Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
funadmin: XSS through Value argument in Backend Interface component CVE-2026-2897, GHSA-rfh7-7v27-6p9r | Low | 0.2% | 22 Feb, 2026 | Packagist funadmin/funadmin |
funadmin has Incorrect Privilege Assignment in its Configuration Handler CVE-2026-2896, GHSA-5m2g-4cf6-c3rg | Medium | 0.3% | 22 Feb, 2026 | Packagist funadmin/funadmin |
funadmin has Weak Password Recovery Mechanism for Forgotten Password CVE-2026-2895, GHSA-fmr2-m7gc-577w | Low | 0.5% | 21 Feb, 2026 | Packagist funadmin/funadmin |
funadmin exposes sensitive information via getMember function CVE-2026-2894, GHSA-8hhx-xq9j-xwfj | Medium | 0.5% | 21 Feb, 2026 | Packagist funadmin/funadmin |
Moodle TeX formula editor is vulnerable to DoS through lack of execution time limits BIT-moodle-2026-26047, CVE-2026-26047, GHSA-cg8j-5cr2-568q | Medium | 0.5% | 21 Feb, 2026 | Packagist moodle/moodle |
Moodle has a Remote Code Execution risk via file restore BIT-moodle-2026-26045, CVE-2026-26045, GHSA-ggxq-2mg9-8966 | High | 0.6% | 21 Feb, 2026 | Packagist moodle/moodle |
AVideo has Stored Cross-Site Scripting via Markdown Comment Injection CVE-2026-27568, GHSA-rcqw-6466-3mv7 | Medium | 0.3% | 20 Feb, 2026 | Packagist wwbn/avideo |
Zumba Json Serializer has a potential PHP Object Injection via Unrestricted @type in unserialize() CVE-2026-27206, GHSA-v7m3-fpcr-h7m2 | High | 0.8% | 19 Feb, 2026 | Packagist zumba/json-serializer |
Formwork Improperly Managed Privileges in User creation CVE-2026-27198, GHSA-34p4-7w83-35g2 | High | 0.5% | 19 Feb, 2026 | Packagist getformwork/formwork |
Statamic affected by privilege escalation via stored cross-site scripting CVE-2026-27196, GHSA-8r7r-f4gm-wcpq | High | 0.3% | 19 Feb, 2026 | Packagist statamic/cms |
LibreNMS has a Time-Based Blind SQL Injection in address-search.inc.php CVE-2026-26990, GHSA-79q9-wc6p-cf92 | High | 4.5% | 18 Feb, 2026 | Packagist librenms/librenms |
LibreNMS has a Stored XSS in Alert Rule CVE-2026-26989, GHSA-6xmx-xr9p-58p7 | Medium | 0.3% | 18 Feb, 2026 | Packagist librenms/librenms |
LibreNMS: SQL Injection in ajax_table.php spreads through a covert data stream. CVE-2026-26988, GHSA-h3rv-q4rq-pqcv | Critical | 8.4% | 18 Feb, 2026 | Packagist librenms/librenms |
LibreNMS has a Stored XSS in Custom OID - unit parameter missing strip_tags() CVE-2026-27016, GHSA-fqx6-693c-f55g | Medium | 0.3% | 18 Feb, 2026 | Packagist librenms/librenms |
LibreNMS /port-groups name Stored Cross-Site Scripting CVE-2026-26992, GHSA-93fx-g747-695x | Medium | 0.3% | 18 Feb, 2026 | Packagist librenms/librenms |
LibreNMS /device-groups name Stored Cross-Site Scripting CVE-2026-26991, GHSA-5pqf-54qp-32wx | Medium | 0.3% | 18 Feb, 2026 | Packagist librenms/librenms |
LibreNMS affected by reflected xss via email field CVE-2026-26987, GHSA-gqx7-99jw-6fpr | Medium | 0.3% | 18 Feb, 2026 | Packagist librenms/librenms |
