Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Kimai: Login CSRF in the Timesheet Stop and Restart API Endpoints Allows Unauthorized State Changes CVE-2026-52823, GHSA-r8vr-m544-qh4h | Medium | 0.3% | 14 Jul, 2026 | Packagist kimai/kimai |
Improper Authorization in Kimai Timesheet Restart and Duplicate Allows New Timesheets After Project Access Revocation CVE-2026-52822, GHSA-c6w6-57jj-62vh | Medium | 0.5% | 14 Jul, 2026 | Packagist kimai/kimai |
Kimai: Improper Authorization Through Activity Creation with Preset Project Allows Creation Under Unauthorized Projects CVE-2026-52821, GHSA-3q6q-26vg-v97x | Medium | 0.4% | 14 Jul, 2026 | Packagist kimai/kimai |
Kimai: Timesheet PATCH/POST allows assigning to project outside user's team via query_builder OR-bypass CVE-2026-52820, GHSA-vrr2-g9gh-c3jc | Medium | 0.4% | 13 Jul, 2026 | Packagist kimai/kimai |
Kimai: Teamlead authorization bypass in GET /api/timesheets allows reading other users' timesheet records without being teamlead of the target CVE-2026-52819, GHSA-4m8q-55qv-9pwp | Medium | 0.5% | 13 Jul, 2026 | Packagist kimai/kimai |
Kimai: Login CSRF in Default Team Creation Endpoints Allows Unauthorized Team and Permission Structure Changes CVE-2026-49992, GHSA-pgcc-vfmc-7cw5 | Medium | 0.2% | 13 Jul, 2026 | Packagist kimai/kimai |
FacturaScripts: Account takeover of any 2FA-enabled user CVE-2026-47677, GHSA-c67f-gmxw-mj93 | Critical | Not scored | 13 Jul, 2026 | Packagist facturascripts/facturascripts |
Laravel-Mediable: path traversal vulnerability in the File::sanitizePath() CVE-2026-49970, GHSA-xv8g-76mx-2rxc | High | 1.0% | 13 Jul, 2026 | Packagist plank/laravel-mediable |
NukeViet: Pre-authentication SSRF via X-Forwarded-Host CVE-2026-55372, GHSA-4chg-4752-w88r | High | Not scored | 13 Jul, 2026 | Packagist nukeviet/nukeviet |
NukeViet: Path Traversal to Arbitrary File Deletion in Edit Comment Function CVE-2026-54065, GHSA-c9xg-64p9-f2jj | High | Not scored | 13 Jul, 2026 | Packagist nukeviet/nukeviet |
NukeViet: Multiple Anti-XSS Filter Bypasses Leading to Stored XSS in News Module CVE-2026-54064, GHSA-465g-4q99-5x86 | High | Not scored | 13 Jul, 2026 | Packagist nukeviet/nukeviet |
NukeViet: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CVE-2026-49259, GHSA-w2w5-w2pw-r929 | High | Not scored | 13 Jul, 2026 | Packagist nukeviet/nukeviet |
NukeViet: Unauthenticated Reflected XSS in Comment Module CVE-2026-48118, GHSA-mxpf-qgg6-v3ff | High | Not scored | 13 Jul, 2026 | Packagist nukeviet/nukeviet |
Phalcon: Catastrophic backtracking (ReDoS) in the default Phalcon Router route lead to remote unauthenticated DoS CVE-2026-57584, GHSA-x7rj-f32v-7jjg | High | 0.5% | 10 Jul, 2026 | Packagist phalcon/cphalcon |
Phalcon: Non-constant-time HMAC verification in `Encryption\Crypt::decrypt` (timing side-channel) CVE-2026-54736, GHSA-8jqh-95g6-7jpj | High | 0.2% | 10 Jul, 2026 | Packagist phalcon/cphalcon |
prestashop/ps_facetedsearch: PHP Object Injection in faceted search cache allows unauthenticated RCE CVE-2026-54159, GHSA-m5f5-28qr-9g9r | Critical | 0.8% | 10 Jul, 2026 | Packagist prestashop/ps_facetedsearch |
