Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
PaperCut NG/MF Unsafe Reflection Vulnerability CVE-2026-82078 | CriticalExploited | 60.9% | 28 Aug, 2026 | |
PaperCut NG/MF Missing Authentication for Critical Function Vulnerability CVE-2026-81578 | HighExploited | 83.7% | 28 Aug, 2026 | |
Gitea Code Injection Vulnerability CVE-2026-60004 | CriticalExploited | 24.0% | 26 Aug, 2026 | |
TrueConf Server Code Injection Vulnerability CVE-2026-72530 | CriticalExploited | 1.7% | 19 Aug, 2026 | |
TrueConf Server Missing Authentication for Critical Function Vulnerability CVE-2026-72529 | CriticalExploited | 1.5% | 19 Aug, 2026 | |
Citrix NetScaler Authentication Bypass Using an Alternate Path or Channel Vulnerability CVE-2026-19490 | CriticalExploited | 32.7% | 19 Aug, 2026 | |
MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding) BIT-mlflow-2026-64849, CVE-2026-64849, GHSA-7gwp-5pfp-969j, PYSEC-2026-3687 | CriticalExploited | 10.0% | 17 Aug, 2026 | PyPI mlflow |
Zimbra Collaboration Suite (ZCS) OS Command Injection Vulnerability CVE-2026-73570 | HighExploited | 71.7% | 13 Aug, 2026 | |
JFrog Artifactory Improper Authentication Vulnerability CVE-2026-42018 | HighExploited | 9.8% | 12 Aug, 2026 | |
JFrog Artifactory Improper Limitation of a Pathname to a Restricted Directory Vulnerability CVE-2026-66384 | MediumExploited | 0.7% | 12 Aug, 2026 | |
Adobe Commerce and Magento Incorrect Authorization Vulnerability CVE-2026-71362 | CriticalExploited | 90.5% | 11 Aug, 2026 | |
Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability CVE-2026-68820 | HighExploited | 0.3% | 11 Aug, 2026 | |
Microsoft SharePoint Code Injection Vulnerability CVE-2026-65660 | HighExploited | 8.2% | 11 Aug, 2026 | |
Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Heap Inspection Vulnerability CVE-2026-20349 | HighExploited | 1.0% | 11 Aug, 2026 | |
Metabase SQL Injection Vulnerability CVE-2026-72898 | CriticalExploited | 98.6% | 10 Aug, 2026 | |
Apple macOS Improper Authentication Vulnerability CVE-2026-65400 | CriticalExploited | 1.7% | 06 Aug, 2026 | |
WSO2 Multiple Products Path Traversal Vulnerability CVE-2026-5430 | CriticalExploited | 22.4% | 06 Aug, 2026 | |
N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability CVE-2026-18577 | HighExploited | 14.6% | 02 Aug, 2026 | |
N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability CVE-2026-18556 | HighExploited | 7.9% | 01 Aug, 2026 | |
Broadcom VMWare ESX Insufficient Logging Vulnerability CVE-2026-41709 | LowExploited | 0.3% | 30 Jul, 2026 | |
Broadcom VMware vCenter Path Traversal Vulnerability CVE-2026-59310 | CriticalExploited | 2.6% | 30 Jul, 2026 | |
Cisco Secure Firewall Management Center Use of Hard-coded Password Vulnerability CVE-2026-20316 | MediumExploited | 35.1% | 29 Jul, 2026 | |
JFrog Artifactory Incorrect Authorization Vulnerability CVE-2026-42016 | HighExploited | 8.6% | 27 Jul, 2026 | |
JetBrains TeamCity Deserialization of Untrusted Data Vulnerability CVE-2026-63077 | CriticalExploited | 93.6% | 27 Jul, 2026 | |
Arista VeloCloud Orchestrator On-Prem OS Command Injection Vulnerability CVE-2026-16812 | CriticalExploited | 1.0% | 27 Jul, 2026 | |
