Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Parse Server vulnerable to SQL Injection via dot-notation sub-key name in `Increment` operation on PostgreSQL BIT-parse-2026-31871, CVE-2026-31871, GHSA-gqpp-xgvh-9h7h | Critical | 0.4% | 11 Mar, 2026 | npm parse-server |
Parse Server vulnerable to SQL injection via `Increment` operation on nested object field in PostgreSQL BIT-parse-2026-31856, CVE-2026-31856, GHSA-q3vj-96h2-gwvg | Critical | 0.4% | 11 Mar, 2026 | npm parse-server |
@siteboon/claude-code-ui is Vulnerable to Command Injection via Multiple Parameters CVE-2026-31862, GHSA-f2fc-vc88-6w7q | Critical | 0.5% | 11 Mar, 2026 | npm @siteboon/claudecodeui |
Parse Server has role escalation and CLP bypass via direct `_Join` table write BIT-parse-2026-30966, CVE-2026-30966, GHSA-5f92-jrq3-28rc | Critical | 0.4% | 10 Mar, 2026 | npm parse-server |
Parse Server vulnerable to session token exfiltration via `redirectClassNameForKey` query parameter BIT-parse-2026-30965, CVE-2026-30965, GHSA-6r2j-cxgf-495f | Critical | 1.4% | 10 Mar, 2026 | npm parse-server |
Feathers has a NoSQL Injection via WebSocket id Parameter in MongoDB Adapter CVE-2026-29793, GHSA-p9xr-7p9p-gpqx | Critical | 0.5% | 10 Mar, 2026 | npm @feathersjs/mongodb |
Feathers has an OAuth Callback Account Takeover issue CVE-2026-29792, GHSA-wg9x-qfgw-pxhj | Critical | 0.5% | 10 Mar, 2026 | npm @feathersjs/authentication-oauth |
simple-git has blockUnsafeOperationsPlugin bypass via case-insensitive protocol.allow config key enables RCE CVE-2026-28292, GHSA-r275-fr43-pm7q | Critical | 1.3% | 10 Mar, 2026 | npm simple-git |
Parse Server: SQL injection via dot-notation field name in PostgreSQL BIT-parse-2026-31840, CVE-2026-31840, GHSA-qpr4-jrj4-6f27 | Critical | 0.4% | 10 Mar, 2026 | npm parse-server |
OneUptime has Synthetic Monitor RCE via exposed Playwright browser object CVE-2026-30957, GHSA-jw8q-gjvg-8w4q | Critical | 1.2% | 10 Mar, 2026 | npm @oneuptime/common |
OneUptime has authorization bypass via client‑controlled is-multi-tenant-query header that leads to cross‑tenant data exposure and account takeover CVE-2026-30956, GHSA-r5v6-2599-9g3m | Critical | 0.5% | 10 Mar, 2026 | npm @oneuptime/common |
Parse Server: JWT audience validation bypass in Google, Apple, and Facebook authentication adapters BIT-parse-2026-30863, CVE-2026-30863, GHSA-x6fw-778m-wr9v | Critical | 0.5% | 07 Mar, 2026 | npm parse-server |
OneUptime: Synthetic Monitor RCE via exposed Playwright browser object CVE-2026-30921, GHSA-4j36-39gm-8vq8 | Critical | 0.5% | 07 Mar, 2026 | npm @oneuptime/common |
OneUpTime's Unsandboxed Code Execution in Probe Allows Any Project Member to Achieve RCE CVE-2026-30887, GHSA-h343-gg57-2q67 | Critical | 0.4% | 07 Mar, 2026 | npm @oneuptime/common |
@perfood/couch-auth has a host header injection vulnerability CVE-2025-70948, GHSA-qw8v-34ww-6q9p | Critical | 0.4% | 05 Mar, 2026 | npm @perfood/couch-auth |
