Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Meta Box Plugin for WordPress: Authenticated (Contributor+) Arbitrary File Deletion via ajax_delete_file CVE-2025-14675, GHSA-m4q3-832v-44j6 | High | 2.4% | 07 Mar, 2026 | Packagist wpmetabox/meta-box |
AVideo has Unauthenticated IDOR - Playlist Information Disclosure CVE-2026-30885, GHSA-6w2r-cfpc-23r5 | Medium | 0.4% | 07 Mar, 2026 | Packagist wwbn/avideo |
Firefly III user API endpoints expose all users' information to any authenticated user (IDOR) GHSA-5q8v-j673-m5v4 | Medium | Not scored | 07 Mar, 2026 | Packagist grumpydictator/firefly-iii |
CommonMark has DisallowedRawHtml extension bypass via whitespace in HTML tag names CVE-2026-30838, GHSA-4v6x-c7xx-hw9f | Medium | 0.2% | 06 Mar, 2026 | Packagist league/commonmark |
TSPortal: Any user can forge self-deletion requests for any account CVE-2026-29788, GHSA-gfhq-7499-f3f2 | High | 0.3% | 06 Mar, 2026 | Packagist miraheze/ts-portal |
Snipe-IT has sensitive user attributes related to account privileges that are insufficiently protected against mass assignment CVE-2025-15602, GHSA-5448-v74m-7mv7 | High | 0.5% | 06 Mar, 2026 | Packagist snipe/snipe-it |
EC-CUBE has a Vulnerability that Allows MFA Bypass in the Administrative Interface GHSA-7rhv-h82h-vpjh | Medium | Not scored | 05 Mar, 2026 | Packagist ec-cube/ec-cube |
Leantime has HTML injection through firstname and lastname fields GHSA-qrfh-cc86-vc8c | Medium | Not scored | 05 Mar, 2026 | Packagist leantime/leantime |
AVideo: Unauthenticated PHP session store exposed to host network via published memcached port CVE-2026-29093, GHSA-xxpw-32hf-q8v9 | Critical | 0.5% | 05 Mar, 2026 | Packagist wwbn/avideo |
Kimai's API invoice endpoint missing customer-level access control (IDOR) CVE-2026-28685, GHSA-v33r-r6h2-8wr7 | Medium | 0.4% | 04 Mar, 2026 | Packagist kimai/kimai |
Craft CMS has unauthenticated activation email trigger with potential user enumeration CVE-2026-29069, GHSA-234q-vvw3-mrfq | High | 0.3% | 04 Mar, 2026 | Packagist craftcms/cms |
Concrete CMS has a stored Cross-site Scripting (XSS) vulnerability CVE-2026-3242, GHSA-w9qg-chfh-g3q9 | Medium | 0.2% | 04 Mar, 2026 | Packagist concrete5/concrete5 |
Concrete CMS has a stored Cross-site Scripting (XSS) vulnerability CVE-2026-3241, GHSA-f4vq-pj32-gr4q | Medium | 0.2% | 04 Mar, 2026 | Packagist concrete5/concrete5 |
Concrete CMS has a stored Cross-site Scripting (XSS) vulnerability CVE-2026-3240, GHSA-45fj-fvmm-xcc5 | Medium | 0.2% | 04 Mar, 2026 | Packagist concrete5/concrete5 |
Concrete CMS vulnerable to Cross-Site Request Forgery (CSRF) CVE-2026-2994, GHSA-6mxw-2vhf-42g5 | Low | 0.2% | 04 Mar, 2026 | Packagist concrete5/concrete5 |
Concrete CMS vulnerable to Remote Code Execution by stored PHP object injection CVE-2026-3452, GHSA-gj26-w59c-29mf | High | 0.6% | 04 Mar, 2026 | Packagist concrete5/concrete5 |
