Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Twig: `{% sandbox %}{% include %}` skips checkSecurity() on cached templates (incomplete fix for CVE-2024-45411) CVE-2026-46638, GHSA-7fxw-r6jv-74c8 | Medium | 0.5% | 21 May, 2026 | Packagist twig/twig |
Twig: HTML-output filters in twig/* extras incorrectly declared `is_safe => ['all']` CVE-2026-46637, GHSA-jv8m-2544-3pg3 | Medium | 0.3% | 21 May, 2026 | Packagist twig/cssinliner-extra Packagist twig/markdown-extra |
Twig: Sandbox property allowlist bypass via the `column` filter (array_column on objects) CVE-2026-46635, GHSA-vcc8-phrv-43wj | Medium | 0.3% | 21 May, 2026 | Packagist twig/twig |
twig/intl-extra: Unbounded formatter memoisation in keyed on template-controlled arguments CVE-2026-46629, GHSA-35wc-cvqg-78fp | Medium | 0.5% | 21 May, 2026 | Packagist twig/intl-extra |
Twig: The `spaceless` filter implicitly marks its output as safe CVE-2026-46628, GHSA-4j38-f5cw-54h7 | Medium | 0.3% | 21 May, 2026 | Packagist twig/twig |
Concrete CMS is vulnerable to authorization bypass in the Calendar Block CVE-2026-8205, GHSA-46xh-7854-f568 | Medium | 0.2% | 21 May, 2026 | Packagist concrete5/concrete5 |
Concrete CMS is vulnerable to authorization bypass in the Calendar Event Frontend Dialog CVE-2026-8204, GHSA-x2fp-hj8c-mmxh | Medium | 0.2% | 21 May, 2026 | Packagist concrete5/concrete5 |
Concrete CMS is vulnerable to unauthenticated file usage disclosure CVE-2026-6826, GHSA-4g7q-44qp-cc5c | Medium | 1.5% | 21 May, 2026 | Packagist concrete5/concrete5 |
Snappy : SSRF and local file read via the xsl-style-sheet option CVE-2026-46683, GHSA-c5fp-p67m-gq56 | Medium | 0.2% | 21 May, 2026 | Packagist knplabs/knp-snappy |
FPDI: Memory Exhaustion and Endless Loop in FPDI leads to Denial of Service CVE-2026-45802, GHSA-2mgw-7q6p-8grg | Medium | 0.3% | 19 May, 2026 | Packagist setasign/fpdi |
AVideo: Unauthenticated Arbitrary Image Read via Path Traversal in `view/img/image404Raw.php` CVE-2026-46337, GHSA-w4qq-74h6-58wq | Medium | 0.5% | 19 May, 2026 | Packagist WWBN/AVideo |
TYPO3 ke_search path traversal due to lack of normalization on config directory from file indexer CVE-2026-46724, GHSA-c72x-mc2p-wv7x | Medium | 0.4% | 19 May, 2026 | Packagist tpwd/ke_search |
TYPO3 ke_search path traversal from arbitrary table configuration input CVE-2026-46723, GHSA-67j3-jmm3-32xc | Medium | 0.3% | 19 May, 2026 | Packagist tpwd/ke_search |
TYPO3 ke_search XML External Entity Injection CVE-2026-46722, GHSA-fq39-62gx-8hqx | Medium | 0.3% | 19 May, 2026 | Packagist tpwd/ke_search |
TYPO3 sf_register extension allows unauthorized assignment of frontend user groups CVE-2026-46721, GHSA-v348-vr4q-fv9p | Medium | 0.4% | 19 May, 2026 | Packagist evoweb/sf-register |
AVideo: Authenticated Arbitrary File Read in view/update.php CVE-2026-45731, GHSA-3mjv-375j-6h92 | Medium | 0.5% | 18 May, 2026 | Packagist WWBN/AVideo |
Sulu: Weak Cryptographical usage for API Key generation and Reset Tokens CVE-2026-45701, GHSA-7fv8-6pp7-6h85 | Medium | 0.2% | 18 May, 2026 | Packagist sulu/sulu |
