Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
linuxfabrik-lib: Arbitrary root file read via live --test argument (lib.lftest) across sudoers-whitelisted plugins (LPE) CVE-2026-73974, GHSA-rh9c-rqvg-f7pr, PYSEC-2026-3682 | Medium | 0.2% | 18 Aug, 2026 | PyPI linuxfabrik-lib |
moby/go-archive: Crafted tar archive can write outside the extraction directory BIT-docker-cli-2026-17106, CVE-2026-17106, GHSA-hfg8-hc9c-6c3h, GO-2026-6253 | High | 0.4% | 18 Aug, 2026 | Go github.com/moby/go-archive |
LibreNMS: SSRF-driven stored XSS via Oxidized API response fields in device showconfig page CVE-2026-84189, GHSA-7gww-x7fh-jf9j | Critical | 0.4% | 18 Aug, 2026 | Packagist librenms/librenms |
LibreNMS: Stored XSS via graph_descr admin config settings echoed without escaping to all authenticated users CVE-2026-84188, GHSA-7cj5-v4pp-v632 | Medium | 0.3% | 18 Aug, 2026 | Packagist librenms/librenms |
LibreNMS Vulnerable to Remote Code Execution via AboutController CVE-2026-84190, GHSA-jf24-8g2h-2wg7 | High | 0.9% | 18 Aug, 2026 | Packagist librenms/librenms |
fastify vulnerable to schema validation bypass via root primitive coercion mismatch CVE-2026-18504, GHSA-w2qp-rph6-63g4 | Medium | 0.3% | 18 Aug, 2026 | npm fastify |
fastify vulnerable to X-Forwarded-* spoofing under trustProxy hop-count CVE-2026-16732, GHSA-3m5p-2c4r-xxw2 | Medium | 0.2% | 18 Aug, 2026 | npm fastify |
Vitess: Missing authorization on vttablet /debug/vrlog exposes live VReplication SQL data CVE-2026-65959, GHSA-mhc4-g3wh-cw7m, GO-2026-6356 | Medium | 0.4% | 18 Aug, 2026 | Go vitess.io/vitess |
Froxlor: Credential and 2FA secret disclosure via Froxlor API endpoints CVE-2026-62988, GHSA-7788-ghfq-c6mh | Critical | 0.6% | 18 Aug, 2026 | Packagist froxlor/froxlor |
Froxlor has CSRF Vulnerability in AJAX Endpoint — Missing Cross-Site Request Forgery Protection CVE-2026-55593, GHSA-xpr4-8vp6-c87j | Medium | 0.3% | 18 Aug, 2026 | Packagist froxlor/froxlor |
Froxlor DomainZones.add allows DNS zone-file RR injection via record/type fields CVE-2026-54543, GHSA-5rw4-4665-cvwf | Medium | 0.4% | 18 Aug, 2026 | Packagist froxlor/froxlor |
Froxlor: Second-Order SQL Injection via `Admins.add` `ipaddress` Parameter Allows Full Database Exfiltration CVE-2026-54348, GHSA-w27m-rmmf-g5w4 | High | 0.7% | 18 Aug, 2026 | Packagist froxlor/froxlor |
Froxlor: Stored XSS in DNS TXT Record Content Allows Customer-to-Admin Account Takeover CVE-2026-54347, GHSA-43gm-9rr3-cx7g | High | 0.4% | 18 Aug, 2026 | Packagist froxlor/froxlor |
devpi-server may leak database contents CVE-2026-54723, GHSA-m5pq-69xg-vcq3, PYSEC-2026-3661 | Medium | 0.4% | 18 Aug, 2026 | PyPI devpi-server |
MineAdmin Vulnerable to Path Traversal via Unsanitized identifier in Plugin Install/Uninstall CVE-2026-55224, GHSA-59xm-4m8c-g3xj | High | 1.4% | 18 Aug, 2026 | Packagist mineadmin/mineadmin |
MONAI: Unsafe deserialization in NumpyReader allows arbitrary code execution via malicious .npy files CVE-2026-100845, GHSA-wg9g-w2j2-8pgr, PYSEC-2026-4020 | High | 0.2% | 18 Aug, 2026 | PyPI monai |