Concrete CMS has a stored Cross-site Scripting (XSS) vulnerability CVE-2026-3244, GHSA-mm5f-5rqw-574f | Medium | 0.2% | 04 Mar, 2026 | Packagist concrete5/concrete5 |
Craft CMS has potential authenticated Remote Code Execution via Twig SSTI CVE-2026-28784, GHSA-qc86-q28f-ggww | High | 0.5% | 03 Mar, 2026 | Packagist craftcms/cms |
Craft CMS has Permission Bypass and IDOR in Duplicate Entry Action CVE-2026-28782, GHSA-jxm3-pmm2-9gf6 | Medium | 0.2% | 03 Mar, 2026 | Packagist craftcms/cms |
Craft CMS has Twig Function Blocklist Bypass CVE-2026-28783, GHSA-5fvc-7894-ghp4 | Critical | 0.5% | 03 Mar, 2026 | Packagist craftcms/cms |
Craft CMS: Entries Authorship Spoofing via Mass Assignment CVE-2026-28781, GHSA-2xfc-g69j-x2mp | High | 0.3% | 03 Mar, 2026 | Packagist craftcms/cms |
Craft CMS Vulnerable to Authenticated RCE via "craft.app.fs.write()" in Twig Templates CVE-2026-28697, GHSA-v47q-jxvr-p68x | Critical | 1.1% | 03 Mar, 2026 | Packagist craftcms/cms |
Craft CMS Vulnerable to Stored XSS in Settings Names and Field Options CVE-2026-56393, GHSA-4mgv-366x-qxvx | Medium | 0.2% | 03 Mar, 2026 | Packagist craftcms/cms |
Craft CMS has IDOR via GraphQL @parseRefs CVE-2026-28696, GHSA-7x43-mpfg-r9wj | High | 0.5% | 03 Mar, 2026 | Packagist craftcms/cms |
Craft CMS Vulnerable to Authenticated RCE via Twig SSTI - create() function + Symfony Process gadget CVE-2026-28695, GHSA-94rc-cqvm-m4pw | High | 0.6% | 03 Mar, 2026 | Packagist craftcms/cms |
WWBN AVideo is vulnerable to unauthenticated OS Command Injection via base64Url in objects/getImage.php CVE-2026-29058, GHSA-9j26-99jh-v26q | Critical | 8.8% | 03 Mar, 2026 | Packagist wwbn/avideo |
OpenSTAManager affected by unauthenticated privilege escalation via modules/utenti/actions.php CVE-2026-27012, GHSA-247v-7cw6-q57v | Critical | 0.6% | 03 Mar, 2026 | Packagist devcode-it/openstamanager |
Froxlor has Admin-to-Root Privilege Escalation via Input Validation Bypass + OS Command Injection CVE-2026-26279, GHSA-33mp-8p67-xj7c | Critical | 0.9% | 03 Mar, 2026 | Packagist froxlor/froxlor |
OpenSTAManager Affected by XSS in modifica_iva.php via righe parameter CVE-2026-24415, GHSA-jfgp-g7x7-j25j | Medium | 0.3% | 03 Mar, 2026 | Packagist devcode-it/openstamanager |
Idno Vulnerable to Remote Code Execution via Chained Import File Write and Template Path Traversal CVE-2026-28507, GHSA-37j7-56xc-c468 | High | 0.7% | 02 Mar, 2026 | Packagist idno/known |
Idno Vulnerable to Unauthenticated SSRF via URL Unfurl Endpoint CVE-2026-28508, GHSA-fcrh-fqxh-6fx6 | Critical | 0.7% | 02 Mar, 2026 | Packagist idno/known |
AVideo has Authenticated Remote Code Execution via Unsafe Plugin ZIP Extraction CVE-2026-28502, GHSA-v8jw-8w5p-23g3 | Critical | 0.7% | 02 Mar, 2026 | Packagist wwbn/avideo |
AVideo has Unauthenticated SQL Injection via JSON Request Bypass in objects/videos.json.php CVE-2026-28501, GHSA-pv87-r9qf-x56p | Critical | 1.6% | 02 Mar, 2026 | Packagist wwbn/avideo |
