Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
WsgiDAV MySQL provider has a blind SQL injection CVE-2026-55509, GHSA-p6gw-4frg-j7jw, PYSEC-2026-3945 | High | 0.5% | 28 Aug, 2026 | PyPI WsgiDAV PyPI wsgidav |
Malicious release: Malicious code in calcboxlite (PyPI) MAL-2026-15488 | Malicious | Not scored | 28 Aug, 2026 | PyPI calcboxlite |
free5GC NRF nnrf-nfm lacks NF Profile input validation — enables NF Registration Poisoning with arbitrary service endpoints CVE-2026-55068, GHSA-x8mj-6p3q-g5pp, GO-2026-6316 | Critical | Not scored | 28 Aug, 2026 | Go github.com/free5gc/free5gc |
Vikunja vulnerable to authenticated cross-tenant kanban-bucket relocation via `project_view_id` mass-assignment CVE-2026-55067, GHSA-569v-q83c-3j3g, GO-2026-6307 | Medium | Not scored | 28 Aug, 2026 | Go code.vikunja.io/api |
Vikunja has cross-tenant IDOR in kanban move-task endpoint via unauthorized body task_id CVE-2026-55066, GHSA-5pg6-m483-7vrg, GO-2026-6308 | High | Not scored | 28 Aug, 2026 | Go code.vikunja.io/api |
Vikunja vulnerable to Improper Authorization and Authorization Bypass Through User-Controlled Key CVE-2026-55065, GHSA-gg93-x632-9ccv, GO-2026-6313 | High | Not scored | 28 Aug, 2026 | Go code.vikunja.io/api |
Vikunja has an incomplete fix for CVE-2026-35595: Write-only user can detach shared project from parent hierarchy via parent_project_id=0 CVE-2026-55064, GHSA-44v6-7fxq-vgf4, GO-2026-6306 | Medium | Not scored | 28 Aug, 2026 | Go code.vikunja.io/api |
Vikunja has a project duplication bypasses write-permission check on the target parent project CVE-2026-54766, GHSA-f27p-pw2p-9pr4, GO-2026-6311 | Medium | Not scored | 28 Aug, 2026 | Go code.vikunja.io/api |
Pocket-ID has an Open Redirect on the OIDC /authorize page via unvalidated redirect_uri with prompt=none CVE-2026-55834, GHSA-2wvm-8mvp-22qv, GO-2026-6305 | Medium | Not scored | 28 Aug, 2026 | Go github.com/pocket-id/pocket-id/backend |
Aqua's archive extraction follows attacker-planted symlinks, allowing writes outside the install directory CVE-2026-55569, GHSA-mf5c-hw34-4hpp, GO-2026-6314 | Medium | Not scored | 28 Aug, 2026 | Go github.com/aquaproj/aqua Go github.com/aquaproj/aqua/v2 |
Klever: Integer overflow in split-royalty validation enables unbounded minting of KLV (native token) CVE-2026-54755, GHSA-cgc5-v3f2-8m2v, GO-2026-6310 | Critical | Not scored | 28 Aug, 2026 | Go github.com/klever-io/klever-go |
Klever: Marketplace settlement mints KLV when referral % + royalty % exceed the bid (negative seller share silently skipped) CVE-2026-54754, GHSA-p7gw-2pcp-5pf8, GO-2026-6315 | Critical | Not scored | 28 Aug, 2026 | Go github.com/klever-io/klever-go |
PaperCut NG/MF Unsafe Reflection Vulnerability CVE-2026-82078 | CriticalExploited | 63.0% | 28 Aug, 2026 | |
PaperCut NG/MF Missing Authentication for Critical Function Vulnerability CVE-2026-81578 | HighExploited | 84.7% | 28 Aug, 2026 | |
morgan vulnerable to Log Forging via unescaped Unicode line separators CVE-2026-15603, GHSA-jxfw-x594-9x9m | Medium | 0.4% | 28 Aug, 2026 | npm morgan |
