Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Grav: Path Traversal in MediaUploadTrait::deleteFile() Allows Arbitrary File Deletion CVE-2026-72695, GHSA-jq29-c7v8-rg55 | High | 0.6% | 25 Aug, 2026 | Packagist getgrav/grav |
Cloudreve's remote download file paths can escape the selected destination directory CVE-2026-101051, GHSA-w8j7-39hp-8x59, GO-2026-6289 | Medium | 0.3% | 24 Aug, 2026 | Go github.com/cloudreve/Cloudreve Go github.com/cloudreve/Cloudreve/v3 Go github.com/cloudreve/Cloudreve/v4 |
Cloudreve has Broken Access Control - Revoked Share Access Still Allows Signed File URL Generation via Cached context_hint CVE-2026-101056, GHSA-vx2m-jpxr-xv7w, GO-2026-6287 | Medium | 0.2% | 24 Aug, 2026 | Go github.com/cloudreve/Cloudreve Go github.com/cloudreve/Cloudreve/v3 Go github.com/cloudreve/Cloudreve/v4 |
CakePHP: FunctionsBuilder::jsonValue() vulerable to SQL injection with PostgresDriver CVE-2026-77635, GHSA-fxf7-vhh8-7vpq | Critical | 0.5% | 24 Aug, 2026 | Packagist cakephp/cakephp Packagist cakephp/database |
Filament: Multi-factor authentication (app) can be bypassed when recovery codes are enabled CVE-2026-77567, GHSA-52xp-w8hr-xv3c | High | 0.6% | 24 Aug, 2026 | Packagist filament/filament |
3X-UI Vulnerable to Authenticated Arbitrary File Write via Database Import and Xray Log Path Manipulation CVE-2026-55477, GHSA-jm48-m3rr-9hgg, GO-2026-6284 | High | 0.6% | 24 Aug, 2026 | Go github.com/mhsanaei/3x-ui Go github.com/mhsanaei/3x-ui/v2 Go github.com/mhsanaei/3x-ui/v3 |
Gorilla WebSocket Uses Cryptographically Weak PRNG for WebSocket Mask Key GHSA-w67g-5rqw-f597, GO-2026-6278 | Medium | Not scored | 24 Aug, 2026 | Go github.com/gorilla/websocket |
netfoil vulnerable to improper handling of untrusted DoH response data GHSA-4ph6-mjv7-3fq6, GO-2026-6277 | Low | Not scored | 24 Aug, 2026 | Go github.com/tinfoil-factory/netfoil |
Mistune: Denial of Service — RecursionError via Excessive Emphasis Markers in Markdown CVE-2026-76098, GHSA-6m44-fpc8-c3rq, PYSEC-2026-3863 | High | 0.5% | 24 Aug, 2026 | PyPI mistune |
mcp-contextforge-gateway has RestrictedPython sandbox bypass via getattr builtin in python_sandbox_server CVE-2026-53710, GHSA-xm98-3vcf-fph7, PYSEC-2026-3862 | Critical | 1.1% | 24 Aug, 2026 | PyPI mcp-contextforge-gateway |
Malicious release: Malicious code in unifi-credential-server (npm) MAL-2026-15692 | Malicious | Not scored | 24 Aug, 2026 | npm unifi-credential-server |
Malicious release: Malicious code in react-hook-doms (npm) MAL-2026-15691 | Malicious | Not scored | 24 Aug, 2026 | npm react-hook-doms |
Malicious release: Malicious code in mongosooe (npm) MAL-2026-15690 | Malicious | Not scored | 24 Aug, 2026 | npm mongosooe |
Malicious release: Malicious code in lil-swisgom-hlepers (npm) MAL-2026-15689 | Malicious | Not scored | 24 Aug, 2026 | npm lil-swisgom-hlepers |
Malicious release: Malicious code in leaflet-opencage-geocoding (npm) MAL-2026-15688 | Malicious | Not scored | 24 Aug, 2026 | npm leaflet-opencage-geocoding |
Malicious release: Malicious code in @medisend/shared (npm) GHSA-f6mp-mchf-ppcc, MAL-2026-14423 | Malicious | Not scored | 24 Aug, 2026 | npm @medisend/shared |
Malicious release: Malicious code in chai-as-mno (npm) MAL-2026-14427 | Malicious | Not scored | 24 Aug, 2026 | npm chai-as-mno |
Malicious release: Malicious code in @medisend/auth (npm) GHSA-cpvc-ph75-5rf3, MAL-2026-14421 | Malicious | Not scored | 24 Aug, 2026 | npm @medisend/auth |
Malicious release: Malicious code in @medisend/core (npm) GHSA-wfxf-4cwg-r55p, MAL-2026-14422 | Malicious | Not scored | 24 Aug, 2026 | npm @medisend/core |
Malicious release: Malicious code in kelly-stake-sizing (npm) GHSA-h8rr-x7cp-4h62, MAL-2026-14432 | Malicious | Not scored | 24 Aug, 2026 | npm kelly-stake-sizing |
Malicious release: Malicious code in openai-pr-reviewer (npm) GHSA-wpv4-wxrh-hvmh, MAL-2026-14434 | Malicious | Not scored | 24 Aug, 2026 | npm openai-pr-reviewer |
Malicious release: Malicious code in consumerweb-serverutils (npm) MAL-2026-14428 | Malicious | Not scored | 24 Aug, 2026 | npm consumerweb-serverutils |
