Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
AVideo's CSRF on Admin Plugin Configuration Enables Payment Credential Hijacking CVE-2026-34394, GHSA-4wwr-7h7c-chqr | High | 0.2% | 31 Mar, 2026 | Packagist wwbn/avideo |
Admidio has Missing CSRF Protection on Registration Approval Actions CVE-2026-34384, GHSA-ph84-r98x-2j22 | High | 0.2% | 31 Mar, 2026 | Packagist admidio/admidio |
Admidio allows Unauthenticated Access to Role-Restricted documents via neutralized .htaccess CVE-2026-34381, GHSA-7fh7-8xqm-3g88 | High | 0.6% | 31 Mar, 2026 | Packagist admidio/admidio |
baserCMS is Vulnerable to Cross-site Scripting CVE-2026-32734, GHSA-677c-xv24-crgx | High | 0.3% | 31 Mar, 2026 | Packagist baserproject/basercms |
baserCMS Path Traversal Leads to Arbitrary File Write and RCE via Theme File API CVE-2026-30940, GHSA-c5c6-37vq-pjcq | High | 1.1% | 31 Mar, 2026 | Packagist baserproject/basercms |
baserCMS has Unsafe File Upload Leading to Remote Code Execution (RCE) CVE-2025-32957, GHSA-hv78-cwp4-8r7r | High | 0.6% | 31 Mar, 2026 | Packagist baserproject/basercms |
AVideo: Unauthenticated Access to Payment Log DataTables Endpoints Exposes Transaction Data, PayPal Tokens, and User Financial Records CVE-2026-56341, GHSA-wprj-9cvc-5w37 | High | 0.5% | 29 Mar, 2026 | Packagist wwbn/avideo |
AWS SDK for PHP has CloudFront Policy Document Injection via Special Characters GHSA-27qh-8cxx-2cr5 | High | Not scored | 27 Mar, 2026 | Packagist aws/aws-sdk-php |
AVideo Vulnerable to Reflected XSS via Unsanitized plugin Parameter in YPTWallet Stripe Payment Page CVE-2026-34375, GHSA-pm37-62g7-p768 | High | 0.3% | 27 Mar, 2026 | Packagist wwbn/avideo |
AVideo has SQL Injection in category.php fixCleanTitle() via Unparameterized clean_title and id Variables CVE-2026-33770, GHSA-584p-rpvq-35vf | High | 0.5% | 26 Mar, 2026 | Packagist wwbn/avideo |
AVideo has SQL Injection via Partial Prepared Statement — videos_id Concatenated Directly into Query CVE-2026-33767, GHSA-fj74-qxj7-r3vc | High | 0.5% | 26 Mar, 2026 | Packagist wwbn/avideo |
LibreNMS is Vulnerable to Remote Code Execution by Arbitrary File Write CVE-2026-6204, GHSA-pr3g-phhr-h8fh | High | 7.5% | 26 Mar, 2026 | Packagist librenms/librenms |
Saloon has insecure deserialization in AccessTokenAuthenticator CVE-2026-33942, GHSA-rf88-776r-rcq9 | High | 0.6% | 26 Mar, 2026 | Packagist saloonphp/saloon |
Saloon has a Fixture Name Path Traversal Vulnerability CVE-2026-33183, GHSA-f7xc-5852-fj99 | High | 0.6% | 25 Mar, 2026 | Packagist saloonphp/saloon |
Protobuf: Denial of Service issue through malicious messages containing negative varints or deep recursion CVE-2026-6409, GHSA-p2gh-cfq4-4wjc | High | 0.4% | 25 Mar, 2026 | Packagist google/protobuf |
Sharp is Vulnerable to Path Traversal via Unsanitized Extension in FileUtil CVE-2026-33686, GHSA-9ffq-6457-8958 | High | 0.6% | 25 Mar, 2026 | Packagist code16/sharp |
Sharp has Unrestricted File Upload via Client-Controlled Validation Rules CVE-2026-33687, GHSA-fr76-5637-w3g9 | High | 0.5% | 25 Mar, 2026 | Packagist code16/sharp |
PrestaShop has multiple stored XSS vulnerabilities via unprotected Template variables CVE-2026-33673, GHSA-35pf-37c6-jxjv | High | 0.3% | 25 Mar, 2026 | Packagist prestashop/prestashop |
