Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Laravel Backpack CRUD: Arbitrary file deletion via attacker-controlled clear_<attr>[] in HasUploadFields::uploadMultipleFilesToDisk CVE-2026-54178, GHSA-8xjm-wqrp-2f25 | High | 0.6% | 20 Aug, 2026 | Packagist backpack/crud |
Laravel Backpack CRUD: HasUploadFields keeps the attacker-supplied file extension — public-disk uploads of `shell.php` reach the webserver CVE-2026-54177, GHSA-8q2w-pv9p-mjvc | Medium | 0.9% | 20 Aug, 2026 | Packagist backpack/crud |
Laravel Backpack CRUD: MyAccountController allows changing the login email without a current-password check CVE-2026-54176, GHSA-9fw9-8c49-qch8 | Medium | 0.7% | 20 Aug, 2026 | Packagist backpack/crud |
Laravel Backpack CRUD: Unverified password change in MyAccountController via mass assignment CVE-2026-54175, GHSA-xpv2-hrfc-hw62 | High | 0.6% | 20 Aug, 2026 | Packagist backpack/crud |
MCP PHP SDK: client HttpTransport SSE buffer (sseBuffer .= chunk) grows unbounded when server withholds the event delimiter CVE-2026-53965, GHSA-7m52-jw36-44r3 | High | 0.6% | 19 Aug, 2026 | Packagist mcp/sdk |
Snipe-IT: Stored DOM XSS via table selected-count IDs CVE-2026-61807, GHSA-c8qc-wf67-342w | Medium | 0.2% | 19 Aug, 2026 | Packagist snipe/snipe-it |
Snipe-IT: Maintenance Record Disclosure via Missing Authorization on GET CVE-2026-55703, GHSA-r9r3-g9fp-3q4q | Medium | 0.3% | 19 Aug, 2026 | Packagist snipe/snipe-it |
Snipe-IT: Chained Information Disclosure and IDOR Leads to Full EULA File Takeover CVE-2026-55694, GHSA-3hgv-jr5j-cg9x | High | 0.3% | 19 Aug, 2026 | Packagist snipe/snipe-it |
Snipe-IT: Tenant Isolation Bypass in FMCS Floater Mode CVE-2026-55643, GHSA-c6w2-j4wq-mvwg | High | 0.3% | 19 Aug, 2026 | Packagist snipe/snipe-it |
Grav: Remote code execution via unrestricted callable in Blueprint::dynamicData() CVE-2026-64850, CVE-2026-65008, GHSA-fj2p-qj2f-74v5 | High | 2.5% | 19 Aug, 2026 | Packagist getgrav/grav |
Grav: .htaccess file extension rules bypass via case variation on case-insensitive filesystems CVE-2026-62230, CVE-2026-62673, GHSA-vwg3-w8w3-pc79 | High | 0.5% | 19 Aug, 2026 | Packagist getgrav/grav |
Grav: Authenticated ReDoS via regex_replace in Twig Sandbox CVE-2026-62237, CVE-2026-62672, GHSA-37f3-6p89-6qr9 | Medium | 0.4% | 19 Aug, 2026 | Packagist getgrav/grav |
Grav: 2FA Bypass via 'login.regenerate2FASecret' - Secret Rotation During Pending Challenge CVE-2026-62232, CVE-2026-62669, GHSA-7mgc-c7pq-3rr3 | High | 0.5% | 19 Aug, 2026 | Packagist getgrav/grav |
Grav: Twig sandbox config exfiltration via grav.offsetGet + dump filter (CVE-2026-44738 bypass) CVE-2026-61450, CVE-2026-61842, GHSA-mc5q-6hpj-rp7j | Medium | 5.4% | 19 Aug, 2026 | Packagist getgrav/grav |
Grav: Decompression Bomb via ZipArchiver - Missing Extraction Limits CVE-2026-61455, CVE-2026-61690, GHSA-928x-9mpw-8h56 | Medium | 0.5% | 19 Aug, 2026 | Packagist getgrav/grav |
LibreNMS: SSRF-driven stored XSS via Oxidized API response fields in device showconfig page CVE-2026-84189, GHSA-7gww-x7fh-jf9j | Critical | 0.4% | 18 Aug, 2026 | Packagist librenms/librenms |
