Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Craft CMS: Stored XSS in the control panel via unescaped draft name CVE-2026-72787, GHSA-2rp4-x2j7-qmcc | Medium | 0.3% | 06 Aug, 2026 | Packagist craftcms/cms |
PHP_CodeSniffer gitblame report command injection via crafted filename CVE-2026-67434, GHSA-hmqg-cxww-wqhq | High | 1.1% | 06 Aug, 2026 | Packagist squizlabs/php_codesniffer |
Craft CMS: Arbitrary user password reset leading to administrator account takeover CVE-2026-72786, CVE-2026-79989, GHSA-p8x7-9vfw-p7vc | High | 0.5% | 06 Aug, 2026 | Packagist craftcms/cms |
Craft CMS: Authenticated RCE through Twig sandbox escape CVE-2026-72781, GHSA-f5wm-88jv-g5hx | High | 0.8% | 06 Aug, 2026 | Packagist craftcms/cms |
Craft CMS: Authenticated RCE via `condition.config` JSON cleanse bypass CVE-2026-72778, GHSA-265m-7826-wjqm | High | 0.8% | 06 Aug, 2026 | Packagist craftcms/cms |
league/commonmark: Denial of service via deeply nested XML output GHSA-mj63-m3rc-8ppr | Medium | Not scored | 06 Aug, 2026 | Packagist league/commonmark |
league/commonmark: Denial of service via colliding heading slugs CVE-2026-86434, GHSA-mh25-x5hq-wrqp | High | 0.5% | 06 Aug, 2026 | Packagist league/commonmark |
league/commonmark: Denial of service via duplicate footnote definitions GHSA-jfm3-95jq-q3rf | High | Not scored | 06 Aug, 2026 | Packagist league/commonmark |
league/commonmark: Denial of service via adjacent inline attribute blocks GHSA-g2gp-3wwq-f4ph | High | Not scored | 06 Aug, 2026 | Packagist league/commonmark |
league/commonmark: Quadratic-time denial of service when parsing crafted Markdown CVE-2026-71488, GHSA-2q4p-g7hv-5rgv | High | 0.6% | 06 Aug, 2026 | Packagist league/commonmark |
league/commonmark: AttributesExtension href/src unsafe-link filter bypass via embedded control bytes CVE-2026-71478, GHSA-29pj-957v-52mc | Medium | 0.4% | 06 Aug, 2026 | Packagist league/commonmark |
Silverstripe: XSS in breadcrumbs in page list view CVE-2026-54717, GHSA-w3cp-g2pf-65wh | Medium | 0.3% | 06 Aug, 2026 | Packagist silverstripe/cms |
Statamic: Stored Cross-Site Scripting in Automagic Form Notification Email Template CVE-2026-71435, GHSA-vx89-p3j7-8xqc | Medium | 0.3% | 06 Aug, 2026 | Packagist statamic/cms |
Statamic: Missing file upload validation on frontend forms allows uploading disallowed file types CVE-2026-71434, GHSA-qhr7-v3xp-vw9m | Medium | 0.4% | 06 Aug, 2026 | Packagist statamic/cms |
Statamic: Missing authorization on navigation endpoint allows disclosure of restricted entries CVE-2026-64662, GHSA-qh8c-7588-qfrv | Medium | 0.4% | 06 Aug, 2026 | Packagist statamic/cms |
Statamic: Unsafe method invocation via Antlers template resolution allows data destruction CVE-2026-64663, GHSA-j2vp-f2pv-5rj4 | Medium | 0.4% | 06 Aug, 2026 | Packagist statamic/cms |
Statamic: Account takeover via OAuth email matching without email-verification check CVE-2026-64665, GHSA-93qh-5269-9wcf | High | 0.5% | 06 Aug, 2026 | Packagist statamic/cms |
Statamic: Missing authorization on Control Panel endpoint allows disclosure of user existence CVE-2026-64664, GHSA-225x-3jhx-wh4q | Medium | 0.3% | 06 Aug, 2026 | Packagist statamic/cms |