WeChat Pay callback signature verification bypassed when Host header is localhost CVE-2026-33661, GHSA-q938-ghwv-8gvc | High | 0.5% | 25 Mar, 2026 | Packagist yansongda/pay |
Craft CMS is Vulnerable to Authenticated Remote Code Execution via Malicious Attached Behavior CVE-2026-33157, GHSA-2fph-6v5w-89hh | High | 1.1% | 24 Mar, 2026 | Packagist craftcms/cms |
Froxlor is vulnerable to BIND zone file injection via unsanitized DNS record content in DomainZones API CVE-2026-30932, GHSA-x6w6-2xwp-3jh6 | High | 0.6% | 24 Mar, 2026 | Packagist froxlor/froxlor |
Connect CMS: Improper Authorization in the My Page Profile Update Feature Allows Modification of Arbitrary User Information CVE-2026-32300, GHSA-qr6x-wvxr-8hm9 | High | 0.3% | 23 Mar, 2026 | Packagist opensource-workshop/connect-cms |
Connect CMS: Information Disclosure Due to Improper Authorization through the Page Content Retrieval Feature CVE-2026-32299, GHSA-62ch-j6x7-722j | High | 0.3% | 23 Mar, 2026 | Packagist opensource-workshop/connect-cms |
Connect CMS has Stored Cross-site Scripting (XSS) in the File Field of its Form Plugin CVE-2026-32278, GHSA-mv3p-7p89-wq9p | High | 0.2% | 23 Mar, 2026 | Packagist opensource-workshop/connect-cms |
Connect-CMS has DOM-based Cross-Site Scripting (XSS) in the Cabinet Plugin List View CVE-2026-32277, GHSA-cmfh-mpmf-fmq4 | High | 0.3% | 23 Mar, 2026 | Packagist opensource-workshop/connect-cms |
Connect-CMS has Arbitrary Code Execution by an Authenticated User in its Code Study Plugin CVE-2026-32276, GHSA-hxqw-6qv7-cqfv | High | 0.5% | 23 Mar, 2026 | Packagist opensource-workshop/connect-cms |
MantisBT has Stored HTML Injection/XSS when displaying Tags in Timeline CVE-2026-33548, GHSA-73vx-49mv-v8w5 | High | 0.2% | 23 Mar, 2026 | Packagist mantisbt/mantisbt |
MantisBT Vulnerable to Stored HTML Injection in Tag Delete Confirmation CVE-2026-33517, GHSA-fh48-f69w-7vmp | High | 0.2% | 23 Mar, 2026 | Packagist mantisbt/mantisbt |
AVideo is Vulnerable to SQL Injection through Subscribe Endpoint via Unsanitized user_id Parameter CVE-2026-33723, GHSA-ffr8-fxhv-fv8h | High | 0.2% | 23 Mar, 2026 | Packagist wwbn/avideo |
AVideo: Unauthenticated CDN Configuration Takeover via Empty Default Key Bypass and Mass-Assignment CVE-2026-33719, GHSA-r64r-883r-wcwh | High | 0.4% | 23 Mar, 2026 | Packagist wwbn/avideo |
AVideo: Remote Code Execution via PHP Temp File in Encoder downloadURL CVE-2026-33717, GHSA-8wf4-c4x3-h952 | High | 0.4% | 23 Mar, 2026 | Packagist wwbn/avideo |
AVideo has Path Traversal in pluginRunDatabaseScript.json.php Enables Arbitrary SQL File Execution via Unsanitized Plugin Name CVE-2026-33681, GHSA-3hwv-x8g3-9qpr | High | 0.5% | 23 Mar, 2026 | Packagist wwbn/avideo |
AVideo has a Blind SQL Injection in Live Schedule Reminder via Unsanitized live_schedule_id in Scheduler_commands::getAllActiveOrToRepeat() CVE-2026-33651, GHSA-pvw4-p2jm-chjm | High | 0.4% | 23 Mar, 2026 | Packagist wwbn/avideo |
AVideo: Video Moderator Privilege Escalation via Ownership Transfer Enables Arbitrary Video Deletion CVE-2026-33650, GHSA-8x77-f38v-4m5j | High | 0.2% | 23 Mar, 2026 | Packagist wwbn/avideo |
