Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
@wakaru/cli arbitrary file write during bundle unpack CVE-2026-54545, GHSA-7wpj-vvmv-pgm8 | High | 0.2% | 28 Jul, 2026 | npm @wakaru/cli |
WordPress Coding Standards (WordPressCS) contains an arbitrary code execution vulnerability CVE-2026-45293, GHSA-3pwp-g2mj-5p3v | High | 0.2% | 28 Jul, 2026 | Packagist wp-coding-standards/wpcs |
JFrog Artifactory Incorrect Authorization Vulnerability CVE-2026-42016 | HighExploited | 8.6% | 27 Jul, 2026 | |
Apache Thrift Python, Go, PHP and Java bindings have an Infinite Loop BIT-thrift-2026-43871, CVE-2026-43871, GHSA-8wv5-x4w7-5gww, PYSEC-2026-3926 | High | 1.0% | 27 Jul, 2026 | Go github.com/apache/thrift Maven org.apache.thrift:libthrift Packagist apache/thrift PyPI thrift |
Apache Thrift Python bindings have an Improper Handling of Highly Compressed Data (Data Amplification) vulnerability BIT-thrift-2026-41608, CVE-2026-41608, GHSA-6pjx-3pjc-mrj8, PYSEC-2026-3925 | High | 1.0% | 27 Jul, 2026 | PyPI thrift |
libp2p: yamux connection DoS via oversized data frame CVE-2026-73568, GHSA-hmj8-5xmh-5573, PYSEC-2026-3681 | High | 0.5% | 24 Jul, 2026 | PyPI libp2p |
Shescape: Quadratic-time denial of service in the flag-protection CVE-2026-73413, GHSA-gm3r-q2wp-hw87 | High | 0.6% | 24 Jul, 2026 | npm shescape |
NLTK vulnerable to Eval Injection via collocations CLI arguments CVE-2025-71408, GHSA-848c-c2cx-j7qx, PYSEC-2026-3657 | High | 0.3% | 24 Jul, 2026 | PyPI nltk |
Poweradmin: OIDC `sub` collation bypass in Poweradmin leading to account takeover GHSA-cmwh-g2h8-c222 | High | Not scored | 24 Jul, 2026 | Packagist poweradmin/poweradmin |
Poweradmin: Broken access control (IDOR): any zone owner can modify DNS records in zones they do not own GHSA-rm67-g9ch-vxff | High | Not scored | 24 Jul, 2026 | Packagist poweradmin/poweradmin |
Poweradmin: API user-update endpoint leads to a non-admin reset any user's password and take over the superuser account GHSA-h4hf-v6w5-897x | High | Not scored | 24 Jul, 2026 | Packagist poweradmin/poweradmin |
vantage6: Algorithm developer can edit another developer's algorithm that is pending / under review CVE-2026-73652, GHSA-47w6-gwp4-w6vc, PYSEC-2026-3703 | High | 0.4% | 24 Jul, 2026 | PyPI vantage6 |
@anephenix/hub: Unauthenticated WebSocket RPC Waiter Resource Exhaustion CVE-2026-73561, GHSA-g5vv-q72c-7j78 | High | 0.6% | 24 Jul, 2026 | npm @anephenix/hub |
Pheditor: Terminal command-allowlist bypass via argument injection leads to RCE — surviving vector after the metacharacter-sanitization fixes GHSA-g3hq-hphg-8fhh | High | Not scored | 24 Jul, 2026 | Packagist pheditor/pheditor |
GitPython: Environment-variable exfiltration via Repo.create_remote() / Remote.add() URL (incomplete fix of GHSA-rwj8-pgh3-r573) CVE-2026-73622, GHSA-94p4-4cq8-9g67, PYSEC-2026-3951 | High | 0.5% | 24 Jul, 2026 | PyPI GitPython PyPI gitpython |
Budibase: SSRF via DNS rebinding in the REST datasource integration CVE-2026-73410, GHSA-v42f-v8xc-j435 | High | 0.3% | 24 Jul, 2026 | npm @budibase/server |
Budibase: NoSQL injection in MongoDB integration: collection dump, $where JS exec, cross-collection pivot, arbitrary update/delete CVE-2026-73617, GHSA-pmpg-2mxq-6xwr | High | 0.3% | 24 Jul, 2026 | npm @budibase/server |
