Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Poweradmin: CSV Injection in log export endpoints allows formula execution in spreadsheet applications CVE-2026-47693, GHSA-3h6h-67x3-cv5x | Medium | 0.4% | 08 Jun, 2026 | Packagist poweradmin/poweradmin |
TYPO3 HTML Sanitizer allows Cross-site Scripting CVE-2026-47345, GHSA-p5j5-4j3q-8mq8 | Medium | 0.5% | 08 Jun, 2026 | Packagist typo3/html-sanitizer |
Twig: XSS in profiler HtmlDumper via unescaped template and profile names CVE-2026-47730, GHSA-2g2g-8p8h-fgwm | Medium | 0.3% | 05 Jun, 2026 | Packagist twig/twig |
Shopware: SSRF in Media External-Link Endpoint Bypasses IP Validation CVE-2026-48013, GHSA-gq96-5pfx-f4vc | Medium | 0.4% | 04 Jun, 2026 | Packagist shopware/core Packagist shopware/platform |
Shopware: Stored XSS via SVG file upload — no SVG sanitization CVE-2026-48015, GHSA-xvhc-gm7j-mhmc | Medium | 0.5% | 04 Jun, 2026 | Packagist shopware/core Packagist shopware/platform |
Shopware: Unauthorized Payment Trigger for Foreign Orders via /store-api/handle-payment CVE-2026-48016, GHSA-9v5m-39wh-5chq | Medium | 0.4% | 04 Jun, 2026 | Packagist shopware/core Packagist shopware/platform |
Shopware: Admin API ACL Bypass in Order State Transition Endpoints CVE-2026-48014, GHSA-f8q6-3g5w-jjr6 | Medium | 0.4% | 04 Jun, 2026 | Packagist shopware/core Packagist shopware/platform |
Shopware SSO referer trust leading to an arbitrary redirect target CVE-2026-48012, GHSA-4x3x-869w-xx3m | Medium | 0.3% | 04 Jun, 2026 | Packagist shopware/core Packagist shopware/platform |
Shopware: Privilege escalation: non-admin user with user:create ACL can create admin accounts CVE-2026-48010, GHSA-v39m-97p8-gqg7 | Medium | 0.5% | 04 Jun, 2026 | Packagist shopware/core Packagist shopware/platform |
Shopware: Admin Account Takeover via User Recovery Hash Exposure CVE-2026-48009, GHSA-8v9p-g828-v98f | Medium | 0.5% | 04 Jun, 2026 | Packagist shopware/core Packagist shopware/platform |
Shopware: Privilege Escalation via Sync API Integration Admin Flag Bypass CVE-2026-48008, GHSA-gv8p-48fr-4fxg | Medium | 0.5% | 04 Jun, 2026 | Packagist shopware/core Packagist shopware/platform |
WWBN AVideo: Stored XSS via Hostile YouTube Video Title in AVideo YouTubeAPI Gallery Section CVE-2026-50183, GHSA-66q5-cj5g-wrfx | Medium | 0.2% | 04 Jun, 2026 | Packagist WWBN/AVideo |
WWBN AVideo: Unauthenticated Reflected XSS via $_GET['search'] in AVideo YouTubeAPI Gallery Pagination CVE-2026-50182, GHSA-hgjh-6wj8-gcgf | Medium | 0.2% | 04 Jun, 2026 | Packagist WWBN/AVideo |
backpack/crud is vulnerable to Cross-Site Scripting (XSS) CVE-2022-31114, GHSA-m8xx-3x29-84h8 | Medium | 0.3% | 03 Jun, 2026 | Packagist backpack/crud |
Admidio: Any logged-in user can delete inventory fields via `mode=field_delete` — incomplete fix of #2024 CVE-2026-47233, GHSA-xw54-c3mx-9pm3 | Medium | 0.3% | 29 May, 2026 | Packagist admidio/admidio |
Admidio writes session IDs and auto-login cookie values to application logs CVE-2026-47234, GHSA-mch8-wf3h-6x88 | Medium | 0.2% | 29 May, 2026 | Packagist admidio/admidio |
Admidio PKCS#12 private key export action lacks CSRF protection CVE-2026-47232, GHSA-4rgq-38mh-9xqg | Medium | 0.1% | 29 May, 2026 | Packagist admidio/admidio |