KubeVela Terraform remote loader DoS via unbounded file read CVE-2026-55108, GHSA-fmgp-q6jx-gg3x, GO-2026-6312 | High | Not scored | 28 Aug, 2026 | Go github.com/oam-dev/kubevela |
Hatchet allows cross-tenant write/DoS to other tenants' workers via Dispatcher gRPC UpsertWorkerLabels and Unsubscribe CVE-2026-54746, GHSA-8x7x-83cf-c3pg, GO-2026-6309 | Medium | Not scored | 28 Aug, 2026 | Go github.com/hatchet-dev/hatchet |
Malicious release: Malicious code in 3layerdipstackpcv17m (npm) GHSA-283x-m4wp-8428, MAL-2026-14872 | Malicious | Not scored | 28 Aug, 2026 | npm 3layerdipstackpcv17m |
Malicious release: Malicious code in 3layerdipstackm7mock (npm) GHSA-2xmr-4cx4-q8xh, MAL-2026-14827 | Malicious | Not scored | 28 Aug, 2026 | npm 3layerdipstackm7mock |
Malicious release: Malicious code in 3layerdipstackesp1lb (npm) GHSA-34fw-55mp-c63j, MAL-2026-14743 | Malicious | Not scored | 28 Aug, 2026 | npm 3layerdipstackesp1lb |
Malicious release: Malicious code in 3layerdipstackulgnp8 (npm) GHSA-5grf-6834-4gx2, MAL-2026-14949 | Malicious | Not scored | 28 Aug, 2026 | npm 3layerdipstackulgnp8 |
Malicious release: Malicious code in 3layerdipstackt3wr5f (npm) GHSA-fjvm-qq3g-pfj8, MAL-2026-14925 | Malicious | Not scored | 28 Aug, 2026 | npm 3layerdipstackt3wr5f |
Malicious release: Malicious code in 3layerdipstackru7mfn (npm) GHSA-fx3x-5gff-392g, MAL-2026-14909 | Malicious | Not scored | 28 Aug, 2026 | npm 3layerdipstackru7mfn |
Malicious release: Malicious code in 3layerdipstacktfieac (npm) GHSA-hx6j-pg3c-xp7h, MAL-2026-14929 | Malicious | Not scored | 28 Aug, 2026 | npm 3layerdipstacktfieac |
Malicious release: Malicious code in 3layerdipstackcyqc7o (npm) GHSA-mrwr-vvf3-5cj3, MAL-2026-14716 | Malicious | Not scored | 28 Aug, 2026 | npm 3layerdipstackcyqc7o |
Malicious release: Malicious code in 3layerdipstackjsuvtk (npm) GHSA-mwhw-pqwx-mcgc, MAL-2026-14791 | Malicious | Not scored | 28 Aug, 2026 | npm 3layerdipstackjsuvtk |
Malicious release: Malicious code in 3layerdipstackev4sn5 (npm) GHSA-v5hh-fxh9-5jg2, MAL-2026-14745 | Malicious | Not scored | 28 Aug, 2026 | npm 3layerdipstackev4sn5 |
Malicious release: Malicious code in 3layerdipstackhr3ocw (npm) GHSA-xcr2-ph6w-v53x, MAL-2026-14774 | Malicious | Not scored | 28 Aug, 2026 | npm 3layerdipstackhr3ocw |
Malicious release: Malicious code in 3layerdipstackvnmth1 (npm) GHSA-25h6-8cqx-xgh6, MAL-2026-14965 | Malicious | Not scored | 28 Aug, 2026 | npm 3layerdipstackvnmth1 |
Malicious release: Malicious code in 3layerdipstackvm4qaj (npm) GHSA-29f5-999f-rvqh, MAL-2026-14964 | Malicious | Not scored | 28 Aug, 2026 | npm 3layerdipstackvm4qaj |
Malicious release: Malicious code in 3layerdipstackfywqmz (npm) GHSA-2gr6-mqqx-ch77, MAL-2026-14760 | Malicious | Not scored | 28 Aug, 2026 | npm 3layerdipstackfywqmz |
Malicious release: Malicious code in 3layerdipstacko8li9w (npm) GHSA-3fmf-7gp2-6qh7, MAL-2026-14852 | Malicious | Not scored | 28 Aug, 2026 | npm 3layerdipstacko8li9w |
