Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
WordPress Coding Standards (WordPressCS) contains an arbitrary code execution vulnerability CVE-2026-45293, GHSA-3pwp-g2mj-5p3v | High | 0.2% | 28 Jul, 2026 | Packagist wp-coding-standards/wpcs |
Apache Thrift Python, Go, PHP and Java bindings have an Infinite Loop BIT-thrift-2026-43871, CVE-2026-43871, GHSA-8wv5-x4w7-5gww, PYSEC-2026-3926 | High | 1.0% | 27 Jul, 2026 | Go github.com/apache/thrift Maven org.apache.thrift:libthrift Packagist apache/thrift PyPI thrift |
Poweradmin: OIDC `sub` collation bypass in Poweradmin leading to account takeover GHSA-cmwh-g2h8-c222 | High | Not scored | 24 Jul, 2026 | Packagist poweradmin/poweradmin |
Poweradmin: Broken access control (IDOR): any zone owner can modify DNS records in zones they do not own GHSA-rm67-g9ch-vxff | High | Not scored | 24 Jul, 2026 | Packagist poweradmin/poweradmin |
Poweradmin: API user-update endpoint leads to a non-admin reset any user's password and take over the superuser account GHSA-h4hf-v6w5-897x | High | Not scored | 24 Jul, 2026 | Packagist poweradmin/poweradmin |
Pheditor: Terminal command-allowlist bypass via argument injection leads to RCE — surviving vector after the metacharacter-sanitization fixes GHSA-g3hq-hphg-8fhh | High | Not scored | 24 Jul, 2026 | Packagist pheditor/pheditor |
PHPSpreadsheet: XLS/OLE sector-chain self-loop causes memory exhaustion CVE-2026-59933, GHSA-xh5m-36r6-47m3 | High | 0.5% | 23 Jul, 2026 | Packagist phpoffice/phpspreadsheet |
PHPSpreadsheet: Gnumeric reader unbounded gzip expansion causes memory exhaustion CVE-2026-59932, GHSA-2mrg-gjxq-2gvr | High | 0.5% | 23 Jul, 2026 | Packagist phpoffice/phpspreadsheet |
PHPSpreadsheet: SSRF bypass via HTTP redirect in WEBSERVICE() domain whitelist CVE-2026-59931, GHSA-6hq5-7373-42rg | High | 0.5% | 23 Jul, 2026 | Packagist phpoffice/phpspreadsheet |
Grav: FlexDirectory::dynamicDataField() executes arbitrary callables from blueprint data with no validation CVE-2026-65608, GHSA-c4wf-2xxc-68qm | High | 1.1% | 23 Jul, 2026 | Packagist getgrav/grav |
Guzzle: URI fragments disclosed in redirect Referer headers CVE-2026-67354, GHSA-h95v-h523-3mw8 | High | 0.4% | 20 Jul, 2026 | Packagist guzzlehttp/guzzle |
Guzzle: Host-only cookie scope is not preserved CVE-2026-67355, GHSA-wm3w-8rrp-j577 | High | 0.4% | 20 Jul, 2026 | Packagist guzzlehttp/guzzle |
Pheditor: Incomplete command sanitization in terminal feature allows RCE via pipe operator, backtick substitution, and newline injection CVE-2026-55578, GHSA-wg4w-wr5q-6vjc | High | 0.7% | 16 Jul, 2026 | Packagist pheditor/pheditor |
Pheditor has an authenticated terminal command whitelist bypass CVE-2026-54540, GHSA-9643-6xjp-vx57 | High | 0.7% | 16 Jul, 2026 | Packagist pheditor/pheditor |
MantisBT: Stored XSS in print_all_bug_page_word.php CVE-2026-62944, GHSA-h2wf-967x-gxvw | High | Not scored | 15 Jul, 2026 | Packagist mantisbt/mantisbt |
Koel: Incomplete fix for CVE-2026-47260 — systemic SSRF in podcast & radio fetch paths CVE-2026-54491, GHSA-6qvr-wjmv-v8mm | High | 0.4% | 15 Jul, 2026 | Packagist phanan/koel |
Koel: Authenticated Full-Read SSRF via Subsonic Internet Radio Stations CVE-2026-54493, GHSA-6p96-cfg5-4vhp | High | 0.4% | 15 Jul, 2026 | Packagist phanan/koel |
