Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
ProcessWire: server-side request forgery vulnerability in the admin panel's 'Add Module From URL' feature CVE-2026-40500, GHSA-gmwr-9j4p-96vm | Medium | Not scored | 16 Apr, 2026 | Packagist processwire/processwire |
Froxlor has an Email Sender Alias Domain Ownership Bypass via Wrong Array Index Allows Cross-Customer Email Spoofing CVE-2026-41232, GHSA-vmjj-qr7v-pxm6 | Medium | 0.2% | 16 Apr, 2026 | Packagist froxlor/froxlor |
Froxlor has a Reseller Domain Quota Bypass via Unvalidated adminid Parameter in Domains.add() CVE-2026-41233, GHSA-jvx4-xv3m-hrj4 | Medium | 0.3% | 16 Apr, 2026 | Packagist froxlor/froxlor |
Kimai's User Preferences API allows standard users to modify restricted attributes: hourly_rate, internal_rate CVE-2026-40486, GHSA-qh43-xrjm-4ggp | Medium | 0.3% | 15 Apr, 2026 | Packagist kimai/kimai |
Kimai has Stored XSS via Incomplete HTML Attribute Escaping in Team Member Widget CVE-2026-40479, GHSA-g82g-m9vx-vhjg | Medium | 0.2% | 15 Apr, 2026 | Packagist kimai/kimai |
PocketMine-MP has LogDoS by many junk properties in client data JWT in LoginPacket CVE-2026-86200, GHSA-xp4f-g2cm-rhg7 | Medium | 0.6% | 15 Apr, 2026 | Packagist pocketmine/pocketmine-mp |
Drupal core allows Cross-Site Scripting (XSS) BIT-drupal-2026-6367, CVE-2026-6367, DRUPAL-CORE-2026-003, GHSA-pw6f-3999-xp7g | Medium | 0.2% | 15 Apr, 2026 | Packagist drupal/core |
Drupal core allows Object Injection BIT-drupal-2026-6366, CVE-2026-6366, DRUPAL-CORE-2026-002, GHSA-xmjc-63pr-2mpg | Medium | 0.4% | 15 Apr, 2026 | Packagist drupal/core |
Drupal core is Vulnerable to Cross-Site Scripting BIT-drupal-2026-6365, CVE-2026-6365, DRUPAL-CORE-2026-001, GHSA-f3cj-mjqm-fhvj | Medium | 0.2% | 15 Apr, 2026 | Packagist drupal/core |
Craft CMS has a host header injection leading to SSRF via resource-js endpoint CVE-2026-41130, GHSA-95wr-3f2v-v2wh | Medium | 0.3% | 14 Apr, 2026 | Packagist craftcms/cms |
Server-Side Request Forgery (SSRF) in Craft CMS with Asset Uploads Mutations CVE-2026-41129, GHSA-3m9m-24vh-39wx | Medium | 0.3% | 14 Apr, 2026 | Packagist craftcms/cms |
Craft CMS has a Missing Authorization Check on User Group Removal via save-permissions Action CVE-2026-41128, GHSA-jq2f-59pj-p3m3 | Medium | 0.2% | 14 Apr, 2026 | Packagist craftcms/cms |
WWBN AVideo has an incomplete fix for CVE-2026-33500: XSS CVE-2026-41063, GHSA-m7r8-6q9j-m2hc | Medium | 0.2% | 14 Apr, 2026 | Packagist wwbn/avideo |
WWBN AVideo has an Incomplete fix: Directory traversal bypass via query string in ReceiveImage downloadURL parameters CVE-2026-41062, GHSA-m63r-m9jh-3vc6 | Medium | 0.7% | 14 Apr, 2026 | Packagist wwbn/avideo |
WWBN AVideo has Stored XSS via Unanchored Duration Regex in Video Encoder Receiver CVE-2026-41061, GHSA-8pv3-29pp-pf8f | Medium | 0.2% | 14 Apr, 2026 | Packagist wwbn/avideo |
WWBN AVideo has an incomplete fix for CVE-2026-33039: SSRF CVE-2026-41055, GHSA-793q-xgj6-7frp | Medium | 0.4% | 14 Apr, 2026 | Packagist wwbn/avideo |
CAPTCHA Bypass in WWBN/AVideo via Attacker-Controlled Length Parameter and Missing Token Invalidation on Failure CVE-2026-40935, GHSA-hg7g-56h5-5pqr | Medium | 0.2% | 14 Apr, 2026 | Packagist wwbn/avideo |
