Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
PTC Windchill and FlexPLM Improper Input Validation Vulnerability CVE-2026-12569 | CriticalExploited | 46.0% | 18 Jun, 2026 | |
Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability CVE-2026-7273 | HighExploited | 2.8% | 16 Jun, 2026 | |
Cisco Catalyst SD-WAN Manager Directory or Path Traversal Vulnerability CVE-2026-20262 | MediumExploited | 29.1% | 15 Jun, 2026 | |
LiteSpeed cPanel Plugin UNIX Symbolic Link (Symlink) Following Vulnerability CVE-2026-54420 | HighExploited | 1.4% | 14 Jun, 2026 | |
SimpleHelp Authentication Bypass Vulnerability CVE-2026-48558 | CriticalExploited | 77.7% | 12 Jun, 2026 | |
Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability CVE-2026-35273 | CriticalExploited | 96.7% | 11 Jun, 2026 | |
Splunk Enterprise Missing Authentication for Critical Function Vulnerability CVE-2026-20253 | CriticalExploited | 96.9% | 10 Jun, 2026 | |
Fortinet FortiSandbox OS Command Injection Vulnerability CVE-2026-25089 | CriticalExploited | 76.1% | 09 Jun, 2026 | |
Ivanti Sentry OS Command Injection Vulnerability CVE-2026-10520 | CriticalExploited | 99.9% | 09 Jun, 2026 | |
Google Chromium V8 Out-of-Bounds Read and Write Vulnerability CVE-2026-11645 | HighExploited | 2.4% | 09 Jun, 2026 | |
Check Point Security Gateway Improper Authentication Vulnerability CVE-2026-50751 | CriticalExploited | 85.3% | 08 Jun, 2026 | |
Arista Extensible Operating System Incomplete Comparison with Missing Factors Vulnerability CVE-2026-7473 | MediumExploited | 1.1% | 05 Jun, 2026 | |
Widget Factory Joomla Content Editor Improper Access Control Vulnerability CVE-2026-48907 | CriticalExploited | 85.4% | 05 Jun, 2026 | |
Cisco Catalyst SD-WAN Manager Improper Encoding or Escaping of Output Vulnerability CVE-2026-20245 | HighExploited | 25.3% | 04 Jun, 2026 | |
SolarWinds Serv-U Uncontrolled Resource Consumption Vulnerability CVE-2026-28318 | HighExploited | 43.7% | 04 Jun, 2026 | |
Progress LoadMaster Command Injection Vulnerability CVE-2026-8037 | CriticalExploited | 99.8% | 04 Jun, 2026 | |
Cisco Unified Communications Manager Server-Side Request Forgery (SSRF) Vulnerability CVE-2026-20230 | HighExploited | 88.2% | 03 Jun, 2026 | |
Android Framework Integer Overflow Vulnerability CVE-2025-48595 | HighExploited | 1.9% | 01 Jun, 2026 | |
Oracle E-Business Suite Improper Privilege Management Vulnerability CVE-2026-46817 | CriticalExploited | 12.3% | 28 May, 2026 | |
Nx Console Embedded Malicious Code Vulnerability CVE-2026-48027 | CriticalExploited | 1.8% | 27 May, 2026 | |
Mirasvit Full Page Cache Warmer Deserialization of Untrusted Data Vulnerability CVE-2026-45247 | CriticalExploited | 26.2% | 26 May, 2026 | |
Linux Kernel Missing Initialization of a Variable Vulnerability CVE-2026-46300 | HighExploited | 10.2% | 23 May, 2026 | |
Microsoft SharePoint Server Deserialization of Untrusted Data Vulnerability CVE-2026-45659 | HighExploited | 80.2% | 22 May, 2026 | |
Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks CVE-2026-48710, GHSA-86qp-5c8j-p5mr, PYSEC-2026-161, X41-2026-002 | MediumExploited | 70.3% | 22 May, 2026 | PyPI starlette |
Ubiquiti UniFi OS Improper Input Validation Vulnerability CVE-2026-34910 | CriticalExploited | 90.0% | 22 May, 2026 | |
