Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
decode-uri-component vulnerable to denial of service via quadratic replacement of percent-encoded runs CVE-2026-118664, GHSA-qr28-fpjm-wq7f | High | Not scored | 3 hours ago | npm decode-uri-component |
Twisted: Unauthenticated Remote Denial of Service in the Twisted HTTP/2 Server via Rapid Stream Reset GHSA-vpp8-g58w-m8mp | High | Not scored | 3 hours ago | PyPI Twisted PyPI twisted |
@eeacms/volto-chatbot has Unauthenticated Danswer API Confused Deputy Proxy GHSA-w9x9-j56r-h98r | High | Not scored | 4 hours ago | npm @eeacms/volto-chatbot |
@sylphx/pdf-reader-mcp: HTTP transport accepts unauthenticated requests despite a configured MCP_API_KEY CVE-2026-62264, GHSA-q344-5v34-gm84 | High | Not scored | 4 hours ago | npm @sylphx/pdf-reader-mcp |
PraisonAI vulnerable to Remote Code Execution via Broken AST Sandbox CVE-2026-61438, GHSA-26mh-57q7-jfvr | High | Not scored | 4 hours ago | PyPI praisonai |
LangGraph JavaScript custom authentication may permit cross-user Store access CVE-2026-118668, GHSA-4hm6-w6qq-w73v | High | Not scored | 23 hours ago | PyPI langgraph-api |
Happy DOM: SSRF via iframe and link stylesheet when parsing untrusted HTML CVE-2026-118660, GHSA-c8p4-j97h-3vg8 | High | Not scored | 23 hours ago | npm happy-dom |
GraphQL Tools: Per-request connection parameters persist into later users' WebSocket authentications CVE-2026-118665, GHSA-434m-5hcj-pxf3 | High | Not scored | 23 hours ago | npm @graphql-tools/executor-legacy-ws |
mcp-sanitizer: URL sanitizer allows localhost/IPv6 loopback SSRF bypass via explicit port or bracketed IPv6 GHSA-4mfg-r38w-w8fg | High | Not scored | 1 day ago | npm mcp-sanitizer |
mcp-sanitizer: File Path Sanitizer Permits Arbitrary User-Home Absolute Paths GHSA-7w82-6f9j-v9jp | High | Not scored | 1 day ago | npm mcp-sanitizer |
rucio has an Authorization Bypass on REST API endpoint for signing URLs CVE-2026-58273, GHSA-5j9r-fx4x-rpvg | High | Not scored | 1 day ago | PyPI rucio |
Vue I18n: escapeParameter does not prevent XSS through srcdoc in translation messages CVE-2026-118257, GHSA-83rm-6c8r-g728 | High | Not scored | 1 day ago | npm @intlify/core npm @intlify/core-base npm @intlify/shared npm @intlify/vue-i18n-core +2 more |
Highcharts Grid: `javascript:` URL in credits.href runs script on click CVE-2026-118255, GHSA-6hgp-fmhr-mrg4 | High | Not scored | 1 day ago | npm @highcharts/dashboards npm @highcharts/grid-pro |
Highcharts Grid parses pagination language options as HTML CVE-2026-118254, GHSA-r5wg-q8fc-p6w2 | High | Not scored | 1 day ago | npm @highcharts/grid-lite npm @highcharts/grid-pro |
Highcharts Dashboards parses fullscreen labels as HTML CVE-2026-118253, GHSA-58g7-7f52-h92c | High | Not scored | 1 day ago | npm @highcharts/dashboards |
Highcharts Dashboards parses sidebar component labels as HTML CVE-2026-118252, GHSA-rcqf-f6h2-ccg9 | High | Not scored | 1 day ago | npm @highcharts/dashboards |
Highcharts: `javascript:` URL in credits.href runs script on click CVE-2026-118251, GHSA-5793-x2q3-c3q7 | High | Not scored | 1 day ago | npm highcharts |
Highcharts: dotted series.keys paths write to Object.prototype CVE-2026-118250, GHSA-rmqc-xvr3-v46c | High | Not scored | 1 day ago | npm highcharts |
Highcharts: series column construction writes to Object.prototype CVE-2026-118249, GHSA-gfvx-2c2g-38wq | High | Not scored | 1 day ago | npm highcharts |
Highcharts Core: `breadcrumbs.style` keys become SVG event-handler attributes CVE-2026-118246, GHSA-35rr-xwfh-x789 | High | Not scored | 1 day ago | npm highcharts |
Highcharts Dashboards: `chartConstructor` is an unchecked lookup into the Highcharts namespace CVE-2026-118245, GHSA-grj7-r4jv-pw9j | High | Not scored | 1 day ago | npm @highcharts/dashboards |
Highcharts Core: HTML text parsing falls back to unfiltered `innerHTML` during printing CVE-2026-118244, GHSA-65hg-cf3f-5m39 | High | Not scored | 1 day ago | npm highcharts |
Highcharts Grid: custom icon definition objects written with raw `setAttribute` on `<path>` CVE-2026-118242, GHSA-6g3c-p4fg-xv47 | High | Not scored | 1 day ago | npm @highcharts/grid-lite npm @highcharts/grid-pro |
Highcharts Grid Pro: cell-renderer `attributes` map written with raw `setAttribute` CVE-2026-116797, GHSA-5ghw-9mgr-jvx2 | High | Not scored | 1 day ago | npm @highcharts/dashboards npm @highcharts/grid-pro |
Highcharts Core: `javascript:` URL in an `xlink:href` attribute survives text filtering and reaches exported charts CVE-2026-116796, GHSA-mw4f-gj5x-6xr4 | High | Not scored | 1 day ago | npm highcharts |
