Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Zimbra Collaboration Suite (ZCS) OS Command Injection Vulnerability CVE-2026-73570 | HighExploited | 71.7% | 13 Aug, 2026 | |
atomic-agents-stack: Dashboard HTTP server path traversal allows arbitrary file read CVE-2026-91989, GHSA-rm43-82j9-r4mj | High | 1.3% | 13 Aug, 2026 | PyPI atomic-agents-stack |
Pimcore: ClassDefinition UID regex missing end anchor allows SQL injection via Block.php unquoted table name CVE-2026-55072, GHSA-2mhj-fhvg-v428 | High | 0.4% | 13 Aug, 2026 | Packagist pimcore/pimcore |
@fastify/busboy vulnerable to Denial of Service via oversized multipart boundary CVE-2026-19484, GHSA-xjh9-v7x6-24jw | High | 0.6% | 13 Aug, 2026 | npm @fastify/busboy |
@fastify/busboy vulnerable to Denial of Service via prototype-named multipart part header CVE-2026-19481, GHSA-x8mw-p69m-v3mx | High | 0.5% | 13 Aug, 2026 | npm @fastify/busboy |
Ansible FreeBSD Jail Connection Plugin: Jail escape via symlink following in put_file (host-side root mv) CVE-2026-55074, GHSA-cxgv-hp74-jj7r, PYSEC-2026-3658 | High | 0.4% | 12 Aug, 2026 | PyPI ansible-jailexec |
MCP-for-Stata: Stata Command Injection via Unsanitized `package` in `ado_package_install` CVE-2026-55071, GHSA-49m4-vp58-wgc9, PYSEC-2026-3700 | High | 0.3% | 12 Aug, 2026 | PyPI stata-mcp |
JFrog Artifactory Improper Authentication Vulnerability CVE-2026-42018 | HighExploited | 9.8% | 12 Aug, 2026 | |
Apache Airflow Backfill API parser discrepancy permits cross-DAG authorization bypass BIT-airflow-2026-68968, CVE-2026-68968, GHSA-j4jc-cq9h-xrhr, PYSEC-2026-3710 | High | 0.4% | 12 Aug, 2026 | PyPI apache-airflow |
Apache Airflow Task SDK Callback deserialization can import arbitrary modules in the scheduler BIT-airflow-2026-67587, CVE-2026-67587, GHSA-2qjv-p2gc-mjg2, PYSEC-2026-3708 | High | 0.6% | 12 Aug, 2026 | PyPI apache-airflow |
Apache Airflow scheduler unsafely deserializes human-in-the-loop task next_kwargs BIT-airflow-2026-67260, CVE-2026-67260, GHSA-q4c3-7575-55j2, PYSEC-2026-3707 | High | 0.8% | 12 Aug, 2026 | PyPI apache-airflow |
Apache Airflow exception-node deserialization permits arbitrary callable execution BIT-airflow-2026-58076, CVE-2026-58076, GHSA-8prw-8m6x-8w6f, PYSEC-2026-3991 | High | 0.5% | 12 Aug, 2026 | PyPI apache-airflow |
compliance-trestle has an URLSecurityValidator SSRF allowlist bypass via IPv4-mapped IPv6 and 0.0.0.0 CVE-2026-52776, GHSA-h47f-gmjp-m7rr, PYSEC-2026-3659 | High | 0.4% | 12 Aug, 2026 | PyPI compliance-trestle |
Winter: Authenticated backend users can bypass Users controller permission checks CVE-2026-35445, GHSA-j5jq-cr68-v2xx | High | 0.4% | 12 Aug, 2026 | Packagist winter/wn-backend-module |
Winter: Stored XSS through Editor Settings custom styles CVE-2026-32258, GHSA-vgp4-2fc4-qff2 | High | 0.4% | 12 Aug, 2026 | Packagist winter/wn-backend-module |
Winter: Stored XSS through Brand Settings custom styles CVE-2026-32257, GHSA-v7cf-8gh9-gxmj | High | 0.4% | 12 Aug, 2026 | Packagist winter/wn-backend-module |
