Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
OpenClaw: Write-scoped callers could reach admin-only session reset logic through `agent` CVE-2026-32919, GHSA-jf6w-m8jw-jfxc | Medium | 0.1% | 13 Mar, 2026 | npm openclaw |
OpenClaw: Sandbox `writeFile` commit could race outside the validated path CVE-2026-32977, GHSA-xvx8-77m6-gwg6 | Medium | 0.1% | 13 Mar, 2026 | npm openclaw |
Undici has Unbounded Memory Consumption in its DeduplicationHandler via Response Buffering that leads to DoS CVE-2026-2581, GHSA-phc3-fgpg-7m6h | Medium | 0.6% | 12 Mar, 2026 | npm undici |
Undici has CRLF Injection in undici via `upgrade` option CVE-2026-1527, GHSA-4992-7rv2-5pvq | Medium | 0.3% | 12 Mar, 2026 | npm undici |
Parse Server OAuth2 adapter app ID validation sends wrong token to introspection endpoint BIT-parse-2026-32269, CVE-2026-32269, GHSA-69xg-f649-w5g2 | Medium | 0.3% | 12 Mar, 2026 | npm parse-server |
Trix has a Stored XSS vulnerability through serialized attributes CVE-2026-73426, GHSA-qmpg-8xg6-ph5q | Medium | 0.3% | 12 Mar, 2026 | RubyGems action_text-trix npm trix |
Hyperterse: Raw exposure of database statements in MCP search tool CVE-2026-31841, GHSA-92gp-jfgx-9qpv | Medium | 0.2% | 12 Mar, 2026 | npm hyperterse |
TinaCMS CLI has Arbitrary File Read via Disabled Vite Filesystem Restriction CVE-2026-29066, GHSA-m48g-4wr2-j2h6 | Medium | 1.0% | 12 Mar, 2026 | npm @tinacms/cli |
@tinacms/graphql has a Path Traversal issue CVE-2026-24125, GHSA-2238-xc5r-v9hj | Medium | 0.5% | 12 Mar, 2026 | npm @tinacms/graphql |
@backstage/plugin-scaffolder-backend: Possible exposure of defaultEnvironment secrets using dry-run endpoint CVE-2026-32237, GHSA-8wq8-6859-qx77 | Medium | 0.3% | 12 Mar, 2026 | npm @backstage/plugin-scaffolder-backend |
@backstage/plugin-auth-backend: OAuth redirect URI allowlist bypass CVE-2026-32235, GHSA-wqvh-63mv-9w92 | Medium | 0.1% | 12 Mar, 2026 | npm @backstage/plugin-auth-backend |
Uptime Kuma is Missing Authorization Checks on Ping Badge Endpoint, Leaks Ping times of monitors without needing to be on a status page CVE-2026-32230, GHSA-c7hf-c5p5-5g6h | Medium | 0.9% | 12 Mar, 2026 | npm uptime-kuma |
OpenClaw: /api/channels gateway-auth boundary bypass via path canonicalization mismatch CVE-2026-32031, GHSA-8j2w-6fmm-m587 | Medium | 0.2% | 12 Mar, 2026 | npm openclaw |
OpenClaw: Slack system events bypass sender authorization in member and message subtype handlers CVE-2026-32895, GHSA-v8cg-4474-49v8 | Medium | 0.2% | 12 Mar, 2026 | npm openclaw |
OpenClaw's MS Teams sender allowlist bypass when route allowlist is configured and sender allowlist is empty CVE-2026-34506, GHSA-g7cr-9h7q-4qxq | Medium | 0.3% | 12 Mar, 2026 | npm openclaw |
OpenClaw's skills-install-download can be redirected outside the tools root by rebinding the validated base path CVE-2026-33574, GHSA-vhwf-4x96-vqx2 | Medium | 0.1% | 12 Mar, 2026 | npm openclaw |
