Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Arista VeloCloud Orchestrator SQL Injection Vulnerability CVE-2026-114625 | CriticalExploited | 1.0% | 6 days ago | |
Brotli: Out-of-bounds write in the Brotli decoder ("Node2Shell") also affects the PyPI Brotli package BIT-brotli-2026-111497, BIT-dotnet-2026-111497, BIT-dotnet-sdk-2026-111497, BIT-node-2026-111497, BIT-node-min-2026-111497, BIT-powershell-2026-111497, CVE-2026-111497, GHSA-9v8h-qqgm-4m35, PYSEC-2026-4322, PYSEC-2026-4323 | CriticalExploited | 88.0% | 7 days ago | PyPI brotli PyPI brotlicffi |
PHP Stale Internal Request-State Vulnerability CVE-2026-109619 | CriticalExploited | 100.0% | 8 days ago | |
PHP Memory Corruption Vulnerability CVE-2026-109618 | CriticalExploited | 100.0% | 8 days ago | |
BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability CVE-2026-102764 | CriticalExploited | 18.9% | 13 days ago | |
Siemens Software Center Uncontrolled Search Path Element Vulnerability CVE-2026-110936 | HighExploited | 1.0% | 14 days ago | |
Palo Alto Networks PAN-OS Code Injection Vulnerability CVE-2026-0322 | HighExploited | 1.7% | 15 days ago | |
Cisco Secure Email Gateway Relative Path Traversal Vulnerability CVE-2026-76519 | CriticalExploited | 2.2% | 15 days ago | |
EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability CVE-2026-106931 | HighExploited | 2.5% | 15 days ago | |
Collabora Online – Built-in CODE Server OS Command Injection Vulnerability CVE-2026-110447 | CriticalExploited | 11.6% | 15 days ago | |
Microsoft Windows Command Injection Vulnerability CVE-2026-96951 | HighExploited | 9.8% | 16 days ago | |
Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability CVE-2026-104935 | HighExploited | 86.8% | 16 days ago | |
Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability CVE-2026-21589 | CriticalExploited | 99.5% | 23 days ago | |
Ahsay AhsayCBS Command Injection Vulnerability CVE-2026-105134 | CriticalExploited | 81.8% | 25 days ago | |
Ahsay AhsayCBS Improper Authentication Vulnerability CVE-2026-105133 | MediumExploited | 79.5% | 25 days ago | |
Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability CVE-2026-88779 | HighExploited | 11.4% | 25 days ago | |
Fortinet FortiMail Path Traversal Vulnerability CVE-2026-104286 | CriticalExploited | 4.6% | 27 days ago | |
Zammad GmbH Zammad Improper Privilege Management Vulnerability CVE-2026-102490 | CriticalExploited | 0.9% | 29 days ago | |
Zammad GmbH Zammad Session Fixation Vulnerability CVE-2026-102489 | CriticalExploited | 2.0% | 29 days ago | |
Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability CVE-2026-76504 | CriticalExploited | 38.9% | 29 days ago | |
Apple Multiple Products Out-of-Bounds Write Vulnerability CVE-2026-86950 | HighExploited | 26.2% | 28 Sep, 2026 | |
Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability CVE-2026-88772 | CriticalExploited | 78.2% | 27 Sep, 2026 | |
Citrix NetScaler Improper Input Validation Vulnerability CVE-2026-88771 | CriticalExploited | 82.2% | 27 Sep, 2026 | |
Plex Media Server External Control of File Name or Path Vulnerability CVE-2026-96656 | HighExploited | 1.8% | 23 Sep, 2026 | |
Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability CVE-2026-96655 | MediumExploited | 1.6% | 23 Sep, 2026 | |
Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability CVE-2026-96654 | MediumExploited | 1.9% | 23 Sep, 2026 | |
Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability CVE-2026-96652 | MediumExploited | 1.8% | 23 Sep, 2026 | |
WordPress Core Remote File Inclusion Vulnerability CVE-2026-87902 | HighExploited | 95.8% | 22 Sep, 2026 | |
F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability CVE-2026-94127 | CriticalExploited | 24.9% | 22 Sep, 2026 | |
Check Point Multiple Products Path Traversal Vulnerability CVE-2026-93616 | CriticalExploited | 91.6% | 22 Sep, 2026 | |
Arista VeloCloud Orchestrator Improper Input Validation Vulnerability CVE-2026-93952 | CriticalExploited | 1.4% | 22 Sep, 2026 | |
Acronis Backup Incorrect Default Permissions Vulnerability CVE-2026-87886 | HighExploited | 0.2% | 17 Sep, 2026 | |
Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability CVE-2026-76460 | CriticalExploited | 75.6% | 16 Sep, 2026 | |
Google Pixel Improper Authorization Vulnerability CVE-2026-58704 | HighExploited | 0.6% | 15 Sep, 2026 | |
Cisco Secure Email Gateway SQL Injection Vulnerability CVE-2026-76461 | CriticalExploited | 29.5% | 14 Sep, 2026 | |
GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability CVE-2026-85706 | CriticalExploited | 97.4% | 12 Sep, 2026 | |
Check Point Multiple Products Improper Certificate Validation Vulnerability CVE-2026-85102 | CriticalExploited | 54.1% | 09 Sep, 2026 | |
Google Chromium V8 Out of Bounds Write Vulnerability CVE-2026-87491 | HighExploited | 3.5% | 09 Sep, 2026 | |
ConnectWise ScreenConnect Improper Privilege Management and Missing Authorization Vulnerability CVE-2026-84869 | CriticalExploited | 0.9% | 08 Sep, 2026 | |
Microsoft Windows Heap-Based Buffer Overflow Vulnerability CVE-2026-85880 | HighExploited | 0.4% | 08 Sep, 2026 | |
Microsoft Windows Link Following Vulnerability CVE-2026-81963 | HighExploited | 0.4% | 08 Sep, 2026 | |
Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerability CVE-2026-75650 | CriticalExploited | 3.9% | 07 Sep, 2026 | |
N-able N-central Static Code Injection Vulnerability CVE-2026-86218 | CriticalExploited | 15.4% | 06 Sep, 2026 | |
MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command Vulnerability CVE-2026-86060 | CriticalExploited | 6.4% | 05 Sep, 2026 | |
Mikrotik RouterOS Improper Enforcement of Behavioral Workflow Vulnerability CVE-2026-67279 | MediumExploited | 2.3% | 05 Sep, 2026 | |
MikroTik RouterOS Missing Authentication for Critical Function Vulnerability CVE-2026-67277 | HighExploited | 1.6% | 05 Sep, 2026 | |
Google Chromium V8 Type Confusion Vulnerability CVE-2026-85046 | HighExploited | 1.8% | 03 Sep, 2026 | |
SonicWall SMA1000 Appliances OS Command Injection Vulnerability CVE-2026-83549 | HighExploited | 9.9% | 01 Sep, 2026 | |
SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability CVE-2026-83548 | CriticalExploited | 8.0% | 01 Sep, 2026 | |
JFrog Artifactory Improper Authentication Vulnerability CVE-2026-82329 | CriticalExploited | 14.4% | 28 Aug, 2026 |