Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Parse Server has a session field immutability bypass via falsy-value guard BIT-parse-2026-34574, CVE-2026-34574, GHSA-f6j3-w9v3-cq22 | Medium | 0.2% | 31 Mar, 2026 | npm parse-server |
parse-server has GraphQL complexity validator exponential fragment traversal DoS BIT-parse-2026-34573, CVE-2026-34573, GHSA-mfj6-6p54-m98c | High | 0.6% | 31 Mar, 2026 | npm parse-server |
parse-server has cloud function validator bypass via prototype chain traversal BIT-parse-2026-34532, CVE-2026-34532, GHSA-vpj2-qq7w-5qq6 | Critical | 0.3% | 31 Mar, 2026 | npm parse-server |
OpenClaw affected by SSRF via unguarded image download in fal provider CVE-2026-34504, GHSA-qxgf-hmcj-3xw3 | Medium | 0.2% | 31 Mar, 2026 | npm openclaw |
OpenClaw's device removal and token revocation do not terminate active WebSocket sessions CVE-2026-34503, GHSA-2pr2-hcv6-7gwv | High | 0.3% | 31 Mar, 2026 | npm openclaw |
OpenClaw's message tool media parameter bypasses tool policy filesystem isolation CVE-2026-33581, GHSA-v8wv-jg3q-qwpq | High | 0.6% | 31 Mar, 2026 | npm openclaw |
OpenClaw's Nextcloud Talk webhook missing rate limiting on shared secret authentication CVE-2026-33580, GHSA-9528-x887-j2fp | Medium | 0.4% | 31 Mar, 2026 | npm openclaw |
OpenClaw: /pair approve command path omitted caller scope subsetting and reopened device pairing escalation CVE-2026-33579, GHSA-hc5h-pmr3-3497 | Critical | 0.8% | 31 Mar, 2026 | npm openclaw |
OpenClaw: Google Chat and Zalouser group sender allowlist bypass via policy downgrade CVE-2026-33578, GHSA-63mg-xp9j-jfcm | Medium | 0.3% | 31 Mar, 2026 | npm openclaw |
OpenClaw: node.pair.approve missing callerScopes validation allows low-privilege operator to approve malicious nodes CVE-2026-33577, GHSA-2x4x-cc5g-qmmg | High | 0.4% | 31 Mar, 2026 | npm openclaw |
OpenClaw: Zalo channel downloads media before sender authorization CVE-2026-33576, GHSA-v2v2-f783-358j | Medium | 0.4% | 31 Mar, 2026 | npm openclaw |
Malicious release: Malicious code in tailwindcss-typeface-inter (npm) GHSA-3cx6-7g5g-3hhp, MAL-2026-2312 | Malicious | Not scored | 31 Mar, 2026 | npm tailwindcss-typeface-inter |
Malicious release: Malicious code in axios (npm) GHSA-fw8c-xr5c-95f9, MAL-2026-2307 | Malicious | Not scored | 31 Mar, 2026 | npm axios |
Malicious release: Malicious code in plain-crypto-js (npm) GHSA-2x9r-6wxq-hrr7, MAL-2026-2306 | Malicious | Not scored | 31 Mar, 2026 | npm plain-crypto-js |
OpenClaw: Non-owner command-authorized sender can change the owner-only `/send` session delivery policy CVE-2026-35620, GHSA-39mp-545q-w789 | Medium | 0.5% | 30 Mar, 2026 | npm openclaw |
OpenClaw: `browser.request` still allows `POST /reset-profile` through the `operator.write` surface CVE-2026-35653, GHSA-xp9r-prpg-373r | High | 0.6% | 30 Mar, 2026 | npm openclaw |
