Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Low-privileged Grav API users can create super-admin accounts via blueprint-upload CVE-2026-42844, GHSA-6xx2-m8wv-756h | High | 0.3% | 06 May, 2026 | Packagist getgrav/grav |
phpMyFAQ: Path Traversal in Client::deleteClientFolder enables arbitrary directory deletion by non-super-admin admins CVE-2026-45008, GHSA-gh9p-q46p-57g2 | High | 0.3% | 06 May, 2026 | Packagist phpmyfaq/phpmyfaq Packagist thorsten/phpmyfaq |
phpMyFAQ has unauthenticated FAQ permission bypass via getFaqBySolutionId fallback query CVE-2026-46366, GHSA-99qv-g4x9-mgc3 | High | 0.3% | 06 May, 2026 | Packagist phpmyfaq/phpmyfaq Packagist thorsten/phpmyfaq |
phpMyFAQ has SQL Injection in CurrentUser::setTokenData through unescaped OAuth token fields CVE-2026-46359, GHSA-pm8c-3qq3-72w7 | High | 0.3% | 06 May, 2026 | Packagist phpmyfaq/phpmyfaq Packagist thorsten/phpmyfaq |
phpMyFAQ has stored XSS via | raw Filter in search.twig — html_entity_decode(strip_tags()) Bypass in Search Result Rendering CVE-2026-46361, GHSA-pqh6-8fxf-jx22 | High | 0.3% | 06 May, 2026 | Packagist phpmyfaq/phpmyfaq Packagist thorsten/phpmyfaq |
phpMyFAQ has an Authorization Bypass in All Admin Pages Due to Non-Terminating Permission Check CVE-2026-46362, GHSA-hpgw-ww76-c68r | High | 0.3% | 06 May, 2026 | Packagist phpmyfaq/phpmyfaq Packagist thorsten/phpmyfaq |
phpMyFAQ has stored XSS via Utils::parseUrl() in comment rendering CVE-2026-46367, GHSA-9525-27vj-c8r8 | High | 0.2% | 06 May, 2026 | Packagist phpmyfaq/phpmyfaq Packagist thorsten/phpmyfaq |
Kimai's Twig function config() leaks server-wide secrets (LDAP bind password, SAML SP private key) via invoice/export templates CVE-2026-80198, GHSA-vrqv-52x7-rm4v | High | 0.4% | 06 May, 2026 | Packagist kimai/kimai |
Craft CMS's Missing Volume Permission Check in AssetsController::actionShowInFolder Allows Information Disclosure CVE-2026-44012, GHSA-33m5-hqp9-97pw | High | 0.3% | 06 May, 2026 | Packagist craftcms/cms |
Craft CMS has Potential Authenticated Remote Code Execution via Malicious Attached Behavior CVE-2026-44011, GHSA-qrgm-p9w5-rrfw | High | 0.6% | 06 May, 2026 | Packagist craftcms/cms |
Craft CMS's Missing Authorization in GraphQL Address Resolver Allows Cross-Scope PII Disclosure CVE-2026-44010, GHSA-gj2p-p9m4-c8gw | High | 0.4% | 06 May, 2026 | Packagist craftcms/cms |
AVideo Vulnerable to Exposure of Sensitive Information to an Unauthorized Actor and Missing Authorization CVE-2026-43885, GHSA-xr49-f4rh-qcjf | High | 0.3% | 05 May, 2026 | Packagist wwbn/avideo |
AVideo has SSRF Protection Bypass via HTTP Redirect and DNS Rebinding in isSSRFSafeURL() CVE-2026-43884, GHSA-2hch-c97c-g99x | High | 0.3% | 05 May, 2026 | Packagist wwbn/avideo |
Grav is Vulnerable to Stored XSS via Tag Injection CVE-2026-42611, GHSA-w8cg-7jcj-4vv2 | High | 0.3% | 05 May, 2026 | Packagist getgrav/grav |
Grav is Vulnerable to XXE via SVG Upload CVE-2026-56701, GHSA-3446-6mgw-f79p | High | 0.3% | 05 May, 2026 | Packagist getgrav/grav |
Grav has Unauthenticated Path Traversal & Arbitrary File Write in its FormFlash component CVE-2026-42608, GHSA-hmcx-ch82-3fv2 | High | 0.6% | 05 May, 2026 | Packagist getgrav/grav |
