Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
OpenClaw: Bonjour/DNS-SD TXT metadata steers CLI routing after failed service resolution CVE-2026-35659, GHSA-rvqr-hrcc-j9vv | Medium | 0.1% | 26 Mar, 2026 | npm openclaw |
path-to-regexp vulnerable to Regular Expression Denial of Service via multiple wildcards CVE-2026-4923, GHSA-27v5-c462-wpq7 | Medium | 0.4% | 26 Mar, 2026 | npm path-to-regexp |
OpenClaw: Synology Chat reply delivery could be rebound through username-based user resolution. CVE-2026-35670, GHSA-wv46-v6xc-2qhf | Medium | 0.2% | 26 Mar, 2026 | npm openclaw |
OpenClaw: Windows media loaders accepted remote-host file URLs before local path validation CVE-2026-34426, CVE-2026-34510, GHSA-98ch-45wp-ch47, GHSA-h3x4-hc5v-v2gm | Medium | 0.3% | 26 Mar, 2026 | npm openclaw |
OpenClaw: Gateway Canvas local-direct requests bypass Canvas HTTP and WebSocket authentication CVE-2026-35634, GHSA-6mqc-jqh6-x8fc | Medium | 0.1% | 26 Mar, 2026 | npm openclaw |
srvx is vulnerable to middleware bypass via absolute URI in request line CVE-2026-33732, GHSA-p36q-q72m-gchr | Medium | 0.3% | 26 Mar, 2026 | npm srvx |
Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching CVE-2026-33672, GHSA-3v7f-55p6-f55p | Medium | 0.4% | 25 Mar, 2026 | npm picomatch |
smol-toml: Denial of Service via TOML documents containing thousands of consecutive commented lines GHSA-v3rj-xjv7-4jmq | Medium | Not scored | 25 Mar, 2026 | npm smol-toml |
yaml is vulnerable to Stack Overflow via deeply nested YAML collections CVE-2026-33532, GHSA-48c2-rrv3-qjmp | Medium | 0.5% | 25 Mar, 2026 | npm yaml |
n8n Vulnerable to LDAP Filter Injection in LDAP Node CVE-2026-33751, GHSA-w83q-mcmx-mh42 | Medium | 0.2% | 25 Mar, 2026 | npm n8n |
n8n Vulnerable to XSS via Binary Data Inline HTML Rendering CVE-2026-33749, GHSA-qfc3-hm4j-7q77 | Medium | 0.3% | 25 Mar, 2026 | npm n8n |
n8n's Source Control SSH Configuration Uses StrictHostKeyChecking=no CVE-2026-33724, GHSA-43v7-fp2v-68f6 | Medium | 0.3% | 25 Mar, 2026 | npm n8n |
n8n Has Authorization Bypass in OAuth Callback via N8N_SKIP_AUTH_ON_OAUTH_CALLBACK CVE-2026-33720, GHSA-vpgc-2f6g-7w7x | Medium | 0.2% | 25 Mar, 2026 | npm n8n |
@grackle-ai/server has Missing Content-Security-Policy and X-Frame-Options Headers GHSA-3mjm-x6gw-2x42 | Medium | Not scored | 25 Mar, 2026 | npm @grackle-ai/server |
@grackle-ai/powerline Runs Without Authentication by Default GHSA-xq7h-vwjp-5vrh | Medium | Not scored | 25 Mar, 2026 | npm @grackle-ai/powerline |
Parse Server's Session Update endpoint allows overwriting server-generated session fields BIT-parse-2026-33527, CVE-2026-33527, GHSA-jc39-686j-wp6q | Medium | 0.3% | 24 Mar, 2026 | npm parse-server |
H3 has an Open Redirect via Protocol-Relative Path in redirectBack() Referer Validation CVE-2026-86205, GHSA-fp4x-ggrf-wmc6 | Medium | 0.3% | 23 Mar, 2026 | npm h3 |
