Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
baserCMS Update Functionality Vulnerable to OS Command Injection CVE-2026-30877, GHSA-m9g7-rgfc-jcm7 | Critical | 1.5% | 31 Mar, 2026 | Packagist baserproject/basercms |
baserCMS has OS Command Injection Leading to Remote Code Execution (RCE) CVE-2026-21861, GHSA-qxmc-6f24-g86g | Critical | 2.3% | 31 Mar, 2026 | Packagist baserproject/basercms |
CI4MS: Methods Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS CVE-2026-34558, GHSA-v77r-xg3p-75g7 | Critical | 0.3% | 30 Mar, 2026 | Packagist ci4-cms-erp/ci4ms |
CI4MS: Permissions Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS CVE-2026-34557, GHSA-rpjr-985c-qhvm | Critical | 0.3% | 30 Mar, 2026 | Packagist ci4-cms-erp/ci4ms |
ci4-cms-erp/ci4ms: System Settings (Mail Settings) Full Platform Compromise & Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS CVE-2026-27599, GHSA-66m2-v9v9-95c3 | Critical | 0.4% | 30 Mar, 2026 | Packagist ci4-cms-erp/ci4ms |
AVideo has Plaintext Video Password Storage CVE-2026-33867, GHSA-363v-5rh8-23wg | Critical | 0.2% | 26 Mar, 2026 | Packagist wwbn/avideo |
MantisBT is vulnerable to authentication bypass through the SOAP API on MySQL CVE-2026-30849, GHSA-phrq-pc6r-f6gh | Critical | 1.8% | 23 Mar, 2026 | Packagist mantisbt/mantisbt |
AVideo Allows Unauthenticated Live Stream Control via Token Verification URL Override in control.json.php CVE-2026-33716, GHSA-9hv9-gvwm-95f2 | Critical | 0.4% | 23 Mar, 2026 | Packagist wwbn/avideo |
AVideo has Unauthenticated SSRF via plugin/Live/test.php CVE-2026-33502, GHSA-3fpm-8rjr-v5mc | Critical | 0.4% | 20 Mar, 2026 | Packagist wwbn/avideo |
AVideo Multi-Chain Attack: Unauthenticated Remote Code Execution via Clone Key Disclosure, Database Dump, and Command Injection CVE-2026-33478, GHSA-687q-32c6-8x68 | Critical | 13.3% | 20 Mar, 2026 | Packagist wwbn/avideo |
AVideo has an Unauthenticated SQL Injection via `doNotShowCats` Parameter (Backslash Escape Bypass) CVE-2026-33352, GHSA-mcj5-6qr4-95fj | Critical | 0.5% | 19 Mar, 2026 | Packagist wwbn/avideo |
AVideo has Unauthenticated SSRF via `webSiteRootURL` Parameter in saveDVR.json.php, Chaining to Verification Bypass CVE-2026-33351, GHSA-5f7v-4f6g-74rj | Critical | 0.4% | 19 Mar, 2026 | Packagist wwbn/avideo |
Admidio is Missing Authorization and CSRF Protection on Document and Folder Deletion CVE-2026-32817, GHSA-rmpj-3x5m-9m5f | Critical | 0.3% | 16 Mar, 2026 | Packagist admidio/admidio |
Winter vulnerable to privilege escalation by authenticated backend users CVE-2026-27591, GHSA-pgpf-m8m4-6cg6 | Critical | 0.7% | 11 Mar, 2026 | Packagist winter/wn-backend-module |
AVideo: Unauthenticated PHP session store exposed to host network via published memcached port CVE-2026-29093, GHSA-xxpw-32hf-q8v9 | Critical | 0.5% | 05 Mar, 2026 | Packagist wwbn/avideo |
Craft CMS has Twig Function Blocklist Bypass CVE-2026-28783, GHSA-5fvc-7894-ghp4 | Critical | 0.5% | 03 Mar, 2026 | Packagist craftcms/cms |