Snipe-IT: Cross-company deletion of pending checkout acceptances via unscoped report endpoint CVE-2026-55515, GHSA-35cr-9hqq-p2mg | Medium | 0.3% | 10 Jul, 2026 | Packagist snipe/snipe-it |
Snipe-IT has CSS Injection via `header_color` Setting CVE-2026-55481, GHSA-w7qw-5wfv-gwx9 | Medium | 0.3% | 10 Jul, 2026 | Packagist snipe/snipe-it |
Snipe-IT has incorrect permission for legacy license checkin API CVE-2026-55479, GHSA-8frh-vhgh-64cf | Medium | 0.3% | 10 Jul, 2026 | Packagist snipe/snipe-it |
Snipe-IT's import created_by can be overwritten CVE-2026-55475, GHSA-5wx7-xq8j-v4qm | Medium | 0.3% | 10 Jul, 2026 | Packagist snipe/snipe-it |
Snipe-IT has a path traversal vulnerability via CSV import `image` field CVE-2026-55469, GHSA-xr9m-gphc-9p63 | Medium | 0.6% | 10 Jul, 2026 | Packagist snipe/snipe-it |
Snipe-IT vulnerable to stored XSS via inline-served attachment CVE-2026-55466, GHSA-jhph-5q74-pmfx | Medium | 0.4% | 10 Jul, 2026 | Packagist snipe/snipe-it |
Snipe-IT has an authorization bypass on print inventory page CVE-2026-55462, GHSA-fc33-6w3q-538h | Medium | 0.3% | 10 Jul, 2026 | Packagist snipe/snipe-it |
Snipe-IT has an Open Redirect After User Edit CVE-2026-55461, GHSA-wg2f-x2c2-c4rp | Medium | 0.3% | 10 Jul, 2026 | Packagist snipe/snipe-it |
Snipe-IT has CSV formula injection in Activity Report export CVE-2026-55452, GHSA-whrx-mmgr-gpcf | Medium | 0.4% | 10 Jul, 2026 | Packagist snipe/snipe-it |
NotrinosERP: Authenticated arbitrary file upload leads to remote code execution via HRM employee "Documents" (doc_file) CVE-2026-76913, GHSA-qv4m-m73m-8hj7 | High | Not scored | 10 Jul, 2026 | Packagist notrinos/notrinos-erp |
Snipe-IT has an Improper Privilege Management issue CVE-2026-55843, GHSA-j5g3-42wp-gqm3 | High | 0.5% | 10 Jul, 2026 | Packagist snipe/snipe-it |
Snipe-IT vulnerable to cross-company asset maintenance re-parenting via API update CVE-2026-55516, GHSA-575r-357h-fhch | High | 0.4% | 10 Jul, 2026 | Packagist snipe/snipe-it |
Snipe-IT has missing object-level authorization in Kits API CVE-2026-55478, GHSA-crv3-j83j-f3r6 | Medium | 0.3% | 10 Jul, 2026 | Packagist snipe/snipe-it |
Snipe-IT Vulnerable to Unauthorized Asset Request Cancellation via Unguarded cancel_by_admin Parameter CVE-2026-55476, GHSA-53jc-27pc-x8r8 | Medium | 0.3% | 10 Jul, 2026 | Packagist snipe/snipe-it |
Snipe-IT vulnerable to directory traversal in displaySig CVE-2026-55474, GHSA-c6f4-wj38-m3g3 | High | 0.5% | 10 Jul, 2026 | Packagist snipe/snipe-it |
Snipe-IT's API Location Creation Bypasses FMCS Parent-Child Company Boundary Validation CVE-2026-55472, GHSA-8w8c-8mx9-52cw | Medium | 0.3% | 10 Jul, 2026 | Packagist snipe/snipe-it |
Snipe-IT vulnerable to stored XSS via Markdown custom field CVE-2026-55464, GHSA-r52f-r9v5-66xr | Medium | 0.3% | 10 Jul, 2026 | Packagist snipe/snipe-it |
Snipe-IT has an authorization bypass on bulk editing users CVE-2026-55460, GHSA-vgx7-c78r-69w9 | High | 0.4% | 10 Jul, 2026 | Packagist snipe/snipe-it |