OpenClaw: Mutating internal `/allowlist` chat commands missed `operator.admin` scope enforcement GHSA-vqvg-86cc-cg83 | Medium | Not scored | 30 Mar, 2026 | npm openclaw |
OpenClaw: Gateway operator.write Can Reach Admin-Class Channel Allowlist Persistence via chat.send CVE-2026-35621, GHSA-94pw-c6m8-p9p9 | High | 0.3% | 30 Mar, 2026 | npm openclaw |
OpenClaw has an Arbitrary Malicious Code Execution Vulnerability CVE-2026-35641, GHSA-m3mh-3mpg-37hw | High | 0.1% | 30 Mar, 2026 | npm openclaw |
OpenClaw has a Gateway HTTP /v1/models Route Bypasses Operator Read Scope CVE-2026-35619, GHSA-68f8-9mhj-h2mp | Medium | 0.3% | 30 Mar, 2026 | npm openclaw |
OpenClaw has incomplete Fix for CVE-2026-32011: Feishu Webhook Pre-Auth Body Parsing DoS (Slow-Body / Slowloris Variant) CVE-2026-35665, GHSA-w6m8-cqvj-pg5v | Medium | 0.3% | 30 Mar, 2026 | npm openclaw |
OpenClaw has Sandbox Media Root Bypass via Unnormalized `mediaUrl` / `fileUrl` Parameter Keys (CWE-22) CVE-2026-35668, GHSA-hr5v-j9h9-xjhg | High | 0.4% | 30 Mar, 2026 | npm openclaw |
OpenClaw has incomplete Fix for CVE-2026-27486: Unvalidated SIGKILL in `!stop` Chat Command via `shell-utils.ts` CVE-2026-35667, GHSA-3298-56p6-rpw2 | Medium | 0.1% | 30 Mar, 2026 | npm openclaw |
GraphQL API endpoint ignores CORS origin restriction BIT-parse-2026-34373, CVE-2026-34373, GHSA-q3p6-g7c4-829c | Medium | 0.2% | 30 Mar, 2026 | npm parse-server |
LiveQuery protected field leak via shared mutable state across concurrent subscribers BIT-parse-2026-34363, CVE-2026-34363, GHSA-m983-v2ff-wq65 | High | 0.4% | 30 Mar, 2026 | npm parse-server |
NocoBase Affected by Sandbox Escape to RCE via console._stdout Prototype Chain Traversal in Workflow Script Node CVE-2026-34156, GHSA-px3p-vgh9-m57c | Critical | 35.0% | 30 Mar, 2026 | npm @nocobase/plugin-workflow-javascript |
@tinacms/graphql has Path Traversal that leads to overwrite of arbitrary files CVE-2026-33949, GHSA-v9p7-gf3q-h779 | High | 0.4% | 30 Mar, 2026 | npm @tinacms/graphql |
Malicious release: Malicious code in eslint-validator (npm) GHSA-m9ph-m48c-mrq8, MAL-2026-2300 | Malicious | Not scored | 30 Mar, 2026 | npm eslint-validator |
Malicious release: Malicious code in earthengine-api (npm) MAL-2026-2297 | Malicious | Not scored | 30 Mar, 2026 | npm earthengine-api |
Malicious release: Malicious code in bos-decoration-elements (npm) MAL-2026-2296 | Malicious | Not scored | 29 Mar, 2026 | npm bos-decoration-elements |
OpenClaw has ACP CLI approval prompt ANSI escape sequence injection CVE-2026-35651, GHSA-4hmj-39m8-jwc7 | Medium | 0.3% | 29 Mar, 2026 | npm openclaw |
OpenClaw: Telegram DM-Scoped Inline Button Callbacks Bypass DM Pairing and Mutate Session State CVE-2026-35661, GHSA-j4c9-w69r-cw33 | Medium | 0.3% | 29 Mar, 2026 | npm openclaw |
OpenClaw: Synology Chat Webhook Pre-Auth Rate-Limit Bypass Enables Brute-Force Guessing of Webhook Token CVE-2026-35646, GHSA-mf5g-6r6f-ghhm | Medium | 0.2% | 29 Mar, 2026 | npm openclaw |