AVideo's GET-Based CSRF in setPermission.json.php Enables Privilege Escalation via Arbitrary Permission Modification CVE-2026-33649, GHSA-g8x9-7mgh-7cvj | High | 0.2% | 23 Mar, 2026 | Packagist wwbn/avideo |
AVideo Vulnerable to OS Command Injection via Unsanitized `users_id` and `liveTransmitionHistory_id` in Restreamer Log File Path CVE-2026-33648, GHSA-5m4q-5cvx-36mw | High | 0.6% | 23 Mar, 2026 | Packagist wwbn/avideo |
AVideo Vulnerable to Remote Code Execution via MIME/Extension Mismatch in ImageGallery File Upload CVE-2026-33647, GHSA-wxjw-phj6-g75w | High | 0.7% | 23 Mar, 2026 | Packagist wwbn/avideo |
AVideo has an Unauthenticated Local File Inclusion in API locale (RCE possible with writable PHP) CVE-2026-33513, GHSA-8fw8-q79c-fp9m | High | 0.8% | 20 Mar, 2026 | Packagist wwbn/avideo |
AVideo has an unauthenticated decrypt oracle leaking any ciphertext CVE-2026-33512, GHSA-mwjc-5j4x-r686 | High | 0.2% | 20 Mar, 2026 | Packagist wwbn/avideo |
AVideo Affected by CSRF on Plugin Import Endpoint Enables Unauthenticated Remote Code Execution via Malicious Plugin Upload CVE-2026-33507, GHSA-hv36-p4w4-6vmj | High | 0.4% | 20 Mar, 2026 | Packagist wwbn/avideo |
DreamFactory has a directory traversal CVE-2025-55988, GHSA-gv7f-w92j-383q | High | 0.9% | 20 Mar, 2026 | Packagist dreamfactory/df-core |
AVideo has a Path Traversal in import.json.php Allows Private Video Theft and Arbitrary File Read/Deletion via fileURI Parameter CVE-2026-33493, GHSA-83xq-8jxj-4rxm | High | 0.3% | 20 Mar, 2026 | Packagist wwbn/avideo |
AVideo has Session Fixation via GET PHPSESSID Parameter With Disabled Login Session Regeneration CVE-2026-33492, GHSA-x3pr-vrhq-vq43 | High | 0.3% | 20 Mar, 2026 | Packagist wwbn/avideo |
AVideo has a PGP 2FA Bypass via Cryptographically Broken 512-bit RSA Key Generation in LoginControl Plugin CVE-2026-33488, GHSA-6m5f-j7w2-w953 | High | 0.3% | 20 Mar, 2026 | Packagist wwbn/avideo |
AVideo has an Unauthenticated Blind SQL Injection in RTMP on_publish Callback via Stream Name Parameter CVE-2026-33485, GHSA-8p58-35c3-ccxx | High | 0.5% | 20 Mar, 2026 | Packagist wwbn/avideo |
AVideo Affected by Unauthenticated Disk Space Exhaustion via Unlimited Temp File Creation in aVideoEncoderChunk.json.php CVE-2026-33483, GHSA-vv7w-qf5c-734w | High | 0.6% | 20 Mar, 2026 | Packagist wwbn/avideo |
AVideo has an OS Command Injection via $() Shell Substitution Bypass in sanitizeFFmpegCommand() CVE-2026-33482, GHSA-pmj8-r2j7-xg6c | High | 4.3% | 20 Mar, 2026 | Packagist wwbn/avideo |
AVideo has a SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses in Unauthenticated LiveLinks Proxy CVE-2026-33480, GHSA-p3gr-g84w-g8hh | High | 0.3% | 20 Mar, 2026 | Packagist wwbn/avideo |
AVideo has PHP Code Injection via eval() in Gallery saveSort.json.php Exploitable Through CSRF Against Admin CVE-2026-33479, GHSA-xggw-g9pm-9qhh | High | 0.5% | 20 Mar, 2026 | Packagist wwbn/avideo |
The Query Monitor plugin for WordPress has Reflected Cross-Site Scripting via Request URI CVE-2026-4267, GHSA-2xr4-chcf-vmvf | High | 0.3% | 19 Mar, 2026 | Packagist johnbillion/query-monitor |