Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Broken Access Control in extension "Redirect Tab" (redirect_tab) CVE-2026-4202, GHSA-755r-r738-mjgp | Low | 0.2% | 17 Mar, 2026 | Packagist ayacoo/redirect-tab |
The mailqueue TYPO3 extension has Insecure Deserialization in `TransportFailure` class CVE-2026-1323, GHSA-2pm6-9fhx-vvg3 | Medium | 0.2% | 17 Mar, 2026 | Packagist cpsit/typo3-mailqueue |
Admidio has a Second-Order SQL Injection via List Configuration (lsc_special_field, lsc_sort, lsc_filter) CVE-2026-32813, GHSA-3x67-4c2c-w45m | High | 0.3% | 16 Mar, 2026 | Packagist admidio/admidio |
Admidio is Missing Authorization on Forum Topic and Post Deletion CVE-2026-32818, GHSA-g375-5wmp-xr78 | Medium | 0.2% | 16 Mar, 2026 | Packagist admidio/admidio |
Admidio has an HTMLPurifier Bypass in eCard Message Allows HTML Email Injection CVE-2026-32757, GHSA-4wr4-f2qf-x5wj | Medium | 0.2% | 16 Mar, 2026 | Packagist admidio/admidio |
Admidio is Missing Authorization and CSRF Protection on Document and Folder Deletion CVE-2026-32817, GHSA-rmpj-3x5m-9m5f | Critical | 0.3% | 16 Mar, 2026 | Packagist admidio/admidio |
Admidio Vulnerable to SSRF and Local File Read via Unrestricted URL Fetch in SSO Metadata Endpoint CVE-2026-32812, GHSA-6j68-gcc3-mq73 | Medium | 0.4% | 16 Mar, 2026 | Packagist admidio/admidio |
Admidio is Missing CSRF Protection on Role Membership Date Changes CVE-2026-32755, GHSA-h8gr-qwr6-m9gx | Medium | 0.2% | 16 Mar, 2026 | Packagist admidio/admidio |
Admidio is Missing CSRF Validation on Role Delete, Activate, and Deactivate Actions CVE-2026-32816, GHSA-wwg8-6ffr-h4q2 | Medium | 0.1% | 16 Mar, 2026 | Packagist admidio/admidio |
File Upload(RCE) Vulnerability in admidio CVE-2026-32756, GHSA-95cq-p4w2-32w5 | High | 1.0% | 16 Mar, 2026 | Packagist admidio/admidio |
Azure Blob Storage for Craft CMS Potential Sensitive Information Disclosure vulnerability CVE-2026-32268, GHSA-q6fm-p73f-x862 | High | 0.4% | 16 Mar, 2026 | Packagist craftcms/azure-blob |
Craft CMS Vulnerable to Privilege Escalation/Bypass through UsersController->actionImpersonateWithToken() CVE-2026-32267, GHSA-cc7p-2j3x-x7xf | High | 9.4% | 16 Mar, 2026 | Packagist craftcms/cms |
Google Cloud Storage for Craft CMS has an Information Disclosure Vulnerability CVE-2026-32266, GHSA-67cr-jmh8-4jpq | Low | 0.4% | 16 Mar, 2026 | Packagist craftcms/google-cloud |
Amazon S3 for Craft CMS has an Information Disclosure vulnerability CVE-2026-32265, GHSA-hwj7-4vgc-j3v9 | Medium | 0.4% | 16 Mar, 2026 | Packagist craftcms/aws-s3 |
Craft CMS vulnerable to behavior injection RCE ElementIndexesController and FieldsController CVE-2026-32264, GHSA-4484-8v2f-5748 | High | 0.5% | 16 Mar, 2026 | Packagist craftcms/cms |
Craft CMS vulnerable to behavior injection RCE via EntryTypesController CVE-2026-32263, GHSA-qx2q-q59v-wf3j | High | 0.5% | 16 Mar, 2026 | Packagist craftcms/cms |
Craft CMS has a Path Traversal Vulnerability in AssetsController CVE-2026-32262, GHSA-472v-j2g4-g9h2 | Medium | 0.3% | 16 Mar, 2026 | Packagist craftcms/cms |
