Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Parse Server crash via deeply nested query condition operators BIT-parse-2026-32944, CVE-2026-32944, GHSA-9xp9-j92r-p88v | High | 0.5% | 17 Mar, 2026 | npm parse-server |
jsPDF has a PDF Object Injection via FreeText color CVE-2026-31898, GHSA-7x6v-j9x4-qf24 | High | 0.4% | 17 Mar, 2026 | npm jspdf |
sjcl is missing point-on-curve validation in sjcl.ecc.basicKey.publicKey CVE-2026-4258, GHSA-2w8x-224x-785m | High | 0.3% | 17 Mar, 2026 | npm sjcl |
OpenClaw Telegram webhook request bodies were read before secret validation, enabling unauthenticated resource exhaustion CVE-2026-32980, GHSA-jq3f-vjww-8rq7 | High | 0.5% | 16 Mar, 2026 | npm openclaw |
OpenClaw Telegram media fetch errors exposed bot tokens in logged file URLs CVE-2026-32982, GHSA-xwcj-hwhf-h378 | High | 0.4% | 16 Mar, 2026 | npm openclaw |
Parse Server has a stored XSS filter bypass via Content-Type MIME parameter and missing XML extension blocklist entries BIT-parse-2026-32728, CVE-2026-32728, GHSA-42ph-pf9q-cr72 | High | 0.3% | 16 Mar, 2026 | npm parse-server |
Uncontrolled memory allocation via crafted SVG dimensions in @dicebear/converter CVE-2026-29112, GHSA-v3r3-4qgc-vw66 | High | 0.4% | 16 Mar, 2026 | npm @dicebear/converter |
Angular vulnerable to XSS in i18n attribute bindings CVE-2026-32635, GHSA-g93w-mfhg-p222 | High | 0.5% | 13 Mar, 2026 | npm @angular/compiler npm @angular/core |
OpenClaw: Feishu webhook mode accepted forged events when only `verificationToken` was configured CVE-2026-32974, GHSA-g353-mgv3-8pcj | High | 0.3% | 13 Mar, 2026 | npm openclaw |
OpenClaw: Gateway `agent` calls could override the workspace boundary CVE-2026-33573, GHSA-2rqg-gjgv-84jm | High | 0.3% | 13 Mar, 2026 | npm openclaw |
OpenClaw: Workspace plugin auto-discovery allowed code execution from cloned repositories CVE-2026-32920, GHSA-99qw-6mr3-36qr | High | 0.3% | 13 Mar, 2026 | npm openclaw |
OpenClaw: Command-authorized non-owners could reach owner-only `/config` and `/debug` surfaces CVE-2026-32914, GHSA-r7vr-gr74-94p8 | High | 0.3% | 13 Mar, 2026 | npm openclaw |
OpenClaw: Exec approval allowlist patterns overmatched on POSIX paths CVE-2026-32973, GHSA-f8r2-vg7x-gh8m | High | 0.4% | 13 Mar, 2026 | npm openclaw |
OpenClaw: `browser.request` let `operator.write` persist admin-only browser profile changes CVE-2026-32972, GHSA-vmhq-cqm9-6p7q | High | 0.3% | 13 Mar, 2026 | npm openclaw |
OpenClaw: Pairing setup codes exposed long-lived shared gateway credentials instead of short-lived bootstrap tokens CVE-2026-33575, GHSA-7h7g-x2px-94hj | High | 0.3% | 13 Mar, 2026 | npm openclaw |
@google/clasp vulnerable to unsafe path traversal cloning or pulling a malicious script CVE-2026-4092, GHSA-hqjg-pww4-pcgq | High | 0.5% | 13 Mar, 2026 | npm @google/clasp |
OneUptime: Stored XSS via Mermaid Diagram Rendering (securityLevel: "loose") CVE-2026-32308, GHSA-wvh5-6vjm-23qh | High | 0.2% | 13 Mar, 2026 | npm oneuptime |
OpenClaw: Sandbox staged writes could escape the verified parent directory before commit CVE-2026-32988, GHSA-mj4p-rc52-m843 | High | 0.1% | 13 Mar, 2026 | npm openclaw |
OpenClaw: Channel commands could bypass account-scoped `configWrites` restrictions CVE-2026-32976, GHSA-8jhh-jcqg-mj5p | High | 0.2% | 13 Mar, 2026 | npm openclaw |
OpenClaw: Node-host approvals could show misleading shell payloads instead of the executed argv CVE-2026-32971, GHSA-rw39-5899-8mxp | High | 0.3% | 13 Mar, 2026 | npm openclaw |
OpenClaw: Unbound interpreter and runtime commands could bypass node-host approval integrity CVE-2026-32979, GHSA-xf99-j42q-5w5p | High | 0.1% | 13 Mar, 2026 | npm openclaw |
Dagu: SSE Authentication Bypass in Basic Auth Mode CVE-2026-31882, GHSA-9wmw-9wph-2vwp | High | 0.8% | 13 Mar, 2026 | npm dagu |
Undici has Unhandled Exception in WebSocket Client Due to Invalid server_max_window_bits Validation CVE-2026-2229, GHSA-v9p9-hfj2-hcw8 | High | 0.9% | 12 Mar, 2026 | npm undici |
Undici: Malicious WebSocket 64-bit length overflows parser and crashes the client CVE-2026-1528, GHSA-f269-vfmq-vjvj | High | 0.5% | 12 Mar, 2026 | npm undici |
Undici has Unbounded Memory Consumption in WebSocket permessage-deflate Decompression CVE-2026-1526, GHSA-vrm6-8vpv-qv8q | High | 1.2% | 12 Mar, 2026 | npm undici |