Admidio: IDOR in documents-files.php allows cross-folder file rename and description changes by unauthorized uploaders CVE-2026-47230, GHSA-q6w3-hpfv-rg36 | Medium | 0.3% | 29 May, 2026 | Packagist admidio/admidio |
Admidio: CSRF in SSO client `enable` action toggles SAML/OIDC clients without token validation CVE-2026-47229, GHSA-xg76-5qj2-2hhv | Medium | 0.1% | 29 May, 2026 | Packagist admidio/admidio |
Admidio's CSRF in registration `send_login` mode resets arbitrary user passwords CVE-2026-47228, GHSA-mx25-j3rc-6w2w | Medium | 0.2% | 29 May, 2026 | Packagist admidio/admidio |
Admidio module-administrator can delete or reorder categories owned by other modules via dead authorization check in `modules/categories.php` CVE-2026-47227, GHSA-rwjr-qjj3-mq2f | Medium | 0.3% | 29 May, 2026 | Packagist admidio/admidio |
Admidio: Authorization bypass in file_delete enables cross-folder file removal by authenticated users without delete privileges CVE-2026-47226, GHSA-qc4c-hrmc-4f78 | Medium | 0.3% | 29 May, 2026 | Packagist admidio/admidio |
Symfony: Twilio SMS Notifier allows unauthenticated webhook injection due to missing X-Twilio-Signature verification CVE-2026-47212, GHSA-55rj-x2vc-4whq | Medium | 1.5% | 29 May, 2026 | Packagist symfony/symfony Packagist symfony/twilio-notifier |
Spatie Laravel Media Library contains a server-side request forgery vulnerability CVE-2026-48555, GHSA-fggg-964j-3j7h | Medium | 0.2% | 29 May, 2026 | Packagist spatie/laravel-medialibrary |
Shopper: Missing per-action authorization on PaymentMethods, Currencies and Carriers admin tables CVE-2026-47745, GHSA-fxqw-97cc-7g5c | Medium | 0.2% | 29 May, 2026 | Packagist shopper/framework |
Shopper: Missing authorization on Product admin Livewire sub-form components CVE-2026-47742, GHSA-h4mp-g9c6-xwph | Medium | 0.2% | 29 May, 2026 | Packagist shopper/framework |
WWBN AVideo: Stored XSS via unescaped Gallery category description CVE-2026-47694, GHSA-c8h8-vq34-9fw2 | Medium | 0.2% | 29 May, 2026 | Packagist WWBN/AVideo |
Mautic has Stored Cross-Site Scripting (XSS) in Project Option Selector CVE-2026-9811, GHSA-5hvg-w58j-545m | Medium | 0.2% | 29 May, 2026 | Packagist mautic/core |
Mautic Focus component Vulnerable to SSRF CVE-2026-9557, GHSA-jmv8-8j9j-rcpc | Medium | 0.1% | 29 May, 2026 | Packagist mautic/core |
symfony/polyfill-intl-idn: xn-- labels with ASCII-only Punycode payloads are treated as equivalent to their decoded form CVE-2026-46644, GHSA-2xf4-cg6j-vhgq | Medium | 0.5% | 28 May, 2026 | Packagist symfony/polyfill Packagist symfony/polyfill-intl-idn |
Symfony's Mailtrap Mailer Webhook Parser Never Verifies the X-Mt-Signature HMAC — Unauthenticated Webhook Event Injection CVE-2026-45755, GHSA-59f3-vp2f-mp9w | Medium | 0.3% | 28 May, 2026 | Packagist symfony/mailtrap-mailer Packagist symfony/symfony |
Symfony's Mailjet Mailer Webhook Parser Never Verifies the Configured Secret — Unauthenticated Webhook Event Injection CVE-2026-45754, GHSA-64hg-93w9-fc35 | Medium | 0.4% | 28 May, 2026 | Packagist symfony/lox24-notifier Packagist symfony/mailjet-mailer Packagist symfony/symfony |
Pimcore has a WordExport Authorization Bypass for Unauthorized Document Export CVE-2026-45703, GHSA-332x-r494-54fq | Medium | 0.3% | 27 May, 2026 | Packagist pimcore/pimcore |