Craft CMS Vulnerable to Authenticated RCE via "craft.app.fs.write()" in Twig Templates CVE-2026-28697, GHSA-v47q-jxvr-p68x | Critical | 1.1% | 03 Mar, 2026 | Packagist craftcms/cms |
WWBN AVideo is vulnerable to unauthenticated OS Command Injection via base64Url in objects/getImage.php CVE-2026-29058, GHSA-9j26-99jh-v26q | Critical | 8.8% | 03 Mar, 2026 | Packagist wwbn/avideo |
OpenSTAManager affected by unauthenticated privilege escalation via modules/utenti/actions.php CVE-2026-27012, GHSA-247v-7cw6-q57v | Critical | 0.6% | 03 Mar, 2026 | Packagist devcode-it/openstamanager |
Froxlor has Admin-to-Root Privilege Escalation via Input Validation Bypass + OS Command Injection CVE-2026-26279, GHSA-33mp-8p67-xj7c | Critical | 0.9% | 03 Mar, 2026 | Packagist froxlor/froxlor |
Idno Vulnerable to Unauthenticated SSRF via URL Unfurl Endpoint CVE-2026-28508, GHSA-fcrh-fqxh-6fx6 | Critical | 0.7% | 02 Mar, 2026 | Packagist idno/known |
AVideo has Authenticated Remote Code Execution via Unsafe Plugin ZIP Extraction CVE-2026-28502, GHSA-v8jw-8w5p-23g3 | Critical | 0.7% | 02 Mar, 2026 | Packagist wwbn/avideo |
AVideo has Unauthenticated SQL Injection via JSON Request Bypass in objects/videos.json.php CVE-2026-28501, GHSA-pv87-r9qf-x56p | Critical | 1.6% | 02 Mar, 2026 | Packagist wwbn/avideo |
Statamic is vulnerable to account takeover via password reset link injection CVE-2026-27593, GHSA-jxq9-79vj-rgvw | Critical | 0.5% | 24 Feb, 2026 | Packagist statamic/cms |
LibreNMS: SQL Injection in ajax_table.php spreads through a covert data stream. CVE-2026-26988, GHSA-h3rv-q4rq-pqcv | Critical | 8.4% | 18 Feb, 2026 | Packagist librenms/librenms |
Pterodactyl Panel Allows Cross-Node Server Configuration Disclosure via Remote API Missing Authorization CVE-2026-26016, GHSA-g7vw-f8p5-c728 | Critical | 0.4% | 17 Feb, 2026 | Packagist pterodactyl/panel |
Known affected by Account Takeover via Password Reset Token Leakage CVE-2026-26273, GHSA-78wq-6gcv-w28r | Critical | 1.0% | 13 Feb, 2026 | Packagist idno/known |
OpenSTAManager has an OS Command Injection in P7M File Processing CVE-2025-69212, GHSA-25fp-8w8p-mx36 | Critical | 1.9% | 06 Feb, 2026 | Packagist devcode-it/openstamanager |
Moodle has an authorization logic flaw BIT-moodle-2025-67856, CVE-2025-67856, GHSA-hcm6-q6pc-xfhm | Critical | 0.3% | 03 Feb, 2026 | Packagist moodle/moodle |
CI4MS Vulnerable to Remote Code Execution (RCE) via Arbitrary File Creation and Save in File Editor CVE-2026-25510, GHSA-gp56-f67f-m4px | Critical | 0.9% | 02 Feb, 2026 | Packagist ci4-cms-erp/ci4ms |
FacturaScripts has Stored Cross-Site Scripting (XSS) in "Observations" field via History View CVE-2026-23997, GHSA-4v7v-7v7r-3r5h | Critical | 0.4% | 02 Feb, 2026 | Packagist facturascripts/facturascripts |
Laravel Redis Horizontal Scaling Insecure Deserialization CVE-2026-23524, GHSA-m27r-m6rx-mhm4 | Critical | 1.0% | 21 Jan, 2026 | Packagist laravel/reverb |
Livewire Filemanager does not restrict uploaded file types CVE-2025-14894, GHSA-9g95-48c6-r778 | Critical | 0.6% | 16 Jan, 2026 | Packagist livewire-filemanager/filemanager |