shopper/framework: Race condition on Discount.usage_limit allows silent over-redemption CVE-2026-47741, GHSA-9rh9-hf3w-9fgg | Medium | 0.2% | 18 May, 2026 | Packagist shopper/cart |
CI4MS Fileeditor allows deletion and rename of critical application files due to missing extension allowlist on destructive operations CVE-2026-45139, GHSA-245j-xjvr-xvm5 | Medium | 0.3% | 18 May, 2026 | Packagist ci4-cms-erp/ci4ms |
CI4MS: Stored XSS in Blog Content via Broken `html_purify` Validation Rule CVE-2026-45138, GHSA-2m69-jmvh-6chr | Medium | 0.2% | 18 May, 2026 | Packagist ci4-cms-erp/ci4ms |
Statamic CMS: Server-Side Request Forgery via Glide CVE-2026-45660, GHSA-pf9c-ch8r-2958 | Medium | 0.2% | 18 May, 2026 | Packagist statamic/cms |
AVideo CVE-2026-43881 incomplete fix - `objects/mention.json.php:17` is an unauthenticated user enumeration sibling that survives `d9cdc7024` CVE-2026-45620, GHSA-vpfx-pxqw-2w79 | Medium | 0.2% | 18 May, 2026 | Packagist WWBN/AVideo |
AVideo CVE-2026-43884 incomplete fix - six (or more) `isSSRFSafeURL()` call sites still discard the `$resolvedIP` out-param at master HEAD post-`603e7bf` CVE-2026-45619, GHSA-c3ch-22rq-xfwr | Medium | 0.1% | 15 May, 2026 | Packagist WWBN/AVideo |
AVideo: 2FA toggle endpoint has no CSRF protection, letting an attacker page silently disable a logged-in victim's 2FA CVE-2026-45610, GHSA-3mv2-vmwh-rwfx | Medium | 0.1% | 15 May, 2026 | Packagist WWBN/AVideo |
AVideo: stored XSS via unescaped stream key in modeYoutubeLive.php class attribute CVE-2026-45580, GHSA-m5j4-7r85-2cj2 | Medium | 0.1% | 15 May, 2026 | Packagist WWBN/AVideo |
Cockpit CMS: Stored cross-site scripting vulnerability in the Set field type's Display template option CVE-2026-23695, GHSA-ch4j-vcf5-58x5 | Medium | 0.1% | 15 May, 2026 | Packagist cockpit-hq/cockpit |
SimpleSAMLphp casserver: Open Redirect in logout CVE-2025-65954, GHSA-cvrm-5hp6-h523 | Medium | 0.3% | 15 May, 2026 | Packagist simplesamlphp/simplesamlphp-module-casserver |
MantisBT: Authorization Bypass in Bugnote Editing via Issue Update API CVE-2026-42070, GHSA-pq86-j2c2-47f6 | Medium | 0.3% | 11 May, 2026 | Packagist mantisbt/mantisbt |
MantisBT is Vulnerable to Reflected XSS in Rendering Dynamic Custom Textarea Field CVE-2026-41897, GHSA-j7v9-f46r-2rp4 | Medium | 0.3% | 11 May, 2026 | Packagist mantisbt/mantisbt |
MantisBT has Potential Referer-Based Reflected HTML Injection / XSS in Tag Update Page CVE-2026-40598, GHSA-6jh4-47v2-4g37 | Medium | 0.4% | 11 May, 2026 | Packagist mantisbt/mantisbt |
MantisBT is Vulnerable to Stored XSS in Custom Field Textarea Values CVE-2026-39960, GHSA-qj6w-v29q-4rgx | Medium | 0.2% | 11 May, 2026 | Packagist mantisbt/mantisbt |
MantisBT: Bugnote Revision Page Leaks Private Issue Metadata After Issue Access Is Revoked CVE-2026-34970, GHSA-crmx-4p49-46m2 | Medium | 0.4% | 11 May, 2026 | Packagist mantisbt/mantisbt |
MantisBT has an Authorization Bypass that Allows Uploading Attachments to Private Issues via REST API CVE-2026-34754, GHSA-h4x5-gvx6-3rwc | Medium | 0.2% | 11 May, 2026 | Packagist mantisbt/mantisbt |
MantisBT has an authorization bypass that allows reading attachments after losing access to a private issue CVE-2026-34744, GHSA-rmp5-5jj7-gmvf | Medium | 0.4% | 11 May, 2026 | Packagist mantisbt/mantisbt |
