Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
decode-uri-component vulnerable to denial of service via quadratic replacement of percent-encoded runs CVE-2026-118664, GHSA-qr28-fpjm-wq7f | High | Not scored | 4 hours ago | npm decode-uri-component |
Twisted: Unauthenticated Remote Denial of Service in the Twisted HTTP/2 Server via Rapid Stream Reset GHSA-vpp8-g58w-m8mp | High | Not scored | 4 hours ago | PyPI Twisted PyPI twisted |
@eeacms/volto-chatbot has Unauthenticated Danswer API Confused Deputy Proxy GHSA-w9x9-j56r-h98r | High | Not scored | 4 hours ago | npm @eeacms/volto-chatbot |
@sylphx/pdf-reader-mcp: HTTP transport accepts unauthenticated requests despite a configured MCP_API_KEY CVE-2026-62264, GHSA-q344-5v34-gm84 | High | Not scored | 4 hours ago | npm @sylphx/pdf-reader-mcp |
PraisonAI vulnerable to Remote Code Execution via Broken AST Sandbox CVE-2026-61438, GHSA-26mh-57q7-jfvr | High | Not scored | 4 hours ago | PyPI praisonai |