Statamic vulnerable to privilege escalation via stored cross-site scripting CVE-2026-28426, GHSA-5vrj-wf7v-5wr7 | High | 0.3% | 27 Feb, 2026 | Packagist statamic/cms |
Statamic vulnerable to remote code execution via Antlers-enabled control panel inputs CVE-2026-28425, GHSA-cpv7-q2wx-m8rw | High | 0.5% | 27 Feb, 2026 | Packagist statamic/cms |
Statamic's missing authorization allows access to email addresses CVE-2026-28424, GHSA-w878-f8c6-7r63 | Medium | 0.3% | 27 Feb, 2026 | Packagist statamic/cms |
Statamic Vulnerable to Server-Side Request Forgery via Glide CVE-2026-28423, GHSA-cwpp-325q-2cvp | High | 0.4% | 27 Feb, 2026 | Packagist statamic/cms |
Statamic allows Authenticated Control Panel users to escalate privileges via elevated session bypass CVE-2026-27939, GHSA-rw9x-pxqx-q789 | High | 0.4% | 27 Feb, 2026 | Packagist statamic/cms |
phpMyFAQ Allows Unauthenticated Account Creation via WebAuthn Prepare Endpoint CVE-2026-27836, GHSA-w22q-m2fm-x9f4 | High | 0.5% | 27 Feb, 2026 | Packagist thorsten/phpmyfaq |
Craft CMS has Stored XSS in Table Field in its "Row Heading" Column Type CVE-2026-56383, GHSA-6j87-m5qx-9fqp | Medium | 0.2% | 25 Feb, 2026 | Packagist craftcms/cms |
TypiCMS Core has Stored Cross-Site Scripting (XSS) via SVG File Upload CVE-2026-27621, GHSA-xfvg-8v67-j7wp | Medium | 0.2% | 25 Feb, 2026 | Packagist typicms/core |
Statamic is vulnerable to account takeover via password reset link injection CVE-2026-27593, GHSA-jxq9-79vj-rgvw | Critical | 0.5% | 24 Feb, 2026 | Packagist statamic/cms |
Mautic is Vulnerable to SQL Injection through Contact Activity API Sorting CVE-2026-3105, GHSA-r5j5-q42h-fc93 | High | 0.3% | 24 Feb, 2026 | Packagist mautic/core |
AVideo has Authenticated Server-Side Request Forgery via downloadURL in aVideoEncoder.json.php CVE-2026-27732, GHSA-h39h-7cvg-q7j6 | High | 0.3% | 24 Feb, 2026 | Packagist wwbn/avideo |
Pimcore vulnerable to SQL injection via unsanitized filter value in Dependency Dao RLIKE clause CVE-2026-27461, GHSA-vxg3-v4p6-f3fp | Medium | 0.5% | 24 Feb, 2026 | Packagist pimcore/pimcore |
Craft CMS: Cloud Metadata SSRF Protection Bypass via IPv6 Resolution CVE-2026-27129, GHSA-v2gc-rm6g-wrw9 | Medium | 0.5% | 24 Feb, 2026 | Packagist craftcms/cms |
Craft CMS Race condition in Token Service potentially allows for token usage greater than the token limit CVE-2026-27128, GHSA-6fx5-5cw5-4897 | Medium | 0.2% | 23 Feb, 2026 | Packagist craftcms/cms |
Craft CMS has Cloud Metadata SSRF Protection Bypass via DNS Rebinding CVE-2026-27127, GHSA-gp2f-7wcm-5fhx | High | 0.5% | 23 Feb, 2026 | Packagist craftcms/cms |
Craft CMS has Stored XSS in Table Field via "HTML" Column Type CVE-2026-27126, GHSA-3jh3-prx3-w6wc | Medium | 0.2% | 23 Feb, 2026 | Packagist craftcms/cms |
funadmin: Deserialization Vulnerability in Backend Endpoint via AuthCloudService getMember Function CVE-2026-2898, GHSA-gcxp-xg77-798j | Low | 0.3% | 22 Feb, 2026 | Packagist funadmin/funadmin |