Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
MultiFactor Authentication for SilverStripe can bypass MFA during password reset flow CVE-2026-55186, GHSA-68wq-phq7-p2vg | Medium | Not scored | 5 hours ago | Packagist silverstripe/mfa |
Livewire: Authorization bypass in #[Authorize] via reordered parameter keys and #[Json] execution order GHSA-mhf7-xp6r-6qrc | Medium | Not scored | 6 days ago | Packagist livewire/livewire |
PhpSpreadsheet: SSRF whitelist bypass via unre-validated HTTP redirect in Drawing::setPath external image loading CVE-2026-108360, GHSA-2phh-27fw-q4gc | Medium | 0.2% | 7 days ago | Packagist phpoffice/phpspreadsheet |
Laravel relationship inclusion can trigger unauthorized data destruction CVE-2026-114508, GHSA-5wcm-3v2w-8362 | Medium | 0.4% | 7 days ago | Packagist laravel/framework |
Cachet has Stored XSS in Incident Component CVE-2026-113712, GHSA-x397-5hrv-j9m9 | Medium | 0.5% | 9 days ago | Packagist cachethq/cachet |
YOURLS: Unauthenticated File Inclusion CVE-2026-62858, GHSA-f8ff-652m-j5rx | Medium | 0.5% | 15 days ago | Packagist yourls/yourls |
Contao: Improper access control in the preview links module CVE-2026-107850, GHSA-q6wp-fr43-gm9v | Medium | 0.2% | 20 days ago | Packagist contao/core-bundle |
Contao: Improper access control in the table access voter CVE-2026-107851, GHSA-5974-gfqc-wrcm | Medium | 0.2% | 20 days ago | Packagist contao/core-bundle |
Contao: Path traversal in the images controller CVE-2026-107844, GHSA-mrvp-7wmx-5m4h | Medium | 0.3% | 20 days ago | Packagist contao/core-bundle |
Contao: The registration module re-sends activation mails CVE-2026-107843, GHSA-mfxh-vp55-7gc6 | Medium | 0.3% | 20 days ago | Packagist contao/core-bundle |
Contao: Protected page content is disclosed to anonymous visitors after contao.search.index_protected is disabled CVE-2026-107842, GHSA-x2rp-9qf7-2fmq | Medium | 0.3% | 20 days ago | Packagist contao/core-bundle |
svg-sanitizer: Mixed-case xlink:HrEf skips the `<use>` nesting-DoS check in Resolver::processReferences CVE-2026-107381, GHSA-m9xh-6747-9r6f | Medium | 0.5% | 21 days ago | Packagist enshrined/svg-sanitize |
enshrined/svg-sanitize: Stored XSS via DTD Entity / HTML5 Named Character Reference Collision CVE-2026-107380, GHSA-9rjx-3jch-6vjf | Medium | 0.3% | 21 days ago | Packagist enshrined/svg-sanitize |
enshrined/svg-sanitize: Denial of Service via DTD Attribute Declaration Crash CVE-2026-107379, GHSA-v383-3rw5-q8rf | Medium | 0.5% | 21 days ago | Packagist enshrined/svg-sanitize |
Filament: Multi-factor authentication (app) management actions do not require password reauthentication CVE-2026-104181, GHSA-7m6h-rg42-m449 | Medium | 0.3% | 28 days ago | Packagist filament/filament |
league/commonmark: DisallowedRawHtml bypassed when a disallowed tag name ends the raw-HTML literal CVE-2026-105829, GHSA-97jj-33gv-5xf9 | Medium | 0.3% | 29 days ago | Packagist league/commonmark |
Sulu: JCR-SQL2 injection via `categories` query parameter (unauthenticated) CVE-2026-92692, GHSA-jg26-q8hg-3pq4 | Medium | 0.4% | 23 Sep, 2026 | Packagist sulu/sulu |
