Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Laravel TokenGuard authentication bypass through non-string API credentials CVE-2026-114509, GHSA-f9x3-7vq9-cph6 | Critical | 0.8% | 7 days ago | Packagist laravel/framework |
Contao: Cross-site scripting in the comments bundle CVE-2026-107845, GHSA-628f-v4f6-p37r | Critical | 0.3% | 20 days ago | Packagist contao/comments-bundle |
FriendsOfFlarum OAuth: Unauthenticated account takeover via unverified email trust in Discord OAuth provider CVE-2026-92161, GHSA-g7vj-c29h-3h5m | Critical | 0.3% | 25 Sep, 2026 | Packagist fof/oauth |
Chamilo LMS CStudio upload flow allows unauthenticated remote code execution CVE-2026-45140, GHSA-g4c3-4g96-6g4m | Critical | 1.3% | 17 Sep, 2026 | Packagist chamilo/chamilo-lms |
CakePHP: Multiple methods in FunctionsBuilder vulnerable to SQL injection CVE-2026-79752, GHSA-vjqc-q4mp-2rvf | Critical | 0.6% | 17 Sep, 2026 | Packagist cakephp/cakephp Packagist cakephp/database |
Predis: Redis command injection and denial of service via CRLF smuggling in pipelined commands on aggregate connections CVE-2026-84372, GHSA-w6f5-v2h6-g786 | Critical | 0.7% | 01 Sep, 2026 | Packagist predis/predis |
Pimcore Vulnerable to Remote Code Execution via DataObject Class-Definition Field Name CVE-2026-55634, GHSA-9x44-4gxf-8c25 | Critical | 0.7% | 28 Aug, 2026 | Packagist pimcore/pimcore |
Pimcore Hotspotimage getDataFromResource() unrestricted Serialize::unserialize over object-store column (PHP Object Injection, CWE-502) CVE-2026-55220, GHSA-w23p-wrp7-ch38 | Critical | 0.7% | 28 Aug, 2026 | Packagist pimcore/pimcore |
Grav: Origin validation bypass in Uri::referrer() and Pages::referrerRoute() via unanchored prefix match CVE-2026-72702, GHSA-9ccq-2jfg-qw33 | Critical | 0.1% | 25 Aug, 2026 | Packagist getgrav/grav |
CakePHP: FunctionsBuilder::jsonValue() vulerable to SQL injection with PostgresDriver CVE-2026-77635, GHSA-fxf7-vhh8-7vpq | Critical | 0.5% | 24 Aug, 2026 | Packagist cakephp/cakephp Packagist cakephp/database |
Phalcon Volt compiler `join` filter compile-time PHP code injection (SSTI leads to RCE) CVE-2026-59989, GHSA-hrwp-4hh9-c8r8 | Critical | 0.5% | 21 Aug, 2026 | Packagist phalcon/cphalcon |
Winter: Authenticated Twig sandbox escape in CMS SecurityPolicy (bypass of CVE-2024-54149) CVE-2026-79774, GHSA-8cfw-pcwh-v63w | Critical | 0.8% | 20 Aug, 2026 | Packagist winter/wn-system-module |
LibreNMS: SSRF-driven stored XSS via Oxidized API response fields in device showconfig page CVE-2026-84189, GHSA-7gww-x7fh-jf9j | Critical | 0.4% | 18 Aug, 2026 | Packagist librenms/librenms |
Froxlor: Credential and 2FA secret disclosure via Froxlor API endpoints CVE-2026-62988, GHSA-7788-ghfq-c6mh | Critical | 0.6% | 18 Aug, 2026 | Packagist froxlor/froxlor |
Grav: Missing admin.super guard on core group blueprint access field allows admin.users operator to escalate to super-admin CVE-2026-75837, GHSA-xhfv-7758-r9hx | Critical | 0.5% | 18 Aug, 2026 | Packagist getgrav/grav |
Grav: detectXss() misses an event-handler attribute after an unpaired quote in an unquoted attribute value, giving stored XSS CVE-2026-75828, GHSA-vfmf-q6x9-cw96 | Critical | 0.4% | 18 Aug, 2026 | Packagist getgrav/grav |
