Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Admidio: CSRF on Plugin Install, Uninstall, and Update via Unprotected GET Requests CVE-2026-53760, GHSA-hm42-q32m-vj4f | Medium | 0.2% | 09 Jul, 2026 | Packagist admidio/admidio |
Composer: URL-embedded HTTP-Basic username leaks to verbose logs (GitHub PAT exposure) BIT-composer-2026-59947, CVE-2026-59947, GHSA-g6xq-892h-64w3 | Medium | 0.1% | 08 Jul, 2026 | Packagist composer/composer |
Composer: Path traversal in package bin field lets dependencies chmod arbitrary host files BIT-composer-2026-59946, CVE-2026-59946, GHSA-gjfg-22fp-rrxx | Medium | 0.1% | 08 Jul, 2026 | Packagist composer/composer |
Guzzle: Cookie Disclosure and Injection via IP-Address Domains CVE-2026-59883, GHSA-g446-98w2-8p5w | Medium | 0.2% | 08 Jul, 2026 | Packagist guzzlehttp/guzzle |
guzzlehttp/psr7: Host Confusion via Weak URI Host Validation CVE-2026-59882, GHSA-c2w2-prh8-qm98 | Medium | 0.3% | 08 Jul, 2026 | Packagist guzzlehttp/psr7 |
Grav: Stored CSS injection via Markdown image resize() bypasses prior media style sanitizers in Grav CVE-2026-58657, GHSA-ffmg-hfvg-jhg9 | Medium | 0.3% | 08 Jul, 2026 | Packagist getgrav/grav |
EGroupware Vulnerable to Local File Inclusion via file:// URI in Mail Compose CVE-2026-45016, GHSA-c8m7-r2jv-rw63 | Medium | Not scored | 07 Jul, 2026 | Packagist egroupware/egroupware |
Craft CMS: Missing authorization check allows non-admin control panel users access to user registration metrics CVE-2026-14794, GHSA-rvmm-v933-jgxq | Medium | 0.4% | 06 Jul, 2026 | Packagist craftcms/cms |
Craft CMS: Missing authorization check allows non-admin control panel users to reorder Global Sets CVE-2026-14793, GHSA-9p7c-v5x3-rfx8 | Medium | 0.4% | 06 Jul, 2026 | Packagist craftcms/cms |
Froxlor customer can create MySQL databases on disallowed servers via Mysqls.add API CVE-2026-90935, GHSA-q4rm-m6xh-5pv7 | Medium | 0.3% | 02 Jul, 2026 | Packagist froxlor/froxlor |
Froxlor: Authenticated customers can read other customers' allowed sender aliases CVE-2026-90936, GHSA-mr9h-45p9-fg8h | Medium | 0.3% | 02 Jul, 2026 | Packagist froxlor/froxlor |
Craft CMS: Sensitive File Disclosure / Server-Side File Read CVE-2026-55792, GHSA-287w-mxq6-x2cp | Medium | 0.3% | 02 Jul, 2026 | Packagist craftcms/cms |
Craft CMS: Authorization bypass in `entries/move-to-section` via missing target-section save check CVE-2026-50280, GHSA-43cq-c2gq-pfpw | Medium | 0.4% | 02 Jul, 2026 | Packagist craftcms/cms |
Craft CMS: Unauthorized Deletion of Source Assets During File Replacement CVE-2026-50283, GHSA-qh45-9g5p-m2v4 | Medium | 0.4% | 01 Jul, 2026 | Packagist craftcms/cms |
Craft CMS: Stored XSS via Structure entry title in table view CVE-2026-55793, GHSA-xrqc-p465-2xvg | Medium | 0.3% | 01 Jul, 2026 | Packagist craftcms/cms |
Silverstripe Framework: Possible XSS attack through media embed CVE-2026-54720, GHSA-gvrw-qqp5-jgc5 | Medium | 0.3% | 01 Jul, 2026 | Packagist silverstripe/framework |
API Platform Core: Relation IRIs are not type-checked: a related resource can be denormalised as the wrong resource type (type confusion) CVE-2026-54164, GHSA-9rjg-x2p2-h68h | Medium | 0.3% | 01 Jul, 2026 | Packagist api-platform/core |
