Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Winter: ImportExportController AJAX handlers bypass granular import/export permission gate GHSA-fm29-4mq3-phg6 | High | Not scored | 20 Aug, 2026 | Packagist winter/wn-backend-module |
Winter: My Account preview exposes another backend user's profile by record ID GHSA-mpmw-f6h6-3g26 | Medium | Not scored | 20 Aug, 2026 | Packagist winter/wn-backend-module |
Winter: Stored XSS through Backend List widget image columns GHSA-7mpf-4465-7fc2 | Low | Not scored | 20 Aug, 2026 | Packagist winter/wn-backend-module |
Fleet: ORDER BY column injection on activity list endpoints CVE-2026-101046, GHSA-rxhg-vcww-2mpw, GO-2026-6269 | Low | 0.2% | 20 Aug, 2026 | Go github.com/fleetdm/fleet/v4 |
Fleet: Unauthenticated download of in-house iOS app binaries via predictable URLs CVE-2026-101047, GHSA-q9c5-pp7m-fm2g, GO-2026-6268 | Medium | 0.2% | 20 Aug, 2026 | Go github.com/fleetdm/fleet/v4 |
Winter: Authenticated Twig sandbox escape in CMS SecurityPolicy (bypass of CVE-2024-54149) CVE-2026-79774, GHSA-8cfw-pcwh-v63w | Critical | 0.8% | 20 Aug, 2026 | Packagist winter/wn-system-module |
Winter: Local File Inclusion through =include directives in JavaScript asset compilation CVE-2026-79773, GHSA-2223-f22x-24cq | Medium | 0.5% | 20 Aug, 2026 | Packagist winter/wn-system-module |
Winter: Local File Inclusion through @import directives in LESS compilation of backend customizable stylesheets and theme assets CVE-2026-63179, GHSA-58fp-mcx6-7qf9 | Medium | 0.5% | 20 Aug, 2026 | Packagist winter/wn-backend-module |
django CMS: Missing authorization in `render_object_structure` discloses non-PageContent placeholder structure to low-privileged staff CVE-2026-61663, GHSA-8qj2-c6q4-f399, PYSEC-2026-3823 | Medium | 0.3% | 20 Aug, 2026 | PyPI django-cms |
django CMS: Broken access control in page *Duplicate* allows reading the content of any page (cross-site / restriction bypass) CVE-2026-63003, GHSA-6x92-6vx4-5fwr, PYSEC-2026-3821 | Medium | 0.4% | 20 Aug, 2026 | PyPI django-cms |
django CMS: Stored XSS in edit-mode plugin exception rendering CVE-2026-75526, GHSA-hvq6-2r72-p2x7, PYSEC-2026-3825 | Medium | 0.3% | 20 Aug, 2026 | PyPI django-cms |
Laravel Backpack CRUD: HasMany/MorphMany relation fields allow cross-tenant record re-parenting (IDOR) via attachManyRelation CVE-2026-57570, GHSA-42vx-43vc-x6pr | Medium | 0.4% | 20 Aug, 2026 | Packagist backpack/crud |
Wagtail: Improper restriction handling on Pages admin API CVE-2026-55468, GHSA-3vrh-m9w7-v94f, PYSEC-2026-3939 | Medium | 0.3% | 20 Aug, 2026 | PyPI wagtail |
NocoBase: Arbitrary File Write chained with Local file Inclusion leads to Remote code execution GHSA-ghvf-qf6h-g8x5 | High | Not scored | 20 Aug, 2026 | npm @nocobase/server |
django CMS: Structure endpoint bypasses page-view permission CVE-2026-54624, GHSA-vgxm-h9gx-h9w7, PYSEC-2026-3826 | Medium | 0.4% | 20 Aug, 2026 | PyPI django-cms |
django CMS: Clipboard copy IDOR discloses unauthorized plugin content CVE-2026-54622, GHSA-4xfr-4p46-gc6p, PYSEC-2026-3820 | Medium | 0.4% | 20 Aug, 2026 | PyPI django-cms |
Winter: Authenticated IDOR in backend FileUpload widget allows cross-user access to attachment metadata CVE-2026-54256, GHSA-3277-h8g9-qj5f | Medium | 0.2% | 20 Aug, 2026 | Packagist winter/wn-backend-module |
