See the full list of npm packages compromised in the "Keyv / Cacheable Supply Chain Compromise - Aug 2026" [View compromised packages].
Find out if you have vulnerabilities that put you at risk
Test your applicationsAPPLICATION
OPERATING SYSTEM
- C
Directory TraversalCVE-2026-41202
Affects ci4-cms-erp/ci4ms | Versions <0.31.5.0
Has fix
ComposerPublished 26 Apr 2026
- C
Directory TraversalCVE-2026-41203
Affects ci4-cms-erp/ci4ms | Versions <0.31.5.0
Has fix
ComposerPublished 26 Apr 2026
- M
Cross-site Scripting (XSS)CVE-2025-13784
Affects yungifez/skuul | Versions >=0.0.0
Has fix
ComposerPublished 26 Apr 2026
- M
Cross-site Request Forgery (CSRF)CVE-2026-40929
Affects wwbn/avideo | Versions >=0.0.0
Has fix
ComposerPublished 26 Apr 2026
- M
Guessable CAPTCHACVE-2026-40935
Affects wwbn/avideo | Versions >=0.0.0
Has fix
ComposerPublished 26 Apr 2026
- M
Active Debug CodeCVE-2026-40908
Affects wwbn/avideo | Versions >=0.0.0
Has fix
ComposerPublished 26 Apr 2026
- H
Authorization Bypass Through User-Controlled KeyCVE-2026-40907
Affects wwbn/avideo | Versions >=0.0.0
Has fix
ComposerPublished 26 Apr 2026
- M
Cross-site Scripting (XSS)CVE-2019-20921
Affects snapappointments/bootstrap-select | Versions <1.13.6
Has fix
ComposerPublished 23 Apr 2026
- L
Incorrect AuthorizationCVE-2026-29179
Affects october/october | Versions <4.1.17
Has fix
ComposerPublished 22 Apr 2026
- M
Incorrect AuthorizationCVE-2026-26067
Affects october/october | Versions <4.1.17
Has fix
ComposerPublished 22 Apr 2026
- H
Incomplete List of Disallowed InputsCVE-2026-26274
Affects october/october | Versions <4.1.17
Has fix
ComposerPublished 22 Apr 2026
- L
Cross-site Scripting (XSS)CVE-2026-27937
Affects october/october | Versions <4.1.17
Has fix
ComposerPublished 22 Apr 2026
- H
Cleartext Storage of Sensitive InformationCVE-2026-6553
Affects typo3/cms-core | Versions >14.2.0, <14.3.0
Has fix
ComposerPublished 21 Apr 2026
- H
Cleartext Storage of Sensitive InformationCVE-2026-6553
Affects typo3/cms-backend | Versions >14.2.0, <14.3.0
Has fix
ComposerPublished 21 Apr 2026
- M
SQL InjectionCVE-2026-41143
Affects yeswiki/yeswiki | Versions <4.6.1
Has fix
ComposerPublished 19 Apr 2026
- C
Command InjectionCVE-2026-41247
Affects studio-42/elfinder | Versions <2.1.67
Has fix
ComposerPublished 19 Apr 2026
Affects statamic/cms | Versions <5.73.20>=6.0.0-alpha.1, <6.13.0
Has fix
ComposerPublished 19 Apr 2026
- H
Authorization Bypass Through User-Controlled KeyCVE-2026-40308
Affects joedolson/my-calendar | Versions <3.7.7
Has fix
ComposerPublished 19 Apr 2026
- C
Access Control BypassCVE-2026-31843
Affects goodoneuz/pay-uz | Versions >=0.0.0
Has fix
ComposerPublished 19 Apr 2026
- M
Cross-site Request Forgery (CSRF)CVE-2016-20054
Affects khodakhah/nodcms | Versions >=0.0.0
Has fix
ComposerPublished 19 Apr 2026
- H
PHP Remote File InclusionCVE-2026-41228
Affects froxlor/froxlor | Versions <2.3.6
Has fix
ComposerPublished 19 Apr 2026
- M
Incorrect AuthorizationCVE-2026-41232
Affects froxlor/froxlor | Versions <2.3.6
Has fix
ComposerPublished 19 Apr 2026
- H
Symlink AttackCVE-2026-41231
Affects froxlor/froxlor | Versions <2.3.6
Has fix
ComposerPublished 19 Apr 2026
- M
Incorrect AuthorizationCVE-2026-41233
Affects froxlor/froxlor | Versions <2.3.6
Has fix
ComposerPublished 19 Apr 2026
- H
CRLF InjectionCVE-2026-41230
Affects froxlor/froxlor | Versions <2.3.6
Has fix
ComposerPublished 19 Apr 2026
- H
Arbitrary Code InjectionCVE-2026-41229
Affects froxlor/froxlor | Versions <2.3.6
Has fix
ComposerPublished 19 Apr 2026
- H
Command InjectionCVE-2026-41304
Affects wwbn/avideo | Versions >=0.0.0
Has fix
ComposerPublished 19 Apr 2026
- M
Cross-site Scripting (XSS)CVE-2026-40479
Affects kimai/kimai | Versions <2.53.0
Has fix
ComposerPublished 19 Apr 2026
Affects kimai/kimai | Versions <2.53.0
Has fix
ComposerPublished 19 Apr 2026