REDAXO: Unwhitelisted ORDER BY Column in rex_list Allows Authenticated Column Enumeration CVE-2026-62998, GHSA-4f5f-j737-pm58 | Medium | 0.4% | 23 Sep, 2026 | Packagist redaxo/source |
Solspace Freeform: Limited Twig template injection via submitted field values CVE-2026-73858, GHSA-gxrg-x694-283w | Medium | 0.5% | 23 Sep, 2026 | Packagist solspace/craft-freeform |
WPGraphQL: Contributor can publish and modify posts without the required capabilities via updatePost CVE-2026-88974, GHSA-5mmc-8pc9-wggg | Medium | 0.4% | 23 Sep, 2026 | Packagist wp-graphql/wp-graphql |
REDAXO: Missing CSRF Protection on Package Update Action Allows Forced Addon Updates CVE-2026-63000, GHSA-m8r3-22v6-g877 | Medium | 0.1% | 23 Sep, 2026 | Packagist redaxo/source |
REDAXO: Stored XSS in Mediapool Sync Page via Unescaped Filesystem Filenames CVE-2026-63002, GHSA-w998-qmw9-mf4m | Medium | 0.2% | 23 Sep, 2026 | Packagist redaxo/source |
REDAXO: Stored XSS via Unescaped Media Manager Type Name in `mediaIsInUse()` CVE-2026-63001, GHSA-mf2p-wjp4-99pq | Medium | 0.2% | 23 Sep, 2026 | Packagist redaxo/source |
Paymenter has a credit-refund double-spend race condition in service downgrade (doUpgrade) CVE-2026-71537, GHSA-5gmm-hjfj-8ff7 | Medium | 0.3% | 18 Sep, 2026 | Packagist paymenter/paymenter |
Semantic MediaWiki's Special:FacetedSearch cstate hidden inputs enable reflected XSS (residual of CVE-2025-10354) CVE-2026-116891, GHSA-9rcc-pmj8-ffhr | Medium | 0.2% | 18 Sep, 2026 | Packagist mediawiki/semantic-media-wiki |
Semantic MediaWiki affected by reflected XSS in `Special:Ask` via a forged cursor pagination token CVE-2026-77616, GHSA-cx86-7xwp-w9wf | Medium | 0.3% | 18 Sep, 2026 | Packagist mediawiki/semantic-media-wiki |
Semantic MediaWiki has a query debug output XSS (`DebugFormatter`) CVE-2026-77610, GHSA-q5fm-9mx6-44f4 | Medium | 0.3% | 18 Sep, 2026 | Packagist mediawiki/semantic-media-wiki |
Semantic MediaWiki has an open redirect in Special:URIResolver CVE-2026-77609, GHSA-hw3m-8j5x-94ff | Medium | 0.3% | 18 Sep, 2026 | Packagist mediawiki/semantic-media-wiki |
Semantic MediaWiki affected by Special:Ask table `sep` parameter reflected XSS CVE-2026-77607, GHSA-7xv3-gf2g-498h | Medium | 0.3% | 18 Sep, 2026 | Packagist mediawiki/semantic-media-wiki |
Semantic MediaWiki has reflected XSS in `Special:SearchByProperty` (`property` and `value` parameters) CVE-2026-77608, GHSA-59xw-qv23-j3rc | Medium | 0.3% | 18 Sep, 2026 | Packagist mediawiki/semantic-media-wiki |
Semantic MediaWiki has reflected XSS in Special:Ask plain table headers CVE-2026-77606, GHSA-3jp5-3h47-28qf | Medium | 0.3% | 18 Sep, 2026 | Packagist mediawiki/semantic-media-wiki |
Composer: GHSA-gjfg-22fp-rrxx fix bypass via symlinked package bin path BIT-composer-2026-59944, CVE-2026-59944, GHSA-96h3-5x6v-m776 | Medium | 0.5% | 16 Sep, 2026 | Packagist composer/composer |
October CMS: Incomplete Scheme Validation in Image Resizer CVE-2026-100909, GHSA-2xmm-m4wv-3fjh | Medium | 0.3% | 14 Sep, 2026 | Packagist october/october |