Grav: Blueprint dynamic-data bare-function branch is denylist-gated and omits error_log, giving arbitrary file write CVE-2026-75827, GHSA-f8wv-xp27-6gq7 | Critical | 0.9% | 18 Aug, 2026 | Packagist getgrav/grav |
Craft CMS: Passkey login accepts replayed WebAuthn assertions CVE-2026-72780, GHSA-wg23-69c2-gjc8 | Critical | 0.4% | 07 Aug, 2026 | Packagist craftcms/cms |
Craft CMS: Authorization bypass: view-only Categories user can modify category structure via structures/move-element CVE-2026-72785, GHSA-xxpx-f366-4xpq | Critical | 0.3% | 06 Aug, 2026 | Packagist craftcms/cms |
CodeIgniter: Uploaded file extension validation bypass in `is_image` and `mime_in` rules CVE-2026-63223, GHSA-mmj4-63m4-r6h5 | Critical | 0.8% | 31 Jul, 2026 | Packagist codeigniter4/framework |
CodeIgniter: SQL injection in Query Builder deleteBatch() when used with where() conditions CVE-2026-63221, GHSA-c9w5-rwh3-7pm9 | Critical | 0.6% | 31 Jul, 2026 | Packagist codeigniter4/framework |
Pheditor: Authentication Bypass in Forced Password-Change Flow via Unverified Current Password GHSA-f25v-x6vr-962g | Critical | Not scored | 24 Jul, 2026 | Packagist pheditor/pheditor |
Pheditor: Hardcoded default password 'admin' with no forced change enables full application compromise CVE-2026-55579, GHSA-p4h7-p9rj-2pq2 | Critical | 0.8% | 16 Jul, 2026 | Packagist pheditor/pheditor |
MantisBT: Reflected XSS in admin/install.php via unescaped printf CVE-2026-52881, GHSA-vcrw-4xvv-jh49 | Critical | Not scored | 15 Jul, 2026 | Packagist mantisbt/mantisbt |
MantisBT: Reflected XSS in admin/install.php CVE-2026-52847, GHSA-77x8-3v3h-hrhv | Critical | Not scored | 15 Jul, 2026 | Packagist mantisbt/mantisbt |
MantisBT: SOAP API Authentication Bypass with Privilege Escalation to Administrator CVE-2026-47156, GHSA-c2xg-qjqw-2v98 | Critical | 0.7% | 15 Jul, 2026 | Packagist mantisbt/mantisbt |
FacturaScripts: Path traversal in UploadedFile::move() via getClientOriginalName() — arbitrary file write outside MyFiles/ leading to RCE GHSA-hgjx-r89m-m7v4 | Critical | Not scored | 14 Jul, 2026 | Packagist facturascripts/facturascripts |
FacturaScripts: Authenticated SQL injection in the FacturaScripts REST API filter parameter via parenthesis bypass in `Where::sqlColumn` CVE-2026-45262, GHSA-5qmh-x653-g8qj | Critical | Not scored | 14 Jul, 2026 | Packagist facturascripts/facturascripts |
Kimai: Default APP_SECRET in Docker Image Enables Cookie Forgery and Account Takeover CVE-2026-52824, GHSA-jr9p-4h4j-6c58 | Critical | 1.3% | 14 Jul, 2026 | Packagist kimai/kimai |
FacturaScripts: Account takeover of any 2FA-enabled user CVE-2026-47677, GHSA-c67f-gmxw-mj93 | Critical | Not scored | 13 Jul, 2026 | Packagist facturascripts/facturascripts |
prestashop/ps_facetedsearch: PHP Object Injection in faceted search cache allows unauthenticated RCE CVE-2026-54159, GHSA-m5f5-28qr-9g9r | Critical | 0.8% | 10 Jul, 2026 | Packagist prestashop/ps_facetedsearch |
YesWiki Vulnerable to Authenticated PHP Object Injection in BazarImportAction via unserialize CVE-2026-52777, GHSA-9369-69wj-7m2f | Critical | 0.3% | 09 Jul, 2026 | Packagist yeswiki/yeswiki |