MantisBT: Remote Code Execution via eval() Class Hoisting in adm_config_set.php CVE-2026-49273, GHSA-v84x-qvhg-f36r | High | Not scored | 15 Jul, 2026 | Packagist mantisbt/mantisbt |
MantisBT: SQL Injection via history_order Configuration Value CVE-2026-47142, GHSA-mw6p-33vw-46cc | High | Not scored | 15 Jul, 2026 | Packagist mantisbt/mantisbt |
Grav: Decompression-bomb size cap bypassed by forged ZIP size in ZipArchiver/Installer CVE-2026-61449, GHSA-8h9x-89f2-m7x3 | High | 0.3% | 15 Jul, 2026 | Packagist getgrav/grav |
EasyAdmin: Stored Cross-Site Scripting (XSS) via uploaded files served inline in FileField and ImageField CVE-2026-54087, GHSA-8559-gwj3-q37r | High | 0.4% | 14 Jul, 2026 | Packagist easycorp/easyadmin-bundle |
FacturaScripts: CSV formula injection in CSVExport allows authenticated low-priv users to plant payloads that execute when an admin opens the export CVE-2026-45263, GHSA-2p5x-4jr6-x5jg | High | Not scored | 14 Jul, 2026 | Packagist facturascripts/facturascripts |
FacturaScripts: Unauthenticated Path Traversal in Static File Controllers Reads Private MyFiles Documents CVE-2026-45693, GHSA-cv65-7cg8-r623 | High | Not scored | 14 Jul, 2026 | Packagist facturascripts/facturascripts |
Easy!Appointments Vulnerable to Appointments Takeover via Excessive Data Exposure CVE-2026-55651, GHSA-4vmm-5qvc-w5p7 | High | 0.2% | 14 Jul, 2026 | Packagist alextselegidis/easyappointments |
Kimai: Pre-2FA KIMAI_SESSION cookie grants full authenticated REST API access, bypassing TOTP CVE-2026-52827, GHSA-v8hx-4vx8-wc96 | High | 0.6% | 14 Jul, 2026 | Packagist kimai/kimai |
Laravel-Mediable: path traversal vulnerability in the File::sanitizePath() CVE-2026-49970, GHSA-xv8g-76mx-2rxc | High | 1.0% | 13 Jul, 2026 | Packagist plank/laravel-mediable |
NukeViet: Pre-authentication SSRF via X-Forwarded-Host CVE-2026-55372, GHSA-4chg-4752-w88r | High | Not scored | 13 Jul, 2026 | Packagist nukeviet/nukeviet |
NukeViet: Path Traversal to Arbitrary File Deletion in Edit Comment Function CVE-2026-54065, GHSA-c9xg-64p9-f2jj | High | Not scored | 13 Jul, 2026 | Packagist nukeviet/nukeviet |
NukeViet: Multiple Anti-XSS Filter Bypasses Leading to Stored XSS in News Module CVE-2026-54064, GHSA-465g-4q99-5x86 | High | Not scored | 13 Jul, 2026 | Packagist nukeviet/nukeviet |
NukeViet: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CVE-2026-49259, GHSA-w2w5-w2pw-r929 | High | Not scored | 13 Jul, 2026 | Packagist nukeviet/nukeviet |
NukeViet: Unauthenticated Reflected XSS in Comment Module CVE-2026-48118, GHSA-mxpf-qgg6-v3ff | High | Not scored | 13 Jul, 2026 | Packagist nukeviet/nukeviet |
Phalcon: Catastrophic backtracking (ReDoS) in the default Phalcon Router route lead to remote unauthenticated DoS CVE-2026-57584, GHSA-x7rj-f32v-7jjg | High | 0.5% | 10 Jul, 2026 | Packagist phalcon/cphalcon |
Phalcon: Non-constant-time HMAC verification in `Encryption\Crypt::decrypt` (timing side-channel) CVE-2026-54736, GHSA-8jqh-95g6-7jpj | High | 0.2% | 10 Jul, 2026 | Packagist phalcon/cphalcon |
