Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
phpMyFAQ has a SVG Sanitizer Entity Decoding Depth Limit Bypass Leading to Stored XSS CVE-2026-46360, GHSA-whqh-9pq5-c7r3 | Medium | 0.2% | 06 May, 2026 | Packagist phpmyfaq/phpmyfaq Packagist thorsten/phpmyfaq |
phpMyFAQ has Stored XSS in FAQ Question/Answer via Encode-Decode Bypass of removeAttributes() Sanitization CVE-2026-46363, GHSA-f5p7-2c9q-8896 | Medium | 0.2% | 06 May, 2026 | Packagist phpmyfaq/phpmyfaq Packagist thorsten/phpmyfaq |
phpMyFAQ's Missing Authorization on Tag Deletion Allows Any Authenticated User to Delete Tags CVE-2026-46365, GHSA-7cx3-2qx2-3g6w | Medium | 0.2% | 06 May, 2026 | Packagist phpmyfaq/phpmyfaq Packagist thorsten/phpmyfaq |
AVideo: IDOR in PayPalYPT Plugin Allows Any Authenticated User to Cancel Arbitrary PayPal Subscription Agreements CVE-2026-43883, GHSA-958h-qp3x-q4gj | Medium | 0.2% | 05 May, 2026 | Packagist wwbn/avideo |
AVideo: Unauthenticated CRLF/ICS Injection in Scheduler downloadICS.php Allows Calendar Event Spoofing CVE-2026-43882, GHSA-mwgh-92m2-wvhv | Medium | 0.2% | 05 May, 2026 | Packagist wwbn/avideo |
AVideo: Unauthenticated User Enumeration in objects/users.json.php via isCompany Parameter Allows Bypass of the Admin-Only Listing Restriction CVE-2026-43881, GHSA-6rvw-7p8v-mjfq | Medium | 0.3% | 05 May, 2026 | Packagist wwbn/avideo |
AVideo: Unauthenticated Arbitrary Email Sending via sendEmail.json.php Enables Phishing from the Site’s Legitimate From Address CVE-2026-43880, GHSA-5hgj-7gm9-cff5 | Medium | 0.3% | 05 May, 2026 | Packagist wwbn/avideo |
AVideo has Blind SSRF in YPTWallet Donation Webhook via Missing isSSRFSafeURL() Check and CURLOPT_FOLLOWLOCATION Redirect Bypass CVE-2026-43879, GHSA-wp38-whx3-xffh | Medium | 0.2% | 05 May, 2026 | Packagist wwbn/avideo |
Grav Vulnerable to Sensitive Information Disclosure via Accounts Service Bypass CVE-2026-42610, GHSA-3f29-pqwf-v4j4 | Medium | 0.3% | 05 May, 2026 | Packagist getgrav/grav |
Grav Vulnerable to XSS via Taxonomy Field Values in Admin Panel CVE-2026-42842, GHSA-c2q3-p4jr-c55f | Medium | 0.2% | 05 May, 2026 | Packagist getgrav/grav |
Grav CMS vulnerable to stored XSS via Markdown media attribute() action CVE-2026-42841, GHSA-r7fx-8g49-7hhr | Medium | 0.4% | 05 May, 2026 | Packagist getgrav/grav |
Kimai vulnerable to formula Injection via tag names in XLSX export CVE-2026-42267, GHSA-3xc2-h5r3-wv3r | Medium | 0.2% | 05 May, 2026 | Packagist kimai/kimai |
Magento LTS Vulnerable to Open Redirect via Unvalidated `uenc` Parameter in `stockAction()` CVE-2026-42207, GHSA-qpgq-5g92-j5q8 | Medium | 0.2% | 05 May, 2026 | Packagist openmage/magento-lts |
Admidio has an incomplete fix for CVE-2026-32812 (SSRF) CVE-2026-42194, GHSA-hcjj-chvw-fmw9 | Medium | 0.2% | 05 May, 2026 | Packagist admidio/admidio |
Video: Reflected XSS in plugin/Meet/iframe.php via Unescaped user and pass Parameters in JavaScript String Literal CVE-2026-43878, GHSA-mm5f-8q57-4fc4 | Medium | 0.3% | 05 May, 2026 | Packagist wwbn/avideo |