YesWiki vulnerable to unauthenticated arbitrary page deletion via `{{erasespamedcomments}}` action CVE-2026-52766, GHSA-6x7x-gcmf-7r8x | Critical | 0.6% | 09 Jul, 2026 | Packagist yeswiki/yeswiki |
EGroupware has a Remote Code Execution Vulnerability CVE-2026-27823, GHSA-h9qx-v5xp-ph8p | Critical | 1.0% | 07 Jul, 2026 | Packagist egroupware/egroupware |
Formie Hidden field defaults vulnerable to Server-Side Template Injection CVE-2026-52889, GHSA-565m-g33j-jq96 | Critical | 1.3% | 06 Jul, 2026 | Packagist verbb/formie |
Poweradmin has Host Header Injection in OIDC redirect_uri, SAML ACS/SLO URL, and Logout Redirect Construction. CVE-2026-54588, GHSA-3735-5339-xfwx | Critical | 0.5% | 23 Jun, 2026 | Packagist poweradmin/poweradmin |
Craft CMS: Blind SSRF and Arbitrary JavaScript Injection via Host Header Poisoning in actionResourceJs CVE-2026-55791, GHSA-c55v-343g-5xff | Critical | 0.5% | 19 Jun, 2026 | Packagist craftcms/cms |
Kirby: External Initialization of the Panel on reverse proxy setups with the `Forwarded` header CVE-2026-54003, GHSA-whxw-24jc-cwmv | Critical | 0.7% | 18 Jun, 2026 | Packagist getkirby/cms |
Cotonti: Cross-Site Request Forgery in the administration rights handler CVE-2026-55742, GHSA-7g3p-35vc-mgjr | Critical | 0.2% | 18 Jun, 2026 | Packagist cotonti/cotonti |
shlink has a Server-Side Request Forgery issue CVE-2026-50887, GHSA-p85r-x2wj-mxqj | Critical | 0.3% | 15 Jun, 2026 | Packagist shlinkio/shlink |
Project Firefly III has incorrect access control in the webhook management component CVE-2026-50886, GHSA-9mmg-q95p-gp67 | Critical | 0.3% | 15 Jun, 2026 | Packagist grumpydictator/firefly-iii |
jmespath.php has CompilerRuntime code injection via unescaped function names CVE-2026-54133, GHSA-pcw8-m77r-2528 | Critical | 0.4% | 12 Jun, 2026 | Packagist mtdowling/jmespath.php |
CodeIgniter4 has a validation bypass when uploading file extensions via `ext_in` rule CVE-2026-48062, GHSA-2gr4-ppc7-7mhx | Critical | 0.8% | 11 Jun, 2026 | Packagist codeigniter4/framework |
Pheditor: OS Command Injection in terminal handler via unsanitized 'dir' parameter CVE-2026-48030, GHSA-jvc5-6g7q-c843 | Critical | 7.5% | 09 Jun, 2026 | Packagist pheditor/pheditor |
PHPSpreadsheet has a patch bypass for CVE-2026-34084 CVE-2026-45034, GHSA-87m4-826x-3crx | Critical | 0.5% | 08 Jun, 2026 | Packagist phpoffice/phpspreadsheet |
YesWiki has Unsafe eval() in its Formula Calculato, Leading to Remote Code Execution & Denial of Service CVE-2026-52778, GHSA-px5m-h76g-p7p8 | Critical | 0.8% | 08 Jun, 2026 | Packagist yeswiki/yeswiki |
WWBN AVideo: Unauthenticated Stored DOM Cross-Site Scripting via Per-Client Metadata Broadcast in YPTSocket Plugin CVE-2026-54458, GHSA-8whc-2wmv-ww35 | Critical | 0.4% | 04 Jun, 2026 | Packagist WWBN/AVideo |
Shopper: Authorization bypass and RBAC privilege escalation in team settings CVE-2026-47744, GHSA-c3qp-2ggw-xjg7 | Critical | 0.3% | 29 May, 2026 | Packagist shopper/framework |
Mautic vulnerable to Path Traversal via Campaign Import CVE-2026-9559, GHSA-6r9h-4h75-7q4x | Critical | 0.6% | 29 May, 2026 | Packagist mautic/core |
Mautic has Server-Side Template Injection (SSTI) in Theme Templates CVE-2026-9558, GHSA-9fx4-7cmj-47vg | Critical | 0.6% | 29 May, 2026 | Packagist mautic/core |