RCE via SSTI for users with permissions to access the Craft CMS Webhooks plugin CVE-2026-32261, GHSA-8wg7-wm29-2rvg | High | 0.4% | 16 Mar, 2026 | Packagist craftcms/webhooks |
Aureus ERP vulnerable to cross-site scripting in the Chatter Message Handler CVE-2026-4175, GHSA-76c2-3q6g-xvpm | Medium | 0.3% | 16 Mar, 2026 | Packagist aureuserp/aureuserp |
simplesamlphp/xml-security: Missing AES-GCM Authentication Tag Validation on Encrypted Nodes Allows for Unauthorized Decryption CVE-2026-32600, GHSA-r353-4845-pr5p | High | 0.2% | 13 Mar, 2026 | Packagist simplesamlphp/xml-security |
xmlseclibs: Missing AES-GCM Authentication Tag Validation on Encrypted Nodes Allows for Unauthorized Decryption CVE-2026-32313, GHSA-4v26-v6cg-g6f9 | High | 0.2% | 13 Mar, 2026 | Packagist robrichards/xmlseclibs |
Statamic vulnerable to privilege escalation via stored cross-site scripting CVE-2026-32612, GHSA-hcch-w73c-jp4m | Medium | 0.2% | 13 Mar, 2026 | Packagist statamic/cms |
Winter vulnerable to privilege escalation by authenticated backend users CVE-2026-27591, GHSA-pgpf-m8m4-6cg6 | Critical | 0.7% | 11 Mar, 2026 | Packagist winter/wn-backend-module |
Shopware vulnerable to a potential take over of app credentials CVE-2026-31889, GHSA-c4p7-rwrg-pf6p | High | 0.3% | 11 Mar, 2026 | Packagist shopware/core Packagist shopware/platform |
Shopware has user enumeration via distinct error codes on Store API login endpoint CVE-2026-31888, GHSA-gqc5-xv7m-gcjq | Medium | 0.2% | 11 Mar, 2026 | Packagist shopware/core Packagist shopware/platform |
Shopware: Unauthenticated data extraction possible through store-api.order endpoint CVE-2026-31887, GHSA-7vvp-j573-5584 | High | 0.2% | 11 Mar, 2026 | Packagist shopware/core Packagist shopware/platform |
Craft CMS Vulnerable to Stored XSS via User Group Name in User Permissions Page CVE-2026-56381, GHSA-g3hp-vvqf-8vw6 | Medium | 0.2% | 11 Mar, 2026 | Packagist craftcms/cms |
CraftCMS has an RCE vulnerability via relational conditionals in the control panel CVE-2026-31857, GHSA-fp5j-j7j4-mcxc | High | 0.9% | 11 Mar, 2026 | Packagist craftcms/cms |
CraftCMS's `ElementSearchController` Affected by Blind SQL Injection CVE-2026-31858, GHSA-g7j6-fmwx-7vp8 | High | 0.4% | 11 Mar, 2026 | Packagist craftcms/cms |
CraftCMS vulnerable to reflective XSS via incomplete return URL sanitization CVE-2026-31859, GHSA-fvwq-45qv-xvhv | Medium | 0.2% | 11 Mar, 2026 | Packagist craftcms/cms |
Sylius has a DQL Injection via API Order Filters CVE-2026-31825, GHSA-xcwx-r2gw-w93m | Medium | 0.2% | 10 Mar, 2026 | Packagist sylius/sylius |
Sylius has a Promotion Usage Limit Bypass via Race Condition CVE-2026-31824, GHSA-7mp4-25j8-hp5q | High | 0.2% | 10 Mar, 2026 | Packagist sylius/sylius |
Sylius Vulnerable to Authenticated Stored XSS CVE-2026-31823, GHSA-mx4q-xxc9-pf5q | Medium | 0.2% | 10 Mar, 2026 | Packagist sylius/sylius |