MONAI vulnerable to OS command injection CVE-2026-100844, GHSA-rghg-q7wp-9767, PYSEC-2026-4019 | High | 0.9% | 18 Aug, 2026 | PyPI MONAI PyPI monai |
Incomplete Fix in MONAI: algo_from_pickle() pickle.loads() RCE still present in v1.5.2 despite GHSA-89gg-p5r5-q6r4 claiming patch CVE-2026-100843, GHSA-qxq5-qhx6-94qw, PYSEC-2026-4018 | High | 0.3% | 18 Aug, 2026 | PyPI monai |
Lemur: Any user can revoke arbitrary certificates at the CA by uploading a duplicate record and revoking it CVE-2026-71417, GHSA-pxmc-2ffp-8j67, PYSEC-2026-3678 | High | 0.1% | 18 Aug, 2026 | PyPI lemur |
Lemur: Missing authorization check on POST /certificates/<id>/export for plugins with requires_key = False CVE-2026-71322, GHSA-4h97-p9wq-chqj, PYSEC-2026-3673 | Medium | 0.2% | 18 Aug, 2026 | PyPI lemur |
Lemur: Sub-CA creation never checks `AuthorityPermission` on the parent authority CVE-2026-71317, GHSA-g7p5-89mh-248h, PYSEC-2026-3677 | Medium | 0.1% | 18 Aug, 2026 | PyPI lemur |
Lemur: Unchecked `replaces[]` lets any user silence notifications and hijack auto-rotation for arbitrary certificates CVE-2026-71308, GHSA-cfh6-pv5c-38jv, PYSEC-2026-3675 | High | 0.3% | 18 Aug, 2026 | PyPI lemur |
Lemur: Authenticated low-privilege users can read plaintext destination credentials (SFTP password / private-key passphrase) via the destinations API CVE-2026-71307, GHSA-6c8m-q6g9-vrw3, PYSEC-2026-3674 | High | 0.3% | 18 Aug, 2026 | PyPI lemur |
Lemur: Incomplete fix for GHSA-v2wp-frmc-5q3v -- ACME authority update endpoint allows non-admin to replace `acme_url` with internal IP, bypassing allowlist CVE-2026-71303, GHSA-v5rc-cpwc-cfpr, PYSEC-2026-3679 | High | 0.3% | 18 Aug, 2026 | PyPI lemur |
Lemur: Server-Side Request Forgery via the ACME client following server-controlled URLs CVE-2026-70666, GHSA-xpmj-wjcp-6pww, PYSEC-2026-3680 | High | 0.2% | 18 Aug, 2026 | PyPI lemur |
surfio has an out-of-bounds read CVE-2026-55211, GHSA-rcr2-hggw-43wm, PYSEC-2026-3701 | Critical | 0.7% | 18 Aug, 2026 | PyPI surfio |
resdata has Classic Buffer Overflow, Improper Validation of Array Index, NULL Pointer Dereference and Out-of-bounds Read CVE-2026-55209, GHSA-pr85-w493-9w3x, PYSEC-2026-3694 | Critical | 0.8% | 18 Aug, 2026 | PyPI resdata |
kobako Sandbox Escape: guest eval reaches host RCE via method_missing → public_send (any bound Service) CVE-2026-55107, GHSA-7pwq-q9jf-539h | Critical | 0.8% | 18 Aug, 2026 | RubyGems kobako |
MeshCentral has unsanitized data fields GHSA-c7hr-448w-65px | High | Not scored | 18 Aug, 2026 | npm meshcentral |
Malicious release: Malicious code in infogram-bot (PyPI) MAL-2026-14131 | Malicious | Not scored | 18 Aug, 2026 | PyPI infogram-bot |
Malicious release: Malicious code in httpz-requests (PyPI) MAL-2026-14130 | Malicious | Not scored | 18 Aug, 2026 | PyPI httpz-requests |
Lemur: SSRF protection in certificate revocation checking bypassable via HTTP redirects and DNS rebinding (incomplete fix for GHSA-54vg-pfh7-jq95) CVE-2026-70667, GHSA-f3qq-49m6-rw8f, PYSEC-2026-3676 | Medium | 0.2% | 18 Aug, 2026 | PyPI lemur |
Authorization bypass via double-encoded paths in github.com/valyala/fasthttp GO-2026-4950 | Not scored | 18 Aug, 2026 | Go github.com/valyala/fasthttp | |
