Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
MineAdmin improperly refreshes tokens CVE-2026-1195, GHSA-43rr-x62x-q96w | Low | 0.3% | 20 Jan, 2026 | Packagist mineadmin/mineadmin |
MineAdmin May Expose Sensitive Information to an Unauthorized Actor CVE-2026-1194, GHSA-7f7m-83r3-p644 | Medium | 0.8% | 20 Jan, 2026 | Packagist mineadmin/mineadmin |
MineAdmin has Incorrect Privilege Assignment CVE-2026-1193, GHSA-23hh-2f47-3p4h | Low | 0.3% | 19 Jan, 2026 | Packagist mineadmin/mineadmin |
Pterodactyl improperly locks resources allowing raced queries to create more resources than alloted CVE-2025-69198, GHSA-jw2v-cq5x-q68g | Medium | 0.2% | 19 Jan, 2026 | Packagist pterodactyl/panel |
Kimai has an Authenticated Server-Side Template Injection (SSTI) CVE-2026-23626, GHSA-jg2j-2w24-54cg | Medium | 0.5% | 18 Jan, 2026 | Packagist kimai/kimai |
CakePHP PaginatorHelper::limitControl() vulnerable to reflected cross-site-scripting CVE-2026-23643, GHSA-qh8m-9qxx-53m5 | Medium | 0.3% | 16 Jan, 2026 | Packagist cakephp/cakephp |
Livewire Filemanager does not restrict uploaded file types CVE-2025-14894, GHSA-9g95-48c6-r778 | Critical | 0.6% | 16 Jan, 2026 | Packagist livewire-filemanager/filemanager |
solspace/craft-freeform Exposed to Known Axios Vulnerabilities via Precompiled Assets GHSA-rwr8-xrpw-9qf5 | Low | Not scored | 15 Jan, 2026 | Packagist solspace/craft-freeform |
solspace/craft-freeform Vulnerable to XSS in `PhpSpreadsheet` HTML Writer Due to Unsanitized Styling Data GHSA-44jg-mv3h-wj6g | Low | Not scored | 15 Jan, 2026 | Packagist solspace/craft-freeform |
solspace/craft-freeform Has a DoS Vulnerability GHSA-58q2-9x27-h2jm | Low | Not scored | 15 Jan, 2026 | Packagist solspace/craft-freeform |
alextselegidis/easyappointments is Vulnerable to CSRF Protection Bypass CVE-2026-23622, GHSA-54v4-4685-vwrj | High | 0.2% | 15 Jan, 2026 | Packagist alextselegidis/easyappointments |
Pimcore Web2Print Tools Bundle "Favourite Output Channel Configuration" Missing Function Level Authorization CVE-2026-23496, GHSA-4wg4-p27p-5q2r | Medium | 0.3% | 15 Jan, 2026 | Packagist pimcore/web2print-tools-bundle |
Pimcore's Admin Classic Bundle is Missing Function Level Authorization on "Predefined Properties" Listing CVE-2026-23495, GHSA-hqrp-m84v-2m2f | Medium | 0.4% | 15 Jan, 2026 | Packagist pimcore/admin-ui-classic-bundle |
Pimcore is Vulnerable to Broken Access Control: Missing Function Level Authorization on "Static Routes" Listing CVE-2026-23494, GHSA-m3r2-724c-pwgf | Medium | 0.3% | 15 Jan, 2026 | Packagist pimcore/pimcore |
Pimcore ENV Variables and Cookie Informations are exposed in http_error_log CVE-2026-23493, GHSA-q433-j342-rp9h | High | 0.4% | 15 Jan, 2026 | Packagist pimcore/pimcore |
Aimeos contains a SQL injection vulnerability in the json api 'sort' parameter CVE-2021-47763, GHSA-hm9j-cgmm-2w36 | High | 0.3% | 15 Jan, 2026 | Packagist aimeos/aimeos-laravel |
