Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Kirby CMS vulnerable to cross-site scripting (XSS) from list field content in the site frontend CVE-2026-44175, GHSA-5fhx-9q32-q257 | High | 0.4% | 26 May, 2026 | Packagist getkirby/cms |
Kirby CMS has an Arbitrary Method Call via REST API Search and Collection Query Endpoints CVE-2026-44174, GHSA-86rh-h242-j8xp | High | 0.5% | 26 May, 2026 | Packagist getkirby/cms |
Twig: Arbitrary PHP code execution via `_self.(<string>)` macro-reference compilation CVE-2026-46640, GHSA-45vw-wh46-2vx8 | High | 0.6% | 21 May, 2026 | Packagist twig/twig |
Twig: Sandbox property and method bypass via object-destructuring assignment CVE-2026-46639, GHSA-mm6w-gr99-p3jj | High | 0.4% | 21 May, 2026 | Packagist twig/twig |
Twig: `template_from_string()` escapes a SourcePolicy-driven sandbox via synthesized template name CVE-2026-46634, GHSA-24x9-r6q4-q93w | High | 0.6% | 21 May, 2026 | Packagist twig/twig |
Concrete CMS is Vulnerable to Cross-Site Request Forgery CVE-2026-8428, GHSA-prxr-vjgc-2cq9 | High | 0.1% | 21 May, 2026 | Packagist concrete5/concrete5 |
Concrete CMS does not validate a CSRF token before processing requests to `/dashboard/extend/update/prepare_remote_upgrade/<remoteMPID>` CVE-2026-8426, GHSA-5rj5-gfmr-hrc3 | High | 0.2% | 21 May, 2026 | Packagist concrete5/concrete5 |
Concrete CMS contains a CSRF vulnerability CVE-2026-8421, GHSA-4c8m-6fwx-m7xq | High | 0.2% | 21 May, 2026 | Packagist concrete5/concrete5 |
Concrete does not validate a CSRF token before processing requests to `/dashboard/extend/update/do_update/<pkgHandle>` CVE-2026-8417, GHSA-jr5g-qv3g-rxxx | High | 0.1% | 21 May, 2026 | Packagist concrete5/concrete5 |
Concrete CMS is vulnerable to missing authorization in the bulk_user_assignment.php CVE-2026-8350, GHSA-g7xp-jf3x-wcx4 | High | 0.3% | 21 May, 2026 | Packagist concrete5/concrete5 |
Concrete CMS has Stored XSS through its height parameter CVE-2026-8203, GHSA-9v2g-37mp-qpxf | High | 0.1% | 21 May, 2026 | Packagist concrete5/concrete5 |
Concrete CMS is vulnerable to Stored XSS via OAuth integration name CVE-2026-8197, GHSA-h72c-xx3w-w8h7 | High | 0.2% | 21 May, 2026 | Packagist concrete5/concrete5 |
Concrete CMS is Vulnerable to Cross-Site Request Forgery CVE-2026-8140, GHSA-r42c-3rr2-jrfp | High | 0.1% | 21 May, 2026 | Packagist concrete5/concrete5 |
Concrete CMS Vulnerable to Deserialization of Untrusted Data CVE-2026-8135, GHSA-pv2v-6w2v-97x6 | High | 0.5% | 21 May, 2026 | Packagist concrete5/concrete5 |
Snappy: Binary path is never shell-escaped due to an inverted is_executable check CVE-2026-46643, GHSA-vpr4-p6fq-85jc | High | 0.2% | 21 May, 2026 | Packagist KnpLabs/knp-snappy |
phpMyFAQ: Missing Password Reset Token Allows Account Takeover via Username/Email Enumeration CVE-2026-35675, GHSA-w9xh-5f39-vq89 | High | 0.4% | 20 May, 2026 | Packagist phpmyfaq/phpmyfaq Packagist thorsten/phpmyfaq |
