Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
SymfonyRuntime CVE-2024-50340 Patch Bypass: Web Requests Can Still Set APP_ENV/APP_DEBUG via parse_str/SAPI Argv Mismatch CVE-2026-47767, GHSA-fqc7-9xjw-jrh3 | High | 0.7% | 09 Jun, 2026 | Packagist symfony/runtime Packagist symfony/symfony |
LimeSurvey has a SQL Injection issue CVE-2026-50636, GHSA-pr6f-87hf-hx24 | High | 0.4% | 09 Jun, 2026 | Packagist limesurvey/limesurvey |
LimeSurvey constructs account password-reset links from the client-supplied HTTP Host header without validating it. CVE-2026-50635, GHSA-5c37-5j7w-8mh8 | High | 0.4% | 09 Jun, 2026 | Packagist limesurvey/limesurvey |
TYPO3 CMS has Broken Access Control in its Media Module CVE-2026-49742, GHSA-chm7-4vch-h8vr | High | 0.3% | 09 Jun, 2026 | Packagist typo3/cms-core Packagist typo3/cms-filelist |
TYPO3 CMS has Privilege Escalation & SQL Injection in its Form Framework CVE-2026-49741, GHSA-jh32-v29g-68pq | High | 0.2% | 09 Jun, 2026 | Packagist typo3/cms-core Packagist typo3/cms-form |
TYPO3 CMS has Broken Access Control in its Form Framework CVE-2026-47346, GHSA-hwvq-2w67-rvxp | High | 0.3% | 09 Jun, 2026 | Packagist typo3/cms-core Packagist typo3/cms-form |
TYPO3 CMS: Destructive Actions on File Mount Folders CVE-2026-47343, GHSA-3v8v-4wg6-r7qh | High | 0.2% | 09 Jun, 2026 | Packagist typo3/cms-core |
TYPO3 CMS has Broken Access Control in its Form Framework CVE-2026-11607, GHSA-pjpj-v387-x4vq | High | 0.2% | 09 Jun, 2026 | Packagist typo3/cms-core Packagist typo3/cms-form |
Snipe-IT: Bulk editing users allowed `ldap_import` and `activated_in` bulk editing users CVE-2026-48507, GHSA-6f75-x745-xcpr | High | 0.2% | 08 Jun, 2026 | Packagist snipe/snipe-it |
Twig: Sandbox: multiple `__toString()` policy bypasses via unguarded string coercion points CVE-2026-47732, GHSA-pr2w-4gpj-cpq4 | High | 0.4% | 05 Jun, 2026 | Packagist twig/twig |
Shopper: Multiple data integrity and disclosure issues in admin Livewire components CVE-2026-47743, GHSA-hr9v-r8r2-hg7j | High | 0.4% | 05 Jun, 2026 | Packagist shopper/framework |
WWBN AVideo: Stored XSS via autoEvalCodeOnHTML Bypass in MessageSQLite WebSocket Handler (CVE-2026-43874 Bypass) CVE-2026-49279, GHSA-2fhx-q92v-5fhv | High | 0.4% | 04 Jun, 2026 | Packagist wwbn/avideo |
Froxlor's API Authentication bypasses 2FA Authentication CVE-2026-52793, GHSA-f9rx-7wf7-jr36 | High | 0.3% | 03 Jun, 2026 | Packagist froxlor/froxlor |
Froxlor: BIND Zone File Injection via TXT Record Content CVE-2026-41234, GHSA-37m5-m4q3-fc6x | High | 0.3% | 03 Jun, 2026 | Packagist froxlor/froxlor |
Concrete CMS is vulnerable to PHP Object Injection via unserialize() calls in the Workflow, Form block, and File/Set components CVE-2026-7888, GHSA-52pr-7vmf-2w7x | High | 0.2% | 03 Jun, 2026 | Packagist concrete5/concrete5 |
Admidio has IDOR in `documents-files.php` `mode=move_save` that lets any folder-uploader exfiltrate files from private folders CVE-2026-47231, GHSA-x628-457g-2pw9 | High | 0.4% | 29 May, 2026 | Packagist admidio/admidio |
Spatie Laravel Media Library contains a file upload restriction bypass CVE-2026-48557, GHSA-3ggm-c5m7-hfv5 | High | 0.4% | 29 May, 2026 | Packagist spatie/laravel-medialibrary |
