Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in nx-app (npm) GHSA-h9j7-rx3x-rwhc, GHSA-vmrp-3pwx-mj42, MAL-2026-15516 | Malicious | Not scored | 28 Aug, 2026 | npm nx-app |
Malicious release: Malicious code in grafeno-utils (npm) MAL-2026-15509 | Malicious | Not scored | 28 Aug, 2026 | npm grafeno-utils |
Malicious release: Malicious code in grafeno-sdk (npm) MAL-2026-15508 | Malicious | Not scored | 28 Aug, 2026 | npm grafeno-sdk |
Malicious release: Malicious code in grafeno-config (npm) MAL-2026-15504 | Malicious | Not scored | 28 Aug, 2026 | npm grafeno-config |
Malicious release: Malicious code in grafeno-api (npm) MAL-2026-15501 | Malicious | Not scored | 28 Aug, 2026 | npm grafeno-api |
Malicious release: Malicious code in grafeno-client (npm) MAL-2026-15503 | Malicious | Not scored | 28 Aug, 2026 | npm grafeno-client |
Malicious release: Malicious code in grafeno-auth (npm) MAL-2026-15502 | Malicious | Not scored | 28 Aug, 2026 | npm grafeno-auth |
Malicious release: Malicious code in grafeno-logger (npm) MAL-2026-15506 | Malicious | Not scored | 28 Aug, 2026 | npm grafeno-logger |
Malicious release: Malicious code in spc-grafeno (npm) MAL-2026-15522 | Malicious | Not scored | 28 Aug, 2026 | npm spc-grafeno |
Malicious release: Malicious code in grafeno-core (npm) MAL-2026-15505 | Malicious | Not scored | 28 Aug, 2026 | npm grafeno-core |
Malicious release: Malicious code in grafeno-pix (npm) MAL-2026-15507 | Malicious | Not scored | 28 Aug, 2026 | npm grafeno-pix |
Malicious release: Malicious code in @7nohe/openapi-react-query-codegen (npm) GHSA-rg27-qr39-ch6w, MAL-2026-15494 | Malicious | Not scored | 28 Aug, 2026 | npm @7nohe/openapi-react-query-codegen |
MariaDB has possible SQL injection in Buffer parameter escaping under big5/gbk/sjis/cp932/gb18030 client charsets BIT-mariadb-2026-55855, BIT-mariadb-min-2026-55855, BIT-mysql-client-2026-55855, CVE-2026-55855, GHSA-g5xc-5w98-jfvm | Medium | 0.7% | 28 Aug, 2026 | npm mariadb |
free5GC AUSF uses non-constant-time authentication comparisons and logs XRES* in 5G-AKA CVE-2026-55785, GHSA-fp46-6vfw-gc9c, GO-2026-6328 | Low | Not scored | 28 Aug, 2026 | Go github.com/free5gc/ausf |
free5GC AUSF authentication contexts can be overwritten by concurrent requests for the same SUPI CVE-2026-55784, GHSA-334q-h5g3-fpxv, GO-2026-6326 | High | Not scored | 28 Aug, 2026 | Go github.com/free5gc/ausf |
Malicious release: Malicious code in grafeno-actions (npm) MAL-2026-15596 | Malicious | Not scored | 28 Aug, 2026 | npm grafeno-actions |
silverstripe/versioned has XSS in archive admin restore CVE-2026-55779, GHSA-m4g4-86qc-v8w7 | Medium | 0.3% | 28 Aug, 2026 | Packagist silverstripe/versioned |
SeaweedFS: Path traversal in the S3 gateway X-Amz-Copy-Source header allows cross-bucket object read BIT-seaweedfs-2026-55874, CVE-2026-55874, GHSA-56wq-x3wv-3ff4, GO-2026-6327 | High | Not scored | 28 Aug, 2026 | Go github.com/seaweedfs/seaweedfs |
multer vulnerable to Denial of Service via oversized array index in field names CVE-2026-82333, GHSA-535w-7cp7-47q4 | High | 0.4% | 28 Aug, 2026 | npm multer |