Fleet: SQL injection in Okta conditional access endpoint allows host-controlled compromise of the Fleet database CVE-2026-54245, GHSA-7q96-f8xw-jv5j, GO-2026-6264 | High | 0.6% | 20 Aug, 2026 | Go github.com/fleetdm/fleet Go github.com/fleetdm/fleet/v4 |
Laravel Backpack CRUD: OS command injection in Stats::makeCurlRequest via attacker-controlled Host header (pre-auth) CVE-2026-54182, GHSA-mrc5-3mm3-45c5 | High | 0.8% | 20 Aug, 2026 | Packagist backpack/crud |
Laravel Backpack CRUD: Stored XSS in the color column — the `@if($column['escaped'])` branches are inverted CVE-2026-54181, GHSA-mmg4-322v-6jvc | Medium | 0.3% | 20 Aug, 2026 | Packagist backpack/crud |
Laravel Backpack CRUD: CRUD panel query scopes are not enforced on Update, Delete, and Reorder (cross-tenant IDOR) CVE-2026-54180, GHSA-vgmv-8xjc-6rch | High | 0.5% | 20 Aug, 2026 | Packagist backpack/crud |
Laravel Backpack CRUD: SingleBase64Image accepts any base64 payload behind a `data:image` prefix — SVG-with-script lands on the public disk CVE-2026-54179, GHSA-8hw4-7qjr-3wxg | Medium | 0.3% | 20 Aug, 2026 | Packagist backpack/crud |
Laravel Backpack CRUD: Arbitrary file deletion via attacker-controlled clear_<attr>[] in HasUploadFields::uploadMultipleFilesToDisk CVE-2026-54178, GHSA-8xjm-wqrp-2f25 | High | 0.6% | 20 Aug, 2026 | Packagist backpack/crud |
Laravel Backpack CRUD: HasUploadFields keeps the attacker-supplied file extension — public-disk uploads of `shell.php` reach the webserver CVE-2026-54177, GHSA-8q2w-pv9p-mjvc | Medium | 0.9% | 20 Aug, 2026 | Packagist backpack/crud |
Laravel Backpack CRUD: MyAccountController allows changing the login email without a current-password check CVE-2026-54176, GHSA-9fw9-8c49-qch8 | Medium | 0.7% | 20 Aug, 2026 | Packagist backpack/crud |
Laravel Backpack CRUD: Unverified password change in MyAccountController via mass assignment CVE-2026-54175, GHSA-xpv2-hrfc-hw62 | High | 0.6% | 20 Aug, 2026 | Packagist backpack/crud |
Tekton Pipelines-as-Code: Unscoped GitHub App installation token allows unauthorized access to private repositories via remote task resolution CVE-2026-54168, GHSA-6f2p-296r-cc28, GO-2026-6263 | Medium | 0.6% | 20 Aug, 2026 | Go github.com/openshift-pipelines/pipelines-as-code |
Pipelines-as-Code GitHub App token request can be redirected via untrusted Enterprise Host header CVE-2026-54167, GHSA-f5f4-3hh4-f54m, GO-2026-6266 | High | 0.3% | 20 Aug, 2026 | Go github.com/openshift-pipelines/pipelines-as-code |
OpenTofu has high CPU usage when using K8S remote state backend or when parsing specifically crafted TLS certificates from untrusted or compromised servers GHSA-22w5-2fxg-vrwx, GO-2026-6262 | Low | Not scored | 20 Aug, 2026 | Go github.com/opentofu/opentofu |
Ember has unneutralized terminal escape/control sequences from Caddy logs injected into the operator's TUI CVE-2026-54162, GHSA-x3g7-qrwc-f6c5, GO-2026-6270 | Medium | 0.3% | 20 Aug, 2026 | Go github.com/alexandre-daubois/ember |
node-opcua: Unbounded nonce cache enables unauthenticated heap exhaustion DoS CVE-2026-54156, GHSA-6wvw-vrw4-363w | High | 0.8% | 20 Aug, 2026 | npm node-opcua |
node-opcua missing nonce verification in UserNameIdentityToken authentication CVE-2026-54155, GHSA-mq36-523m-x7vv | High | 0.4% | 20 Aug, 2026 | npm node-opcua |