TechDocs Mkdocs Configuration Key Enables Arbitrary Code Execution CVE-2026-29186, GHSA-928r-fm4v-mvrw | Critical | 0.8% | 05 Mar, 2026 | npm @backstage/plugin-techdocs-node |
Hono vulnerable to arbitrary file access via serveStatic vulnerability CVE-2026-29045, GHSA-q5qw-h33p-qvwr | Critical | 0.5% | 04 Mar, 2026 | npm hono |
Ghost Vulnerable to Remote Code Execution via Malicious Themes BIT-ghost-2026-29053, CVE-2026-29053, GHSA-cgc2-rcrh-qr5x | Critical | 4.8% | 03 Mar, 2026 | npm ghost |
OpenClaw has a sandbox network isolation bypass via docker.network=container:<id> CVE-2026-32038, GHSA-ww6v-v748-x7g9 | Critical | 0.3% | 02 Mar, 2026 | npm openclaw |
OpenClaw Vulnerable to Remote Code Execution via Node Invoke Approval Bypass in Gateway CVE-2026-28466, GHSA-gv46-4xfq-jv58 | Critical | 0.4% | 02 Mar, 2026 | npm openclaw |
OpenClaw gateway agents.files symlink escape allowed out-of-workspace file read/write CVE-2026-32013, GHSA-fgvx-58p6-gjwc | Critical | 0.7% | 02 Mar, 2026 | npm openclaw |
CpenClaw's ACPX Windows wrapper shell fallback allowed cwd injection in specific paths CVE-2026-31999, GHSA-6f6j-wx9w-ff4j | Critical | 0.3% | 02 Mar, 2026 | npm openclaw |
`@orpc/client` has Prototype Pollution via `StandardRPCJsonSerializer` Deserialization CVE-2026-28794, GHSA-m272-9rp6-32mc | Critical | 0.9% | 02 Mar, 2026 | npm @orpc/client |
Qwik vulnerable to Unauthenticated RCE via server$ Deserialization CVE-2026-27971, GHSA-p9x5-jp3h-96mm | Critical | 5.5% | 02 Mar, 2026 | npm @builder.io/qwik |
OneUptime has WebAuthn 2FA bypass: server accepts client-supplied challenge instead of server-stored value, allowing credential replay CVE-2026-28787, GHSA-gjjc-pcwp-c74m | Critical | 0.3% | 02 Mar, 2026 | npm @oneuptime/common |
OpenClaw's tools.exec.safeBins sort long-option abbreviation bypass can skip exec approval in allowlist mode CVE-2026-28363, CVE-2026-32059, GHSA-3c6h-g97w-fg78, GHSA-7977-c43c-xpwj | Critical | 0.6% | 27 Feb, 2026 | npm openclaw |
dottie is vulnerable to Prototype Pollution bypass via non-first path segments in set() and transform() CVE-2026-27837, GHSA-r5mx-6wc6-7h9w | Critical | 0.4% | 26 Feb, 2026 | npm dottie |
Parse Server: Account takeover via JWT algorithm confusion in Google auth adapter BIT-parse-2026-27804, CVE-2026-27804, GHSA-4q3h-vp4r-prv2 | Critical | 0.2% | 25 Feb, 2026 | npm parse-server |
n8n: Expression Sandbox Escape Leads to RCE CVE-2026-27577, GHSA-vpcf-gvg4-6qwr | Critical | 10.7% | 25 Feb, 2026 | npm n8n |
n8n has Arbitrary Command Execution via File Write and Git Operations CVE-2026-27498, GHSA-x2mw-7j39-93xq | Critical | 0.8% | 25 Feb, 2026 | npm n8n |
n8n has Potential Remote Code Execution via Merge Node CVE-2026-27497, GHSA-wxx7-mcgf-j869 | Critical | 0.9% | 25 Feb, 2026 | npm n8n |
n8n has a Sandbox Escape in its JavaScript Task Runner CVE-2026-27495, GHSA-jjpj-p2wh-qf23 | Critical | 0.8% | 25 Feb, 2026 | npm n8n |
n8n has Unauthenticated Expression Evaluation via Form Node CVE-2026-27493, GHSA-75g8-rv7v-32f7 | Critical | 1.4% | 25 Feb, 2026 | npm n8n |
