Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Directus: Sensitive fields exposed in revision history CVE-2026-39943, GHSA-mvv8-v4jj-g47j | Medium | 0.2% | 04 Apr, 2026 | npm directus |
Directus: GraphQL Schema SDL Disclosure Setting CVE-2026-35413, GHSA-wxwm-3fxv-mrvx | Medium | 0.3% | 04 Apr, 2026 | npm directus |
Directus: Open Redirect via Parser Bypass in OAuth2/SAML Authentication Flow CVE-2026-35410, GHSA-cf45-hxwj-4cfj | Medium | 0.3% | 04 Apr, 2026 | npm directus |
Directus: Open Redirect in Admin 2FA Setup Page CVE-2026-35411, GHSA-q75c-4gmv-mg9x | Medium | 0.3% | 04 Apr, 2026 | npm directus |
Electron: Use-after-free in offscreen shared texture release() callback CVE-2026-34764, GHSA-8x5q-pvf5-64mp | Medium | 0.1% | 03 Apr, 2026 | npm electron |
SandboxJS: Sandbox Escape via Prop Object Leak in New Handler CVE-2026-34217, GHSA-hg73-4w7g-q96w | Medium | 0.3% | 03 Apr, 2026 | npm @nyariv/sandboxjs |
SandboxJS: Stack overflow DoS via deeply nested expressions in recursive descent parser CVE-2026-34211, GHSA-8pfc-jjgw-6g26 | Medium | 0.4% | 03 Apr, 2026 | npm @nyariv/sandboxjs |
DOMPurify ADD_ATTR predicate skips URI validation CVE-2026-65912, GHSA-cjmm-f4jc-qw8r | Medium | 0.3% | 03 Apr, 2026 | npm dompurify |
DOMPurify USE_PROFILES prototype pollution allows event handlers CVE-2026-65913, GHSA-cj63-jhhr-wcxv | Medium | 0.3% | 03 Apr, 2026 | npm dompurify |
OpenClaw: Endpoint persists after trust decline, leaking gateway credentials CVE-2026-41300, GHSA-9f4w-67g7-mqwv | Medium | 0.3% | 03 Apr, 2026 | npm openclaw |
OpenClaw: diffs viewer misclassifies proxied remote requests as loopback when `allowRemoteViewer` is disabled CVE-2026-41403, GHSA-3xv9-89fm-7h4r | Medium | 0.3% | 03 Apr, 2026 | npm openclaw |
OpenClaw: Telegram legacy allowFrom migration fans default-account trust into all named accounts CVE-2026-41340, GHSA-f693-58pc-2gfr | Medium | 0.3% | 03 Apr, 2026 | npm openclaw |
OpenClaw: Tlon Startup Migration Rehydrates Empty-Array Revocations From File Config CVE-2026-41388, GHSA-3pm9-5j7m-59vc | Medium | 0.3% | 03 Apr, 2026 | npm openclaw |
OpenClaw: Discord voice manager bypasses channel-level member access allowlist CVE-2026-41381, GHSA-cqgw-44wg-44rf | Medium | 0.2% | 03 Apr, 2026 | npm openclaw |
OpenClaw: Telegram audio preflight transcription enables resource consumption by unauthorized senders CVE-2026-41331, GHSA-m6fx-m8hc-572m | Medium | 0.3% | 03 Apr, 2026 | npm openclaw |
OpenClaw: Voice-call still parses large WebSocket frames before start validation (Incomplete fix for CVE-2026-32062) CVE-2026-41400, GHSA-2w79-r9g8-wmcr | Medium | 0.5% | 03 Apr, 2026 | npm openclaw |
OpenClaw: Fake DeviceToken Bypasses Shared Auth Rate Limiting CVE-2026-41333, GHSA-6p8r-6m93-557f | Medium | 0.4% | 03 Apr, 2026 | npm openclaw |
OpenClaw Has a Gateway Control Interface Information Disclosure Vulnerability CVE-2026-41335, GHSA-hr8g-2q7x-3f4w | Medium | 0.3% | 03 Apr, 2026 | npm openclaw |
OpenClaw: Sandbox file operations use check-then-act, bypassing fd-based TOCTOU defenses CVE-2026-41338, GHSA-rm5c-4rmf-vvhw | Medium | 0.1% | 03 Apr, 2026 | npm openclaw |
OpenClaw: Telnyx Webhook Replay Detection Bypass via Base64 Signature Re-encoding CVE-2026-41351, GHSA-37v6-fxx8-xjmx | Medium | 0.3% | 03 Apr, 2026 | npm openclaw |
OpenClaw: Host exec environment overrides miss proxy, TLS, Docker, and Git TLS controls CVE-2026-41330, GHSA-9gp8-hjxr-6f34 | Medium | 0.1% | 03 Apr, 2026 | npm openclaw |
OpenClaw runs Discord audio preflight transcription before member authorization CVE-2026-41374, GHSA-hhff-fj5f-qg48 | Medium | 0.5% | 03 Apr, 2026 | npm openclaw |
OpenClaw: Media download follows cross-origin redirects with Authorization headers intact CVE-2026-41345, GHSA-68v4-hmwv-f43h | Medium | 0.3% | 03 Apr, 2026 | npm openclaw |
Electron: Service worker can spoof executeJavaScript IPC replies CVE-2026-34778, GHSA-xj5x-m3f3-5x3h | Medium | 0.1% | 03 Apr, 2026 | npm electron |
Electron: Incorrect origin passed to permission request handler for iframe requests CVE-2026-34777, GHSA-r5p7-gp4j-qhrx | Medium | 0.1% | 03 Apr, 2026 | npm electron |
