Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
FacturaScripts has SQL Injection in Autocomplete Actions CVE-2026-25514, GHSA-pqqg-5f4f-8952 | High | 0.5% | 03 Feb, 2026 | Packagist facturascripts/facturascripts |
FacturaScripts has SQL Injection in API ORDER BY Clause CVE-2026-25513, GHSA-cjfx-qhwm-hf99 | High | 0.5% | 03 Feb, 2026 | Packagist facturascripts/facturascripts |
Moodle Inserts Sensitive Information Into Sent Data BIT-moodle-2025-67857, CVE-2025-67857, GHSA-8jrv-wx83-w3xj | Medium | 0.4% | 03 Feb, 2026 | Packagist moodle/moodle |
Moodle has an authorization logic flaw BIT-moodle-2025-67856, CVE-2025-67856, GHSA-hcm6-q6pc-xfhm | Critical | 0.3% | 03 Feb, 2026 | Packagist moodle/moodle |
Moodle vulnerable to Cross-site Scripting BIT-moodle-2025-67855, CVE-2025-67855, GHSA-vwhw-vp9v-q9c9 | Medium | 0.4% | 03 Feb, 2026 | Packagist moodle/moodle |
Moodle Affected by Improper Restriction of Excessive Authentication Attempts BIT-moodle-2025-67853, CVE-2025-67853, GHSA-5cx4-w4fh-fr57 | High | 0.5% | 03 Feb, 2026 | Packagist moodle/moodle |
Moodle Open Redirect vulnerability BIT-moodle-2025-67852, CVE-2025-67852, GHSA-qv78-6gpp-hm68 | Medium | 0.3% | 03 Feb, 2026 | Packagist moodle/moodle |
Moodle formula injection vulnerability BIT-moodle-2025-67851, CVE-2025-67851, GHSA-qfh6-h7j6-fvjv | High | 0.3% | 03 Feb, 2026 | Packagist moodle/moodle |
Moodle vulnerable to Cross-site Scripting BIT-moodle-2025-67850, CVE-2025-67850, GHSA-6mmv-f6c6-v6q8 | High | 0.3% | 03 Feb, 2026 | Packagist moodle/moodle |
Moodle Cross-site Scripting (XSS) vulnerability BIT-moodle-2025-67849, CVE-2025-67849, GHSA-mhf6-pp52-8wqj | High | 0.3% | 03 Feb, 2026 | Packagist moodle/moodle |
Moodle authentication bypass vulnerability BIT-moodle-2025-67848, CVE-2025-67848, GHSA-j5jv-w5cw-j9ff | High | 0.4% | 03 Feb, 2026 | Packagist moodle/moodle |
Subrion CMS vulnerable to cross-site scripting CVE-2025-70958, GHSA-9jjm-mc56-3qxv | Medium | 0.3% | 02 Feb, 2026 | Packagist intelliants/subrion |
Magento's X-Original-Url header can expose admin url CVE-2026-25523, GHSA-jg68-vhv3-9r8f | Medium | 0.3% | 02 Feb, 2026 | Packagist openmage/magento-lts |
Craft Commerce has Stored XSS in Shipping Zone (Name & Description) Fields Leading to Potential Privilege Escalation CVE-2026-25522, GHSA-h9r9-2pxg-cx9m | Medium | 0.3% | 02 Feb, 2026 | Packagist craftcms/commerce |
Craft Commerce has Stored XSS in Inventory Location Address Leading to Potential Privilege Escalation CVE-2026-25490, GHSA-wq2m-r96q-crrf | Medium | 0.3% | 02 Feb, 2026 | Packagist craftcms/commerce |
Craft Commerce has Stored XSS in Tax Zones (Name & Description) Leading to Potential Privilege Escalation CVE-2026-25489, GHSA-v585-mf6r-rqrc | Medium | 0.3% | 02 Feb, 2026 | Packagist craftcms/commerce |
Craft Commerce has Stored XSS in Tax Categories (Name & Description) Fields Leading to Potential Privilege Escalation CVE-2026-25488, GHSA-p6w8-q63m-72c8 | Medium | 0.3% | 02 Feb, 2026 | Packagist craftcms/commerce |