Budibase: Chat-Link Handoff Identity Confusion (Same-Tenant Account-Link CSRF) CVE-2026-72849, GHSA-pvcr-8mvp-w8qr | High | 0.2% | 24 Jul, 2026 | npm @budibase/server |
Budibase: MySQL DESCRIBE Backtick Injection via multipleStatements in Database Connector CVE-2026-73408, GHSA-2xgg-r2wc-c5r2 | High | 0.5% | 24 Jul, 2026 | npm @budibase/server |
Budibase: NoSQL Injection via JSON Parameter Interpolation in MongoDB Query Execution CVE-2026-73618, GHSA-qw6m-8fw2-2v64 | High | 0.4% | 24 Jul, 2026 | npm @budibase/server |
Budibase: Unauthenticated user information disclosure via public tenant user lookup endpoint CVE-2026-73406, GHSA-hr66-5mqr-8mpx | High | 0.5% | 24 Jul, 2026 | npm @budibase/server |
Budibase: DNS rebinding SSRF bypasses remain in OpenAPI import and REST query execution CVE-2026-72855, GHSA-xg5g-26x8-cvf4 | High | 0.4% | 24 Jul, 2026 | npm @budibase/server |
Budibase: S3 presigned URL endpoint authorization regression in v3.39.4 allows BASIC users to obtain S3 PutObject presigned URLs CVE-2026-72859, GHSA-xcx6-4f2g-hhgx | High | 0.2% | 24 Jul, 2026 | npm @budibase/server |
Budibase: Server Filesystem Existence/Read Oracle via Builder-Controlled MongoDB tlsCertificateKeyFile CVE-2026-73409, GHSA-ppr4-5f46-j9c6 | High | 0.3% | 24 Jul, 2026 | npm @budibase/server |
Budibase: Email Change IDOR via POST /api/v2/email allows full Account Takeover (accountId not validated against session) CVE-2026-73303, GHSA-c8vc-7pv3-g98p | High | 0.3% | 24 Jul, 2026 | npm @budibase/server |
Budibase: Privilege escalation via public role assignment API missing app-level authorization CVE-2026-73305, GHSA-j9fc-w3mr-x6mv | High | 0.5% | 24 Jul, 2026 | npm @budibase/server |
Open WebUI: Cross-channel message overwrite via chat completion API (single-model and multimodel message_ids) CVE-2026-59714, GHSA-x2ff-v5v8-m75m, PYSEC-2026-3605 | High | 0.5% | 24 Jul, 2026 | PyPI open-webui |
js-yaml: Exponential parsing time in flow collections leads to denial of service CVE-2026-73643, GHSA-pm4m-ph32-ghv5 | High | 0.5% | 24 Jul, 2026 | npm js-yaml |
React Router: RSC Mode CSRF Bypass Allows Action Execution Before 400 Response GHSA-qwww-vcr4-c8h2 | High | Not scored | 24 Jul, 2026 | npm react-router |
GitPython: Unsafe git option guard bypass via single-character kwarg value token smuggling enables arbitrary command execution CVE-2026-73625, GHSA-r9mr-m37c-5fr3, PYSEC-2026-3953 | High | 0.9% | 24 Jul, 2026 | PyPI GitPython PyPI gitpython |
GitPython: Incomplete unsafe_git_clone_options denylist omits --template enabling arbitrary command execution via clone hooks CVE-2026-73623, GHSA-6p8h-3wgx-97gf, PYSEC-2026-3952 | High | 0.8% | 24 Jul, 2026 | PyPI GitPython PyPI gitpython |
GitPython: Arbitrary file overwrite via git diff --output argument injection in Diffable.diff (key- and value-controlled) CVE-2026-73624, GHSA-fjr4-x663-mwxc, PYSEC-2026-3995 | High | 0.6% | 24 Jul, 2026 | PyPI GitPython PyPI gitpython |
node-tar: Uncontrolled recursion in mapHas/filesFilter allows uncatchable stack-overflow DoS via crafted long-path tar with member selection CVE-2026-73566, GHSA-r292-9mhp-454m | High | 0.5% | 24 Jul, 2026 | npm tar |
PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure CVE-2026-73646, GHSA-r28c-9q8g-f849 | High | 0.5% | 24 Jul, 2026 | npm postcss |
GitPython: git-config section-name injection enables arbitrary config directives (core.sshCommand RCE) CVE-2026-69097, GHSA-3rp5-jjmw-4wv2, PYSEC-2026-3981 | High | 0.3% | 24 Jul, 2026 | PyPI gitpython |
Better Auth: Account takeover via pre-account hijacking on magic-link and email-OTP sign-in CVE-2026-67327, GHSA-qq9h-g4jm-xgf3 | High | 0.4% | 24 Jul, 2026 | npm better-auth |
@better-auth/stripe: cross-organization billing tampering in organization subscription actions CVE-2026-67329, GHSA-h3rm-78g3-j7cp | High | 0.3% | 24 Jul, 2026 | npm @better-auth/stripe |
React Router: Unauthenticated Denial of Service via Inefficient Route Matching CVE-2026-55685, GHSA-chx6-hx7r-mcp5 | High | 0.7% | 24 Jul, 2026 | npm react-router |
AWS Bedrock AgentCore: Improper neutralization of argument delimiters in the Python SDK install_packages() CVE-2026-16796, GHSA-j6g5-3hh3-pgw8, PYSEC-2026-3551 | High | 0.7% | 23 Jul, 2026 | PyPI bedrock-agentcore |
find-my-way: DDoS with HTTP2 CVE-2026-47219, GHSA-c96f-x56v-gq3h | High | 0.5% | 23 Jul, 2026 | npm find-my-way |
AWS API MCP Server Security Policy Bypass via Startup Initialization Failure CVE-2026-16584, GHSA-29w2-fq35-v728, PYSEC-2026-3549 | High | 0.2% | 23 Jul, 2026 | PyPI awslabs-aws-api-mcp-server PyPI awslabs.aws-api-mcp-server |
PHPSpreadsheet: XLS/OLE sector-chain self-loop causes memory exhaustion CVE-2026-59933, GHSA-xh5m-36r6-47m3 | High | 0.5% | 23 Jul, 2026 | Packagist phpoffice/phpspreadsheet |
PHPSpreadsheet: Gnumeric reader unbounded gzip expansion causes memory exhaustion CVE-2026-59932, GHSA-2mrg-gjxq-2gvr | High | 0.5% | 23 Jul, 2026 | Packagist phpoffice/phpspreadsheet |
PHPSpreadsheet: SSRF bypass via HTTP redirect in WEBSERVICE() domain whitelist CVE-2026-59931, GHSA-6hq5-7373-42rg | High | 0.5% | 23 Jul, 2026 | Packagist phpoffice/phpspreadsheet |
Auth.js: getToken() throws an uncaught exception on malformed Bearer authorization headers CVE-2026-73418, GHSA-xmf8-cvqr-rfgj | High | 0.9% | 23 Jul, 2026 | npm @auth/core npm next-auth |
brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash CVE-2026-14257, GHSA-mh99-v99m-4gvg | High | 0.6% | 23 Jul, 2026 | npm brace-expansion |
Grav: FlexDirectory::dynamicDataField() executes arbitrary callables from blueprint data with no validation CVE-2026-65608, GHSA-c4wf-2xxc-68qm | High | 1.1% | 23 Jul, 2026 | Packagist getgrav/grav |
@fastify/static vulnerable to route guard bypass via path traversal CVE-2026-15074, GHSA-83w8-p2f5-377r | High | 0.7% | 23 Jul, 2026 | npm @fastify/static |
JupyterLab: Cross-site scripting (XSS) via crafted settings file (`overrides.json`) BIT-jupyterlab-2026-73417, CVE-2026-73417, GHSA-pppj-hq3g-57pj, PYSEC-2026-3672 | High | 0.7% | 22 Jul, 2026 | PyPI jupyterlab |
JupyterLab: Image viewer allows XSS when opening malicious image in new browser tab BIT-jupyterlab-2026-73415, CVE-2026-73415, GHSA-gx64-gj6p-pc4c, PYSEC-2026-3671 | High | 0.7% | 22 Jul, 2026 | PyPI jupyterlab |