Check Point SmartConsole Improper Authentication Vulnerability CVE-2026-16232 | CriticalExploited | 3.5% | 22 Jul, 2026 | |
WordPress Core Interpretation Conflict Vulnerability CVE-2026-63030 | CriticalExploited | 10.6% | 17 Jul, 2026 | |
WordPress Core SQL Injection Vulnerability CVE-2026-60137 | MediumExploited | 5.3% | 17 Jul, 2026 | |
IBM Langflow Code Injection Vulnerability CVE-2026-9198 | CriticalExploited | 28.7% | 17 Jul, 2026 | |
Sangoma Switchvox SQL Injection Vulnerability CVE-2026-9586 | CriticalExploited | 19.0% | 17 Jul, 2026 | |
DD-WRT Stack-Based Buffer Overflow Vulnerability CVE-2021-27137 | HighExploited | 4.0% | 16 Jul, 2026 | |
Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability CVE-2026-48356 | CriticalExploited | 59.1% | 14 Jul, 2026 | |
SonicWall SMA1000 Appliances Code Injection Vulnerability CVE-2026-15410 | HighExploited | 11.8% | 14 Jul, 2026 | |
SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability CVE-2026-15409 | CriticalExploited | 6.8% | 14 Jul, 2026 | |
Microsoft SharePoint Weak Authentication Vulnerability CVE-2026-55040 | CriticalExploited | 69.5% | 14 Jul, 2026 | |
Microsoft SharePoint Deserialization of Untrusted Data Vulnerability CVE-2026-58644 | CriticalExploited | 15.9% | 14 Jul, 2026 | |
Microsoft SharePoint Server Missing Authentication for Critical Function Vulnerability CVE-2026-56164 | CriticalExploited | 1.0% | 14 Jul, 2026 | |
Microsoft Active Directory Federation Services Insufficient Granularity of Access Control Vulnerability CVE-2026-56155 | HighExploited | 0.3% | 14 Jul, 2026 | |
Microsoft SharePoint Deserialization of Untrusted Data Vulnerability CVE-2026-50522 | CriticalExploited | 3.0% | 14 Jul, 2026 | |
Balbooa Forms Unrestricted Upload of File with Dangerous Type Vulnerability CVE-2026-56291 | CriticalExploited | 14.9% | 09 Jul, 2026 | |
LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback CVE-2026-59822, GHSA-7488-6r32-c95q, PYSEC-2026-3479 | HighExploited | 0.8% | 08 Jul, 2026 | PyPI litellm |
Linux Kernel Unspecified Vulnerability CVE-2026-53362 | HighExploited | 0.7% | 04 Jul, 2026 | |
Adobe ColdFusion Path Traversal Vulnerability CVE-2026-48282 | CriticalExploited | 42.4% | 30 Jun, 2026 | |
Citrix NetScaler ADC and NetScaler Gateway Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability CVE-2026-8452 | HighExploited | 1.0% | 30 Jun, 2026 | |
Joomlack Page Builder Improper Access Control Vulnerability CVE-2026-56290 | CriticalExploited | 30.9% | 29 Jun, 2026 | |
Kestra OSS OS Command Injection Vulnerability CVE-2026-49869 | CriticalExploited | 2.1% | 26 Jun, 2026 | |
Linux Kernel Out-of-Bounds Write Vulnerability CVE-2026-53266 | HighExploited | 0.9% | 25 Jun, 2026 | |
iCagenda Unrestricted Upload of File with Dangerous Type Vulnerability CVE-2026-48939 | CriticalExploited | 20.1% | 20 Jun, 2026 | |
JoomShaper SP Page Builder Unrestricted Upload of File with Dangerous Type Vulnerability CVE-2026-48908 | CriticalExploited | 88.5% | 20 Jun, 2026 | |
Langflow: IDOR Vulnerability in `/api/v1/responses` Endpoint Allows Authenticated Attackers to Access Another User's Flow CVE-2026-55255, GHSA-qrpv-q767-xqq2, PYSEC-2026-221 | HighExploited | 0.9% | 19 Jun, 2026 | PyPI langflow |