LibreNMS: Stored XSS via graph_descr admin config settings echoed without escaping to all authenticated users CVE-2026-84188, GHSA-7cj5-v4pp-v632 | Medium | 0.3% | 18 Aug, 2026 | Packagist librenms/librenms |
LibreNMS Vulnerable to Remote Code Execution via AboutController CVE-2026-84190, GHSA-jf24-8g2h-2wg7 | High | 0.9% | 18 Aug, 2026 | Packagist librenms/librenms |
Froxlor: Credential and 2FA secret disclosure via Froxlor API endpoints CVE-2026-62988, GHSA-7788-ghfq-c6mh | Critical | 0.6% | 18 Aug, 2026 | Packagist froxlor/froxlor |
Froxlor has CSRF Vulnerability in AJAX Endpoint — Missing Cross-Site Request Forgery Protection CVE-2026-55593, GHSA-xpr4-8vp6-c87j | Medium | 0.3% | 18 Aug, 2026 | Packagist froxlor/froxlor |
Froxlor DomainZones.add allows DNS zone-file RR injection via record/type fields CVE-2026-54543, GHSA-5rw4-4665-cvwf | Medium | 0.4% | 18 Aug, 2026 | Packagist froxlor/froxlor |
Froxlor: Second-Order SQL Injection via `Admins.add` `ipaddress` Parameter Allows Full Database Exfiltration CVE-2026-54348, GHSA-w27m-rmmf-g5w4 | High | 0.7% | 18 Aug, 2026 | Packagist froxlor/froxlor |
Froxlor: Stored XSS in DNS TXT Record Content Allows Customer-to-Admin Account Takeover CVE-2026-54347, GHSA-43gm-9rr3-cx7g | High | 0.4% | 18 Aug, 2026 | Packagist froxlor/froxlor |
MineAdmin Vulnerable to Path Traversal via Unsanitized identifier in Plugin Install/Uninstall CVE-2026-55224, GHSA-59xm-4m8c-g3xj | High | 1.4% | 18 Aug, 2026 | Packagist mineadmin/mineadmin |
LibreNMS Vulnerable to Remote Code Execution by Signal Alert Transportation module CVE-2026-55182, GHSA-c9fv-cgmm-2wg7 | High | 1.6% | 18 Aug, 2026 | Packagist librenms/librenms |
Grav: Missing admin.super guard on core group blueprint access field allows admin.users operator to escalate to super-admin CVE-2026-75837, GHSA-xhfv-7758-r9hx | Critical | 0.5% | 18 Aug, 2026 | Packagist getgrav/grav |
Grav: Single invalid UTF-8 byte disables every rule in Security::detectXss(), bypassing the page-content XSS safety gate CVE-2026-75834, GHSA-q2j8-x8hf-63ch | Medium | 0.3% | 18 Aug, 2026 | Packagist getgrav/grav |
Grav: Stored XSS via Markdown audio/video media <source> URL CVE-2026-75831, GHSA-6qw9-4vv5-jr97 | Medium | 0.4% | 18 Aug, 2026 | Packagist getgrav/grav |
Grav: detectXss() misses an event-handler attribute after an unpaired quote in an unquoted attribute value, giving stored XSS CVE-2026-75828, GHSA-vfmf-q6x9-cw96 | Critical | 0.4% | 18 Aug, 2026 | Packagist getgrav/grav |
Grav: Blueprint dynamic-data bare-function branch is denylist-gated and omits error_log, giving arbitrary file write CVE-2026-75827, GHSA-f8wv-xp27-6gq7 | Critical | 0.9% | 18 Aug, 2026 | Packagist getgrav/grav |
Grav: Unauthenticated Path Traversal via Missing Directory-Boundary Check in `plugin-asset-map.php` Static Asset Server (`index.php`) CVE-2026-74907, GHSA-4v9q-p283-qc2m | High | 0.4% | 18 Aug, 2026 | Packagist getgrav/grav |
Grav: Stored XSS via quoted-attribute bypass in detectXss CVE-2026-72832, GHSA-269c-h76q-8cxw | Medium | 0.3% | 14 Aug, 2026 | Packagist getgrav/grav |
Grav CMS vulnerable to remote code execution via .zip file upload CVE-2026-72819, GHSA-r94f-hx44-8jqf | High | 0.9% | 14 Aug, 2026 | Packagist getgrav/grav |