Faker: helpers.fake exploitable into arbritary code execution CVE-2026-73231, GHSA-qxc2-j82w-r537 | High | 0.2% | 11 Aug, 2026 | npm @faker-js/faker |
Claude Code Templates: Unauthenticated OS command injection (RCE) in Claude Code Studio server (--studio) CVE-2026-73222, GHSA-79wm-x847-7cvg | High | 0.3% | 11 Aug, 2026 | npm claude-code-templates |
Browserslist: Unbounded memory growth (no cache eviction) via distinct query results, leading to eventual OOM CVE-2026-73089, GHSA-c83g-rgw3-j3cx | High | 0.7% | 11 Aug, 2026 | npm browserslist |
Browserslist: Uncaught crash / prototype write via untrusted browserslist-stats.json custom stats (normalizeStats) CVE-2026-73088, GHSA-73wf-gq98-2v4g | High | 0.7% | 11 Aug, 2026 | npm browserslist |
nanoid: Integer Overflow or Wraparound CVE-2026-73086, GHSA-xwg4-73v4-xw9w | High | 0.3% | 11 Aug, 2026 | npm nanoid |
Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability CVE-2026-68820 | HighExploited | 0.3% | 11 Aug, 2026 | |
Microsoft SharePoint Code Injection Vulnerability CVE-2026-65660 | HighExploited | 8.2% | 11 Aug, 2026 | |
Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Heap Inspection Vulnerability CVE-2026-20349 | HighExploited | 1.0% | 11 Aug, 2026 | |
TYPO3 CMS - Broken Access Control in Backend and Install Tool CVE-2026-19418, GHSA-68jx-f42c-7599 | High | 0.2% | 11 Aug, 2026 | Packagist typo3/cms-backend Packagist typo3/cms-core |
SAP Approuter has an Information Disclosure vulnerability CVE-2026-58230, GHSA-vhh6-v828-x62f | High | 0.3% | 11 Aug, 2026 | npm @sap/approuter |
GitPython: Unsafe git option guard bypass via split_single_char_options=False short-option token smuggling enables command execution CVE-2026-76220, GHSA-wvpp-8hx9-p66j, PYSEC-2026-3843 | High | 0.9% | 07 Aug, 2026 | PyPI GitPython PyPI gitpython |
GitPython: git-config OPTION-name injection via =/#/whitespace bypasses name validator, enabling forged core.sshCommand/hooksPath (RCE) CVE-2026-76221, GHSA-jm78-9fvv-mhgr, PYSEC-2026-3783 | High | 0.8% | 07 Aug, 2026 | PyPI GitPython PyPI gitpython |
GitPython: Arbitrary Git Repository Creation Outside the Working Tree via Unvalidated .gitmodules Submodule Name in GitPython CVE-2026-76222, GHSA-hmq2-w58f-27jc, PYSEC-2026-3784 | High | 0.4% | 07 Aug, 2026 | PyPI GitPython PyPI gitpython |
GitPython: Arbitrary file read via --pathspec-from-file in IndexFile.remove() and Head.checkout() CVE-2026-76217, GHSA-hh9p-6wh2-4mfc, PYSEC-2026-3841 | High | 0.4% | 07 Aug, 2026 | PyPI GitPython PyPI gitpython |
GitPython: Unguarded git option forwarding in Repo.init enables arbitrary command execution via --template clone hooks CVE-2026-76218, GHSA-9rj7-rf2p-w77r, PYSEC-2026-3840 | High | 0.8% | 07 Aug, 2026 | PyPI GitPython PyPI gitpython |
GitPython: Unguarded git read-tree option forwarding in IndexFile.from_tree/reset/merge_tree enables arbitrary file overwrite CVE-2026-76219, GHSA-4gmw-gg2m-w46p, PYSEC-2026-3838 | High | 0.5% | 07 Aug, 2026 | PyPI GitPython PyPI gitpython |