multer vulnerable to Denial of Service via crafted multipart field names CVE-2026-77078, GHSA-wc9g-mqfw-jrwm | High | 0.5% | 28 Aug, 2026 | npm multer |
multer vulnerable to file size limit bypass via async fileFilter race condition CVE-2026-77063, GHSA-qvfw-j98x-7q72 | Low | 0.2% | 28 Aug, 2026 | npm multer |
multer vulnerable to Denial of Service via file descriptor leak on aborted uploads CVE-2026-77037, GHSA-qfvm-cv95-jqjf | High | 0.5% | 28 Aug, 2026 | npm multer |
SeaweedFS: Improper authorization in the S3Tables / Iceberg REST management API lets a low-privileged S3 user enumerate administrator-owned table buckets BIT-seaweedfs-2026-55873, CVE-2026-55873, GHSA-hgpf-8634-g44c, GO-2026-6329 | Medium | Not scored | 28 Aug, 2026 | Go github.com/seaweedfs/seaweedfs |
klever-go: SFT add-quantity `int64` overflow bypasses a finite per-nonce MaxSupply CVE-2026-55764, GHSA-mrpp-v6pg-p54x, GO-2026-6330 | High | Not scored | 28 Aug, 2026 | Go github.com/klever-io/klever-go |
MariaDB has Cleartext Transmission of Sensitive Information and Insufficiently Protected Credentials BIT-mariadb-2026-55854, BIT-mariadb-min-2026-55854, BIT-mysql-client-2026-55854, CVE-2026-55854, GHSA-42r5-vhpq-m858 | Medium | 0.4% | 28 Aug, 2026 | npm mariadb |
arc has unauthenticated cluster node admission when `cluster.shared_secret` is unset CVE-2026-55678, GHSA-p378-jp5r-gpgw, GO-2026-6322 | Medium | Not scored | 28 Aug, 2026 | Go github.com/basekick-labs/arc |
Portainer has Unauthenticated Restore Endpoint that Allows Admin Takeover on Uninitialized Instances CVE-2026-55761, GHSA-x626-fcwx-f5pc, GO-2026-6324 | High | Not scored | 28 Aug, 2026 | Go github.com/portainer/portainer |
klever-go: Percentage-transfer royalty skips the source debit at exactly-100% splits CVE-2026-55763, GHSA-v358-wf77-39xv, GO-2026-6323 | High | Not scored | 28 Aug, 2026 | Go github.com/klever-io/klever-go |
PrivateBin has reflected JSON injection in backend responses via unescaped REQUEST_URI CVE-2026-55891, GHSA-xrjc-c68j-hp7w | Low | 0.5% | 28 Aug, 2026 | Packagist privatebin/privatebin |
PrivateBin has stored Cross-Side-Scripting (XSS) vulnerability in attachment download link via dangerous MIME types with required user-interaction CVE-2026-55696, GHSA-f2xf-7x3g-4272 | Medium | 0.4% | 28 Aug, 2026 | Packagist privatebin/privatebin |
JFrog Artifactory Improper Authentication Vulnerability CVE-2026-82329 | CriticalExploited | 14.4% | 28 Aug, 2026 | |
AIIR verification and policy gates could report success without enforcing the control (fail-open) GHSA-73p9-6hrp-8qhr | Medium | Not scored | 28 Aug, 2026 | PyPI aiir |
alos-http has unauthenticated remote DoS: malformed path starting with "?" triggers out-of-bounds panic in sanitizeRequestPath, crashing entire server CVE-2026-55484, GHSA-hr6j-w4mw-g9mj, GO-2026-6321 | High | Not scored | 28 Aug, 2026 | Go github.com/guno1928/alos-http |
Pimcore Vulnerable to Remote Code Execution via DataObject Class-Definition Field Name CVE-2026-55634, GHSA-9x44-4gxf-8c25 | Critical | 0.7% | 28 Aug, 2026 | Packagist pimcore/pimcore |
