Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
pdfmake is vulnerable to server-side request forgery (SSRF) CVE-2026-26801, GHSA-wp52-r2fp-4vmr | High | 0.5% | 10 Mar, 2026 | npm pdfmake |
StudioCMS: IDOR — Arbitrary API Token Revocation Leading to Denial of Service CVE-2026-30945, GHSA-8rgj-vrfr-6hqr | High | 0.5% | 10 Mar, 2026 | npm studiocms |
Parse Server has a NoSQL injection via token type in password reset and email verification endpoints BIT-parse-2026-30941, CVE-2026-30941, GHSA-vgjh-hmwf-c588 | High | 0.5% | 10 Mar, 2026 | npm parse-server |
Azure MCP Server has Server-Side Request Forgery issue that allows authorized attacker to elevate privileges over a network CVE-2026-26118, GHSA-hhfx-wfvq-7g9c, PYSEC-2026-2669 | High | 1.0% | 10 Mar, 2026 | NuGet Azure.Mcp PyPI msmcp-azure npm @azure/mcp |
StudioCMS has Privilege Escalation via Insecure API Token Generation CVE-2026-30944, GHSA-667w-mmh7-mrr4 | High | 0.6% | 10 Mar, 2026 | npm studiocms |
node-tar Symlink Path Traversal via Drive-Relative Linkpath CVE-2026-31802, GHSA-9ppj-qmqm-q256 | High | 0.3% | 10 Mar, 2026 | npm tar |
liquidjs has a path traversal fallback vulnerability CVE-2026-30952, GHSA-wmfp-5q7x-987x | High | 0.6% | 10 Mar, 2026 | npm liquidjs |
Parse Server has Denial of Service (DoS) and Cloud Function Dispatch Bypass via Prototype Chain Resolution BIT-parse-2026-30939, CVE-2026-30939, GHSA-5j86-7r7m-p8h6 | High | 0.5% | 10 Mar, 2026 | npm parse-server |
Parse Server has Regular Expression Denial of Service (ReDoS) via `$regex` query in LiveQuery BIT-parse-2026-30925, CVE-2026-30925, GHSA-mf3j-86qx-cq5j | High | 0.5% | 10 Mar, 2026 | npm parse-server |
OpenClaw: fetch-guard forwards custom authorization headers across cross-origin redirects CVE-2026-32913, GHSA-6mgf-v5j7-45cr | High | 0.3% | 09 Mar, 2026 | npm openclaw |
OpenClaw's dashboard leaked gateway auth material via browser URL/query and localStorage GHSA-rchv-x836-w7xp | High | Not scored | 09 Mar, 2026 | npm openclaw |
OneUptime has broken access control in GitHub App installation flow that allows unauthorized project binding CVE-2026-30920, GHSA-656w-6f6c-m9r6 | High | 0.2% | 09 Mar, 2026 | npm @oneuptime/common |
@budibase/server: Command Injection in PostgreSQL Dump Command CVE-2026-25041, GHSA-726g-59wr-cj4c | High | 0.5% | 09 Mar, 2026 | npm @budibase/server |
x402 SDK Security Advisory GHSA-qr2g-p6q7-w82m, GO-2026-4647 | High | Not scored | 07 Mar, 2026 | Go github.com/coinbase/x402/go PyPI x402 npm @x402/svm |
Flowise Missing Authentication on NVIDIA NIM Endpoints CVE-2026-30824, GHSA-5f53-522j-j454 | High | 36.9% | 06 Mar, 2026 | npm flowise |
Flowise has IDOR leading to Account Takeover and Enterprise Feature Bypass via SSO Configuration CVE-2026-30823, GHSA-cwc3-p92j-g7qm | High | 0.4% | 06 Mar, 2026 | npm flowise |
Flowise Allows Mass Assignment in `/api/v1/leads` Endpoint CVE-2026-30822, GHSA-mq4r-h2gh-qv7x | High | 13.4% | 06 Mar, 2026 | npm flowise |
Flowise has Arbitrary File Upload via MIME Spoofing CVE-2026-30821, GHSA-j8g8-j7fc-43v6 | High | 15.2% | 06 Mar, 2026 | npm flowise |
Flowise has Authorization Bypass via Spoofed x-request-from Header CVE-2026-30820, GHSA-wvhq-wp8g-c7vq | High | 0.5% | 06 Mar, 2026 | npm flowise |
parse-server's endpoint `/loginAs` allows `readOnlyMasterKey` to gain full read and write access as any user BIT-parse-2026-30229, CVE-2026-30229, GHSA-79wj-8rqv-jvp5 | High | 0.4% | 06 Mar, 2026 | npm parse-server |
express-rate-limit: IPv4-mapped IPv6 addresses bypass per-client rate limiting on servers with dual-stack network CVE-2026-30827, GHSA-46wh-pxpv-q5gq | High | 0.5% | 06 Mar, 2026 | npm express-rate-limit |
GitHub Copilot CLI Dangerous Shell Expansion Patterns Enable Arbitrary Code Execution CVE-2026-29783, GHSA-g8r9-g2v8-jv6f | High | 0.4% | 06 Mar, 2026 | npm @github/copilot |
@perfood/couch-auth has an Observable Timing Discrepancy CVE-2025-70949, GHSA-mjqr-5c55-g77h | High | 0.4% | 05 Mar, 2026 | npm @perfood/couch-auth |
tar has Hardlink Path Traversal via Drive-Relative Linkpath CVE-2026-29786, GHSA-qffp-2rhf-9h96 | High | 0.5% | 05 Mar, 2026 | npm tar |
Ghost has incomplete CSRF protections around OTC use BIT-ghost-2026-29784, CVE-2026-29784, GHSA-9m84-wc28-w895 | High | 0.2% | 05 Mar, 2026 | npm ghost |