Shopper: Media sub-form store() still lacks authorization (Incomplete fix for GHSA-h4mp-g9c6-xwph) CVE-2026-56830, GHSA-99h5-jhh7-v3r3 | Medium | 0.4% | 11 Sep, 2026 | Packagist shopper/framework |
Shopping privilege escalation through missing authorization in Settings components CVE-2026-56826, GHSA-f7h9-qv4x-9x57 | Medium | 0.3% | 11 Sep, 2026 | Packagist shopper/framework |
Shopper: Negative discount values accepted and propagated through order calculation pipeline CVE-2026-56831, GHSA-5vf4-452p-jjhf | Medium | 0.4% | 11 Sep, 2026 | Packagist shopper/framework |
MongoDB: GridFS data disclosure and deletion via query-operator injection in file IDs CVE-2026-88023, GHSA-8fxw-fmj8-xp7j | Medium | 0.3% | 10 Sep, 2026 | Packagist mongodb/mongodb |
phpseclib — non-constant-time X25519 scalar multiplication permits full private-key recovery CVE-2026-84308, GHSA-q97c-8qh3-fpc6 | Medium | 0.3% | 01 Sep, 2026 | Packagist phpseclib/phpseclib |
Filament: Multi-factor authentication (app) codes can still be used after a newer code has been used CVE-2026-84306, GHSA-r3j6-gpjw-qfjr | Medium | 0.4% | 01 Sep, 2026 | Packagist filament/filament |
Sulu: Stored XSS via media download inline-disposition override CVE-2026-82396, GHSA-pp4x-ccxq-6r33 | Medium | 0.3% | 31 Aug, 2026 | Packagist sulu/sulu |
Sulu: Media move/update authorization bypass (IDOR) CVE-2026-82395, GHSA-h6cx-gjxx-v25c | Medium | 0.4% | 31 Aug, 2026 | Packagist sulu/sulu |
Sulu: Fix authorization bypass when creating preview links CVE-2026-82394, GHSA-65cv-w493-7vhq | Medium | 0.6% | 31 Aug, 2026 | Packagist sulu/sulu |
elFinder: CSRF in netmount allows forced FTP mounts and server-side FTP connections CVE-2026-81890, GHSA-9hjf-w35w-6vx2 | Medium | 0.2% | 31 Aug, 2026 | Packagist studio-42/elfinder |
Livewire DOM-based cross-site scripting during client-side state handling CVE-2026-81887, GHSA-g3hc-697w-wm82 | Medium | 0.7% | 31 Aug, 2026 | Packagist livewire/livewire |
Kirby: Access to image files outside of the site root via path traversal in the media handling CVE-2026-75592, GHSA-6j4c-mgqr-qv76 | Medium | 0.7% | 31 Aug, 2026 | Packagist getkirby/cms |
Smarty: SSRF via redirect bypass of trusted_uri using {fetch} CVE-2026-62993, GHSA-cq55-c7wv-pxmq | Medium | 0.6% | 31 Aug, 2026 | Packagist smarty/smarty |
silverstripe/versioned has XSS in archive admin restore CVE-2026-55779, GHSA-m4g4-86qc-v8w7 | Medium | 0.3% | 28 Aug, 2026 | Packagist silverstripe/versioned |
PrivateBin has stored Cross-Side-Scripting (XSS) vulnerability in attachment download link via dangerous MIME types with required user-interaction CVE-2026-55696, GHSA-f2xf-7x3g-4272 | Medium | 0.4% | 28 Aug, 2026 | Packagist privatebin/privatebin |
cakephp/debug_kit: MailPreview contains unsafe reflection CVE-2026-54614, GHSA-p46m-g734-vpc4 | Medium | 0.5% | 26 Aug, 2026 | Packagist cakephp/debug_kit |
Grav: Non constant time nonce comparison in Utils::verifyNonce() used for CSRF protection CVE-2026-72701, GHSA-38p6-h87p-r4cg | Medium | 0.2% | 25 Aug, 2026 | Packagist getgrav/grav |