API Platform Core vulnerable to cross-user attribute leak in JSON:API and HAL item normalizers due to missing isCacheKeySafe gate CVE-2026-49858, GHSA-pjhx-3c3w-9v23 | Medium | 0.3% | 01 Jul, 2026 | Packagist api-platform/core Packagist api-platform/hal Packagist api-platform/json-api |
EasyAdminBundle has path traversal and reflected XSS in Flag and Icon Twig components GHSA-2wwr-9x6f-88gp | Medium | Not scored | 01 Jul, 2026 | Packagist easycorp/easyadmin-bundle |
Paymenter has race condition in payWithCredit() that enables credit double-spend CVE-2026-55219, GHSA-pgcq-8grm-5rx9 | Medium | 0.2% | 30 Jun, 2026 | Packagist paymenter/paymenter |
Twig: Sandbox property allowlist bypass via the `column` filter under `SourcePolicyInterface` CVE-2026-48808, GHSA-h8vq-8gpg-mhcg | Medium | 0.4% | 30 Jun, 2026 | Packagist twig/twig |
Twig: Sandbox state regression in deprecated internal wrappers in `src/Resources/core.php` CVE-2026-48805, GHSA-p42q-9prx-q5wq | Medium | 0.5% | 30 Jun, 2026 | Packagist twig/twig |
Statamic Vulnerable to CSV formula injection in form submission exports CVE-2026-54243, GHSA-h77m-qrj7-jxcw | Medium | 0.3% | 26 Jun, 2026 | Packagist statamic/cms |
Statamic Vulnerable to Server-Side Request Forgery via Glide (DNS rebinding) CVE-2026-54242, GHSA-v5c4-wcpj-x73m | Medium | 0.2% | 26 Jun, 2026 | Packagist statamic/cms |
WebauthnAuthenticator leaks sensitive HTTP headers through INFO-level logs GHSA-q683-8468-r6h6 | Medium | Not scored | 26 Jun, 2026 | Packagist web-auth/webauthn-symfony-bundle |
Pterodactyl Panel: Client email change endpoint allows enumeration of accounts in system GHSA-j7f5-gfqm-pcx3 | Medium | Not scored | 26 Jun, 2026 | Packagist pterodactyl/panel |
Snipe-IT has Improper Authorization in File Deletion (IDOR) CVE-2026-55519, GHSA-x667-r589-43m7 | Medium | 0.4% | 23 Jun, 2026 | Packagist snipe/snipe-it |
Snipe-IT Vulnerable to Privilege Escalation via Missing admin Permission Check in User Creation CVE-2026-55483, GHSA-hf68-g98v-wp9g | Medium | 0.4% | 23 Jun, 2026 | Packagist snipe/snipe-it |
Snipe-IT has Multi-Tenancy Bypass via Bulk Asset Update CVE-2026-55482, GHSA-33g4-646g-qwmm | Medium | 0.3% | 23 Jun, 2026 | Packagist snipe/snipe-it |
Snipe-IT has a 2FA reset privilege bypass CVE-2026-50550, GHSA-6x4j-8954-5hxm | Medium | 0.3% | 23 Jun, 2026 | Packagist snipe/snipe-it |
Snipe-IT Vulnerable to User Account Escalation via CSV Import CVE-2026-49976, GHSA-p68w-rgmg-3c2v | Medium | 0.5% | 23 Jun, 2026 | Packagist snipe/snipe-it |
Snipe-IT's TOTP is Brute-Forceable Due to Missing Rate Limiting on `POST /two-factor` CVE-2026-49870, GHSA-mr8g-2mj4-pcq2 | Medium | 0.4% | 23 Jun, 2026 | Packagist snipe/snipe-it |
Snipe-IT Vulnerable to Privilege Escalation for self via API Permissions Assignment CVE-2026-48493, GHSA-52fw-7fw2-fmv5 | Medium | 0.3% | 23 Jun, 2026 | Packagist snipe/snipe-it |
Snipe-IT's selectlist visibility is too permissive CVE-2026-48492, GHSA-f3c5-6cw8-fg57 | Medium | 0.4% | 23 Jun, 2026 | Packagist snipe/snipe-it |