Malicious release: Malicious code in 3layerdipstacktm8xp5 (npm) GHSA-3jj7-p8p6-fjjf, MAL-2026-14933 | Malicious | Not scored | 28 Aug, 2026 | npm 3layerdipstacktm8xp5 |
Malicious release: Malicious code in 3layerdipstackmokfkh (npm) GHSA-3vjx-v4f5-8553, MAL-2026-14835 | Malicious | Not scored | 28 Aug, 2026 | npm 3layerdipstackmokfkh |
Malicious release: Malicious code in 3layerdipstackpvsk6r (npm) GHSA-4pfw-969w-75x8, MAL-2026-14881 | Malicious | Not scored | 28 Aug, 2026 | npm 3layerdipstackpvsk6r |
Malicious release: Malicious code in 3layerdipstack4pstwd (npm) GHSA-56jq-5fhp-g3gh, MAL-2026-14626 | Malicious | Not scored | 28 Aug, 2026 | npm 3layerdipstack4pstwd |
Malicious release: Malicious code in 3layerdipstackvcdkrp (npm) GHSA-5cqp-h6j9-xhff, MAL-2026-14958 | Malicious | Not scored | 28 Aug, 2026 | npm 3layerdipstackvcdkrp |
Malicious release: Malicious code in 3layerdipstackvdy7nf (npm) GHSA-6j5j-jmv3-2vqc, MAL-2026-14960 | Malicious | Not scored | 28 Aug, 2026 | npm 3layerdipstackvdy7nf |
Malicious release: Malicious code in 3layerdipstackx26ujd (npm) GHSA-6m22-7jpm-3pwq, MAL-2026-14978 | Malicious | Not scored | 28 Aug, 2026 | npm 3layerdipstackx26ujd |
Malicious release: Malicious code in 3layerdipstack6ih5ru (npm) GHSA-6qfq-f3rx-r2rg, MAL-2026-14642 | Malicious | Not scored | 28 Aug, 2026 | npm 3layerdipstack6ih5ru |
Malicious release: Malicious code in 3layerdipstackvld3fr (npm) GHSA-7qh7-wh5v-4p7p, MAL-2026-14963 | Malicious | Not scored | 28 Aug, 2026 | npm 3layerdipstackvld3fr |
Malicious release: Malicious code in 3layerdipstacklgszmx (npm) GHSA-8gq9-v5rg-4v67, MAL-2026-14820 | Malicious | Not scored | 28 Aug, 2026 | npm 3layerdipstacklgszmx |
Malicious release: Malicious code in 3layerdipstackkpfva6 (npm) GHSA-chrq-p6q9-7c3v, MAL-2026-14804 | Malicious | Not scored | 28 Aug, 2026 | npm 3layerdipstackkpfva6 |
Malicious release: Malicious code in 3layerdipstack2pdlo4 (npm) GHSA-cjx7-rpp8-xjp7, MAL-2026-14610 | Malicious | Not scored | 28 Aug, 2026 | npm 3layerdipstack2pdlo4 |
Malicious release: Malicious code in 3layerdipstackbndk47 (npm) GHSA-f6vp-8xqg-j5rv, MAL-2026-14698 | Malicious | Not scored | 28 Aug, 2026 | npm 3layerdipstackbndk47 |
Malicious release: Malicious code in 3layerdipstack74ooau (npm) GHSA-f836-85g9-539h, MAL-2026-14649 | Malicious | Not scored | 28 Aug, 2026 | npm 3layerdipstack74ooau |
Malicious release: Malicious code in 3layerdipstack1lkqg9 (npm) GHSA-gj6j-q87j-rmx5, MAL-2026-14605 | Malicious | Not scored | 28 Aug, 2026 | npm 3layerdipstack1lkqg9 |
Malicious release: Malicious code in 3layerdipstackr5ga2v (npm) GHSA-h6qm-wv83-7m6p, MAL-2026-14898 | Malicious | Not scored | 28 Aug, 2026 | npm 3layerdipstackr5ga2v |
Malicious release: Malicious code in 3layerdipstackkzelo0 (npm) GHSA-hf47-w27p-rfg5, MAL-2026-14809 | Malicious | Not scored | 28 Aug, 2026 | npm 3layerdipstackkzelo0 |
Malicious release: Malicious code in 3layerdipstackoj4nf9 (npm) GHSA-hw8m-f396-69p5, MAL-2026-14859 | Malicious | Not scored | 28 Aug, 2026 | npm 3layerdipstackoj4nf9 |