Algolia Search & Discovery for Magento 2 Has Untrusted Data Handling GHSA-595p-g7xc-c333 | Medium | Not scored | 14 Jan, 2026 | Packagist algolia/algoliasearch-magento-2 |
Pimcore Has an Incomplete Patch for CVE-2023-30848 CVE-2026-23492, GHSA-qvr7-7g55-69xj | High | 0.5% | 14 Jan, 2026 | Packagist pimcore/pimcore |
pH7-Social-Dating-CMS affected by a stored cross-site scripting (XSS) vulnerability CVE-2025-63644, GHSA-657c-wxg6-jmqv | Medium | 0.3% | 14 Jan, 2026 | Packagist ph7software/ph7builder |
Shopware Has Improper Control of Generation of Code in Twig rendered views CVE-2026-23498, GHSA-7cw6-7h3h-v8pf | High | 0.4% | 14 Jan, 2026 | Packagist shopware/core Packagist shopware/shopware |
Concrete5 CMS contains an XPath injection vulnerability CVE-2022-50807, GHSA-r7vr-wg3f-8hr9 | Medium | Not scored | 14 Jan, 2026 | Packagist concrete5/concrete5 |
TYPO3 CMS Allows Insecure Deserialization via Mailer File Spool CVE-2026-0859, GHSA-7vp9-x248-9vr9 | Medium | 0.2% | 13 Jan, 2026 | Packagist typo3/cms-core |
TYPO3 CMS Allows Broken Access Control in Recycler Module CVE-2025-59022, GHSA-p52w-7rhw-9m67 | High | 0.4% | 13 Jan, 2026 | Packagist typo3/cms-recycler |
TYPO3 CMS Allows Broken Access Control in Redirects Module CVE-2025-59021, GHSA-6c46-p6j5-3f49 | Medium | 0.3% | 13 Jan, 2026 | Packagist typo3/cms-redirects |
TYPO3 CMS Allows Broken Access Control in Edit Document Controller CVE-2025-59020, GHSA-5j7q-wmh7-cqhg | Medium | 0.3% | 13 Jan, 2026 | Packagist typo3/cms-backend |
October CMS Vulnerable to Stored XSS via Branding Styles CVE-2025-61676, GHSA-wvpq-h33f-8rp6 | Medium | 0.3% | 09 Jan, 2026 | Packagist october/system |
October CMS Vulnerable to Stored XSS via Editor and Branding Styles CVE-2025-61674, GHSA-gxxc-m74c-f48x | Medium | 0.3% | 09 Jan, 2026 | Packagist october/system |
Kirby is missing permission checks in the content changes API CVE-2026-21896, GHSA-4j78-4xrm-cr2f | Medium | 0.2% | 08 Jan, 2026 | Packagist getkirby/cms |
CoreShop Vulnerable to SQL Injection via Admin Reports CVE-2026-22242, GHSA-ch7p-mpv4-4vg4 | Medium | 0.4% | 07 Jan, 2026 | Packagist coreshop/core-shop |
Pterodactyl TOTPs can be reused during validity window CVE-2025-69197, GHSA-rgmp-4873-r683 | Medium | 0.4% | 06 Jan, 2026 | Packagist pterodactyl/panel |
Pterodactyl does not revoke SFTP access when server is deleted or permissions reduced CVE-2025-68954, GHSA-8c39-xppg-479c, GO-2026-4283 | High | 0.2% | 06 Jan, 2026 | Go github.com/pterodactyl/wings Packagist pterodactyl/panel |
Redaxo has Path Traversal in Backup Addon Leading to Arbitrary File Read CVE-2026-21857, GHSA-824x-88xg-cwrv | High | 0.5% | 05 Jan, 2026 | Packagist redaxo/source |
Craft CMS vulnerable to potential authenticated Remote Code Execution via malicious attached Behavior CVE-2025-68455, GHSA-255j-qw47-wjh5 | High | 1.0% | 05 Jan, 2026 | Packagist craftcms/cms |