OpenClaw's system.run approvals did not bind mutable script operands across approval and execution CVE-2026-32921, GHSA-8g75-q649-6pv6 | Medium | 0.2% | 12 Mar, 2026 | npm openclaw |
Unhead Vulnerable to Bypass of URI Scheme Sanitization in makeTagSafe via Case-Sensitivity CVE-2026-31873, GHSA-5339-hvwr-7582 | Medium | 0.2% | 12 Mar, 2026 | npm unhead |
Unhead has XSS bypass in `useHeadSafe` via attribute name injection and case-sensitive protocol check CVE-2026-31860, GHSA-g5xx-pwrp-g3fv | Medium | 0.3% | 12 Mar, 2026 | npm unhead |
yauzl contains an off-by-one error CVE-2026-31988, GHSA-gmq8-994r-jv83 | Medium | 0.5% | 11 Mar, 2026 | npm yauzl |
StudioCMS: IDOR in User Notification Preferences Allows Any Authenticated User to Modify Any User's Settings CVE-2026-32104, GHSA-9v82-xrm4-mp52 | Medium | 0.3% | 11 Mar, 2026 | npm studiocms |
Parse Server has a SQL injection via query field name when using PostgreSQL BIT-parse-2026-32234, CVE-2026-32234, GHSA-c442-97qw-j6c6 | Medium | 0.2% | 11 Mar, 2026 | npm parse-server |
Parse Server has a protected fields bypass via LiveQuery subscription WHERE clause BIT-parse-2026-32098, CVE-2026-32098, GHSA-j7mm-f4rv-6q6q | Medium | 0.3% | 11 Mar, 2026 | npm parse-server |
Shescape escape() leaves bracket glob expansion active on Bash, BusyBox, and Dash CVE-2026-32094, GHSA-9jfh-9xrq-4vwm | Medium | 0.2% | 11 Mar, 2026 | npm shescape |
devalue has prototype pollution in devalue.parse and devalue.unflatten CVE-2026-30226, GHSA-cfw5-2vxh-hr84 | Medium | 0.4% | 11 Mar, 2026 | npm devalue |
Parse Server vulnerable to user enumeration via email verification endpoint BIT-parse-2026-31901, CVE-2026-31901, GHSA-w54v-hf9p-8856 | Medium | 0.3% | 11 Mar, 2026 | npm parse-server |
Parse Server vulnerable to stored XSS via file upload of HTML-renderable file types BIT-parse-2026-31868, CVE-2026-31868, GHSA-v5hf-f4c3-m5rv | Medium | 0.3% | 11 Mar, 2026 | npm parse-server |
Hono vulnerable to Prototype Pollution possible through __proto__ key allowed in parseBody({ dot: true }) CVE-2026-56763, GHSA-v8w9-8mx6-g223 | Medium | 0.3% | 11 Mar, 2026 | npm hono |
Parse Server vulnerable to LDAP injection via unsanitized user input in DN and group filter construction BIT-parse-2026-31828, CVE-2026-31828, GHSA-7m6r-fhh7-r47c | Medium | 0.4% | 10 Mar, 2026 | npm parse-server |
file-type affected by infinite loop in ASF parser on malformed input with zero-size sub-header CVE-2026-31808, GHSA-5v7r-6r5c-r473 | Medium | 0.3% | 10 Mar, 2026 | npm file-type |
Parse Server has a rate limit bypass via batch request endpoint BIT-parse-2026-30972, CVE-2026-30972, GHSA-775h-3xrc-c228 | Medium | 0.4% | 10 Mar, 2026 | npm parse-server |
@appium/support has a Zip Slip arbitrary file write in its ZIP extraction CVE-2026-30973, GHSA-rfx7-4xw3-gh4m | Medium | 0.4% | 10 Mar, 2026 | npm @appium/support |
OneUptime has WhatsApp Resend Verification Authorization Bypass CVE-2026-30959, GHSA-cw6x-mw64-q6pv | Medium | 0.4% | 10 Mar, 2026 | npm @oneuptime/common |