NotrinosERP: Authenticated arbitrary file upload leads to remote code execution via HRM employee "Documents" (doc_file) CVE-2026-76913, GHSA-qv4m-m73m-8hj7 | High | Not scored | 10 Jul, 2026 | Packagist notrinos/notrinos-erp |
Snipe-IT has an Improper Privilege Management issue CVE-2026-55843, GHSA-j5g3-42wp-gqm3 | High | 0.5% | 10 Jul, 2026 | Packagist snipe/snipe-it |
Snipe-IT vulnerable to cross-company asset maintenance re-parenting via API update CVE-2026-55516, GHSA-575r-357h-fhch | High | 0.4% | 10 Jul, 2026 | Packagist snipe/snipe-it |
Snipe-IT vulnerable to directory traversal in displaySig CVE-2026-55474, GHSA-c6f4-wj38-m3g3 | High | 0.5% | 10 Jul, 2026 | Packagist snipe/snipe-it |
Snipe-IT has an authorization bypass on bulk editing users CVE-2026-55460, GHSA-vgx7-c78r-69w9 | High | 0.4% | 10 Jul, 2026 | Packagist snipe/snipe-it |
Grav: Unauthenticated denial of service via unbounded image derivative dimensions CVE-2026-53653, GHSA-4x9g-vw65-vvf9 | High | 0.5% | 10 Jul, 2026 | Packagist getgrav/grav |
Pimcore: Insufficient Permission Check on Class Definition Creation Endpoint Allows Privilege Escalation CVE-2026-55212, GHSA-f97c-ph8j-8vff | High | 0.4% | 09 Jul, 2026 | Packagist pimcore/studio-backend-bundle |
Pimcore: SQL Injection via Column Name in DateFilter allows authenticated user to extract arbitrary database data including admin password hashes CVE-2026-55208, GHSA-79cw-hfcc-7mw9 | High | 0.4% | 09 Jul, 2026 | Packagist pimcore/studio-backend-bundle |
Pimcore: Account Takeover via Password Reset URL Injection allows unauthenticated attacker to hijack any admin account with 2FA bypass CVE-2026-55207, GHSA-h854-c3m3-mh5v | High | 0.7% | 09 Jul, 2026 | Packagist pimcore/studio-backend-bundle |
YesWiki has Authenticated SQL Injection via ReactionManager CVE-2026-52775, GHSA-4pf7-cc4r-g63h | High | 0.5% | 09 Jul, 2026 | Packagist yeswiki/yeswiki |
YesWiki: Second-Order SQL Injection in Page Delete API via Unescaped Page Tag (`ApiController::deletePage`) CVE-2026-52771, GHSA-8f2v-2qhj-gfwg | High | 0.5% | 09 Jul, 2026 | Packagist yeswiki/yeswiki |
YesWiki: SQL Injection possible through public Bazar entry-listing APIs via numeric `query`/`queries` filters CVE-2026-52770, GHSA-qg78-vmvc-fhjw | High | 0.5% | 09 Jul, 2026 | Packagist yeswiki/yeswiki |
YesWiki has Unauthenticated Server-Side Request Forgery via ActivityPub `Signature.keyId` CVE-2026-52769, GHSA-vw42-752g-5mrp | High | 0.5% | 09 Jul, 2026 | Packagist yeswiki/yeswiki |
YesWiki Vulnerable to Unauthenticated ActivityPub Signature-Verification Bypass via `!openssl_verify(...)` accepting `int(-1)` CVE-2026-52767, GHSA-mv28-wj57-f57g | High | 0.4% | 09 Jul, 2026 | Packagist yeswiki/yeswiki |
YesWiki: Authenticated (Admin) Server-Side Template Injection to Remote Code Execution via Bazar Semantic Templates CVE-2026-52762, GHSA-65p8-9433-jpcp | High | 0.8% | 09 Jul, 2026 | Packagist yeswiki/yeswiki |
laravel-backup-restore has an OS Command Injection during database restore CVE-2026-53932, GHSA-w9mx-xmg4-gc4r | High | 1.7% | 09 Jul, 2026 | Packagist wnx/laravel-backup-restore |
Composer: Arbitrary file write outside vendor via malicious transitive package name BIT-composer-2026-59948, CVE-2026-59948, GHSA-499r-g7pc-vmp9 | High | 0.1% | 08 Jul, 2026 | Packagist composer/composer |