Ubiquiti UniFi OS Path Traversal Vulnerability CVE-2026-34909 | CriticalExploited | 68.0% | 22 May, 2026 | |
Ubiquiti UniFi OS Improper Access Control Vulnerability CVE-2026-34908 | CriticalExploited | 88.3% | 22 May, 2026 | |
Trend Micro Apex One (On-Premise) Directory Traversal Vulnerability CVE-2026-34926 | MediumExploited | 13.4% | 21 May, 2026 | |
LiteSpeed cPanel Plugin Privilege Escalation Vulnerability CVE-2026-48172 | CriticalExploited | 17.9% | 21 May, 2026 | |
Drupal Core has a SQL Injection issue BIT-drupal-2026-9082, CVE-2026-9082, DRUPAL-CORE-2026-004, GHSA-ghwc-95x2-682j | CriticalExploited | 89.4% | 20 May, 2026 | Packagist drupal/core |
Microsoft Defender Denial of Service Vulnerability CVE-2026-45498 | HighExploited | 63.1% | 20 May, 2026 | |
Microsoft Defender Link Following Vulnerability CVE-2026-41091 | HighExploited | 8.2% | 20 May, 2026 | |
Daemon Tools Lite Embedded Malicious Code Vulnerability CVE-2026-8398 | CriticalExploited | 1.5% | 15 May, 2026 | |
Microsoft Exchange Server Cross-Site Scripting Vulnerability CVE-2026-42897 | MediumExploited | 70.7% | 14 May, 2026 | |
Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability CVE-2026-20182 | CriticalExploited | 91.8% | 14 May, 2026 | |
Palo Alto Networks PAN-OS Authentication Bypass Vulnerability CVE-2026-0257 | HighExploited | 95.0% | 13 May, 2026 | |
Malware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys CVE-2026-45321, GHSA-g7cv-rxg3-hmpx | CriticalExploited | 3.3% | 12 May, 2026 | npm @tanstack/arktype-adapter npm @tanstack/eslint-plugin-router npm @tanstack/eslint-plugin-start npm @tanstack/history +38 more |
Ivanti Endpoint Manager Mobile (EPMM) Improper Input Validation Vulnerability CVE-2026-6973 | HighExploited | 34.5% | 07 May, 2026 | |
Palo Alto Networks PAN-OS Out-of-bounds Write Vulnerability CVE-2026-0300 | CriticalExploited | 41.7% | 06 May, 2026 | |
WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function Vulnerability CVE-2026-41940 | CriticalExploited | 98.5% | 29 Apr, 2026 | |
LiteLLM: Authenticated command execution via MCP stdio test endpoints CVE-2026-42271, GHSA-v4p8-mg3p-g94g, PYSEC-2026-2599 | HighExploited | 91.4% | 25 Apr, 2026 | PyPI litellm |
LiteLLM has SQL Injection in Proxy API key verification CVE-2026-42208, GHSA-r75f-5x8p-qvmc, PYSEC-2026-391 | CriticalExploited | 89.4% | 24 Apr, 2026 | PyPI litellm |
Linux Kernel Incorrect Resource Transfer Between Spheres Vulnerability CVE-2026-31431 | HighExploited | 98.1% | 22 Apr, 2026 | |
Microsoft Defender Insufficient Granularity of Access Control Vulnerability CVE-2026-33825 | HighExploited | 6.7% | 14 Apr, 2026 | |
Microsoft Internet Key Exchange (IKE) Service Extensions Double Free Vulnerability CVE-2026-33824 | CriticalExploited | 77.1% | 14 Apr, 2026 | |
Microsoft Windows Protection Mechanism Failure Vulnerability CVE-2026-32202 | MediumExploited | 70.9% | 14 Apr, 2026 | |
Microsoft SharePoint Server Improper Input Validation Vulnerability CVE-2026-32201 | MediumExploited | 43.4% | 14 Apr, 2026 | |
Fortinet FortiSandbox OS Command Injection Vulnerability CVE-2026-39808 | CriticalExploited | 93.2% | 14 Apr, 2026 | |
Fortinet Multiple Products Path Traversal Vulnerability CVE-2025-61624 | MediumExploited | 1.3% | 14 Apr, 2026 | |
Adobe Acrobat and Reader Prototype Pollution Vulnerability CVE-2026-34621 | HighExploited | 7.2% | 11 Apr, 2026 |