AVideo: CSRF in userSavePhoto.php Allows Cross-Origin Overwrite of Authenticated Users' Profile Photos with Arbitrary Content CVE-2026-43877, GHSA-jw8g-5j46-44rp | Medium | 0.1% | 05 May, 2026 | Packagist wwbn/avideo |
AVideo: HTML Injection in notifySubscribers.json.php Allows Platform-Branded Phishing Emails to Channel Subscribers CVE-2026-43876, GHSA-g9cm-rxp7-6gv5 | Medium | 0.2% | 05 May, 2026 | Packagist wwbn/avideo |
AVideo: Password Hash Leak in MobileManager OAuth Redirect URL Enables Account Takeover CVE-2026-43875, GHSA-5w8w-26ch-v5cw | Medium | 0.3% | 05 May, 2026 | Packagist wwbn/avideo |
AzuraCast's Missing RequireInternalConnection on Liquidsoap API Allows Low-Privilege Metadata Injection and Broadcast Disruption CVE-2026-100854, GHSA-4fm3-ggg2-c6qx | Medium | 0.2% | 04 May, 2026 | Packagist azuracast/azuracast |
CI4MS has a Deactivated User Session Bypass (active=0) CVE-2026-41891, GHSA-5hfv-c864-qcq9 | Medium | 0.3% | 04 May, 2026 | Packagist ci4-cms-erp/ci4ms |
CI4MS Vulnerable to Arbitrary Database Table Drop via Theme deleteProcess CVE-2026-41890, GHSA-vgrf-pr28-vf98 | Medium | 0.4% | 04 May, 2026 | Packagist ci4-cms-erp/ci4ms |
Kirby CMS's system API endpoint leaks installed version and license data to authenticated users CVE-2026-42051, GHSA-x68m-c7jf-2572 | Medium | 0.2% | 04 May, 2026 | Packagist getkirby/cms |
Kirby CMS doesn't gate user avatar creation, replacement and deletion with user update permissions CVE-2026-42174, GHSA-39cp-6679-8xv2 | Medium | 0.2% | 04 May, 2026 | Packagist getkirby/cms |
Funadmin has an Improper Access Control Issue CVE-2026-7733, GHSA-qhh7-263p-54r3 | Medium | 0.3% | 04 May, 2026 | Packagist funadmin/funadmin |
MixPHP Framework has an SQL injection vulnerability CVE-2026-42475, GHSA-vf35-8m4j-gm8v | Medium | 0.2% | 01 May, 2026 | Packagist mix/mix |
MixPHP Framework has an SQL injection vulnerability via crafted `data` array CVE-2026-42474, GHSA-q57j-rwwx-7rwp | Medium | 0.2% | 01 May, 2026 | Packagist mix/mix |
Admidio: OIDC Token Introspection Endpoint Returns Active for All Tokens Without Validation CVE-2026-41671, GHSA-9xx5-cv6j-x533 | Medium | 0.3% | 29 Apr, 2026 | Packagist admidio/admidio |
Admidio Missing Minimum Administrator Check in Role Membership Removal CVE-2026-41662, GHSA-c7xm-r6vj-8vg6 | Medium | 0.3% | 29 Apr, 2026 | Packagist admidio/admidio |
Admidio vulnerable to reflected XSS in msg_window.php via Square Bracket to HTML Tag Conversion CVE-2026-41661, GHSA-gq27-fc8w-vcmp | Medium | 0.2% | 29 Apr, 2026 | Packagist admidio/admidio |
Admidio's Missing Authorization on Inventory Module Destructive Endpoints Allows Any Authenticated User to Delete Items CVE-2026-41658, GHSA-xqv4-xm7h-52cv | Medium | 0.2% | 29 Apr, 2026 | Packagist admidio/admidio |
Admidio Exposes Cross-Organization Member Data via Permission Check Mismatch in contacts_data.php CVE-2026-41657, GHSA-g8p8-94f2-28gr | Medium | 0.3% | 29 Apr, 2026 | Packagist admidio/admidio |
Admidio has Path Traversal via Unvalidated `name` Parameter in Document Add Mode that Enables Arbitrary Server File Read CVE-2026-41656, GHSA-m9h6-8pqm-xrhf | Medium | 0.4% | 29 Apr, 2026 | Packagist admidio/admidio |