formie's unauthenticated front-end submission editing can overwrite existing submissions CVE-2026-47266, GHSA-pgxq-p76c-x9cg | High | 0.3% | 29 May, 2026 | Packagist verbb/formie |
Koel Vulnerable to SSRF via Podcast Episode Enclosure URLs CVE-2026-47260, GHSA-7j2f-6h2r-6cqc | High | 0.3% | 29 May, 2026 | Packagist phanan/koel |
ezsystems/ezpublish-legacy has a SQL injection in dfscleanup CVE-2026-38739, GHSA-xg9x-h37w-h3r3 | High | Not scored | 29 May, 2026 | Packagist ezsystems/ezpublish-legacy |
Froxlor has an incomplete fix for CVE-2026-30932 CVE-2026-41237, GHSA-j6fm-9rfm-j5hx | High | 0.3% | 29 May, 2026 | Packagist froxlor/froxlor |
Froxlor has privilege escalation in SSH key synchronization via symlinked `authorized_keys` path CVE-2026-41236, GHSA-mq5v-pxpm-8jw2 | High | 0.4% | 29 May, 2026 | Packagist froxlor/froxlor |
Froxlor has an authorization bypass in FTP shell assignment via missing server-side `available_shells` enforcement CVE-2026-41235, GHSA-gcv3-5v9q-fmhh | High | 0.2% | 29 May, 2026 | Packagist froxlor/froxlor |
WWBN AVideo: Authenticated wallet credit bypass in AuthorizeNet processPayment endpoint CVE-2026-47696, GHSA-9392-pj54-qqf8 | High | 0.1% | 29 May, 2026 | Packagist WWBN/AVideo |
Mautic has Stored Cross-Site Scripting (XSS) in Projects Component CVE-2026-9809, GHSA-7h65-whp7-rgqf | High | 0.2% | 29 May, 2026 | Packagist mautic/core |
Mautic has an Authorization Bypass in API v2 Endpoints CVE-2026-9808, GHSA-2jrw-c95w-h43g | High | 0.2% | 29 May, 2026 | Packagist mautic/core |
Mautic has SQL Injection in API Contact Filtering CVE-2026-4776, GHSA-fcmw-wx57-9p75 | High | 0.2% | 29 May, 2026 | Packagist mautic/core |
Symfony's JsonPath Evaluates Attacker-Controlled Regular Expressions in match()/search() Without Limits — ReDoS CVE-2026-45756, GHSA-8v8v-g73j-492j | High | 0.6% | 28 May, 2026 | Packagist symfony/json-path Packagist symfony/symfony |
TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments CVE-2026-47762, GHSA-v98h-vmpc-fpqv | High | 0.3% | 28 May, 2026 | NuGet TinyMCE Packagist tinymce/tinymce npm tinymce |
TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection CVE-2026-47761, GHSA-vg35-5wq7-3x7w | High | 0.3% | 28 May, 2026 | NuGet TinyMCE Packagist tinymce/tinymce npm tinymce |
TinyMCE Cross-Site Scripting (XSS) vulnerability using sanitization bypass through nested SVGs CVE-2026-47760, GHSA-mh5m-5hw4-5c69 | High | 0.2% | 28 May, 2026 | NuGet TinyMCE Packagist tinymce/tinymce npm tinymce |
TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes CVE-2026-47759, GHSA-q742-qvgc-gc2f | High | 0.3% | 28 May, 2026 | NuGet TinyMCE Packagist tinymce/tinymce npm tinymce |
Pimcore has a CustomReports Share Bypass CVE-2026-45704, GHSA-jwcc-gv4m-93x6 | High | 0.4% | 27 May, 2026 | Packagist pimcore/pimcore |
Symfony's YAML Parser has a ReDoS via Catastrophic Backtracking in Parser::cleanup() Regex CVE-2026-45305, GHSA-9frc-8383-795m | High | 0.7% | 27 May, 2026 | Packagist symfony/symfony Packagist symfony/yaml |
Symfony's YAML Parser Vulnerable to Exponential Memory Allocation via Recursive Collection-Alias Expansion ("Billion Laughs") CVE-2026-45304, GHSA-4qpc-3hr4-r2p4 | High | 0.7% | 27 May, 2026 | Packagist symfony/symfony Packagist symfony/yaml |
