Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Arista VeloCloud Orchestrator SQL Injection Vulnerability CVE-2026-114625 | CriticalExploited | 1.0% | 8 days ago | |
Brotli: Out-of-bounds write in the Brotli decoder ("Node2Shell") also affects the PyPI Brotli package BIT-brotli-2026-111497, BIT-dotnet-2026-111497, BIT-dotnet-sdk-2026-111497, BIT-node-2026-111497, BIT-node-min-2026-111497, BIT-powershell-2026-111497, CVE-2026-111497, GHSA-9v8h-qqgm-4m35, PYSEC-2026-4322, PYSEC-2026-4323 | CriticalExploited | 82.6% | 8 days ago | PyPI brotli PyPI brotlicffi |
PHP Stale Internal Request-State Vulnerability CVE-2026-109619 | CriticalExploited | 100.0% | 9 days ago | |
PHP Memory Corruption Vulnerability CVE-2026-109618 | CriticalExploited | 100.0% | 9 days ago | |
BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability CVE-2026-102764 | CriticalExploited | 18.9% | 15 days ago | |
Cisco Secure Email Gateway Relative Path Traversal Vulnerability CVE-2026-76519 | CriticalExploited | 2.2% | 16 days ago | |
Collabora Online – Built-in CODE Server OS Command Injection Vulnerability CVE-2026-110447 | CriticalExploited | 73.3% | 16 days ago | |
GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability CVE-2026-97229 | CriticalExploited | 18.4% | 17 days ago | |
Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability CVE-2026-21589 | CriticalExploited | 99.5% | 24 days ago | |
Ahsay AhsayCBS Command Injection Vulnerability CVE-2026-105134 | CriticalExploited | 81.8% | 26 days ago | |
Fortinet FortiMail Path Traversal Vulnerability CVE-2026-104286 | CriticalExploited | 4.6% | 29 days ago | |
Zammad GmbH Zammad Improper Privilege Management Vulnerability CVE-2026-102490 | CriticalExploited | 10.9% | 30 Sep, 2026 | |
Zammad GmbH Zammad Session Fixation Vulnerability CVE-2026-102489 | CriticalExploited | 22.5% | 30 Sep, 2026 | |
Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability CVE-2026-76504 | CriticalExploited | 38.9% | 30 Sep, 2026 | |
Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability CVE-2026-88772 | CriticalExploited | 78.2% | 27 Sep, 2026 | |
Citrix NetScaler Improper Input Validation Vulnerability CVE-2026-88771 | CriticalExploited | 82.2% | 27 Sep, 2026 | |
F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability CVE-2026-94127 | CriticalExploited | 24.9% | 22 Sep, 2026 | |
Check Point Multiple Products Path Traversal Vulnerability CVE-2026-93616 | CriticalExploited | 91.6% | 22 Sep, 2026 | |
Arista VeloCloud Orchestrator Improper Input Validation Vulnerability CVE-2026-93952 | CriticalExploited | 1.4% | 22 Sep, 2026 | |
Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability CVE-2026-76460 | CriticalExploited | 75.6% | 16 Sep, 2026 | |
Cisco Secure Email Gateway SQL Injection Vulnerability CVE-2026-76461 | CriticalExploited | 29.5% | 14 Sep, 2026 | |
GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability CVE-2026-85706 | CriticalExploited | 97.4% | 12 Sep, 2026 | |
Check Point Multiple Products Improper Certificate Validation Vulnerability CVE-2026-85102 | CriticalExploited | 54.1% | 09 Sep, 2026 | |
ConnectWise ScreenConnect Improper Privilege Management and Missing Authorization Vulnerability CVE-2026-84869 | CriticalExploited | 0.9% | 08 Sep, 2026 | |
Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerability CVE-2026-75650 | CriticalExploited | 3.9% | 07 Sep, 2026 | |
N-able N-central Static Code Injection Vulnerability CVE-2026-86218 | CriticalExploited | 15.4% | 06 Sep, 2026 | |
MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command Vulnerability CVE-2026-86060 | CriticalExploited | 6.4% | 05 Sep, 2026 | |
SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability CVE-2026-83548 | CriticalExploited | 8.0% | 01 Sep, 2026 | |
JFrog Artifactory Improper Authentication Vulnerability CVE-2026-82329 | CriticalExploited | 14.4% | 28 Aug, 2026 | |
PaperCut NG/MF Unsafe Reflection Vulnerability CVE-2026-82078 | CriticalExploited | 60.9% | 28 Aug, 2026 | |
Gitea Code Injection Vulnerability CVE-2026-60004 | CriticalExploited | 24.0% | 26 Aug, 2026 | |
TrueConf Server Code Injection Vulnerability CVE-2026-72530 | CriticalExploited | 1.7% | 19 Aug, 2026 | |
TrueConf Server Missing Authentication for Critical Function Vulnerability CVE-2026-72529 | CriticalExploited | 1.5% | 19 Aug, 2026 | |
Citrix NetScaler Authentication Bypass Using an Alternate Path or Channel Vulnerability CVE-2026-19490 | CriticalExploited | 32.7% | 19 Aug, 2026 | |
MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding) BIT-mlflow-2026-64849, CVE-2026-64849, GHSA-7gwp-5pfp-969j, PYSEC-2026-3687 | CriticalExploited | 10.0% | 17 Aug, 2026 | PyPI mlflow |
Adobe Commerce and Magento Incorrect Authorization Vulnerability CVE-2026-71362 | CriticalExploited | 90.5% | 11 Aug, 2026 | |
Metabase SQL Injection Vulnerability CVE-2026-72898 | CriticalExploited | 98.6% | 10 Aug, 2026 | |
Apple macOS Improper Authentication Vulnerability CVE-2026-65400 | CriticalExploited | 1.7% | 06 Aug, 2026 | |
WSO2 Multiple Products Path Traversal Vulnerability CVE-2026-5430 | CriticalExploited | 22.4% | 06 Aug, 2026 | |
Broadcom VMware vCenter Path Traversal Vulnerability CVE-2026-59310 | CriticalExploited | 2.6% | 30 Jul, 2026 | |
JetBrains TeamCity Deserialization of Untrusted Data Vulnerability CVE-2026-63077 | CriticalExploited | 93.6% | 27 Jul, 2026 | |
Arista VeloCloud Orchestrator On-Prem OS Command Injection Vulnerability CVE-2026-16812 | CriticalExploited | 1.8% | 27 Jul, 2026 | |
Check Point SmartConsole Improper Authentication Vulnerability CVE-2026-16232 | CriticalExploited | 3.5% | 22 Jul, 2026 | |
WordPress Core Interpretation Conflict Vulnerability CVE-2026-63030 | CriticalExploited | 10.6% | 17 Jul, 2026 | |
IBM Langflow Code Injection Vulnerability CVE-2026-9198 | CriticalExploited | 28.7% | 17 Jul, 2026 | |
Sangoma Switchvox SQL Injection Vulnerability CVE-2026-9586 | CriticalExploited | 19.0% | 17 Jul, 2026 | |
Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability CVE-2026-48356 | CriticalExploited | 44.6% | 14 Jul, 2026 | |
SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability CVE-2026-15409 | CriticalExploited | 6.8% | 14 Jul, 2026 | |
Microsoft SharePoint Weak Authentication Vulnerability CVE-2026-55040 | CriticalExploited | 69.5% | 14 Jul, 2026 | |
Microsoft SharePoint Deserialization of Untrusted Data Vulnerability CVE-2026-58644 | CriticalExploited | 15.9% | 14 Jul, 2026 |