Pimcore Hotspotimage getDataFromResource() unrestricted Serialize::unserialize over object-store column (PHP Object Injection, CWE-502) CVE-2026-55220, GHSA-w23p-wrp7-ch38 | Critical | 0.7% | 28 Aug, 2026 | Packagist pimcore/pimcore |
MariaDB's connector leaks the cleartext password to an MitM despite `ssl: true` BIT-mariadb-2026-55215, BIT-mariadb-min-2026-55215, BIT-mysql-client-2026-55215, CVE-2026-55215, GHSA-cqhc-2h57-wpxf | High | 0.6% | 28 Aug, 2026 | npm mariadb |
plone.app.event vulnerable to denial of service via iCalendar import CVE-2026-55247, GHSA-r82h-mqw3-fc56, PYSEC-2026-3883 | Critical | 0.4% | 28 Aug, 2026 | PyPI plone-app-event PyPI plone.app.event |
Incus has a project restriction bypass in instance copy across projects CVE-2026-55622, GHSA-c9f5-j9c3-mhrg, GO-2026-6319 | High | Not scored | 28 Aug, 2026 | Go github.com/lxc/incus Go github.com/lxc/incus/v6 Go github.com/lxc/incus/v7 Go github.com/lxc/incus/v7/cmd/incusd |
Incus has a project restriction bypass for custom volume copy across projects CVE-2026-55621, GHSA-64f3-v33m-w89f, GO-2026-6318 | High | Not scored | 28 Aug, 2026 | Go github.com/lxc/incus Go github.com/lxc/incus/v6 Go github.com/lxc/incus/v7 |
Protego has exponential backtracking ReDoS in robots.txt URL wildcard matching CVE-2026-55520, GHSA-wjmf-p669-5m5p, PYSEC-2026-3906 | High | 0.5% | 28 Aug, 2026 | PyPI Protego PyPI protego |
plone.app.portlets vulnerable to denial of service via RSS feed portlet CVE-2026-55248, GHSA-x5g3-w747-2h8q, PYSEC-2026-3884 | Critical | 0.4% | 28 Aug, 2026 | PyPI plone-app-portlets PyPI plone.app.portlets |
phpSysInfo has an IP allowlist (PSI_ALLOWED) bypass via spoofed X-Forwarded-For / Client-IP headers CVE-2026-55584, GHSA-786w-p5pm-cvgh | High | 1.9% | 28 Aug, 2026 | Packagist phpsysinfo/phpsysinfo |
Bifrost's SSRF deny-list is incomplete: isPublicIP permits CGNAT, IPv6 6to4/NAT64, and site-local in FetchAndEncodeURL CVE-2026-55245, GHSA-w98g-5w9p-p3rc, GO-2026-6320 | High | Not scored | 28 Aug, 2026 | Go github.com/maximhq/bifrost/core |
Malicious release: Malicious code in mfa-js (npm) GHSA-2p92-fvvr-75hj, MAL-2026-15492 | Malicious | Not scored | 28 Aug, 2026 | npm mfa-js |
Malicious release: Malicious code in ozturk-mfa (npm) GHSA-wrj4-48g5-vg88, MAL-2026-15493 | Malicious | Not scored | 28 Aug, 2026 | npm ozturk-mfa |
ORAS CLI: Cyclic Referrer Graph Can Cause Unbounded Recursion and Resource Consumption CVE-2026-55588, GHSA-298f-872v-2rcx, GO-2026-6317 | Low | Not scored | 28 Aug, 2026 | Go oras.land/oras |
Malicious release: Malicious code in clmm-fee-audit (npm) GHSA-68fh-772h-wjfw, MAL-2026-15490 | Malicious | Not scored | 28 Aug, 2026 | npm clmm-fee-audit |
Malicious release: Malicious code in borsh-lite (npm) GHSA-6m7x-mwxq-f3wf, MAL-2026-15489 | Malicious | Not scored | 28 Aug, 2026 | npm borsh-lite |
Malicious release: Malicious code in eip712-lite (npm) GHSA-p5jf-vqp6-95h5, MAL-2026-15491 | Malicious | Not scored | 28 Aug, 2026 | npm eip712-lite |
piccolo-admin has a privilege escalation issue - admin to superuser via session-token disclosure in GET /api/tables/sessions/. CVE-2026-55485, GHSA-2gh4-jmwq-rr8w, PYSEC-2026-3882 | High | 0.6% | 28 Aug, 2026 | PyPI piccolo-admin |