Pimcore: ClassDefinition UID regex missing end anchor allows SQL injection via Block.php unquoted table name CVE-2026-55072, GHSA-2mhj-fhvg-v428 | High | 0.4% | 13 Aug, 2026 | Packagist pimcore/pimcore |
phpMyFAQ: SQL LIKE Wildcard Injection in Chat User Search Allows Authenticated User Enumeration CVE-2026-47132, GHSA-6pvm-2vjj-rx4w | Medium | 0.3% | 12 Aug, 2026 | Packagist thorsten/phpmyfaq |
LibreNMS: Reflected XSS via Proxmox instance/vmid GET parameters injected into document.title JavaScript assignment CVE-2026-45694, GHSA-jmqm-f8q4-v7wx | Medium | 0.2% | 12 Aug, 2026 | Packagist librenms/librenms |
Winter: Authenticated backend users can bypass Users controller permission checks CVE-2026-35445, GHSA-j5jq-cr68-v2xx | High | 0.4% | 12 Aug, 2026 | Packagist winter/wn-backend-module |
Winter: Broken access control in `Cms\Controllers\Index` allows cross-template actions and unauthorized asset uploads CVE-2026-32639, GHSA-5c4f-9pq9-6c77 | Medium | 0.5% | 12 Aug, 2026 | Packagist winter/wn-cms-module |
Winter: SQL Injection in Backend Filter Widget numberrange Scope via numbersFromAjax CVE-2026-32593, GHSA-m7jc-g4rc-jmvh | Medium | 0.3% | 12 Aug, 2026 | Packagist winter/wn-backend-module |
Winter: Stored XSS through Editor Settings custom styles CVE-2026-32258, GHSA-vgp4-2fc4-qff2 | High | 0.4% | 12 Aug, 2026 | Packagist winter/wn-backend-module |
Winter: Stored XSS through Brand Settings custom styles CVE-2026-32257, GHSA-v7cf-8gh9-gxmj | High | 0.4% | 12 Aug, 2026 | Packagist winter/wn-backend-module |
TYPO3 CMS - Broken Access Control in Backend and Install Tool CVE-2026-19418, GHSA-68jx-f42c-7599 | High | 0.2% | 11 Aug, 2026 | Packagist typo3/cms-backend Packagist typo3/cms-core |
Kirby: System path exposure from error messages in the REST API CVE-2026-69127, GHSA-rf2p-vh74-7vvh | Medium | 0.7% | 07 Aug, 2026 | Packagist getkirby/cms |
Smarty Security stream restriction bypass through stream: resource CVE-2026-62996, GHSA-rjhh-76wf-8xmw | Medium | 0.5% | 07 Aug, 2026 | Packagist smarty/smarty |
Smarty: Symlink path traversal out of trusted directories CVE-2026-62992, GHSA-f6wf-28g6-769x | Medium | 0.5% | 07 Aug, 2026 | Packagist smarty/smarty |
Craft CMS: Passkey login accepts replayed WebAuthn assertions CVE-2026-72780, GHSA-wg23-69c2-gjc8 | Critical | 0.4% | 07 Aug, 2026 | Packagist craftcms/cms |
Craft CMS: Arbitrary file read via SplFileObject in non-sandboxed template contexts CVE-2026-72779, GHSA-957r-qf9p-67xw | High | 0.4% | 06 Aug, 2026 | Packagist craftcms/cms |
Craft CMS: Authenticated leak of secret environment variables CVE-2026-72782, GHSA-596p-6jv8-775v | High | 0.4% | 06 Aug, 2026 | Packagist craftcms/cms |
Craft CMS: Authorization bypass: view-only Categories user can modify category structure via structures/move-element CVE-2026-72785, GHSA-xxpx-f366-4xpq | Critical | 0.3% | 06 Aug, 2026 | Packagist craftcms/cms |
Craft CMS: Incorrect path validation could potentially lead to path traversal CVE-2026-72783, GHSA-7hxc-f267-h5q7 | Medium | 0.2% | 06 Aug, 2026 | Packagist craftcms/cms |