Cross-forge account takeover on login in codefloe.com/crowci/crow/v6 GO-2026-6216 | Not scored | 18 Aug, 2026 | Go codefloe.com/crowci/crow/v6 | |
Credential leakage to untrusted hosts in github.com/chrismellard/docker-credential-acr-env GO-2026-6225 | Not scored | 18 Aug, 2026 | Go github.com/chrismellard/docker-credential-acr-env | |
MobSF Vulnerable to Arbitrary File Read via Path Traversal in ZIP Uploads CVE-2026-68922, GHSA-8j49-mmcx-4mp5, PYSEC-2026-3689 | Medium | 0.5% | 18 Aug, 2026 | PyPI mobsf |
MobSF's CSRF checks not enforced after Django migration CVE-2026-68923, GHSA-3p54-567p-2wpr, PYSEC-2026-3688 | Medium | 0.3% | 18 Aug, 2026 | PyPI mobsf |
MobSF has SSRF port restriction bypass in assetlinks_check CVE-2026-68927, GHSA-95px-34x5-p37h, PYSEC-2026-3690 | Low | 0.3% | 18 Aug, 2026 | PyPI mobsf |
MobSF Vulnerable to Zip Bomb Denial of Service via Per-File Size Limit Bypass in ZIP/APK Extraction CVE-2026-68924, GHSA-x768-8642-mmq9, PYSEC-2026-3691 | Medium | 0.6% | 18 Aug, 2026 | PyPI mobsf |
MagicMirror socket payload secret placeholder expansion can disclose SECRET_* environment variables CVE-2026-63640, GHSA-q4gh-4ffp-5cg8 | Medium | 0.3% | 18 Aug, 2026 | npm magicmirror |
GeoLens: Cross-dataset authorization bypass discloses private dataset metadata, schema, sample values, table rows, and raster/vector tile data CVE-2026-55178, GHSA-p23g-mvhj-jh3j, PYSEC-2026-3662, PYSEC-2026-3663 | High | 0.6% | 18 Aug, 2026 | PyPI geolens PyPI geolens-cli npm @geolens/sdk |
LibreNMS Vulnerable to Remote Code Execution by Signal Alert Transportation module CVE-2026-55182, GHSA-c9fv-cgmm-2wg7 | High | 1.6% | 18 Aug, 2026 | Packagist librenms/librenms |
Malicious release: Malicious code in plugin-react-vite (npm) GHSA-xjmp-gcmw-2xxm, MAL-2026-14129 | Malicious | Not scored | 18 Aug, 2026 | npm plugin-react-vite |
MagicMirror: ssrf calendar .js CVE-2026-63643, GHSA-w6x9-28jw-hq7j | Medium | 0.7% | 18 Aug, 2026 | npm magicmirror |
MagicMirror newsfeed Socket.IO notification allows blind server-side request forgery CVE-2026-63642, GHSA-998g-7v5w-cr7g | Medium | 0.5% | 18 Aug, 2026 | npm magicmirror |
MagicMirror Socket.IO module namespaces bypass configured IP whitelist and allow unauthenticated server-side actions CVE-2026-63641, GHSA-w26r-fwg8-rcp3 | Low | 0.4% | 18 Aug, 2026 | npm magicmirror |
Denial of service via malformed IPv4 packet in github.com/insomniacslk/dhcp GO-2026-6237 | Not scored | 18 Aug, 2026 | Go github.com/insomniacslk/dhcp | |
Trivy Plugin Manager has Path Traversal that Allows Arbitrary File Write CVE-2026-63328, GHSA-8rc5-4fr6-64pw, GO-2026-6250 | Medium | 0.2% | 18 Aug, 2026 | Go github.com/aquasecurity/trivy |
@rhinostone/swig: arbitrary local file read via include/extends path traversal GHSA-2mf3-mr2r-r4vf | High | Not scored | 18 Aug, 2026 | npm @rhinostone/swig npm @rhinostone/swig-core npm @rhinostone/swig-django npm @rhinostone/swig-jinja2 +1 more |
Malicious release: Malicious code in @reducers/projects (npm) GHSA-3jm4-64fg-x3gh, MAL-2026-14127 | Malicious | Not scored | 18 Aug, 2026 | npm @reducers/projects |