fastify: request.protocol and request.host Spoofable via X-Forwarded-Proto/Host from Untrusted Connections CVE-2026-3635, GHSA-444r-cwp2-x5xf | Medium | 0.2% | 23 Mar, 2026 | npm fastify |
h3: SSE Event Injection via Unsanitized Carriage Return (`\r`) in EventStream Data and Comment Fields (Bypass of CVE Fix) CVE-2026-86252, GHSA-4hxc-9384-m385 | Medium | 0.4% | 20 Mar, 2026 | npm h3 |
h3: Missing Path Segment Boundary Check in `mount()` Causes Middleware Execution on Unrelated Prefix-Matching Routes CVE-2026-33490, GHSA-2j6q-whv2-gh6w | Medium | 0.2% | 20 Mar, 2026 | npm h3 |
Parse Server has a protected field change detection oracle via LiveQuery watch parameter BIT-parse-2026-33429, CVE-2026-33429, GHSA-qpc3-fg4j-8hgm | Medium | 0.3% | 20 Mar, 2026 | npm parse-server |
PDFME has XSS via Unsanitized i18n Label Injection into innerHTML in multiVariableText propPanel CVE-2026-82865, GHSA-xgx4-2wgv-4jhm | Medium | 0.2% | 20 Mar, 2026 | npm @pdfme/schemas |
Protocol-Relative URL Injection via Single Backslash Bypass in Angular SSR CVE-2026-33397, GHSA-vfx2-hv2g-xj5f | Medium | 0.3% | 19 Mar, 2026 | npm @angular/ssr |
Entity Expansion Limits Bypassed When Set to Zero Due to JavaScript Falsy Evaluation in fast-xml-parser CVE-2026-33349, GHSA-jp2q-39xq-3w4g | Medium | 0.5% | 19 Mar, 2026 | npm fast-xml-parser |
@keystone-6/core: `isFilterable` bypass via `cursor` parameter in findMany (CVE-2025-46720 incomplete fix) CVE-2026-33326, GHSA-cgcg-q9jh-5pr2 | Medium | 0.3% | 19 Mar, 2026 | npm @keystone-6/core |
Parse Server email verification resend page leaks user existence BIT-parse-2026-33323, CVE-2026-33323, GHSA-h29g-q5c2-9h4f | Medium | 0.3% | 19 Mar, 2026 | npm parse-server |
SVG Injection via Unsanitized Options in @dicebear/core and @dicebear/initials CVE-2026-33311, GHSA-mr9r-mww3-v6gv | Medium | 0.2% | 19 Mar, 2026 | npm @dicebear/core npm @dicebear/initials |
NotChatbot WebChat has a stored cross-site scripting (XSS) vulnerability CVE-2026-30048, GHSA-w3vx-52j6-9fjp | Medium | 0.3% | 18 Mar, 2026 | npm @developer.notchatbot/webchat |
h3 has an observable timing discrepancy in basic auth utils CVE-2026-33129, GHSA-26f5-8h2x-34xh | Medium | 0.3% | 18 Mar, 2026 | npm h3 |
Cross-Site Scripting (XSS) via SVG Schema innerHTML Injection in @pdfme/schemas CVE-2026-82868, GHSA-87v3-4cfp-cm76 | Medium | 0.3% | 18 Mar, 2026 | npm @pdfme/schemas |
Cross-Site Scripting (XSS) via Select Schema Option Value Injection in @pdfme/schemas CVE-2026-82867, GHSA-qq9g-96v4-m3cj | Medium | 0.3% | 18 Mar, 2026 | npm @pdfme/schemas |
SSRF in @aborruso/ckan-mcp-server via base_url allows access to internal networks CVE-2026-33060, GHSA-3xm7-qw7j-qc8v | Medium | 0.3% | 18 Mar, 2026 | npm @aborruso/ckan-mcp-server |
Parse Server affected by empty authData bypassing credential requirement on signup BIT-parse-2026-33042, CVE-2026-33042, GHSA-wjqw-r9x4-j59v | Medium | 0.3% | 17 Mar, 2026 | npm parse-server |