WWBN AVideo is missing CSRF protection in objects/commentDelete.json.php enables mass comment deletion against moderators and content creators CVE-2026-40929, GHSA-8qm8-g55h-xmqr | Medium | 0.1% | 14 Apr, 2026 | Packagist wwbn/avideo |
WWBN AVideo: Missing CSRF Protection on State-Changing JSON Endpoints Enables Forced Comment Creation, Vote Manipulation, and Category Asset Deletion CVE-2026-40928, GHSA-x2pw-9c38-cp2j | Medium | 0.1% | 14 Apr, 2026 | Packagist wwbn/avideo |
WWBN AVideo has an Unauthenticated Information Disclosure via git.json.php Exposes Developer Emails and Deployed Version CVE-2026-40908, GHSA-52hf-63q4-r926 | Medium | 0.3% | 14 Apr, 2026 | Packagist wwbn/avideo |
WWBN AVideo has an IDOR in Live Restreams list.json.php Exposes Other Users' Stream Keys and OAuth Tokens CVE-2026-40907, GHSA-gpgp-w4x2-h3h7 | Medium | 0.3% | 14 Apr, 2026 | Packagist wwbn/avideo |
Serendipity has a Host Header Injection allows authentication cookie scoping to attacker-controlled domain in functions_config.inc.php CVE-2026-39963, GHSA-4m6c-649p-f6gf | Medium | 0.2% | 14 Apr, 2026 | Packagist s9y/serendipity |
October Rain has Stored XSS via SVG Filter Bypass CVE-2026-25133, GHSA-gcqv-f29m-67gr | Medium | 0.2% | 14 Apr, 2026 | Packagist october/rain |
October Rain has Environment Variable Exfiltration via INI Parser Interpolation CVE-2026-25125, GHSA-g6v3-wv4j-x9hg | Medium | 0.3% | 14 Apr, 2026 | Packagist october/rain |
October CMS has Stored XSS in Event Log Mail Preview CVE-2026-24907, GHSA-j4j5-9x6g-rgxc | Medium | 0.2% | 14 Apr, 2026 | Packagist october/system |
October CMS has Stored XSS in Backend Editor Markup Classes CVE-2026-24906, GHSA-6qmh-j78v-ffp7 | Medium | 0.3% | 14 Apr, 2026 | Packagist october/system |
October Rain has a Twig Sandbox Bypass via Collection Methods CVE-2026-22692, GHSA-m5qg-jc75-4jp6 | Medium | 0.4% | 14 Apr, 2026 | Packagist october/rain |
Kimai has an Open Redirect via Unvalidated RelayState in SAML ACS Handler CVE-2026-80200, GHSA-3jp4-mhh4-gcgr | Medium | 0.4% | 14 Apr, 2026 | Packagist kimai/kimai |
graphql-php is affected by a Denial of Service via quadratic complexity in OverlappingFieldsCanBeMerged validation CVE-2026-40476, GHSA-68jq-c3rv-pcrr | Medium | 0.6% | 14 Apr, 2026 | Packagist webonyx/graphql-php |
LibreNMS: Cross-Site Scripting in ShowConfigController CVE-2026-2728, GHSA-5gm9-622f-qcg5 | Medium | 0.2% | 13 Apr, 2026 | Packagist librenms/librenms |
rhukster/dom-sanitizer: SVG <style> tag allows CSS injection via unfiltered url() and @import directives CVE-2026-40301, GHSA-93vf-569f-22cq | Medium | 0.3% | 10 Apr, 2026 | Packagist rhukster/dom-sanitizer |
CI4MS has stored XSS in Pages Content Due to Missing html_purify Sanitization CVE-2026-39392, GHSA-fjpj-6qcq-6pw2 | Medium | 0.2% | 08 Apr, 2026 | Packagist ci4-cms-erp/ci4ms |
CI4MS has stored XSS via Unescaped Blacklist Note in Admin User List CVE-2026-39391, GHSA-7cm9-v848-cfh2 | Medium | 0.2% | 08 Apr, 2026 | Packagist ci4-cms-erp/ci4ms |