next-video: Unauthenticated arbitrary file read via /api/video request handler CVE-2026-54150, GHSA-2p39-2jf3-fv2q | Medium | 0.4% | 20 Aug, 2026 | npm next-video |
Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings CVE-2026-111932, GHSA-h58c-xccx-75m3, GO-2026-6267 | Medium | 0.2% | 20 Aug, 2026 | Go github.com/coder/coder Go github.com/coder/coder/v2 |
Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison CVE-2026-111933, GHSA-8fxq-53rx-ph5f, GO-2026-6265 | Low | 0.2% | 20 Aug, 2026 | Go github.com/coder/coder Go github.com/coder/coder/v2 |
Zoo Design Studio: Memory-corruption in memory handling of lib-kcl GHSA-mc9m-6fm9-pghc | Medium | Not scored | 20 Aug, 2026 | PyPI zoo-kcl crates.io kcl-lib |
Zoo Design Studio: Recursive KCL parsing is vulnerable to denial-of-service GHSA-jgvr-6x5w-hx5w | Medium | Not scored | 20 Aug, 2026 | PyPI zoo-kcl crates.io kcl-lib |
django CMS: Page cache ignores plugin-declared Vary headers (disclosure & poisoning) CVE-2026-54625, GHSA-fwjf-m4qw-9f2x, PYSEC-2026-3824 | Medium | 0.2% | 20 Aug, 2026 | PyPI django-cms |
django CMS: Plugin move endpoint allows cyclic reparenting (DoS) CVE-2026-54623, GHSA-8jj7-4v57-frf5, PYSEC-2026-3822 | High | 0.5% | 20 Aug, 2026 | PyPI django-cms |
Malicious release: Malicious code in exam-kit (npm) GHSA-3g8c-37c3-75vv, MAL-2026-14331 | Malicious | Not scored | 20 Aug, 2026 | npm exam-kit |
Malicious release: Malicious code in @pablo_clueless/sniffr (npm) GHSA-2gvc-mrh5-885x, MAL-2026-14330 | Malicious | Not scored | 20 Aug, 2026 | npm @pablo_clueless/sniffr |
Malicious release: Malicious code in @pablo_clueless/printr (npm) GHSA-3jxq-xch2-6hpm, MAL-2026-14329 | Malicious | Not scored | 20 Aug, 2026 | npm @pablo_clueless/printr |
LangChain MongoDB has NoSQL Operator Injection in MongoDBSaver.list() leading to cross-tenant data exposure CVE-2026-55253, GHSA-533j-2v4q-mw5h, PYSEC-2026-3859, PYSEC-2026-3860 | High | 0.5% | 20 Aug, 2026 | PyPI langgraph-checkpoint-mongodb PyPI langgraph-store-mongodb |
Dgraph Alpha group stores can be replaced via unauthenticated external snapshot import CVE-2026-54061, GHSA-rrwh-6jrq-wp5v, GO-2026-6261 | Critical | 0.5% | 20 Aug, 2026 | Go github.com/dgraph-io/dgraph Go github.com/dgraph-io/dgraph/v25 |
asteval has a Sandbox Escape via BaseException Subclasses CVE-2026-55244, GHSA-89v8-rhwq-hf77, PYSEC-2026-3807 | Medium | 0.2% | 20 Aug, 2026 | PyPI asteval |
asteval Sandbox Escape: arbitrary native memory read/write via numpy ctypes in default asteval Interpreter CVE-2026-102734, GHSA-9w56-46f6-3qhx | Medium | 0.1% | 20 Aug, 2026 | PyPI asteval |
vouch-proxy has an Unbounded Multipart Cookie Allocation DoS CVE-2026-55149, GHSA-qqff-5854-px68, GO-2026-6260 | High | 0.7% | 20 Aug, 2026 | Go github.com/vouch/vouch-proxy |
OpenTelemetry-Go: Unsynchronized baggage map can panic under concurrent access CVE-2026-45404, GHSA-42cj-99w8-cp2p, GO-2026-6258 | Medium | 0.1% | 20 Aug, 2026 | Go go.opentelemetry.io/otel/bridge/opentracing |
Velero vulnerable to file path traversal when extracting from backup's tarball CVE-2026-32637, GHSA-j2g6-362q-6qc6, GO-2026-6259 | Medium | 0.5% | 20 Aug, 2026 | Go github.com/vmware-tanzu/velero |
Banks: Path traversal in `DirectoryPromptRegistry.set()` allows arbitrary file write outside the registry root CVE-2026-71492, GHSA-x8wg-4xgc-vr54, PYSEC-2026-3810 | Medium | 0.5% | 20 Aug, 2026 | PyPI banks |