Parse Server session creation endpoint allows overwriting server-generated session fields BIT-parse-2026-32742, CVE-2026-32742, GHSA-5v7g-9h8f-8pgg | Medium | 0.3% | 17 Mar, 2026 | npm parse-server |
Parse Server vulnerable to schema poisoning via prototype pollution in deep copy BIT-parse-2026-32878, CVE-2026-32878, GHSA-9ccr-fpp6-78qf | Medium | 0.4% | 17 Mar, 2026 | npm parse-server |
Elysia Cookie Value Prototype Pollution CVE-2026-31865, GHSA-8hq9-phh3-p2wp | Medium | 0.2% | 17 Mar, 2026 | npm elysia |
Next.js: HTTP request smuggling in rewrites CVE-2026-29057, GHSA-ggv3-7p47-pfv8 | Medium | 0.5% | 17 Mar, 2026 | npm next |
Next.js: Unbounded next/image disk cache growth can exhaust storage CVE-2026-27980, GHSA-3x4c-7xq6-9pq8 | Medium | 0.7% | 17 Mar, 2026 | npm next |
Next.js: Unbounded postponed resume buffering can lead to DoS CVE-2026-27979, GHSA-h27x-g6w4-24gq | Medium | 0.7% | 17 Mar, 2026 | npm next |
Next.js: null origin can bypass Server Actions CSRF checks CVE-2026-27978, GHSA-mq59-m269-xvcx | Medium | 0.2% | 17 Mar, 2026 | npm next |
OpenClaw session transcript files were created without forced user-only permissions CVE-2026-33572, GHSA-vr7j-g7jv-h5mp | Medium | 0.1% | 16 Mar, 2026 | npm openclaw |
SandboxJS has an execution-quota bypass (cross-sandbox currentTicks race) in SandboxJS timers CVE-2026-32723, GHSA-7p5m-xrh7-769r | Medium | 0.2% | 16 Mar, 2026 | npm @nyariv/sandboxjs |
Vulnogram contains a stored cross-site scripting vulnerability in comment hypertext handling CVE-2026-32774, GHSA-pg4p-2985-gvxr, GHSA-vggc-6pg2-xvp9 | Medium | 0.3% | 16 Mar, 2026 | npm vulnogram |
file-type: ZIP Decompression Bomb DoS via [Content_Types].xml entry CVE-2026-32630, GHSA-j47w-4g3g-c36v | Medium | 0.3% | 13 Mar, 2026 | npm file-type |
OpenClaw: Zalo webhook rate limiting could be bypassed before secret validation CVE-2026-34505, GHSA-5m9r-p9g7-679c | Medium | 0.3% | 13 Mar, 2026 | npm openclaw |
OpenClaw: Feishu reaction events could bypass group authorization and mention gating CVE-2026-32924, GHSA-m69h-jm2f-2pv8 | Medium | 0.3% | 13 Mar, 2026 | npm openclaw |
OpenClaw's Zalouser allowlist authorization matched mutable group names by default CVE-2026-32975, GHSA-f5mf-3r52-r83w | Medium | 0.3% | 13 Mar, 2026 | npm openclaw |
Parse Server's GraphQL WebSocket endpoint bypasses security middleware BIT-parse-2026-32594, CVE-2026-32594, GHSA-p2x3-8689-cwpg | Medium | 0.4% | 13 Mar, 2026 | npm parse-server |
OneUptime: Password Reset Token Logged at INFO Level CVE-2026-32598, GHSA-4524-cj9j-g4fj | Medium | 0.2% | 13 Mar, 2026 | npm oneuptime |
OpenClaw: Discord guild reaction ingress could bypass users and roles allowlists CVE-2026-32923, GHSA-9vvh-2768-c8vp | Medium | 0.2% | 13 Mar, 2026 | npm openclaw |