phpMyFAQ: Default Empty API Token Authentication Bypass CVE-2026-35672, GHSA-gp95-j463-vv28 | High | 0.5% | 20 May, 2026 | Packagist phpmyfaq/phpmyfaq Packagist thorsten/phpmyfaq |
phpMyFAQ: IDOR Account Takeover CVE-2026-35671, GHSA-xvp4-phqj-cjr3 | High | 0.4% | 20 May, 2026 | Packagist phpmyfaq/phpmyfaq Packagist thorsten/phpmyfaq |
phpMyFAQ: Unauthenticated Password Reset Endpoint Allows User Enumeration and Forced Password Change Without Token Validation CVE-2026-35676, GHSA-9qv9-8xv6-5p35 | High | 0.3% | 20 May, 2026 | Packagist phpmyfaq/phpmyfaq Packagist thorsten/phpmyfaq |
Twig: Possible sandbox bypass when using a source policy CVE-2026-24425, GHSA-2q52-x2ff-qgfr | High | 0.8% | 20 May, 2026 | Packagist twig/twig |
Github Actions issued GITHUB_TOKEN disclosure in GitHub Actions logs BIT-composer-2026-45793, CVE-2026-45793, GHSA-f9f8-rm49-7jv2 | High | 1.0% | 19 May, 2026 | Packagist composer/composer |
BillaBear is Vulnerable to SQL Injection in the EventRepository CVE-2026-31069, GHSA-xp6r-8pcc-xv5p | High | 0.4% | 19 May, 2026 | Packagist billabear/billabear |
TYPO3 SQL Injection in extension "Address List" (tt_address) CVE-2026-8827, GHSA-3h52-6v6j-6wwv | High | 0.3% | 19 May, 2026 | Packagist friendsoftypo3/tt-address |
TYPO3 Remote Code Execution in extension "Site Crawler" (crawler) CVE-2026-8727, GHSA-jr8m-x4p7-p3v5 | High | 0.4% | 19 May, 2026 | Packagist tomasnorre/crawler |
georgringer/news has SQL Injection in extension "News system" (news) CVE-2026-8726, GHSA-g868-j3qm-4j28 | High | 0.4% | 19 May, 2026 | Packagist georgringer/news |
shopper/framework: Authorization bypass in multiple Livewire admin components CVE-2026-47740, GHSA-f946-9qp6-vgch | High | 0.3% | 18 May, 2026 | Packagist shopper/framework |
CI4MS: Stored XSS in Pages Module Content via Broken html_purify Validation Rule CVE-2026-45270, GHSA-gqr2-7hcg-rchf | High | 0.3% | 18 May, 2026 | Packagist ci4-cms-erp/ci4ms |
AVideo: OS command injection in on_publish.php execAsync via unescaped m3u8 URL CVE-2026-45578, GHSA-xw67-cg5f-4m2r | High | 0.3% | 15 May, 2026 | Packagist WWBN/AVideo |
SimpleSAMLphp casserver FileSystemTicketStore path traversal allows out-of-ticket-directory read/unserialize and conditional deletion CVE-2026-46491, GHSA-jrrg-99xh-5j2q | High | 0.4% | 15 May, 2026 | Packagist simplesamlphp/simplesamlphp-module-casserver |
Authenticated Sharp users can download unrelated Laravel Storage objects through the generic download endpoint CVE-2026-44692, GHSA-748w-hm6r-qc7v | High | 0.3% | 15 May, 2026 | Packagist code16/sharp |
NukeViet CMS: Stored Cross-Site Scripting (XSS) via insufficient server-side input sanitization in Request class CVE-2026-41147, GHSA-64rr-pp78-62ww | High | 0.4% | 15 May, 2026 | Packagist nukeviet/nukeviet |
CoreShop Vulnerable to Remote Code Execution (RCE) via Insecure `pull_request_target` Configuration CVE-2026-41249, GHSA-q58j-g3f4-h26h | High | 0.5% | 14 May, 2026 | Packagist coreshop/core-shop |
MantisBT Vulnerable to Stored XSS in File Download CVE-2026-44657, GHSA-p6fr-rxq7-xcg8 | High | 0.3% | 11 May, 2026 | Packagist mantisbt/mantisbt |