Sylius has a XSS vulnerability in checkout login form CVE-2026-31822, GHSA-vgh8-c6fp-7gcg | Medium | 0.2% | 10 Mar, 2026 | Packagist sylius/sylius |
Sylius is Missing Authorization in API v2 Add Item Endpoint CVE-2026-31821, GHSA-wjmg-4cq5-m8hg | Medium | 0.2% | 10 Mar, 2026 | Packagist sylius/sylius |
Sylius affected by IDOR in Cart and Checkout LiveComponents CVE-2026-31820, GHSA-2xc6-348p-c2x6 | High | 0.3% | 10 Mar, 2026 | Packagist sylius/sylius |
Sylius has an Open Redirect via Referer Header CVE-2026-31819, GHSA-9ffx-f77r-756w | Medium | 0.2% | 10 Mar, 2026 | Packagist sylius/sylius |
Craft Commerce: Potential IDOR in Commerce carts CVE-2026-31867, GHSA-vff3-pqq8-4cpq | Medium | 0.3% | 10 Mar, 2026 | Packagist craftcms/commerce |
Craft Commerce has stored XSS in Craft Commerce Order Details Slideout CVE-2026-29177, GHSA-mj32-r678-7mvp | Low | 0.2% | 10 Mar, 2026 | Packagist craftcms/commerce |
Craft Commerce has stored XSS in Inventory Location Name CVE-2026-29176, GHSA-wj89-2385-gpx3 | Medium | 0.2% | 10 Mar, 2026 | Packagist craftcms/commerce |
Craft Commerce has multiple Stored XSS in Commerce Inventory Page, Leading to Session Hijacking CVE-2026-29175, GHSA-cfpv-rmpf-f624 | High | 0.2% | 10 Mar, 2026 | Packagist craftcms/commerce |
Craft Commerce is vulnerable to SQL Injection in Commerce Inventory Table Sorting CVE-2026-29174, GHSA-pmgj-gmm4-jh6j | High | 0.5% | 10 Mar, 2026 | Packagist craftcms/commerce |
Craft Commerce is Vulnerable to Stored XSS while updating Order Status from Orders Table CVE-2026-29173, GHSA-mqxf-2998-c6cp | Low | 0.3% | 10 Mar, 2026 | Packagist craftcms/commerce |
Craft Commerce is Vulnerable to SQL Injection in Commerce Purchasables Table Sorting CVE-2026-29172, GHSA-j3x5-mghf-xvfw | High | 0.4% | 10 Mar, 2026 | Packagist craftcms/commerce |
Craft CMS has a potential information disclosure vulnerability in preview tokens CVE-2026-29113, GHSA-vg3j-hpm9-8v5v | Low | 0.2% | 10 Mar, 2026 | Packagist craftcms/cms |
LimeSurvey is vulnerable to SQL injection CVE-2025-56421, GHSA-rccq-2fxq-7x3h | High | 0.5% | 10 Mar, 2026 | Packagist limesurvey/limesurvey |
Webauthn Framework: allowed_origins collapses URL-like origins to host-only values, bypassing exact origin validation CVE-2026-30964, GHSA-f7pm-6hr8-7ggm | Medium | 0.2% | 10 Mar, 2026 | Packagist web-auth/webauthn-framework Packagist web-auth/webauthn-lib Packagist web-auth/webauthn-symfony-bundle |
flarum/nicknames extension has display name injection in notification emails (autolink & markdown) CVE-2026-30913, GHSA-3c4m-j3g4-hh25 | Medium | 0.2% | 10 Mar, 2026 | Packagist flarum/nicknames |
AzuraCast: RCE via Liquidsoap string interpolation injection in station metadata and playlist URLs CVE-2026-100857, GHSA-93fx-5qgc-wr38 | High | 0.4% | 09 Mar, 2026 | Packagist azuracast/azuracast |
Admidio: Event participation IDOR - non-leaders can register other users for events via user_uuid parameter CVE-2026-30927, GHSA-7pfv-hr63-h7cw | Medium | 0.3% | 09 Mar, 2026 | Packagist admidio/admidio |