RE2JS: Quadratic-time denial of service in re2js lookbehind matching CVE-2026-116795, GHSA-gg6h-894w-4m9c | High | Not scored | 1 day ago | npm re2js |
dd-trace: ReDOS in URL query string obfuscation CVE-2026-116693, GHSA-x94g-w73q-hpcw | High | 0.4% | 1 day ago | npm dd-trace |
MLflow vulnerable to arbitrary file read on unauthenticated servers via prompt model version source CVE-2026-116690, GHSA-m65p-9j7q-6w33 | High | 0.6% | 2 days ago | PyPI mlflow |
CKEditor: Cross-site scripting (XSS) in the engine package CVE-2026-116688, GHSA-rh54-vffm-5fvp | High | 0.5% | 2 days ago | npm @ckeditor/ckeditor5-engine npm ckeditor5 |
MCP TypeScript SDK: HTTP server transports and handlers did not limit request body size or JSON-RPC batch length GHSA-f897-62hf-6gxq | High | Not scored | 2 days ago | npm @modelcontextprotocol/hono npm @modelcontextprotocol/node npm @modelcontextprotocol/sdk npm @modelcontextprotocol/server |
TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` serialization CVE-2026-116675, GHSA-mf2p-h6hf-fcwm | High | 0.3% | 2 days ago | NuGet TinyMCE Packagist tinymce/tinymce npm tinymce |
Hydra legacy target blacklist permits unsafe PyYAML loading GHSA-wf6j-7hvr-gr93 | High | Not scored | 2 days ago | PyPI hydra-core |
Strands Agents: Local Privilege Escalation via Symlink Attack in Default Session File Storage GHSA-3w55-933p-8pv5 | High | Not scored | 2 days ago | PyPI strands-agents |
LiteLLM: internal_user_viewer arbitrary local file read via `vertex_ai_credentials` GHSA-g5ff-637f-6q2m | High | Not scored | 2 days ago | PyPI litellm |
OAuthLib: Bearer token can be retrieved as long as client knows a valid client ID for device workflow CVE-2026-49272, GHSA-3jp2-3mrg-2vxc | High | Not scored | 2 days ago | PyPI oauthlib |
Dolibarr has SQL Injection in societe/class/societe.class.php via localtax1_value parameter CVE-2026-33944, GHSA-v5fq-cf5m-vwv7 | High | Not scored | 2 days ago | Packagist dolibarr/dolibarr |
Datadog dd-trace-py: IAST instrumentation can lead to application DOS CVE-2026-116589, GHSA-p3m5-h5v9-vqj6 | High | 0.3% | 2 days ago | PyPI ddtrace |
Datadog dd-trace-py: ReDoS in URL query string obfuscation CVE-2026-116588, GHSA-3633-r77q-h3v3 | High | 0.5% | 2 days ago | PyPI ddtrace |
Seroval `fromJSON`/`fromCrossJSON` denial of service via unvalidated array node length CVE-2026-116584, GHSA-wp97-x4hv-qvhp | High | 0.4% | 2 days ago | npm seroval |
Seroval: fromJSON deserializer trusts node-supplied array length and sequence doneAt (unauthenticated event-loop DoS) CVE-2026-116581, GHSA-97r2-qh9m-474h | High | 0.5% | 2 days ago | npm seroval |
Seroval: Deserialization invokes attacker-chosen callables: AsyncIteratorFactoryInstance calls source.on(listener) without type check CVE-2026-116580, GHSA-7rv5-mrxv-xcr9 | High | 0.3% | 2 days ago | npm seroval |
systeminformation vulnerable to Windows command injection in services() through Unicode quotation marks CVE-2026-116576, GHSA-3f7j-7jwc-fxfj | High | 0.1% | 2 days ago | npm systeminformation |
Rembg: Unauthenticated SAM model injection permits local-file disclosure through malicious ONNX graphs CVE-2026-115924, GHSA-qr6x-7v33-6qmg | High | 0.4% | 3 days ago | PyPI rembg |
vLLM: Public multimodal SHM handle forgery reaches worker-side `pickle.loads()` with insecure serialization disabled CVE-2026-115912, GHSA-6757-hggm-hp2w, PYSEC-2026-4345 | High | 0.5% | 3 days ago | PyPI vllm |
graphql-scalars PhoneNumber scalar is vulnerable to regular expression denial of service CVE-2026-115887, GHSA-x8rm-f576-gq67 | High | 0.4% | 5 days ago | npm graphql-scalars |
Happy DOM: Incomplete fix for CVE-2026-33943: unsanitized import alias leads to host code execution CVE-2026-115895, GHSA-834v-8h66-3h79 | High | 0.4% | 5 days ago | npm happy-dom |
postal-mime: Quadratic CPU consumption when decoding a header of many joinable RFC 2047 base64 encoded words GHSA-f2hq-32vh-53cc | High | Not scored | 5 days ago | npm postal-mime |
Twisted: Unauthenticated Remote Denial of Service in the Twisted IRC Server via an Unbounded Line Buffer CVE-2026-115776, GHSA-53xc-49m8-p798 | High | 0.5% | 5 days ago | PyPI Twisted PyPI twisted |
Twisted: Unauthenticated Remote Denial of Service in the Twisted conch Telnet Transport via an Unbounded Subnegotiation Buffer CVE-2026-115778, GHSA-cwm5-jh59-mwxr | High | 0.5% | 5 days ago | PyPI Twisted PyPI twisted |
Twisted: Unauthenticated Remote Denial of Service in the Twisted words domish XML Element Stream via an Unbounded Element Tree CVE-2026-115775, GHSA-3476-c5c2-fr73 | High | 0.4% | 5 days ago | PyPI Twisted PyPI twisted |