Cadmium CMS has a background arbitrary file upload vulnerability CVE-2025-51511, GHSA-qx44-p258-3c2v | Critical | 0.4% | 23 Dec, 2025 | Packagist cadmium-org/cadmium-cms |
Pagekit CMS has an Insecure Direct Object Reference (IDOR) in its User Role component CVE-2025-67165, GHSA-w3j8-9p3j-3wjx | Critical | 0.5% | 17 Dec, 2025 | Packagist pagekit/pagekit |
Pagekit CMS is vulnerable to OS Command Injection via Storage component CVE-2025-67164, GHSA-m4f2-xpfq-h97v | Critical | 0.5% | 17 Dec, 2025 | Packagist pagekit/pagekit |
Grav may be vulnerable to SSRF attack via Twig Templates CVE-2025-66844, GHSA-729w-j79f-2c34 | Critical | 0.3% | 15 Dec, 2025 | Packagist getgrav/grav |
MineAdmin has an insecure default password CVE-2025-65854, GHSA-x6mh-4w8x-p34v | Critical | 0.5% | 12 Dec, 2025 | Packagist mineadmin/mineadmin |
Ibexa User Bundle is missing password change validation CVE-2025-67719, GHSA-x93p-w2ch-fg67 | Critical | 0.1% | 10 Dec, 2025 | Packagist ibexa/user |
SAML PHP Toolkit Vulnerability on xmlseclibs CVE-2025-66475 GHSA-5j8p-438x-rgg5 | Critical | Not scored | 09 Dec, 2025 | Packagist onelogin/php-saml |
Neuron MySQLWriteTool allows arbitrary/destructive SQL when exposed to untrusted prompts (agent “footgun”) CVE-2025-67510, GHSA-898v-775g-777c | Critical | 0.4% | 09 Dec, 2025 | Packagist neuron-core/neuron-ai |
alexusmai laravel-file-manager is vulnerable to Directory Traversal via the unzip/extraction functionality CVE-2025-65346, GHSA-q5hg-wppq-r2cc | Critical | 1.0% | 04 Dec, 2025 | Packagist alexusmai/laravel-file-manager |
Mautic user without privileged access to the Marketplace can install and uninstall composer packages CVE-2025-13828, GHSA-3fq7-c5m8-g86x | Critical | 0.2% | 02 Dec, 2025 | Packagist mautic/core |
bagisto has CSV Formula Injection in Create New Product CVE-2025-62417, GHSA-jqrp-58fv-w8cq | Critical | 0.4% | 16 Oct, 2025 | Packagist bagisto/bagisto |
PrestaShop Checkout allows customer account takeover via email CVE-2025-61922, GHSA-54hq-mf6h-48xh | Critical | 0.5% | 16 Oct, 2025 | Packagist prestashop/ps_checkout |
Melis Platform CMS Unauthenticated File Upload Leading to RCE CVE-2025-10353, GHSA-chw4-gjvw-3gxc | Critical | 2.7% | 08 Oct, 2025 | Packagist melisplatform/melis-cms-slider |
Melis Platform CMS Unauthenticated Admin Account Creation CVE-2025-10352, GHSA-p3vc-g9f9-mgw4 | Critical | 0.3% | 08 Oct, 2025 | Packagist melisplatform/melis-core |
Melis Platform CMS SQL Injection CVE-2025-10351, GHSA-mrmx-jfw8-qhgv | Critical | 0.4% | 08 Oct, 2025 | Packagist melisplatform/melis-cms |
phpMyFAQ duplicate email registration allows multiple accounts with the same email CVE-2025-59943, GHSA-9wj2-4hcm-r74j | Critical | 0.4% | 03 Oct, 2025 | Packagist thorsten/phpmyfaq |
Magento Community Edition Improper Input Validation vulnerability CVE-2025-54236, GHSA-wh92-6q6g-px7j | CriticalExploited | 94.7% | 09 Sep, 2025 | Packagist magento/community-edition Packagist magento/project-community-edition |