Grav Vulnerable to Administrative Account Disruption and Privilege De-escalation via User Overwrite Logic CVE-2026-42609, GHSA-rr73-568v-28f8 | High | 0.5% | 05 May, 2026 | Packagist getgrav/grav |
Grav Vulnerable to Publisher-Level Stored XSS via Unquoted Event Attributes CVE-2026-42612, GHSA-9695-8fr9-hw5q | High | 0.2% | 05 May, 2026 | Packagist getgrav/grav |
Grav API Privilege Escalation to Super Admin CVE-2026-42843, GHSA-r945-h4vm-h736 | High | 0.4% | 05 May, 2026 | Packagist getgrav/grav-plugin-api |
phpseclib has a CVE-2024-27355 mitigation bypass — OID amplification DoS in ASN1::decodeOID() CVE-2026-44167, GHSA-3qpq-r242-jqj7 | High | 0.2% | 05 May, 2026 | Packagist phpseclib/phpseclib |
AVideo has an Incomplete Fix for YPTSocket autoEvalCodeOnHTML Strip: Unauthenticated Cross-User JavaScript Execution via `$msg['json']` Relay Bypass CVE-2026-43874, GHSA-ghcv-22jf-vfxm | High | 0.3% | 05 May, 2026 | Packagist wwbn/avideo |
AVideo: Unauthenticated Disclosure of CloneSite `myKey` via Error Echo in `cloneClient.json.php` Enables Cross-Site DB Dump of the Configured Clone Server CVE-2026-43873, GHSA-qm9p-p5pw-jrx2 | High | 0.3% | 05 May, 2026 | Packagist wwbn/avideo |
webonyx/graphql-php has unbounded recursion in parser that causes stack overflow on crafted nested input CVE-2026-107376, GHSA-r7cg-qjjm-xhqq | High | 0.4% | 05 May, 2026 | Packagist webonyx/graphql-php |
webonyx/graphql-php has quadratic validation cost in OverlappingFieldsCanBeMerged via inline fragments GHSA-fc86-6rv6-2jpm | High | Not scored | 04 May, 2026 | Packagist webonyx/graphql-php |
livewire-markdown-editor has arbitrary file upload that allows stored XSS via attachment handler GHSA-gxxh-8vcj-w2mh | High | Not scored | 04 May, 2026 | Packagist mckenziearts/livewire-markdown-editor |
AzuraCast Vulnerable to Liquidsoap Code Injection via Incomplete cleanUpString-to-toRawString Migration in Remote Relay Password Field CVE-2026-100856, GHSA-q4ph-8x8g-95f8 | High | 0.5% | 04 May, 2026 | Packagist azuracast/azuracast |
AzuraCast has Missing Permissions Check on Media File Download, Allowing Cross-Station Data Exfiltration CVE-2026-100855, GHSA-qff7-q5fm-8p76 | High | 0.2% | 04 May, 2026 | Packagist azuracast/azuracast |
AzuraCast has Password Reset Poisoning via Untrusted X-Forwarded-Host Header that Leads to Account Takeover and 2FA Bypass CVE-2026-42606, GHSA-gv7r-3mr9-h5x8 | High | 0.5% | 04 May, 2026 | Packagist azuracast/azuracast |
AzuraCast has Path Traversal in `currentDirectory` Parameter that Enables Remote Code Execution via Media Upload CVE-2026-42605, GHSA-vp2f-cqqp-478j | High | 0.8% | 04 May, 2026 | Packagist azuracast/azuracast |
Kirby CMS's read access to site, user and role information is not gated by permissions CVE-2026-42069, GHSA-2h7v-4372-f6x2 | High | 0.2% | 04 May, 2026 | Packagist getkirby/cms |
OpenSTAManager contains an arbitrary file upload vulnerability in its module update functionality CVE-2026-38751, GHSA-rm34-fg4m-39mw | High | 0.5% | 04 May, 2026 | Packagist devcode-it/openstamanager |
phpBB has Password Reset Link Poisoning via Host Header injection CVE-2026-29199, GHSA-7gm6-w7mx-58cr | High | 0.2% | 04 May, 2026 | Packagist phpbb/phpbb |