Craft CMS has Stored XSS in Tax Rates Name Leading to Potential Privilege Escalation CVE-2026-25487, GHSA-wqc5-485v-3hqh | Medium | 0.3% | 02 Feb, 2026 | Packagist craftcms/commerce |
Craft Commerce has Stored XSS in Shipping Methods Name Field Leading to Potential Privilege Escalation CVE-2026-25486, GHSA-g92v-wpv7-6w22 | Medium | 0.3% | 02 Feb, 2026 | Packagist craftcms/commerce |
Craft Commerce has Stored XSS in Shipping Categories (Name & Description) Fields Leading to Potential Privilege Escalation CVE-2026-25485, GHSA-w8gw-qm8p-j9j3 | Medium | 0.3% | 02 Feb, 2026 | Packagist craftcms/composer |
Craft Commerce has Stored XSS in Product Type Name CVE-2026-25484, GHSA-2h2m-v2mg-656c | Medium | 0.3% | 02 Feb, 2026 | Packagist craftcms/commerce |
Craft Commerce has Stored XSS via Order Status Message with potential database exfiltration CVE-2026-25483, GHSA-8478-rmjg-mjj5 | Medium | 0.3% | 02 Feb, 2026 | Packagist craftcms/commerce |
Craft Commerce has Stored DOM XSS in Order Status Name (Reflects in "Recent Orders" Dashboard Widget) CVE-2026-25482, GHSA-frj9-9rwc-pw9j | Medium | 0.4% | 02 Feb, 2026 | Packagist craftcms/commerce |
CI4MS Vulnerable to Remote Code Execution (RCE) via Arbitrary File Creation and Save in File Editor CVE-2026-25510, GHSA-gp56-f67f-m4px | Critical | 0.9% | 02 Feb, 2026 | Packagist ci4-cms-erp/ci4ms |
CI4MS Vulnerable to User Email Enumeration via Password Reset Flow CVE-2026-25509, GHSA-654x-9q7r-g966 | Medium | 0.4% | 02 Feb, 2026 | Packagist ci4-cms-erp/ci4ms |
FacturaScripts has Stored Cross-Site Scripting (XSS) in "Observations" field via History View CVE-2026-23997, GHSA-4v7v-7v7r-3r5h | Critical | 0.4% | 02 Feb, 2026 | Packagist facturascripts/facturascripts |
FacturaScripts is Vulnerable to Reflected XSS CVE-2026-23476, GHSA-g6w2-q45f-xrp4 | Medium | 0.3% | 02 Feb, 2026 | Packagist facturascripts/facturascripts |
RaspAP raspap-webgui contains an OS Command Injection vulnerability CVE-2026-24788, GHSA-4wwf-f7w3-94f5 | High | 1.4% | 02 Feb, 2026 | Packagist billz/raspap-webgui |
PsySH has Local Privilege Escalation via CWD .psysh.php auto-load CVE-2026-25129, GHSA-4486-gxhx-5mg7 | High | 0.3% | 30 Jan, 2026 | Packagist psy/psysh |
Symfony's incorrect argument escaping under MSYS2/Git Bash can lead to destructive file operations on Windows CVE-2026-24739, GHSA-r39x-jcww-82v6 | Medium | 0.2% | 28 Jan, 2026 | Packagist symfony/process Packagist symfony/symfony |
EGroupware has SQL Injection in Nextmatch Filter Processing CVE-2026-22243, GHSA-rvxj-7f72-mhrx | High | 0.4% | 28 Jan, 2026 | Packagist egroupware/egroupware |
PHPUnit Vulnerable to Unsafe Deserialization in PHPT Code Coverage Handling CVE-2026-24765, GHSA-vvj3-c3rp-c85p | High | 0.4% | 27 Jan, 2026 | Packagist phpunit/phpunit |
LibreNMS contains an authenticated SQL Injection vulnerability CVE-2020-36947, GHSA-qp2j-v5jg-hg68 | High | 0.5% | 27 Jan, 2026 | Packagist librenms/librenms |