Symfony Vulnerable to SQL Injection in PdoAdapter::doClear() via Unsanitized $prefix CVE-2026-45073, GHSA-6qh9-h6wf-jgqc | Medium | 0.5% | 27 May, 2026 | Packagist symfony/cache Packagist symfony/symfony |
Symfony has Email Header Injection via Non-Token Characters in Mime Parameter Names CVE-2026-45070, GHSA-vqc8-7275-q272 | Medium | 0.4% | 27 May, 2026 | Packagist symfony/mime Packagist symfony/symfony |
Symfony has an HtmlSanitizer allowLinkHosts() / allowMediaHosts() Bypass via URL-Parser Differentials and <area> Misclassification CVE-2026-45066, GHSA-qc95-4862-92fh | Medium | 0.3% | 27 May, 2026 | Packagist symfony/html-sanitizer Packagist symfony/symfony |
Symfony's HtmlSanitizer URL Attributes Pass Through BiDi Override Characters → Visual href Spoofing CVE-2026-45064, GHSA-h5vq-qfcg-4m6p | Medium | 0.3% | 27 May, 2026 | Packagist symfony/html-sanitizer Packagist symfony/symfony |
Kirby CMS's content locks disclose IDs and emails of inaccessible users from `users.access/list` permissions CVE-2026-45334, GHSA-39vq-49qm-r2mc | Medium | 0.4% | 27 May, 2026 | Packagist getkirby/cms |
Symfony has a UrlGenerator Route-Requirement Bypass via Unanchored Regex Alternation → Off-Site //host URL Injection CVE-2026-45065, GHSA-72xp-p242-47p9 | Medium | 0.3% | 27 May, 2026 | Packagist symfony/routing Packagist symfony/symfony |
Kirby CMS's `pages.access` permission is not checked during rendering of page drafts CVE-2026-44176, GHSA-2xw4-v2wx-hqq9 | Medium | 0.4% | 26 May, 2026 | Packagist getkirby/cms |
Concrete CMS is vulnerable to IDOR in surveys CVE-2026-8337, GHSA-8c7c-h7px-267g | Medium | 0.2% | 21 May, 2026 | Packagist concrete5/concrete5 |
Concrete CMS has a session-hardening bypass and allows password change without reauthorization CVE-2026-8327, GHSA-wmw3-3fv3-h54w | Medium | 0.2% | 21 May, 2026 | Packagist concrete5/concrete5 |
Concrete CMS is Vulnerable to Reflected XSS in Legacy Pagination CVE-2026-8245, GHSA-f73j-pm2c-rxvr | Medium | 0.1% | 21 May, 2026 | Packagist concrete5/concrete5 |
Concrete CMS is vulnerable to unauthenticated page metadata disclosure CVE-2026-8240, GHSA-vpgr-cwfx-pwfw | Medium | 0.2% | 21 May, 2026 | Packagist concrete5/concrete5 |
Concrete CMS is vulnerable to IDOR CVE-2026-8239, GHSA-2xp7-rpvc-pjwc | Medium | 0.2% | 21 May, 2026 | Packagist concrete5/concrete5 |
Concrete CMS is vulnerable to IDOR CVE-2026-8238, GHSA-qv3x-mffx-9gw8 | Medium | 0.2% | 21 May, 2026 | Packagist concrete5/concrete5 |
Concrete CMS is vulnerable to IDOR CVE-2026-8237, GHSA-xpgc-7vc2-8725 | Medium | 0.6% | 21 May, 2026 | Packagist concrete5/concrete5 |
Concrete CMS is vulnerable to IDOR combined with a missing authentication gate CVE-2026-8236, GHSA-58c8-vvqw-cm7m | Medium | 0.7% | 21 May, 2026 | Packagist concrete5/concrete5 |
Concrete CMS is subject to Insecure Direct Object Reference (IDOR) in the Express Entry Detail block CVE-2026-7881, GHSA-chfm-cm6h-q5x7 | Medium | 0.2% | 21 May, 2026 | Packagist concrete5/concrete5 |
Concrete CMS has an unauthorized file access issue CVE-2026-7879, GHSA-fqg3-8w8r-8g94 | Medium | 0.2% | 21 May, 2026 | Packagist concrete5/concrete5 |