Grav CMS — Improper Handling of Highly Compressed Data in Installer::unZip() CVE-2026-59193, GHSA-2vcx-h8p2-9pg9 | Medium | 0.6% | 10 Jul, 2026 | Packagist getgrav/grav |
Grav: Unauthenticated denial of service via unbounded image derivative dimensions CVE-2026-53653, GHSA-4x9g-vw65-vvf9 | High | 0.5% | 10 Jul, 2026 | Packagist getgrav/grav |
Kimai has Server-Side Request Forgery in Invoice PDF Rendering via Markdown Image URLs CVE-2026-49865, GHSA-pj8j-p4g4-4vw8 | Medium | 0.4% | 10 Jul, 2026 | Packagist kimai/kimai |
phpMyFAQ public FAQ APIs expose inactive FAQ content CVE-2026-57994, GHSA-mf8r-wm2w-f8c5 | Medium | 0.4% | 10 Jul, 2026 | Packagist phpmyfaq/phpmyfaq Packagist thorsten/phpmyfaq |
phpMyFAQ has Potential Authenticated Path Traversal in PDF Export CVE-2026-57961, GHSA-88g4-74f3-63x9 | Medium | 0.4% | 10 Jul, 2026 | Packagist phpmyfaq/phpmyfaq Packagist thorsten/phpmyfaq |
Pimcore: Insufficient Permission Check on Class Definition Creation Endpoint Allows Privilege Escalation CVE-2026-55212, GHSA-f97c-ph8j-8vff | High | 0.4% | 09 Jul, 2026 | Packagist pimcore/studio-backend-bundle |
Pimcore: SQL Injection via Column Name in DateFilter allows authenticated user to extract arbitrary database data including admin password hashes CVE-2026-55208, GHSA-79cw-hfcc-7mw9 | High | 0.4% | 09 Jul, 2026 | Packagist pimcore/studio-backend-bundle |
Pimcore: Account Takeover via Password Reset URL Injection allows unauthenticated attacker to hijack any admin account with 2FA bypass CVE-2026-55207, GHSA-h854-c3m3-mh5v | High | 0.7% | 09 Jul, 2026 | Packagist pimcore/studio-backend-bundle |
Sylius: IDOR on Shop Payment Request API endpoints CVE-2026-53639, GHSA-mr9r-h354-966r | Medium | 0.5% | 09 Jul, 2026 | Packagist sylius/sylius |
Sylius: Channel-based payment method restriction bypass on shop account orders API endpoint CVE-2026-53638, GHSA-6955-hrm5-c4qp | Medium | 0.3% | 09 Jul, 2026 | Packagist sylius/sylius |
Sylius: Cart FormComponent allows modification or deletion of an already-completed order CVE-2026-53637, GHSA-5597-7rmh-97q5 | Medium | 0.4% | 09 Jul, 2026 | Packagist sylius/sylius |
YesWiki Vulnerable to Authenticated PHP Object Injection in BazarImportAction via unserialize CVE-2026-52777, GHSA-9369-69wj-7m2f | Critical | 0.3% | 09 Jul, 2026 | Packagist yeswiki/yeswiki |
YesWiki has Authenticated SQL Injection via ReactionManager CVE-2026-52775, GHSA-4pf7-cc4r-g63h | High | 0.5% | 09 Jul, 2026 | Packagist yeswiki/yeswiki |
YesWiki Vulnerable to Reflected XSS via Unescaped `id` Parameter in Bazar Widget HTML Attributes CVE-2026-52774, GHSA-r5xw-gcgw-hwp5 | Medium | 0.7% | 09 Jul, 2026 | Packagist yeswiki/yeswiki |
YesWiki Vulnerable to Reflected XSS via Unescaped Archived-Revision `time` Parameter in `handlers/page/show.php` CVE-2026-52773, GHSA-35f3-pg38-486f | Medium | 0.6% | 09 Jul, 2026 | Packagist yeswiki/yeswiki |
YesWiki has stored XSS in Bazar form-field templates via unescaped field.label / field.hint (|raw('html')) CVE-2026-52772, GHSA-xc7j-3g8q-9vh4 | Medium | 0.3% | 09 Jul, 2026 | Packagist yeswiki/yeswiki |