Kirby CMS's `pages.access/list` and `files.access/list` permissions are not consistently checked in the Panel and REST API CVE-2026-42137, GHSA-85x2-r8xv-ww8c | High | 0.3% | 30 Apr, 2026 | Packagist getkirby/cms |
Krayin CRM allows a remote attacker to execute arbitrary code via compose email function CVE-2026-36340, GHSA-32px-ccfx-cxq3 | High | 0.6% | 30 Apr, 2026 | Packagist krayin/laravel-crm |
Admidio Sends SAML Response to Unvalidated Assertion Consumer Service URL from AuthnRequest CVE-2026-41670, GHSA-p9w9-87c8-m235 | High | 0.3% | 29 Apr, 2026 | Packagist admidio/admidio |
Admidio Ignores SAML Signature Validation Result, Processes Forged AuthnRequests and LogoutRequests CVE-2026-41669, GHSA-25cw-98hg-g3cg | High | 0.2% | 29 Apr, 2026 | Packagist admidio/admidio |
Admidio has Inverted 2FA Reset Authorization Check that Lets Group Leaders Strip Admin TOTP CVE-2026-41660, GHSA-rh3w-4ccx-prf9 | High | 0.3% | 29 Apr, 2026 | Packagist admidio/admidio |
ipl/web is vulnerable to reflected XSS by malformed search requests CVE-2026-42224, GHSA-55wf-5m3q-6jjf | High | 0.3% | 29 Apr, 2026 | Packagist ipl/web |
CI4MS has Unrestricted PHP File Upload via Theme Installation that Leads to Authenticated Remote Code Execution CVE-2026-41587, GHSA-fw49-9xq4-gmx6 | High | 0.6% | 29 Apr, 2026 | Packagist ci4-cms-erp/ci4ms |
PhpSpreadsheet has CPU Denial of Service via Unbounded Row Number in XLSX Row Dimensions CVE-2026-40902, GHSA-7c6m-4442-2x6m | High | 0.4% | 29 Apr, 2026 | Packagist phpoffice/phpspreadsheet |
PhpSpreadsheet has CPU Denial of Service via Unbounded Row Index in SpreadsheetML XML Reader CVE-2026-40863, GHSA-84wq-86v6-x5j6 | High | 0.4% | 29 Apr, 2026 | Packagist phpoffice/phpspreadsheet |
Cockpit Vulnerable to Unrestricted Upload of File with Dangerous Type CVE-2026-38991, GHSA-j2rx-4jg9-79mw | High | 0.4% | 29 Apr, 2026 | Packagist cockpit-hq/cockpit |
Pimcore Platform - SQL Injection in DataObject composite index handling during class definition import/save CVE-2026-5394, GHSA-r2f4-ff2p-xc64 | High | 0.4% | 27 Apr, 2026 | Packagist pimcore/pimcore |
Kirby is vulnerable to authorization bypass during page, file and user creation via blueprint injection CVE-2026-41325, GHSA-6gqr-mx34-wh8r | High | 0.4% | 24 Apr, 2026 | Packagist getkirby/cms |
Kirby has Server-Side Template Injection (SSTI) via double template resolution in option rendering CVE-2026-34587, GHSA-jcjw-58rv-c452 | High | 0.3% | 23 Apr, 2026 | Packagist getkirby/cms |
PHPUnit: Argument injection via newline in PHP INI values forwarded to child processes GHSA-mh6w-vxff-9wqp | High | Not scored | 22 Apr, 2026 | Packagist phpunit/phpunit |
Dolibarr user with permission to edit PHP content can bypass filtering to restrict dangerous PHP functions CVE-2026-31019, GHSA-j2g9-rprv-hrhc | High | 0.6% | 21 Apr, 2026 | Packagist dolibarr/dolibarr |
Dolibarr Allows Code Injection through its Website Module CVE-2026-31018, GHSA-676v-wh57-p375 | High | 0.3% | 21 Apr, 2026 | Packagist dolibarr/dolibarr |
TYPO3 CMS Stores Cleartext Password in User Settings Module CVE-2026-6553, GHSA-xvv6-p4wf-mvx7 | High | 0.2% | 21 Apr, 2026 | Packagist typo3/cms-backend |
OpenMage LTS: Customer File Upload Extension Blocklist Bypass → Remote Code Execution CVE-2026-40488, GHSA-3j5q-7q7h-2hhv | High | 0.7% | 20 Apr, 2026 | Packagist openmage/magento-lts |