Symfony hardened the parser when handling untrusted input CVE-2026-45133, GHSA-c2p3-7m5p-cv8x | High | 0.6% | 27 May, 2026 | Packagist symfony/symfony Packagist symfony/yaml |
Automad has Broken Access Control: Unauthenticated exposure of administrator bcrypt password hashes and TOTP secrets via public API endpoint CVE-2026-45332, GHSA-xm76-r88j-vm3g | High | 1.4% | 27 May, 2026 | Packagist automad/automad |
Symfony has Unauthenticated PHP Object Deserialization in MonologBridge server:log Listener CVE-2026-45077, GHSA-m7v2-7gxm-vc2v | High | 0.7% | 27 May, 2026 | Packagist symfony/monolog-bridge Packagist symfony/symfony |
Symfony's HEAD Request Bypasses methods: ['GET'] Filter in #[IsGranted] / #[IsSignatureValid] / #[IsCsrfTokenValid] CVE-2026-45075, GHSA-6439-2f28-8p8q | High | 0.4% | 27 May, 2026 | Packagist symfony/http-kernel Packagist symfony/security-http Packagist symfony/symfony |
Symfony's Cas2Handler Derives CAS service URL from Client Host Header → Cross-Service Ticket Replay CVE-2026-45074, GHSA-j8gj-9rm5-4xhx | High | 0.5% | 27 May, 2026 | Packagist symfony/security-http Packagist symfony/symfony |
Symfony has XXE (Local File Disclosure) in DomCrawler::addXmlContent() via validateOnParse = true CVE-2026-45071, GHSA-x6g4-fwcc-jj8w | High | 0.6% | 27 May, 2026 | Packagist symfony/dom-crawler Packagist symfony/symfony |
Symfony's OidcTokenHandler Accepts JWTs Missing aud/iss/exp Claims CVE-2026-45069, GHSA-29fc-p6c4-24cg | High | 0.3% | 27 May, 2026 | Packagist symfony/security-http Packagist symfony/symfony |
Symfony has an Argument Injection in SendmailTransport via Dash-Prefixed Recipient Address CVE-2026-45068, GHSA-xx3c-qf5g-hc39 | High | 0.5% | 27 May, 2026 | Packagist symfony/mailer Packagist symfony/symfony |
Symfony has Email Header / SMTP Command Injection via CRLF in Symfony\Component\Mime\Address CVE-2026-45067, GHSA-qpmx-3rfj-7rhv | High | 0.6% | 27 May, 2026 | Packagist symfony/mime Packagist symfony/symfony |
Kirby CMS vulnerable to cross-site scripting (XSS) from links in KirbyTags and image blocks in the site frontend CVE-2026-45368, GHSA-qvjf-922g-pj44 | High | 0.5% | 27 May, 2026 | Packagist getkirby/cms |
Pimcore: Missing Authorization in WebDAV MOVE via unchecked asset move handling CVE-2026-45260, GHSA-wc7j-g8wx-m2qx | High | 0.6% | 27 May, 2026 | Packagist pimcore/pimcore |
Pimcore has Unsafe PHP Deserialization in Multiple Locations Without allowed_classes Restriction CVE-2026-45162, GHSA-36fc-7wjg-mfvj | High | 1.0% | 27 May, 2026 | Packagist pimcore/pimcore |
Pimcore Admin Classic Bundle Vulnerable to SQL Injection in Translation Grid Date Filter via Unsanitized Property Parameter CVE-2026-44741, GHSA-h4ph-crvj-9h92 | High | 0.5% | 27 May, 2026 | Packagist pimcore/admin-ui-classic-bundle |
Pimcore Vulnerable to SQL Injection in Custom Reports Column Configuration CVE-2026-44739, GHSA-3234-gxc3-pq6f | High | 0.4% | 27 May, 2026 | Packagist pimcore/pimcore |
Kirby CMS has pre-authentication path traversal and PHP file inclusion during user lookup CVE-2026-44177, GHSA-9hx7-c53c-v6x8 | High | 1.8% | 26 May, 2026 | Packagist getkirby/cms |