pymdown-extensions: exponential-backtracking ReDoS in caret, tilde, betterem, and magiclink inline processors CVE-2026-67422, GHSA-gm37-52c6-37mw, PYSEC-2026-3654 | High | 0.6% | 06 Aug, 2026 | PyPI pymdown-extensions |
Craft CMS: Arbitrary file read via SplFileObject in non-sandboxed template contexts CVE-2026-72779, GHSA-957r-qf9p-67xw | High | 0.4% | 06 Aug, 2026 | Packagist craftcms/cms |
Craft CMS: Authenticated leak of secret environment variables CVE-2026-72782, GHSA-596p-6jv8-775v | High | 0.4% | 06 Aug, 2026 | Packagist craftcms/cms |
PHP_CodeSniffer gitblame report command injection via crafted filename CVE-2026-67434, GHSA-hmqg-cxww-wqhq | High | 1.1% | 06 Aug, 2026 | Packagist squizlabs/php_codesniffer |
ngx-extended-pdf-viewer bundles a version of pdf.js vulnerable to CVE-2026-16633 GHSA-w9hm-4m3m-fxmm | High | Not scored | 06 Aug, 2026 | npm ngx-extended-pdf-viewer |
PDF.js: Arbitrary JavaScript execution upon opening a malicious PDF CVE-2026-16633, GHSA-hq66-cqwq-w95j | High | Not scored | 06 Aug, 2026 | npm pdfjs-dist |
Craft CMS: Arbitrary user password reset leading to administrator account takeover CVE-2026-72786, CVE-2026-79989, GHSA-p8x7-9vfw-p7vc | High | 0.5% | 06 Aug, 2026 | Packagist craftcms/cms |
Craft CMS: Authenticated RCE through Twig sandbox escape CVE-2026-72781, GHSA-f5wm-88jv-g5hx | High | 0.8% | 06 Aug, 2026 | Packagist craftcms/cms |
Craft CMS: Authenticated RCE via `condition.config` JSON cleanse bypass CVE-2026-72778, GHSA-265m-7826-wjqm | High | 0.8% | 06 Aug, 2026 | Packagist craftcms/cms |
league/commonmark: Denial of service via colliding heading slugs CVE-2026-86434, GHSA-mh25-x5hq-wrqp | High | 0.5% | 06 Aug, 2026 | Packagist league/commonmark |
league/commonmark: Denial of service via duplicate footnote definitions GHSA-jfm3-95jq-q3rf | High | Not scored | 06 Aug, 2026 | Packagist league/commonmark |
league/commonmark: Denial of service via adjacent inline attribute blocks GHSA-g2gp-3wwq-f4ph | High | Not scored | 06 Aug, 2026 | Packagist league/commonmark |
league/commonmark: Quadratic-time denial of service when parsing crafted Markdown CVE-2026-71488, GHSA-2q4p-g7hv-5rgv | High | 0.6% | 06 Aug, 2026 | Packagist league/commonmark |
JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported GHSA-5p4m-2wfm-xmqj | High | Not scored | 06 Aug, 2026 | npm js-yaml |
Nx: Zip-Slip in the self-hosted remote cache CVE-2026-71476, GHSA-vp3h-ghgh-jr7g | High | 0.9% | 06 Aug, 2026 | npm @nx/azure-cache npm @nx/gcs-cache npm @nx/powerpack-azure-cache npm @nx/powerpack-gcs-cache +5 more |
Statamic: Account takeover via OAuth email matching without email-verification check CVE-2026-64665, GHSA-93qh-5269-9wcf | High | 0.5% | 06 Aug, 2026 | Packagist statamic/cms |
Nuxt: Unauthenticated CPU exhaustion parsing and hashing the Nuxt island endpoint body before hash validation CVE-2026-71321, GHSA-9pgf-384g-p7mv | High | 0.7% | 05 Aug, 2026 | npm nuxt |
Nuxt: Server-Side Remote Code Execution via Runtime Template Injection in Nuxt Server Island Props CVE-2026-71320, GHSA-9473-5f9j-94wq | High | 0.7% | 05 Aug, 2026 | npm nuxt |