CI4MS has stored XSS via srcdoc attribute bypass in Google Maps iframe setting CVE-2026-39390, GHSA-x3hr-cp7x-44r2 | Medium | 0.2% | 08 Apr, 2026 | Packagist ci4-cms-erp/ci4ms |
WWBN AVideo has a Live restream log callback flow enabling stored SSRF to internal services CVE-2026-39368, GHSA-q4x6-6mm2-crg9 | Medium | 0.2% | 07 Apr, 2026 | Packagist WWBN/AVideo |
WWBN AVideo has Stored XSS via Malicious EPG XML Program Titles in AVideo EPG Page CVE-2026-39367, GHSA-rqp3-gf5h-mrqx | Medium | 0.2% | 07 Apr, 2026 | Packagist wwbn/avideo |
WWBN AVideo Affected by a PayPal IPN Replay Attack Enabling Wallet Balance Inflation via Missing Transaction Deduplication in ipn.php CVE-2026-39366, GHSA-mmw7-wq3c-wf9p | Medium | 0.2% | 07 Apr, 2026 | Packagist wwbn/avideo |
yaffa vulnerable to Cross Site Scripting CVE-2025-70844, GHSA-pq95-94c9-j987 | Medium | 0.3% | 07 Apr, 2026 | Packagist kantorge/yaffa |
PocketMine-MP: Player entities can still die and drop items in flaggedForDespawn state CVE-2026-86203, GHSA-f9jp-856v-8642 | Medium | 0.3% | 06 Apr, 2026 | Packagist pocketmine/pocketmine-mp |
PocketMine-MP: Network amplification vulnerability with `ActorEventPacket` CVE-2026-86202, GHSA-7hmv-4j2j-pp6f | Medium | 0.4% | 06 Apr, 2026 | Packagist pocketmine/pocketmine-mp |
Feehi CMS has an authenticated stored cross-site scripting (XSS) vulnerability via the creation/editing module CVE-2026-31313, GHSA-hj9c-p59c-vqph | Medium | 0.1% | 06 Apr, 2026 | Packagist feehi/cms |
Feehi CMS has authenticated stored cross-site scripting (XSS) vulnerabilities via the Permissions module CVE-2026-31354, GHSA-xqm9-6qmm-xrqh | Medium | 0.2% | 06 Apr, 2026 | Packagist feehi/cms |
Feehi CMS has an authenticated stored cross-site scripting (XSS) vulnerability via the Category module CVE-2026-31353, GHSA-664p-j3q6-p843 | Medium | 0.2% | 06 Apr, 2026 | Packagist feehi/cms |
Feehi CMS has an authenticated stored cross-site scripting (XSS) vulnerability via the Role Management module CVE-2026-31352, GHSA-hqjc-wfvx-x2fv | Medium | 0.2% | 06 Apr, 2026 | Packagist feehi/cms |
Feehi CMS has an authenticated stored cross-site scripting (XSS) vulnerability via the creation/editing module CVE-2026-31351, GHSA-cvjh-88c8-2jjx | Medium | 0.2% | 06 Apr, 2026 | Packagist feehi/cms |
Feehi CMS has an authenticated stored cross-site scripting (XSS) vulnerability via the Page Sign parameter CVE-2026-31350, GHSA-cgxr-v74v-g9mm | Medium | 0.2% | 06 Apr, 2026 | Packagist feehi/cms |
Nodcms contains a cross-site request forgery vulnerability CVE-2016-20054, GHSA-3qcm-pj6q-w4c5 | Medium | 0.1% | 04 Apr, 2026 | Packagist khodakhah/nodcms |
AVideo: Unauthenticated Information Disclosure via Missing Auth on CloneSite client.log.php CVE-2026-35452, GHSA-99j6-hj87-6fcf | Medium | 0.4% | 04 Apr, 2026 | Packagist wwbn/avideo |
AVideo: Unauthenticated FFmpeg Remote Server Status Disclosure via check.ffmpeg.json.php CVE-2026-35450, GHSA-2vg4-rrx4-qcpq | Medium | 0.4% | 04 Apr, 2026 | Packagist wwbn/avideo |
AVideo: Unauthenticated Information Disclosure via Disabled CLI Guard in install/test.php CVE-2026-35449, GHSA-hg8q-8wqr-35xx | Medium | 0.3% | 04 Apr, 2026 | Packagist wwbn/avideo |