OpenClaw: MS Teams Feedback Invocation Bypasses Sender Allowlists and Records Unauthorized Session Feedback CVE-2026-35654, GHSA-rf6h-5gpw-qrgq | Medium | 0.2% | 29 Mar, 2026 | npm openclaw |
OpenClaw: Gateway Plugin Subagent Fallback `deleteSession` Uses Synthetic `operator.admin` CVE-2026-35645, GHSA-h4jx-hjr3-fhgc | Medium | 0.3% | 29 Mar, 2026 | npm openclaw |
OpenClaw: Feishu Raw Card Send Surface Can Mint Legacy Card Callbacks That Bypass DM Pairing CVE-2026-35664, GHSA-77w2-crqv-cmv3 | Medium | 0.3% | 29 Mar, 2026 | npm openclaw |
OpenClaw: Feishu webhook reads and parses unauthenticated request bodies before signature validation CVE-2026-35640, GHSA-3h52-cx59-c456 | Medium | 0.5% | 29 Mar, 2026 | npm openclaw |
OpenClaw: SSRF via Unguarded Configured Base URLs in Multiple Channel Extensions (Incomplete Fix for CVE-2026-28476) CVE-2026-35629, GHSA-rhfg-j8jq-7v2h | High | 0.3% | 29 Mar, 2026 | npm openclaw |
OpenClaw: Google Chat Authz Bypass via Group Policy Rebinding with Mutable Space displayName CVE-2026-35617, GHSA-52q4-3xjc-6778 | Low | 0.2% | 29 Mar, 2026 | npm openclaw |
OpenClaw: `session_status` sessionId resolution bypasses sandboxed session-tree visibility CVE-2026-35636, GHSA-q2qc-744p-66r2 | High | 0.3% | 29 Mar, 2026 | npm openclaw |
OpenClaw: Gateway HTTP Session History Route Bypasses Operator Read Scope CVE-2026-35657, GHSA-5jvj-hxmh-6h6j | High | 0.2% | 29 Mar, 2026 | npm openclaw |
MikroORM has Prototype Pollution in Utils.merge CVE-2026-34221, GHSA-qpfv-44f3-qqx6 | High | 0.4% | 29 Mar, 2026 | npm @mikro-orm/core |
MikroORM is vulnerable to SQL Injection via specially crafted object CVE-2026-34220, GHSA-gwhv-j974-6fxm | Critical | 0.4% | 29 Mar, 2026 | npm @mikro-orm/core |
OpenCC has an Out-of-bounds read when processing truncated UTF-8 input GHSA-7fqq-q52p-2jjg | Medium | Not scored | 29 Mar, 2026 | PyPI OpenCC PyPI opencc npm opencc |
Parse Server has an MFA single-use token bypass via concurrent authData login requests BIT-parse-2026-34224, CVE-2026-34224, GHSA-w73w-g5xw-rwhf | Low | 0.3% | 29 Mar, 2026 | npm parse-server |
Trix is vulnerable to XSS through JSON deserialization bypass in drag-and-drop (Level0InputController) CVE-2026-73427, GHSA-53p3-c7vp-4mcc | Low | 0.6% | 29 Mar, 2026 | RubyGems action_text-trix npm trix |
Handlebars.js has a Prototype Method Access Control Gap via Missing __lookupSetter__ Blocklist Entry GHSA-7rx3-28cr-v5wh | Medium | Not scored | 29 Mar, 2026 | npm handlebars |
Handlebars.js has a Property Access Validation Bypass in container.lookup GHSA-442j-39wm-28r2 | Low | Not scored | 29 Mar, 2026 | npm handlebars |
mppx has multiple payment bypass and griefing vulnerabilities GHSA-8x4m-qw58-3pcx | Critical | Not scored | 29 Mar, 2026 | npm mppx |
Parse Server exposes auth data via verify password endpoint BIT-parse-2026-34215, CVE-2026-34215, GHSA-wp76-gg32-8258 | High | 0.3% | 29 Mar, 2026 | npm parse-server |