Angular SSR is vulnerable to SSRF and Header Injection via request handling pipeline CVE-2026-27739, GHSA-x288-3778-4hhx | Critical | 0.6% | 25 Feb, 2026 | npm @angular/ssr npm @nguniversal/common npm @nguniversal/express-engine |
OneUptime: OS Command Injection in Probe NetworkPathMonitor via unsanitized destination in traceroute exec() CVE-2026-27728, GHSA-jmhp-5558-qxh5 | Critical | 2.0% | 25 Feb, 2026 | npm @oneuptime/common |
Budibase: Remote Code Execution via Unsafe eval() in View Filter Map Function (Budibase Cloud) CVE-2026-27702, GHSA-rvhr-26g4-p2r8 | Critical | 0.4% | 25 Feb, 2026 | npm budibase |
Basic FTP has Path Traversal Vulnerability in its downloadToDir() method CVE-2026-27699, GHSA-5rq4-664w-9x2c | Critical | 0.9% | 25 Feb, 2026 | npm basic-ftp |
@enclave-vm/core is vulnerable to Sandbox Escape CVE-2026-27597, GHSA-f229-3862-4942 | Critical | 1.0% | 25 Feb, 2026 | npm @enclave-vm/core |
Parse Dashboard is Missing Authorization for its Agent Endpoint CVE-2026-27608, GHSA-cvwj-6c9h-jg6v | Critical | 0.3% | 25 Feb, 2026 | npm parse-dashboard |
Parse Dashboard has incomplete authentication on AI Agent endpoint CVE-2026-27595, GHSA-qwc3-h9mg-4582 | Critical | 0.5% | 25 Feb, 2026 | npm parse-dashboard |
FUXA has JWT Authentication Bypass via HTTP Referer header spoofing CVE-2025-69985, GHSA-4r4r-4jp4-wwf9 | Critical | 6.0% | 24 Feb, 2026 | npm @frangoteam/fuxa |
ActualBudget server is Missing Authentication for SimpleFIN and Pluggy AI bank sync endpoints CVE-2026-27584, GHSA-m2cq-xjgm-f668 | Critical | 0.4% | 24 Feb, 2026 | npm @actual-app/sync-server |
OneUptime:: node:vm sandbox escape in probe allows any project member to achieve RCE CVE-2026-27574, GHSA-v264-xqh4-9xmm | Critical | 0.6% | 21 Feb, 2026 | npm @oneuptime/common |
fast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity names CVE-2026-25896, GHSA-m7jm-9gc2-mpf2 | Critical | 0.5% | 20 Feb, 2026 | npm fast-xml-parser |
Prototype pollution in swiper CVE-2026-27212, GHSA-hmx5-qpq5-p643 | Critical | 0.5% | 19 Feb, 2026 | npm swiper |
Ghost has a SQL injection in Content API BIT-ghost-2026-26980, CVE-2026-26980, GHSA-w52v-v783-gw97 | Critical | 71.1% | 18 Feb, 2026 | npm ghost |
OpenClaw has an inbound allowlist policy bypass in voice-call extension (empty caller ID + suffix matching) CVE-2026-28446, GHSA-4rj2-gpmh-qq5x | Critical | 0.7% | 17 Feb, 2026 | npm openclaw |
Nextcloud Talk allowlist bypass via actor.name display name spoofing CVE-2026-28474, GHSA-r5h9-vjqc-hq3r | Critical | 0.5% | 17 Feb, 2026 | npm @openclaw/nextcloud-talk |
OpenClaw has a potential access-group authorization bypass if channel type lookup fails CVE-2026-28454, GHSA-fhvm-j76f-qmjv | Critical | 0.3% | 17 Feb, 2026 | npm openclaw |
OpenClaw has an exec allowlist bypass via command substitution/backticks inside double quotes CVE-2026-28470, GHSA-3hcm-ggvf-rch5 | Critical | 0.5% | 17 Feb, 2026 | npm openclaw |