Pterodactyl Panel Allows Cross-Node Server Configuration Disclosure via Remote API Missing Authorization CVE-2026-26016, GHSA-g7vw-f8p5-c728 | Critical | 0.4% | 17 Feb, 2026 | Packagist pterodactyl/panel |
Pterodactyl Panel's SFTP sessions remain active after user account deletion or password change GHSA-hr7j-63v7-vj7g, GO-2026-4497 | High | Not scored | 17 Feb, 2026 | Go github.com/pterodactyl/wings Packagist pterodactyl/panel |
ImapEngine affected by command injection via the ID command parameters CVE-2026-2469, GHSA-rfq9-4wcm-64gh | Medium | 0.4% | 14 Feb, 2026 | Packagist directorytree/imapengine |
Known affected by Account Takeover via Password Reset Token Leakage CVE-2026-26273, GHSA-78wq-6gcv-w28r | Critical | 1.0% | 13 Feb, 2026 | Packagist idno/known |
MagicLink: Insecure Deserialization of MagicLink Actions Leads to Remote Code Execution CVE-2026-61701, GHSA-r33w-fg8j-9c94 | High | 0.8% | 12 Feb, 2026 | Packagist cesargb/laravel-magiclink |
Statamic CMS vulnerable to privilege escalation via stored cross-site scripting CVE-2026-25759, GHSA-ff9r-ww9c-43x8 | High | 0.3% | 11 Feb, 2026 | Packagist statamic/cms |
Statamic CMS's missing authorization allows access to assets CVE-2026-25633, GHSA-gwmx-9gcj-332h | Medium | 0.3% | 11 Feb, 2026 | Packagist statamic/cms |
Kimai 2 vulnerable to persistent cross-site scripting in the timesheet descriptions CVE-2019-25317, GHSA-9278-6hcj-2p4j | Medium | 0.3% | 11 Feb, 2026 | Packagist kimai/kimai |
Phraseanet vulnerable to stored cross-site scripting through crafted file names CVE-2018-25157, GHSA-gcpq-mrgg-v5f3 | Medium | 0.3% | 11 Feb, 2026 | Packagist phraseanet/phraseanet |
amphp/http-server affected by HTTP/2 DDoS vulnerability GHSA-8grv-jq2g-cfhw | Medium | Not scored | 10 Feb, 2026 | Packagist amphp/http-server |
Adminer has an Unauthenticated Persistent DoS via Array Injection in ?script=version Endpoint CVE-2026-25892, GHSA-q4f2-39gr-45jh | High | 1.7% | 09 Feb, 2026 | Packagist vrana/adminer |
FroshAdminer Adminer UI is accessible without admin session CVE-2026-25878, GHSA-f339-246p-wwjp | Medium | 0.4% | 09 Feb, 2026 | Packagist frosh/adminer-platform |
Craft CMS Vulnerable to potential authenticated Remote Code Execution via malicious attached Behavior CVE-2026-25498, GHSA-7jx7-3846-m7w7 | High | 1.1% | 09 Feb, 2026 | Packagist craftcms/cms |
Craft CMS: GraphQL Asset Mutation Privilege Escalation CVE-2026-25497, GHSA-fxp3-g6gw-4r4v | High | 0.5% | 09 Feb, 2026 | Packagist craftcms/cms |
Craft CMS Vulnerable to Stored XSS in Number Prefix & Suffix Fields CVE-2026-25496, GHSA-9f5h-mmq6-2x78 | Medium | 0.4% | 09 Feb, 2026 | Packagist craftcms/cms |
Craft CMS Vulnerable to SQL Injection in Element Indexes via `criteria[orderBy]` CVE-2026-25495, GHSA-2453-mppf-46cj | High | 0.6% | 09 Feb, 2026 | Packagist craftcms/cms |