Parse Server has denylist `requestKeywordDenylist` keyword scan bypass through nested object placement BIT-parse-2026-30938, CVE-2026-30938, GHSA-q342-9w2p-57fp | Medium | 0.4% | 10 Mar, 2026 | npm parse-server |
OpenClaw: Sandboxed /acp spawn requests could initialize host ACP sessions CVE-2026-27646, GHSA-9q36-67vc-rrwg | Medium | 0.1% | 09 Mar, 2026 | npm openclaw |
OpenClaw: system.run allow-always persistence included shell-commented payload tails GHSA-9q2p-vc84-2rwm | Medium | Not scored | 09 Mar, 2026 | npm openclaw |
OpenClaw: `operator.write` chat.send could reach admin-only config writes GHSA-hfpr-jhpq-x4rm | Medium | Not scored | 09 Mar, 2026 | npm openclaw |
OpenClaw: Cross-account sender authorization expansion in `/allowlist ... --store` account scoping GHSA-pjvx-rx66-r3fg | Medium | Not scored | 09 Mar, 2026 | npm openclaw |
OpenClaw's system.run allowlist approval parsing missed PowerShell encoded-command wrappers GHSA-3h2q-j2v4-6w5r | Medium | Not scored | 09 Mar, 2026 | npm openclaw |
OpenClaw's `system.run` env override filtering allowed dangerous helper-command pivots GHSA-j425-whc4-4jgc | Medium | Not scored | 09 Mar, 2026 | npm openclaw |
OpenClaw's hooks count non-POST requests toward auth lockout GHSA-6rmx-gvvg-vh6j | Medium | Not scored | 09 Mar, 2026 | npm openclaw |
Actual Sync Server has an Authenticated Path Traversal CVE-2026-3089, GHSA-27vg-33gh-4hwg | Medium | 0.4% | 09 Mar, 2026 | npm @actual-app/sync-server |
Parse Server: GraphQL `__type` introspection bypass via inline fragments when public introspection is disabled BIT-parse-2026-30854, CVE-2026-30854, GHSA-q5q9-2rhp-33qw | Medium | 0.3% | 07 Mar, 2026 | npm parse-server |
Parse Server: File metadata endpoint bypasses `beforeFind` / `afterFind` trigger authorization BIT-parse-2026-30850, CVE-2026-30850, GHSA-hwx8-q9cg-mqmc | Medium | 0.3% | 07 Mar, 2026 | npm parse-server |
Parse Server: `PagesRouter` path traversal allows reading files outside configured pages directory BIT-parse-2026-30848, CVE-2026-30848, GHSA-hm3f-q6rw-m6wh | Medium | 0.3% | 07 Mar, 2026 | npm parse-server |
PowerSync: Some sync filters ignored on 1.20.0 using `config.edition: 3` CVE-2026-30870, GHSA-q6wc-xx4m-92fj | Medium | 0.2% | 07 Mar, 2026 | npm @powersync/service-core npm @powersync/service-sync-rules |
parse-server: Malformed `$regex` query leaks database error details in API response BIT-parse-2026-30835, CVE-2026-30835, GHSA-9cp7-3q5w-j92g | Medium | 0.3% | 06 Mar, 2026 | npm parse-server |
parse-server's file creation and deletion bypasses `readOnlyMasterKey` write restriction BIT-parse-2026-30228, CVE-2026-30228, GHSA-xfh7-phr7-gr2x | Medium | 0.3% | 06 Mar, 2026 | npm parse-server |
Vercel Workflow Allows Webhook Creation with Predictable User-Specified Tokens GHSA-9r75-g2cr-3h76 | Medium | Not scored | 06 Mar, 2026 | npm @workflow/core npm workflow |
Flowise Vulnerable to PII Disclosure on Unauthenticated Forgot Password Endpoint CVE-2026-56267, GHSA-jc5m-wrp2-qq38 | Medium | 0.5% | 05 Mar, 2026 | npm flowise |