Unauthenticated Craft CMS users can trigger a database backup CVE-2025-68456, GHSA-v64r-7wg9-23pr | High | 0.6% | 05 Jan, 2026 | Packagist craftcms/cms |
Craft CMS vulnerable to potential authenticated Remote Code Execution via Twig SSTI CVE-2025-68454, GHSA-742x-x762-7383 | Medium | 0.9% | 05 Jan, 2026 | Packagist craftcms/cms |
Craft CMS vulnerable to Server-Side Request Forgery (SSRF) via GraphQL Asset Upload Mutation CVE-2025-68437, GHSA-x27p-wfqw-hfcc | Medium | 0.5% | 05 Jan, 2026 | Packagist craftcms/cms |
Craft CMS vulnerable to potential information disclosure via unchecked asset relocation CVE-2025-68436, GHSA-53vf-c43h-j2x9 | Medium | 0.3% | 05 Jan, 2026 | Packagist craftcms/cms |
Bagisto has HTML Filter Bypass that Enables Stored XSS CVE-2026-21451, GHSA-2mwc-h2mg-v6p8 | Medium | 0.6% | 02 Jan, 2026 | Packagist bagisto/bagisto |
Bagisto SSTI vulnerability in type parameter can lead to RCE CVE-2026-21450, GHSA-9hvg-qw5q-wqwp | High | 1.4% | 02 Jan, 2026 | Packagist bagisto/bagisto |
Bagisto is vulnerable to SSTI via name parameters provided by non-admin low-privilege users CVE-2026-21449, GHSA-mqhg-v22x-pqj8 | High | 0.5% | 02 Jan, 2026 | Packagist bagisto/bagisto |
Bagisto has Normal & Blind SSTI from low-privilege user when ordering product CVE-2026-21448, GHSA-5j4h-4f72-qpm6 | High | 0.9% | 02 Jan, 2026 | Packagist bagisto/bagisto |
Bagisto has IDOR in Customer Order Reorder Functionality CVE-2026-21447, GHSA-x5rw-qvvp-5cgm | High | 0.3% | 02 Jan, 2026 | Packagist bagisto/bagisto |
Bagisto Missing Authentication on Installer API Endpoints CVE-2026-21446, GHSA-6h7w-v2xr-mqvw | High | 0.6% | 02 Jan, 2026 | Packagist bagisto/bagisto |
libsodium has Incomplete List of Disallowed Inputs CVE-2025-69277, GHSA-mrfv-m5wm-5w6w, PYSEC-2026-1448, PYSEC-2026-3002 | Medium | 0.2% | 31 Dec, 2025 | Packagist paragonie/sodium_compat PyPI PyNaCl PyPI hdwallet PyPI pynacl |
FacturaScripts is Vulnerable to Stored Cross-Site Scripting (XSS) via XML File Upload CVE-2025-69210, GHSA-2267-xqcf-gw2m | High | 1.0% | 30 Dec, 2025 | Packagist facturascripts/facturascripts |
YOURLS is vulnerable to XSS through JSONP and Callback request parameters GHSA-6mp4-q625-mxjp | High | Not scored | 30 Dec, 2025 | Packagist yourls/yourls |
Composer is vulnerable to ANSI sequence injection BIT-composer-2025-67746, CVE-2025-67746, GHSA-59pp-r3rg-353g | Low | 0.5% | 30 Dec, 2025 | Packagist composer/composer |
Pterodactyl has a Reflected XSS vulnerability in “Create New Database Host” GHSA-mgr9-6c2j-jxrq | Low | Not scored | 30 Dec, 2025 | Packagist pterodactyl/panel |
phpMyFAQ has unauthenticated config backup download via /api/setup/backup CVE-2025-69200, GHSA-9cg9-4h4f-j6fg | High | 2.1% | 29 Dec, 2025 | Packagist thorsten/phpmyfaq |
phpMyFAQ has Stored XSS in user list via admin-managed display_name CVE-2025-68951, GHSA-jv8r-hv7q-p6vc | Medium | 0.3% | 29 Dec, 2025 | Packagist thorsten/phpmyfaq |