gcx | High | 0.5% | 17 Mar, 2026 | Packagist wwbn/avideo |
Cockpit CMS has SQL Injection in MongoLite Aggregation Optimizer via toJsonExtractRaw() CVE-2026-31891, GHSA-7x5c-vfhj-9628 | High | 0.4% | 17 Mar, 2026 | Packagist cockpit-hq/cockpit |
Authentication Bypass in extension "E-Mail MFA Provider" (mfa_email) CVE-2026-4208, GHSA-29r8-gvx4-r9w3 | High | 0.3% | 17 Mar, 2026 | Packagist ralffreit/mfa-email |