Statamic CMS exposes two-factor recovery codes through dynamic Antlers rendering CVE-2026-71293, GHSA-jppw-r5j3-xf7x | Medium | 0.4% | 05 Aug, 2026 | Packagist statamic/cms |
Guzzle: Noncanonical host can bypass host-based checks CVE-2026-69246, GHSA-v5mv-p594-2x33 | High | 0.4% | 03 Aug, 2026 | Packagist guzzlehttp/guzzle |
Guzzle: Noncanonical cookie domain keeps subdomain scope CVE-2026-69245, GHSA-f7vp-7xgx-4w4r | Medium | 0.2% | 03 Aug, 2026 | Packagist guzzlehttp/guzzle |
Grav: Path Traversal in ImageMedium::watermark() — arbitrary file disclosure via publicly-cached images CVE-2026-69089, GHSA-w3f4-8pj2-599w | High | 0.5% | 03 Aug, 2026 | Packagist getgrav/grav |
Grav: Incomplete callable validation in blueprint dynamic fields allows arbitrary static method invocation and file disclosure CVE-2026-69088, GHSA-7pgq-cr25-xvc8 | High | 0.3% | 03 Aug, 2026 | Packagist getgrav/grav |
WPGraphQL has deprecated `user` field on SendPasswordResetEmailPayload that leaks user existence + profile (defeats explicit anti-enumeration design) CVE-2026-54768, GHSA-jhh7-832h-f8hv | Medium | 0.4% | 31 Jul, 2026 | Packagist wp-graphql/wp-graphql |
Contao: Possible path traversal in job download URIs CVE-2026-55825, GHSA-grm4-wm43-9jh5 | Low | 0.3% | 31 Jul, 2026 | Packagist contao/contao Packagist contao/core-bundle |
Redaxo has a Mediapool isAllowedExtension bypass via multi-segment filename that leads to authenticated RCE on Apache mod_php multi-extension handlers CVE-2026-53599, GHSA-98pp-vccm-qm25 | High | 0.5% | 31 Jul, 2026 | Packagist redaxo/source |
Contao: Server-Side Request Forgery (SSRF) via Unvalidated RSS Feed URL in Feed Reader Module CVE-2026-57232, GHSA-87mg-5grr-rhwh | Low | 0.3% | 31 Jul, 2026 | Packagist contao/contao Packagist contao/core-bundle |
Contao crawler leaks auth credentials to external hosts CVE-2026-55824, GHSA-3mr9-p497-58f6 | Low | 0.2% | 31 Jul, 2026 | Packagist contao/contao Packagist contao/core-bundle |
CodeIgniter: Uploaded file extension validation bypass in `is_image` and `mime_in` rules CVE-2026-63223, GHSA-mmj4-63m4-r6h5 | Critical | 0.8% | 31 Jul, 2026 | Packagist codeigniter4/framework |
CodeIgniter: Path traversal in UploadedFile::move() when using client-provided filenames CVE-2026-63222, GHSA-hhmc-q9hp-r662 | High | 0.6% | 31 Jul, 2026 | Packagist codeigniter4/framework |
CodeIgniter: SQL injection in Query Builder deleteBatch() when used with where() conditions CVE-2026-63221, GHSA-c9w5-rwh3-7pm9 | Critical | 0.6% | 31 Jul, 2026 | Packagist codeigniter4/framework |
CodeIgniter: Spoofable forwarded HTTPS headers in IncomingRequest::isSecure() CVE-2026-63220, GHSA-7wmf-pw8j-mc78 | Medium | 0.2% | 31 Jul, 2026 | Packagist codeigniter4/framework |
Sylius Mollie Plugin has unauthenticated IDOR that leaks order token and customer PII CVE-2026-68501, GHSA-x83g-979r-f5fh | Medium | 0.6% | 30 Jul, 2026 | Packagist sylius/mollie-plugin |
Sylius Mollie Plugin vulnerable to payment status forgery via the payment webhook CVE-2026-68500, GHSA-rc52-c4hv-w89p | High | 0.7% | 30 Jul, 2026 | Packagist sylius/mollie-plugin |
Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions CVE-2026-54593, GHSA-8r6w-3qq5-4p4r, GO-2026-6120 | High | 0.7% | 28 Jul, 2026 | Go github.com/pterodactyl/wings Packagist pterodactyl/panel |
Pterodactyl's shared global rate-limit key on login and 2FA checkpoint enables unauthenticated panel-wide authentication lockout (DoS) CVE-2026-61609, GHSA-xvc3-826v-xf47 | High | 0.5% | 28 Jul, 2026 | Packagist pterodactyl/panel |
WordPress Coding Standards (WordPressCS) contains an arbitrary code execution vulnerability CVE-2026-45293, GHSA-3pwp-g2mj-5p3v | High | 0.2% | 28 Jul, 2026 | Packagist wp-coding-standards/wpcs |
Apache Thrift Python, Go, PHP and Java bindings have an Infinite Loop BIT-thrift-2026-43871, CVE-2026-43871, GHSA-8wv5-x4w7-5gww, PYSEC-2026-3926 | High | 1.0% | 27 Jul, 2026 | Go github.com/apache/thrift Maven org.apache.thrift:libthrift Packagist apache/thrift PyPI thrift |
Poweradmin: OIDC `sub` collation bypass in Poweradmin leading to account takeover GHSA-cmwh-g2h8-c222 | High | Not scored | 24 Jul, 2026 | Packagist poweradmin/poweradmin |
Poweradmin: Broken access control (IDOR): any zone owner can modify DNS records in zones they do not own GHSA-rm67-g9ch-vxff | High | Not scored | 24 Jul, 2026 | Packagist poweradmin/poweradmin |
Poweradmin: API user-update endpoint leads to a non-admin reset any user's password and take over the superuser account GHSA-h4hf-v6w5-897x | High | Not scored | 24 Jul, 2026 | Packagist poweradmin/poweradmin |
Pheditor: Authentication Bypass in Forced Password-Change Flow via Unverified Current Password GHSA-f25v-x6vr-962g | Critical | Not scored | 24 Jul, 2026 | Packagist pheditor/pheditor |
Pheditor: Terminal command-allowlist bypass via argument injection leads to RCE — surviving vector after the metacharacter-sanitization fixes GHSA-g3hq-hphg-8fhh | High | Not scored | 24 Jul, 2026 | Packagist pheditor/pheditor |
PHPSpreadsheet: XLS/OLE sector-chain self-loop causes memory exhaustion CVE-2026-59933, GHSA-xh5m-36r6-47m3 | High | 0.5% | 23 Jul, 2026 | Packagist phpoffice/phpspreadsheet |
PHPSpreadsheet: Gnumeric reader unbounded gzip expansion causes memory exhaustion CVE-2026-59932, GHSA-2mrg-gjxq-2gvr | High | 0.5% | 23 Jul, 2026 | Packagist phpoffice/phpspreadsheet |
PHPSpreadsheet: SSRF bypass via HTTP redirect in WEBSERVICE() domain whitelist CVE-2026-59931, GHSA-6hq5-7373-42rg | High | 0.5% | 23 Jul, 2026 | Packagist phpoffice/phpspreadsheet |
Grav: FlexDirectory::dynamicDataField() executes arbitrary callables from blueprint data with no validation CVE-2026-65608, GHSA-c4wf-2xxc-68qm | High | 1.1% | 23 Jul, 2026 | Packagist getgrav/grav |
Dompdf: Embedded SVG images can leak existence of files and directories within the filesystem CVE-2026-59943, GHSA-j8qw-6jw8-r297 | Medium | 0.4% | 22 Jul, 2026 | Packagist dompdf/dompdf |
Dompdf: Denial of Service (DoS) via Resource Exhaustion using Oversized Image Bitmaps CVE-2026-59942, GHSA-f5gf-2cj8-52g2 | Medium | 0.9% | 22 Jul, 2026 | Packagist dompdf/dompdf |
Dompdf: Uncontrolled resource consumption based on declared BMP dimensions CVE-2026-59941, GHSA-8hg6-c449-896m | Medium | 0.6% | 22 Jul, 2026 | Packagist dompdf/dompdf |