Craft CMS Vulnerable to SSRF in GraphQL Asset Mutation via Alternative IP Notation CVE-2026-25494, GHSA-m5r2-8p9x-hp5m | Medium | 0.4% | 09 Feb, 2026 | Packagist craftcms/cms |
Craft CMS Vulnerable to SSRF in GraphQL Asset Mutation via HTTP Redirect CVE-2026-25493, GHSA-8jr8-7hr4-vhfx | Medium | 0.4% | 09 Feb, 2026 | Packagist craftcms/cms |
Craft CMS: save_images_Asset graphql mutation can be abused to exfiltrate AWS credentials of underlying host CVE-2026-25492, GHSA-96pq-hxpw-rgh8 | Medium | 0.5% | 09 Feb, 2026 | Packagist craftcms/craft |
Craft CMS Vulnerable to Stored XSS in Entry Types Name CVE-2026-25491, GHSA-7pr4-wx9w-mqwr | Low | 0.4% | 09 Feb, 2026 | Packagist craftcms/cms |
OpenSTAManager has a SQL Injection vulnerability in the Scadenzario bulk operations module CVE-2026-24418, GHSA-4xwv-49c8-fvhq | High | 0.4% | 06 Feb, 2026 | Packagist devcode-it/openstamanager |
OpenSTAManager has a Time-Based Blind SQL Injection with Amplified Denial of Service CVE-2026-24417, GHSA-4hc4-8599-xh2h | High | 0.4% | 06 Feb, 2026 | Packagist devcode-it/openstamanager |
OpenSTAManager has a Time-Based Blind SQL Injection in Article Pricing Module CVE-2026-24416, GHSA-p864-fqgv-92q4 | High | 0.4% | 06 Feb, 2026 | Packagist devcode-it/openstamanager |
OpenSTAManager has a SQL Injection in the Prima Nota module CVE-2026-24419, GHSA-4j2x-jh4m-fqv6 | High | 0.4% | 06 Feb, 2026 | Packagist devcode-it/openstamanager |
OpenSTAManager has a SQL Injection in Scadenzario Print Template CVE-2025-69216, GHSA-q6g3-fv43-m2w6 | High | 0.4% | 06 Feb, 2026 | Packagist devcode-it/openstamanager |
OpenSTAManager has a SQL Injection in ajax_select.php (componenti endpoint) CVE-2025-69214, GHSA-qjv8-63xq-gq8m | High | 0.5% | 06 Feb, 2026 | Packagist devcode-it/openstamanager |
OpenSTAManager has an OS Command Injection in P7M File Processing CVE-2025-69212, GHSA-25fp-8w8p-mx36 | Critical | 1.9% | 06 Feb, 2026 | Packagist devcode-it/openstamanager |
Microweber Cross-site Scripting vulnerability CVE-2025-70792, GHSA-6w5w-jx4x-vjvw | Medium | 0.3% | 05 Feb, 2026 | Packagist microweber/microweber |
Microweber has a Cross-site Scripting vulnerability CVE-2025-70791, GHSA-5jg5-xqfw-rv92 | Medium | 0.3% | 05 Feb, 2026 | Packagist microweber/microweber |
Winter CMS has Stored Cross-site Scripting (XSS) in Asset Manager CVE-2026-22254, GHSA-m7gw-rffq-rxjm | Low | 0.3% | 04 Feb, 2026 | Packagist winter/wn-cms-module |
PrestaShop affected by time based enumeration in FO login form CVE-2026-25597, GHSA-67v7-3g49-mxh2 | Medium | 0.3% | 03 Feb, 2026 | Packagist prestashop/prestashop |
OpenSTAManager has an SQL Injection in the Stampe Module CVE-2025-69215, GHSA-qx9p-w3vj-q24q | High | 0.4% | 03 Feb, 2026 | Packagist devcode-it/openstamanager |
OpenSTAManager has a SQL Injection in ajax_complete.php (get_sedi endpoint) CVE-2025-69213, GHSA-w995-ff8h-rppg | High | 0.4% | 03 Feb, 2026 | Packagist devcode-it/openstamanager |