Electron: Out-of-bounds read in second-instance IPC on macOS and Linux CVE-2026-34776, GHSA-3c8v-cfp5-9885 | Medium | 0.2% | 03 Apr, 2026 | npm electron |
Electron: HTTP Response Header Injection in custom protocol handlers and webRequest CVE-2026-34767, GHSA-4p4r-m79c-wq3v | Medium | 0.2% | 03 Apr, 2026 | npm electron |
Electron: USB device selection not validated against filtered device list CVE-2026-34766, GHSA-9899-m83m-qhpj | Medium | 0.2% | 03 Apr, 2026 | npm electron |
OpenClaw: Security Scan Failure Does Not Block Plugin Installation (Fail-Open) CVE-2026-41377, GHSA-cwq8-6f96-g3q4 | Medium | 0.2% | 02 Apr, 2026 | npm openclaw |
OpenClaw: SSRF via Unguarded `fetch()` in Marketplace Plugin Download and Ollama Model Discovery CVE-2026-41302, GHSA-9q7v-8mr7-g23p | Medium | 0.2% | 02 Apr, 2026 | npm openclaw |
OpenClaw: SSH-based sandbox backends pass unsanitized process.env to child processes CVE-2026-41357, GHSA-j9pv-rrcj-6pfx | Medium | 0.2% | 02 Apr, 2026 | npm openclaw |
OpenClaw: MSTeams thread history bypasses sender allowlist via Graph API CVE-2026-41365, GHSA-chfm-xgc4-47rj | Medium | 0.2% | 02 Apr, 2026 | npm openclaw |
OpenClaw: LINE webhook handler lacks shared pre-auth concurrency budget before signature verification CVE-2026-41343, GHSA-qcc3-jqwp-5vh2 | Medium | 0.5% | 02 Apr, 2026 | npm openclaw |
OpenClaw: Feishu thread history and quoted messages bypass sender allowlist CVE-2026-41406, GHSA-877v-w3f5-3pcq | Medium | 0.2% | 02 Apr, 2026 | npm openclaw |
OpenClaw: Voice-call Plivo replay mutates in-process callback origin before replay rejection CVE-2026-41337, GHSA-89r3-6x4j-v7wf | Medium | 0.2% | 02 Apr, 2026 | npm openclaw |
OpenClaw's complex interpreter pipelines could skip exec script preflight validation CVE-2026-34425, GHSA-fvx6-pj3r-5q4q | Medium | 0.3% | 02 Apr, 2026 | npm openclaw |
Signal K Server: OAuth Authorization Code Theft via Unvalidated Host Header in OIDC Flow CVE-2026-34083, GHSA-cxj8-ggf2-p57c | Medium | 0.1% | 02 Apr, 2026 | npm signalk-server |
Signal K Server: Unauthenticated Source Priorities Manipulation CVE-2026-33951, GHSA-gfmv-vh34-h2x5 | Medium | 0.3% | 02 Apr, 2026 | npm signalk-server |
StableLib Ed25519 Signature Malleability via Missing S < L Check GHSA-x3ff-w252-2g7j | Medium | Not scored | 01 Apr, 2026 | npm @stablelib/ed25519 |
SillyTavern: Incomplete IP validation in /api/search/visit allows SSRF via localhost and IPv6 CVE-2026-34526, GHSA-wm7j-m6jm-8797 | Medium | 0.2% | 01 Apr, 2026 | npm sillytavern |
SillyTavern: Path Traversal allows file existence oracle CVE-2026-34523, GHSA-525j-2hrj-m8fp | Medium | 0.4% | 01 Apr, 2026 | npm sillytavern |
Payload has Insufficient Filename Validation in Client-Upload Signed-URL Endpoints CVE-2026-34750, GHSA-frq9-7j6g-v74x | Medium | 0.4% | 01 Apr, 2026 | npm @payloadcms/storage-azure npm @payloadcms/storage-gcs npm @payloadcms/storage-r2 npm @payloadcms/storage-s3 |
Payload has a CSRF Protection Bypass in Authentication Flow CVE-2026-34749, GHSA-p6mr-xf3r-ghq4 | Medium | 0.1% | 01 Apr, 2026 | npm payload |
Replicator deserializes untrusted user input CVE-2026-2265, GHSA-2gmp-34j9-fqjm | Medium | 0.4% | 01 Apr, 2026 | npm replicator |
OpenClaw SSRF guard misses four IPv6 special-use ranges CVE-2026-41361, GHSA-g86v-f9qv-rh6m | Medium | 0.2% | 31 Mar, 2026 | npm openclaw |
OpenClaw's Discord component interaction ingress skips guild/channel policy enforcement CVE-2026-41367, GHSA-jp4j-q5fc-58gv | Medium | 0.2% | 31 Mar, 2026 | npm openclaw |
OpenClaw: Gateway `operator.write` can reach admin-only persisted `verboseLevel` via `chat.send` `/verbose` CVE-2026-41344, GHSA-5h2w-qmfp-ggp6 | Medium | 0.2% | 31 Mar, 2026 | npm openclaw |
OpenClaw host-env blocklist missing `GIT_TEMPLATE_DIR` and `AWS_CONFIG_FILE` allows code execution via env override CVE-2026-41332, GHSA-m866-6qv5-p2fg | Medium | 0.1% | 31 Mar, 2026 | npm openclaw |
OpenClaw: Feishu extension resolveUploadInput bypasses file-system sandbox and allows arbitrary file reads via upload_image CVE-2026-41363, GHSA-qf48-qfv4-jjm9 | Medium | 0.3% | 31 Mar, 2026 | npm openclaw |
Nuxt OG Image vulnerable to Server-Side Request Forgery via user-controlled parameters GHSA-pqhr-mp3f-hrpp | Medium | Not scored | 31 Mar, 2026 | npm nuxt-og-image |