phpMyFAQ: Public API endpoints expose emails and invisible questions CVE-2026-24422, GHSA-j4rc-96xj-gvqc | High | 0.4% | 23 Jan, 2026 | Packagist phpmyfaq/phpmyfaq Packagist thorsten/phpmyfaq |
phpMyFAQ: /api/setup/backup accessible to any authenticated user (authz missing) CVE-2026-24421, GHSA-wm8h-26fv-mg7g | Medium | 1.7% | 23 Jan, 2026 | Packagist phpmyfaq/phpmyfaq Packagist thorsten/phpmyfaq |
phpMyFAQ: Attachment download allowed without dlattachment right (broken access control) CVE-2026-24420, GHSA-7p9h-m7m8-vhhv | Medium | 0.5% | 23 Jan, 2026 | Packagist phpmyfaq/phpmyfaq Packagist thorsten/phpmyfaq |
LavaLite CMS affected by a stored cross-site scripting vulnerability CVE-2025-71177, GHSA-w7rq-fgx4-4xcm | Medium | 0.2% | 23 Jan, 2026 | Packagist lavalite/cms |
Moodle affected by a code injection vulnerability BIT-moodle-2025-67847, CVE-2025-67847, GHSA-xvmh-25jw-gmmm | High | 0.6% | 23 Jan, 2026 | Packagist moodle/moodle |
Freeform Craft Plugin CP UI (builder/integrations) has Stored Cross-Site Scripting (XSS) issue CVE-2026-26188, GHSA-jp3q-wwp3-pwv9 | Medium | 0.3% | 22 Jan, 2026 | Packagist solspace/craft-freeform |
phpPgAdmin contains a remote command execution vulnerability CVE-2021-47853, GHSA-86gh-c8r8-xwhq | High | Not scored | 21 Jan, 2026 | Packagist phppgadmin/phppgadmin |
CoreShop Vulnerable to SQL Injection via Admin customer-company-modifier CVE-2026-23959, GHSA-fqcv-8859-86x2 | Medium | 0.4% | 21 Jan, 2026 | Packagist coreshop/core-shop |
Laravel Redis Horizontal Scaling Insecure Deserialization CVE-2026-23524, GHSA-m27r-m6rx-mhm4 | Critical | 1.0% | 21 Jan, 2026 | Packagist laravel/reverb |
mailqueue TYPO3 extension affected by Insecure Deserialization in QueueableFileTransport CVE-2026-0895, GHSA-ggff-9mj3-7246 | Medium | 0.1% | 20 Jan, 2026 | Packagist cpsit/typo3-mailqueue |
MineAdmin May Expose Sensitive Information to an Unauthorized Actor CVE-2026-1196, GHSA-wq8p-q8cq-94w5 | Low | 0.5% | 20 Jan, 2026 | Packagist mineadmin/mineadmin |
MineAdmin improperly refreshes tokens CVE-2026-1195, GHSA-43rr-x62x-q96w | Low | 0.3% | 20 Jan, 2026 | Packagist mineadmin/mineadmin |
MineAdmin May Expose Sensitive Information to an Unauthorized Actor CVE-2026-1194, GHSA-7f7m-83r3-p644 | Medium | 0.8% | 20 Jan, 2026 | Packagist mineadmin/mineadmin |
MineAdmin has Incorrect Privilege Assignment CVE-2026-1193, GHSA-23hh-2f47-3p4h | Low | 0.3% | 19 Jan, 2026 | Packagist mineadmin/mineadmin |
Pterodactyl improperly locks resources allowing raced queries to create more resources than alloted CVE-2025-69198, GHSA-jw2v-cq5x-q68g | Medium | 0.2% | 19 Jan, 2026 | Packagist pterodactyl/panel |
Kimai has an Authenticated Server-Side Template Injection (SSTI) CVE-2026-23626, GHSA-jg2j-2w24-54cg | Medium | 0.5% | 18 Jan, 2026 | Packagist kimai/kimai |
CakePHP PaginatorHelper::limitControl() vulnerable to reflected cross-site-scripting CVE-2026-23643, GHSA-qh8m-9qxx-53m5 | Medium | 0.3% | 16 Jan, 2026 | Packagist cakephp/cakephp |