Malicious release: Malicious code in babel-polyfill-plugin-corejs2 (npm) GHSA-9g6r-83hw-6cq2, MAL-2026-14426 | Malicious | Not scored | 24 Aug, 2026 | npm babel-polyfill-plugin-corejs2 |
Malicious release: Malicious code in poly-price-node (npm) MAL-2026-14436 | Malicious | Not scored | 24 Aug, 2026 | npm poly-price-node |
Malicious release: Malicious code in auth-otp (npm) MAL-2026-14425 | Malicious | Not scored | 24 Aug, 2026 | npm auth-otp |
Malicious release: Malicious code in remove-bg-serverless-azure (npm) GHSA-65rf-pp5h-8fw9, MAL-2026-14438 | Malicious | Not scored | 24 Aug, 2026 | npm remove-bg-serverless-azure |
Malicious release: Malicious code in dim-hydration-ui (npm) GHSA-6797-g855-4767, MAL-2026-14429 | Malicious | Not scored | 24 Aug, 2026 | npm dim-hydration-ui |
Malicious release: Malicious code in secret-key-totp (npm) MAL-2026-14439 | Malicious | Not scored | 24 Aug, 2026 | npm secret-key-totp |
Malicious release: Malicious code in paypal-business-sdk (npm) MAL-2026-14435 | Malicious | Not scored | 24 Aug, 2026 | npm paypal-business-sdk |
Malicious release: Malicious code in manticore-log (npm) MAL-2026-14433 | Malicious | Not scored | 24 Aug, 2026 | npm manticore-log |
Malicious release: Malicious code in ppb-manticore (npm) MAL-2026-14437 | Malicious | Not scored | 24 Aug, 2026 | npm ppb-manticore |
Malicious release: Malicious code in @gsas/gsas-sdk (npm) MAL-2026-14420 | Malicious | Not scored | 24 Aug, 2026 | npm @gsas/gsas-sdk |
Malicious release: Malicious code in web-advertising (npm) MAL-2026-14440 | Malicious | Not scored | 24 Aug, 2026 | npm web-advertising |
Malicious release: Malicious code in @yuva2210/htx-poc-skills-rce (npm) MAL-2026-15686 | Malicious | Not scored | 24 Aug, 2026 | npm @yuva2210/htx-poc-skills-rce |
Malicious release: Malicious code in @yuva2210/okx-poc-rce-impact (npm) MAL-2026-15687 | Malicious | Not scored | 24 Aug, 2026 | npm @yuva2210/okx-poc-rce-impact |
Malicious release: Malicious code in @x-team/strapi (npm) MAL-2026-15685 | Malicious | Not scored | 24 Aug, 2026 | npm @x-team/strapi |
Malicious release: Malicious code in hydration-ui-dim (npm) GHSA-79qw-ww45-gpfp, MAL-2026-14431 | Malicious | Not scored | 24 Aug, 2026 | npm hydration-ui-dim |
Malicious release: Malicious code in svelte-ui-dim (npm) GHSA-qvqg-96qf-37vw, MAL-2026-14442 | Malicious | Not scored | 24 Aug, 2026 | npm svelte-ui-dim |
Malicious release: Malicious code in svelte-dim-ui (npm) GHSA-x8x3-xwj6-73vv, MAL-2026-14441 | Malicious | Not scored | 24 Aug, 2026 | npm svelte-dim-ui |
Malicious release: Malicious code in hydration-dim-ui (npm) GHSA-xf2r-j86w-6c3x, MAL-2026-14430 | Malicious | Not scored | 24 Aug, 2026 | npm hydration-dim-ui |
Malicious release: Malicious code in @pimy-b2cweb/common (npm) MAL-2026-15684 | Malicious | Not scored | 24 Aug, 2026 | npm @pimy-b2cweb/common |
Malicious release: Malicious code in @pimy-b2cweb/apiclient-common (npm) MAL-2026-15683 | Malicious | Not scored | 24 Aug, 2026 | npm @pimy-b2cweb/apiclient-common |
Malicious release: Malicious code in @ice-trade-components/common (npm) MAL-2026-15682 | Malicious | Not scored | 24 Aug, 2026 | npm @ice-trade-components/common |
Malicious release: Malicious code in @grab-food/order-sdk-web (npm) MAL-2026-15681 | Malicious | Not scored | 24 Aug, 2026 | npm @grab-food/order-sdk-web |
Malicious release: Malicious code in @cawraytestorg/packagetest2 (npm) MAL-2026-15680 | Malicious | Not scored | 24 Aug, 2026 | npm @cawraytestorg/packagetest2 |
Malicious release: Malicious code in @bpa-internal/bpa-utils (npm) MAL-2026-15679 | Malicious | Not scored | 24 Aug, 2026 | npm @bpa-internal/bpa-utils |
Malicious release: Malicious code in @bpa-internal/bpa-common (npm) MAL-2026-15677 | Malicious | Not scored | 24 Aug, 2026 | npm @bpa-internal/bpa-common |
Malicious release: Malicious code in @bpa-internal/bpa-types (npm) MAL-2026-15678 | Malicious | Not scored | 24 Aug, 2026 | npm @bpa-internal/bpa-types |
Malicious release: Malicious code in @bpa-internal/bpa-auth (npm) MAL-2026-15676 | Malicious | Not scored | 24 Aug, 2026 | npm @bpa-internal/bpa-auth |
Malicious release: Malicious code in @b2b-frontend/store (npm) MAL-2026-15675 | Malicious | Not scored | 24 Aug, 2026 | npm @b2b-frontend/store |