Parse Server's Cloud Hooks and Cloud Jobs bypass `readOnlyMasterKey` write restriction BIT-parse-2026-29182, CVE-2026-29182, GHSA-vc89-5g3r-cmhh | High | 0.4% | 05 Mar, 2026 | npm parse-server |
SVGO DoS through entity expansion in DOCTYPE (Billion Laughs) CVE-2026-29074, GHSA-xpqw-6gx7-v673 | High | 0.6% | 04 Mar, 2026 | npm svgo |
Immutable is vulnerable to Prototype Pollution CVE-2026-29063, GHSA-wf6x-7x77-mvgw | High | 0.9% | 04 Mar, 2026 | npm immutable |
locutus call_user_func_array vulnerable to Remote Code Execution (RCE) due to Code Injection CVE-2026-29091, GHSA-fp25-p6mj-qqg6 | High | 0.8% | 04 Mar, 2026 | npm locutus |
@hono/node-server has authorization bypass for protected static paths via encoded slashes in Serve Static Middleware CVE-2026-29087, GHSA-wc8c-qw6v-h7f6 | High | 0.3% | 04 Mar, 2026 | npm @hono/node-server |
OpenClaw: Hardlink alias checks could bypass workspace-only file boundaries in specific configurations GHSA-3jx4-q2m7-r496 | High | Not scored | 04 Mar, 2026 | npm openclaw |
OpenClaw Canvas Authentication Bypass Vulnerability CVE-2026-3690, GHSA-vvjh-f6p9-5vcf | High | 0.7% | 04 Mar, 2026 | npm openclaw |
OpenClaw: Slack interactive callbacks could skip configured sender checks in some shared-workspace flows CVE-2026-32005, GHSA-x2ff-j5c2-ggpr | High | 0.3% | 04 Mar, 2026 | npm openclaw |
Multer Vulnerable to Denial of Service via Uncontrolled Recursion CVE-2026-3520, GHSA-5528-5vmv-3xc2 | High | 0.8% | 04 Mar, 2026 | npm multer |
OpenClaw's commands.allowFrom sender authorization accepted conversation identifiers via ctx.From GHSA-2ch6-x3g4-7759 | High | Not scored | 03 Mar, 2026 | npm openclaw |
OpenClaw's exec allowlist wrapper analysis did not unwrap env/shell dispatch chains CVE-2026-27566, GHSA-jj82-76v6-933r | High | 0.4% | 03 Mar, 2026 | npm openclaw |
OpenClaw's sandbox bind validation could bypass allowed-root and blocked-path checks via symlink-parent missing-leaf paths CVE-2026-27523, GHSA-m8v2-6wwh-r4gc | High | 0.3% | 03 Mar, 2026 | npm openclaw |
OpenClaw: Zip extraction symlink traversal could write outside destination GHSA-jxrq-8fm4-9p58 | High | Not scored | 03 Mar, 2026 | npm openclaw |
OpenClaw's Synology Chat dmPolicy=allowlist failed open on empty allowedUserIds, allowing unauthorized agent dispatch CVE-2026-31998, GHSA-gw85-xp4q-5gp9 | High | 0.3% | 03 Mar, 2026 | npm openclaw |
OpenClaw hook transform path containment missed symlink-resolved escapes GHSA-659f-22xc-98f2 | High | Not scored | 03 Mar, 2026 | npm openclaw |
OpenClaw has multiple E2E/test Dockerfiles that run all processes as root GHSA-w7j5-j98m-w679 | High | Not scored | 03 Mar, 2026 | npm openclaw |
OpenClaw's browser-origin WebSocket auth hardening gap could enable loopback password brute-force chains CVE-2026-32025, GHSA-jmmg-jqc7-5qf4 | High | 0.3% | 03 Mar, 2026 | npm openclaw |
OpenClaw's non-default autoAllowSkills setting could bypass on-miss exec prompt GHSA-7ff8-xjh3-mgh6 | High | Not scored | 03 Mar, 2026 | npm openclaw |
OpenClaw's shell startup env injection bypasses system.run allowlist intent (RCE class) CVE-2026-32056, GHSA-xgf2-vxv2-rrmg | High | 0.6% | 03 Mar, 2026 | npm openclaw |
OpenClaw affected by BASH_ENV / ENV startup-file injection into spawned shell commands GHSA-w9cg-v44m-4qv8 | High | Not scored | 03 Mar, 2026 | npm openclaw |
OpenClaw: Sandbox media fallback tmp symlink alias bypass allows host file reads outside sandboxRoot GHSA-xmv6-r34m-62p4 | High | Not scored | 03 Mar, 2026 | npm openclaw |
OpenClaw's `tools.exec.safeBins` PATH-hijack allowed trojan binaries to bypass allowlist checks CVE-2026-32015, GHSA-g75x-8qqm-2vxp | High | 0.1% | 03 Mar, 2026 | npm openclaw |
OpenClaw Improperly Neutralizes Line Breaks in systemd Unit Generation Enables Local Command Execution (Linux) CVE-2026-32063, GHSA-vffc-f7r7-rx2w | High | 1.1% | 03 Mar, 2026 | npm openclaw |
OpenClaw has a Command Injection via unescaped environment assignments in Windows Scheduled Task script generation CVE-2026-22176, GHSA-pj5x-38rw-6fph | High | 0.7% | 03 Mar, 2026 | npm openclaw |
OpenClaw has macOS `system.run` allowlist bypass via quoted command substitution CVE-2026-22179, GHSA-9p38-94jf-hgjj | High | 0.7% | 03 Mar, 2026 | npm openclaw |