OpenClaw: Untrusted web origins can obtain authenticated operator.admin access in trusted-proxy mode CVE-2026-32302, GHSA-5wcw-8jjv-m286 | High | 0.2% | 12 Mar, 2026 | npm openclaw |
flatted vulnerable to unbounded recursion DoS in parse() revive phase CVE-2026-32141, GHSA-25h7-pfq9-p65f | High | 0.8% | 12 Mar, 2026 | npm flatted |
TinaCMS Vulnerable to Path Traversal Leading to Arbitrary File Read, Write and Delete CVE-2026-28793, GHSA-2f24-mg4x-534q | High | 0.2% | 12 Mar, 2026 | npm @tinacms/cli |
Tina: Path Traversal in Media Upload Handle CVE-2026-28791, GHSA-5hxf-c7j4-279c | High | 0.3% | 12 Mar, 2026 | npm tinacms |
OpenClaw: Sandbox dangling-symlink alias handling could bypass workspace-only write boundary GHSA-qcc4-p59m-p54m | High | Not scored | 12 Mar, 2026 | npm openclaw |
OpenClaw: workspace path guard bypass on non-existent out-of-root symlink leaf CVE-2026-32055, GHSA-mgrq-9f93-wpp5 | High | 0.3% | 12 Mar, 2026 | npm openclaw |
OpenClaw: LINE group allowlist scope mismatch with DM pairing-store entries GHSA-gp3q-wpq4-5c5h | High | Not scored | 12 Mar, 2026 | npm openclaw |
StudioCMS: REST API Missing Rank Check Allows Admin to Create Peer Admin Accounts CVE-2026-32106, GHSA-wj56-g96r-673q | High | 0.3% | 11 Mar, 2026 | npm studiocms |
StudioCMS: IDOR — Admin-to-Owner Account Takeover via Password Reset Link Generation CVE-2026-32103, GHSA-h7vr-cg25-jf8c | High | 0.4% | 11 Mar, 2026 | npm studiocms |
StudioCMS S3 Storage Manager Authorization Bypass via Missing `await` on Async Auth Check CVE-2026-32101, GHSA-mm78-fgq8-6pgr | High | 0.2% | 11 Mar, 2026 | npm @studiocms/s3-storage |
Striae has a hash validation utility vulnerability CVE-2026-31839, GHSA-mmf8-487q-p45m | High | 0.1% | 11 Mar, 2026 | npm @striae-org/striae |
@siteboon/claude-code-ui Vulnerable to Unauthenticated RCE via WebSocket Shell Injection CVE-2026-31975, GHSA-gv8f-wpm2-m5wr | High | 3.6% | 11 Mar, 2026 | npm @siteboon/claude-code-ui |
Parse Server's MFA recovery codes not consumed after use BIT-parse-2026-31875, CVE-2026-31875, GHSA-4hf6-3x24-c9m8 | High | 0.5% | 11 Mar, 2026 | npm parse-server |
Parse Server has a protected fields bypass via dot-notation in query and sort BIT-parse-2026-31872, CVE-2026-31872, GHSA-r2m8-pxm9-9c4g | High | 0.4% | 11 Mar, 2026 | npm parse-server |
@siteboon/claude-code-ui is Vulnerable to Shell Command Injection in Git Routes CVE-2026-31861, GHSA-7fv4-fmmc-86g2 | High | 6.3% | 10 Mar, 2026 | npm @siteboon/claude-code-ui |
Flowise affected by Server-Side Request Forgery (SSRF) in HTTP Node Leading to Internal Network Access CVE-2026-31829, GHSA-fvcw-9w9r-pxc7 | High | 2.4% | 10 Mar, 2026 | npm flowise npm flowise-components |
Parse Server: Classes `_GraphQLConfig` and `_Audience` master key bypass via generic class routes BIT-parse-2026-31800, CVE-2026-31800, GHSA-7xg7-rqf6-pw6c | High | 0.3% | 10 Mar, 2026 | npm parse-server |
Parse Server OAuth2 authentication adapter account takeover via identity spoofing BIT-parse-2026-30967, CVE-2026-30967, GHSA-fr88-w35c-r596 | High | 0.4% | 10 Mar, 2026 | npm parse-server |
Parse Server has a protected fields bypass via logical query operators BIT-parse-2026-30962, CVE-2026-30962, GHSA-72hp-qff8-4pvv | High | 0.3% | 10 Mar, 2026 | npm parse-server |
Sequelize v6 Vulnerable to SQL Injection via JSON Column Cast Type CVE-2026-30951, GHSA-6457-6jrx-69cr | High | 0.4% | 10 Mar, 2026 | npm sequelize |
Parse Server missing audience validation in Keycloak authentication adapter BIT-parse-2026-30949, CVE-2026-30949, GHSA-48mh-j4p5-7j9v | High | 0.5% | 10 Mar, 2026 | npm parse-server |
Parse Server vulnerable to stored cross-site scripting (XSS) via SVG file upload BIT-parse-2026-30948, CVE-2026-30948, GHSA-hcj7-6gxh-24ww | High | 0.2% | 10 Mar, 2026 | npm parse-server |
Parse Server has a bypass of class-level permissions in LiveQuery BIT-parse-2026-30947, CVE-2026-30947, GHSA-7ch5-98q2-7289 | High | 0.4% | 10 Mar, 2026 | npm parse-server |
Parse Server affected by denial-of-service via unbounded query complexity in REST and GraphQL API BIT-parse-2026-30946, CVE-2026-30946, GHSA-cmj3-wx7h-ffvg | High | 0.6% | 10 Mar, 2026 | npm parse-server |
Elysia has a string URL format ReDoS CVE-2026-30837, GHSA-f45g-68q3-5w8x | High | 0.5% | 10 Mar, 2026 | npm elysia |