AVideo Meet plugin: anonymous-to-admin stored XSS via unescaped participant User-Agent in getMeetInfo.json.php Participants panel CVE-2026-60092, GHSA-7cqp-7cfv-6c3q | Medium | 0.3% | 23 Jun, 2026 | Packagist wwbn/avideo |
Filament: Unauthenticated temporary file upload on auth pages CVE-2026-48500, GHSA-44wp-g8f4-f4v5 | Medium | 0.3% | 22 Jun, 2026 | Packagist filament/filament |
Filament: Unvalidated ImageColumn and ImageEntry values can be used for XSS CVE-2026-48167, GHSA-3fc8-8hp6-6jr4 | Medium | 0.2% | 22 Jun, 2026 | Packagist filament/infolists Packagist filament/tables |
Filament: Timing-based user enumeration on login page CVE-2026-48166, GHSA-5w46-g9pq-wh6f | Medium | 0.3% | 22 Jun, 2026 | Packagist filament/filament |
Paymenter has broken object level authorization via service reference manipulation on ticket creation CVE-2026-44585, GHSA-x93q-x9pc-w5hw | Medium | 0.3% | 22 Jun, 2026 | Packagist paymenter/paymenter |
Paymenter doesn't reset email verification status after email change CVE-2026-44584, GHSA-rv89-wch8-c574 | Medium | 0.2% | 22 Jun, 2026 | Packagist paymenter/paymenter |
Paymenter has Blind Unauthenticated SSRF on the Paypal gateway module CVE-2026-44583, GHSA-7wwh-xcc3-9fcg | Medium | 0.4% | 22 Jun, 2026 | Packagist paymenter/paymenter |
AVideo has an Authorize.Net Webhook Signature Bypass that Enables Wallet Balance Inflation via Forged Payment Data CVE-2026-33731, GHSA-95jh-7r58-xmxw | Medium | 0.2% | 22 Jun, 2026 | Packagist wwbn/avideo |
AVideo's Privilege Escalation via Unguarded Permission Parameters in signUp API Allows Self-Granting Upload/Stream/Meet Permissions CVE-2026-33684, GHSA-8j8m-p79x-g4jm | Medium | 0.2% | 22 Jun, 2026 | Packagist wwbn/avideo |
Craft CMS: Authenticated "assets/preview-thumb" discloses signed fallback transform preview link to CP users without asset-view permission CVE-2026-56384, GHSA-x76w-8c62-48mg | Medium | 0.3% | 21 Jun, 2026 | Packagist craftcms/cms |
symfony/ux-icons: XSS via unsanitized SVG content in local files and Iconify on-demand responses CVE-2026-55877, GHSA-6v8j-33hc-mv84 | Medium | 0.3% | 19 Jun, 2026 | Packagist symfony/ux-icons |
Craft Commerce: Coupon Code Brute-Force via Rate Limit Bypass CVE-2026-55795, GHSA-h5gm-x9wr-vhcm | Medium | 0.5% | 19 Jun, 2026 | Packagist craftcms/commerce |
Craft Commerce: Partial Payment Amount Without Lower Bound Validation GHSA-78vr-q6cf-c7p6 | Medium | Not scored | 19 Jun, 2026 | Packagist craftcms/commerce |
symfony/ux-autocomplete: XSS via unescaped AJAX response data CVE-2026-49216, GHSA-mwqm-4fw3-cjvr | Medium | 0.3% | 19 Jun, 2026 | Packagist symfony/ux-autocomplete |
symfony/ux-live-component: LiveComponentHydrator HMAC checksum lacks component and slot binding CVE-2026-49212, GHSA-34w5-c283-j9fg | Medium | 0.2% | 19 Jun, 2026 | Packagist symfony/ux-live-component |
symfony/ux-autocomplete: Information exposure via unescaped LIKE wildcards in EntitySearchUtil CVE-2026-49211, GHSA-946h-jp5c-8fvh | Medium | 0.5% | 19 Jun, 2026 | Packagist symfony/ux-autocomplete |