Admidio has Path Traversal in ECard Preview that Allows Reading Arbitrary Server Files Including Database Credentials CVE-2026-41655, GHSA-m3vp-3jjm-gpmx | Medium | 0.3% | 29 Apr, 2026 | Packagist admidio/admidio |
OpenID Connect nonce generated but never validated — ID token replay attack CVE-2026-42206, GHSA-3gx8-q682-38mx | Medium | 0.2% | 29 Apr, 2026 | Packagist roadiz/openid |
Cockpit is vulnerable to directory traversal CVE-2026-38993, GHSA-p46p-7pmj-m34f | Medium | 0.8% | 29 Apr, 2026 | Packagist cockpit-hq/cockpit |
PhpSpreadsheet has XSS via number format code with @ text placeholder bypasses htmlspecialchars in HTML writer CVE-2026-40296, GHSA-hrmw-qprp-wgmc | Medium | 0.2% | 28 Apr, 2026 | Packagist phpoffice/phpspreadsheet |
PhpSpreadsheet has XSS via NumberFormat @ Text Substitution in HTML Writer CVE-2026-35453, GHSA-6wpp-88cp-7q68 | Medium | 0.2% | 28 Apr, 2026 | Packagist phpoffice/phpspreadsheet |
FacturaScripts has Insecure Parameter Handling: Unauthorized Modification of Immutable 'nick' Field CVE-2026-32699, GHSA-pp79-hqv6-vmc3 | Medium | 0.3% | 28 Apr, 2026 | Packagist facturascripts/facturascripts |
Pimcore has an authenticated Cross-site Scripting issue CVE-2026-5362, GHSA-7gxw-q9j5-mrj4 | Medium | 0.2% | 27 Apr, 2026 | Packagist pimcore/pimcore |
ShowDoc has an Injection vulnerability CVE-2026-6982, GHSA-fm5r-cj7v-rj2c | Medium | 0.2% | 25 Apr, 2026 | Packagist showdoc/showdoc |
nova-toggle-5: Improper authorization on toggle endpoint allowed non-Nova users to modify boolean fields CVE-2026-42202, GHSA-f5c8-m5vw-rmgq | Medium | 0.2% | 24 Apr, 2026 | Packagist almirhodzic/nova-toggle-5 |
Kirby's page creation API bypasses the changeStatus permission check via unfiltered isDraft parameter CVE-2026-40099, GHSA-w942-j9r6-hr6r | Medium | 0.3% | 23 Apr, 2026 | Packagist getkirby/cms |
Kirby has XML injection in its XML creator toolkit CVE-2026-32870, GHSA-9wfj-c55w-j9qr | Medium | 0.3% | 23 Apr, 2026 | Packagist getkirby/cms |
Flarum: Path traversal in LESS parser via theme color settings (incomplete fix for CVE-2023-27577) CVE-2026-41887, GHSA-xjvc-pw2r-6878 | Medium | 0.5% | 22 Apr, 2026 | Packagist flarum/core |
October CMS has Safe Mode Bypass via Twig Database Write Operations CVE-2026-26274, GHSA-h6jm-f4hh-fw27 | Medium | 0.2% | 21 Apr, 2026 | Packagist october/october |
October CMS has Safe Mode Bypass via CSS Preprocessor Compilers CVE-2026-26067, GHSA-3888-q23f-x7qh | Medium | 0.2% | 21 Apr, 2026 | Packagist october/system |
OpenMage LTS: Cross-user wishlist import leads to private option & file disclosure CVE-2026-40098, GHSA-665x-ppc4-685w | Medium | 0.2% | 20 Apr, 2026 | Packagist openmage/magento-lts |
OpenMage LTS has a Path Traversal Filter Bypass in Dataflow Module CVE-2026-25525, GHSA-6vqf-6fhm-7rc6 | Medium | 0.5% | 20 Apr, 2026 | Packagist openmage/magento-lts |
Kimai: Username enumeration via timing on X-AUTH-USER CVE-2026-80199, GHSA-jrc6-fmhw-fpq2 | Medium | 0.3% | 17 Apr, 2026 | Packagist kimai/kimai |
Silverstripe Assets Module has a DBFile::getURL() permission bypass CVE-2026-24749, GHSA-jgcf-rf45-2f8v | Medium | 0.4% | 16 Apr, 2026 | Packagist silverstripe/assets |