MantisBT has Stored XSS on Move Attachments Admin Page CVE-2026-44655, GHSA-7mqj-8gj2-cg59 | High | 0.3% | 11 May, 2026 | Packagist mantisbt/mantisbt |
MantisBT has a Private Bugnote Attachment Content Leak via REST API CVE-2026-42071, GHSA-pw5x-2mf9-3xc8 | High | 0.3% | 11 May, 2026 | Packagist mantisbt/mantisbt |
MantisBT is Vulnerable to Stored XSS in Saved-Filter Owner Column CVE-2026-40607, GHSA-f633-865q-2mhh | High | 0.4% | 11 May, 2026 | Packagist mantisbt/mantisbt |
MantisBT has a Content Security Policy bypass via attachments CVE-2026-40597, GHSA-9c3j-xm6v-j7j3 | High | 0.5% | 11 May, 2026 | Packagist mantisbt/mantisbt |
MantisBT is Vulnerable to XSS leading to account takeover via updating a user's font family preference CVE-2026-40596, GHSA-j3v9-553h-x28j | High | 0.4% | 11 May, 2026 | Packagist mantisbt/mantisbt |
Yii 2: Local file inclusion via view parameter name collision CVE-2026-39850, GHSA-5vpg-rj7q-qpw2 | High | 0.5% | 11 May, 2026 | Packagist yiisoft/yii2 |
MantisBT is Vulnerable to Stored HTML Injection/XSS in Clone Issue Form CVE-2026-34463, GHSA-fvjf-68wh-rwp2 | High | 0.4% | 11 May, 2026 | Packagist mantisbt/mantisbt |
Grav: Twig sandbox allows editor-role users to exfiltrate all plugin secrets via Config::toArray() CVE-2026-44738, GHSA-j274-39qw-32c9 | High | 0.3% | 11 May, 2026 | Packagist getgrav/grav |
elFinder MySQL has a SQL Injection in its Volume Driver (elFinderVolumeMySQL) CVE-2026-44521, GHSA-c3gj-q88f-7hqj | High | 0.2% | 11 May, 2026 | Packagist studio-42/elfinder |
Snipe-IT has an open redirect vulnerability CVE-2026-44833, GHSA-mghp-5cq4-v6mg | High | 0.2% | 08 May, 2026 | Packagist snipe/snipe-it |
Snipe-IT has Privilege Escalation via API Permissions Assignment CVE-2026-44832, GHSA-hq28-crg7-95pr | High | 0.3% | 08 May, 2026 | Packagist snipe/snipe-it |
FacturaScripts Vulnerable to Remote Code Execution (RCE) via Zip Slip in Plugin Upload Mechanism CVE-2026-27891, GHSA-3pgc-xqg9-cfr6 | High | 0.5% | 07 May, 2026 | Packagist facturascripts/facturascripts |
Grav Form Plugin has an Anonymous Page Content Overwrite via Form File Upload filename Override CVE-2026-42845, GHSA-w4rc-p66m-x6qq | High | 0.7% | 06 May, 2026 | Packagist getgrav/grav-plugin-form |
Flight vulnerable to sensitive information disclosure via default error handler CVE-2026-42552, GHSA-qrch-52m5-vv85 | High | 0.3% | 06 May, 2026 | Packagist flightphp/core |
Flight: HTTP method override enabled by default, facilitating CSRF escalation and middleware bypass CVE-2026-42551, GHSA-vxrr-w42w-w76g | High | 0.4% | 06 May, 2026 | Packagist flightphp/core |
Flight vulnerable to SQL Injection via unvalidated identifiers in SimplePdo::insert / update / delete CVE-2026-42550, GHSA-xwqr-rcqg-22mr | High | 0.5% | 06 May, 2026 | Packagist flightphp/core |
Flight has reflected XSS through an unvalidated JSONP callback in Flight::jsonp() CVE-2026-42548, GHSA-fcx8-ph5r-mxr4 | High | 0.4% | 06 May, 2026 | Packagist flightphp/core |