MantisBT has an authorization bypass in private issue monitoring CVE-2026-34579, GHSA-ggw7-9675-6v4v | Medium | 0.4% | 11 May, 2026 | Packagist mantisbt/mantisbt |
MantisBT Vulnerable to Privilege Escalation from Manager to Administrator CVE-2026-34390, GHSA-frf7-jhp9-jxm6 | Medium | 0.4% | 11 May, 2026 | Packagist mantisbt/mantisbt |
MantisBT Has Authorization Bypass in Global Profile Creation CVE-2026-33052, GHSA-68w5-w573-q2r8 | Medium | 0.3% | 11 May, 2026 | Packagist mantisbt/mantisbt |
Snipe-IT has Stored XSS via Component Checkout Notes (v8.4.0) CVE-2026-44831, GHSA-r42m-953q-6vjx | Medium | 0.2% | 08 May, 2026 | Packagist snipe/snipe-it |
Grav: Stored XSS via page title (data[header][title]) in admin panel CVE-2026-44737, GHSA-fmg2-f5r9-24qc | Medium | 0.3% | 08 May, 2026 | Packagist getgrav/grav |
Kimai has an arbitrary file read in its invoice PDF renderer (admin) CVE-2026-44298, GHSA-h5fh-7hwr-97mw | Medium | 0.3% | 08 May, 2026 | Packagist kimai/kimai |
FacturaScripts Vulnerable to Authenticated Remote Code Execution (RCE) via GIF Image Upload in Product Images CVE-2026-42879, GHSA-vf3q-frmr-vrr9 | Medium | 0.2% | 07 May, 2026 | Packagist facturascripts/facturascripts |
FacturaScripts Vulnerable to Unauthenticated phpinfo() Disclosure via Installer Endpoint CVE-2026-42878, GHSA-vrxf-vrc4-22p7 | Medium | 0.9% | 07 May, 2026 | Packagist facturascripts/facturascripts |
FacturaScripts vulnerable to stored XSS via product reference in sales/purchases CVE-2026-42877, GHSA-r736-2678-fcrx | Medium | 0.2% | 07 May, 2026 | Packagist facturascripts/facturascripts |
FacturaScripts Vulnerable to Unstripped Image Metadata (EXIF) Leakage via Library Module File Upload/Download CVE-2026-27892, GHSA-q7f2-rv22-2xgr | Medium | 0.2% | 07 May, 2026 | Packagist facturascripts/facturascripts |
Webkul Krayin CRM is Vulnerable to Cross-Site Scripting in the /admin/activities/create endpoint CVE-2026-36341, GHSA-j822-46r5-h4qx | Medium | 0.2% | 07 May, 2026 | Packagist krayin/laravel-crm |
Flight has path traversal in `make:controller` CLI that creates arbitrary directories outside project root CVE-2026-42549, GHSA-3xjv-pmf2-gf2q | Medium | 0.2% | 06 May, 2026 | Packagist flightphp/core |
Magento LTS: Reflected XSS - Import -> Data Flow (profiles) CVE-2026-42458, GHSA-x8jv-q8j2-487c | Medium | 0.3% | 06 May, 2026 | Packagist openmage/magento-lts |
Statamic CMS vulnerable to email enumeration via forgot password endpoint CVE-2026-44306, GHSA-m24v-f7g5-gq67 | Medium | 0.2% | 06 May, 2026 | Packagist statamic/cms |
phpMyFAQ: Ordinary Authenticated User Can Access Admin-Only API Endpoints Due to Insufficient Authorization Check in phpMyFAQ CVE-2026-45009, GHSA-jrc5-w569-h7h5 | Medium | 0.2% | 06 May, 2026 | Packagist phpmyfaq/phpmyfaq Packagist thorsten/phpmyfaq |
phpMyFAQ's Missing CONFIGURATION_EDIT Permission Check on 12 Admin API Configuration Tab Endpoints Allows Information Disclosure by Any Authenticated User CVE-2026-45007, GHSA-rm98-82fr-mcfx | Medium | 0.3% | 06 May, 2026 | Packagist phpmyfaq/phpmyfaq Packagist thorsten/phpmyfaq |