Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Happy DOM: Incomplete fix for CVE-2026-33943: unsanitized import alias leads to host code execution CVE-2026-115895, GHSA-834v-8h66-3h79 | High | 0.4% | 6 days ago | npm happy-dom |
postal-mime: Quadratic CPU consumption when decoding a header of many joinable RFC 2047 base64 encoded words GHSA-f2hq-32vh-53cc | High | Not scored | 6 days ago | npm postal-mime |
Twisted: Unauthenticated Remote Denial of Service in the Twisted IRC Server via an Unbounded Line Buffer CVE-2026-115776, GHSA-53xc-49m8-p798 | High | 0.5% | 6 days ago | PyPI Twisted PyPI twisted |
Twisted: Unauthenticated Remote Denial of Service in the Twisted conch Telnet Transport via an Unbounded Subnegotiation Buffer CVE-2026-115778, GHSA-cwm5-jh59-mwxr | High | 0.5% | 6 days ago | PyPI Twisted PyPI twisted |
Twisted: Unauthenticated Remote Denial of Service in the Twisted words domish XML Element Stream via an Unbounded Element Tree CVE-2026-115775, GHSA-3476-c5c2-fr73 | High | 0.4% | 6 days ago | PyPI Twisted PyPI twisted |
virtualenv: Bash activator leaves the --prompt value unescaped in PS1 when promptvars is off, so prompt expansion later executes it (regression in 21.14.9) BIT-virtualenv-2026-115586, CVE-2026-115586, GHSA-cx6f-vjhg-g3cc | High | 0.2% | 6 days ago | PyPI virtualenv |
pypdf: Possible long runtimes for repeated malformed cross-reference entries (Follow-up) CVE-2026-115585, GHSA-jr96-gvgh-j3r4 | High | 0.4% | 6 days ago | PyPI pypdf |
pypdf: Possible long runtimes for large xref table header limits CVE-2026-115580, GHSA-gmh7-3g9r-mjh5 | High | 0.4% | 6 days ago | PyPI pypdf |
pypdf: Possible long runtimes for repeated references to the same missing object CVE-2026-115572, GHSA-6c7f-9265-g8fw | High | 0.4% | 6 days ago | PyPI pypdf |
Electron: Mitigation for compromised eMudhra intermediate certificates CVE-2026-115570, GHSA-jr5w-w6x2-84p9 | High | 0.4% | 6 days ago | npm electron |
@justice8096/sagemath-mcp-server: executes arbitrary code via the escapeShellString and sanitizeCode functions CVE-2026-106763, GHSA-2vq3-mpmf-9xgr | High | Not scored | 6 days ago | npm @justice8096/sagemath-mcp-server |
obsidian-tc: Memory-lifecycle tools overwrite unowned notes or partially commit lifecycle changes CVE-2026-115478, GHSA-r3g7-r4hr-m258 | High | 0.3% | 6 days ago | npm obsidian-tc |
obsidian-tc: Declined human-in-the-loop confirmations can permit destructive calls over HTTP CVE-2026-115477, GHSA-737x-cwfr-5vvc | High | 0.4% | 6 days ago | npm obsidian-tc |
@rog0x/mcp-git-tools executes arbitrary code via the resolveBaseBranch function CVE-2026-106764, GHSA-jwc4-922r-f2rw | High | Not scored | 6 days ago | npm @rog0x/mcp-git-tools |
Strands Agents SDK: Exposure of data element to wrong session in the A2A Server CVE-2026-115419, GHSA-4v6f-7vjh-6x4m | High | 0.4% | 7 days ago | PyPI strands-agents npm @strands-agents/sdk |
Mistune: Path Traversal and XSS in Include directive CVE-2026-115355, GHSA-h7ww-273w-6cm8 | High | 0.5% | 7 days ago | PyPI mistune |
MessagePack: Unbounded memory leak in msgpack C extension on strict_map_key validation failure CVE-2026-114613, GHSA-j586-36cw-2gc2 | High | 0.4% | 7 days ago | PyPI msgpack |
PhpSpreadsheet ODS Reader: Unbounded number-rows-repeated → CPU & Memory Exhaustion (DoS) CVE-2026-108359, GHSA-j2w7-387v-m2rq | High | 0.4% | 7 days ago | Packagist phpoffice/phpspreadsheet |
PhpSpreadsheet: XmlScanner Bypass via ISO-2022 Escape Sequences Allows XXE and Denial of Service CVE-2026-108358, GHSA-3x94-m842-937c | High | 0.5% | 7 days ago | Packagist phpoffice/phpspreadsheet |
PhpSpreadsheet: XmlScanner Bypass via Double-Encoded unentity() TOCTOU Allows XXE and Denial of Service CVE-2026-108357, GHSA-rxj4-h86g-25gc | High | 0.4% | 7 days ago | Packagist phpoffice/phpspreadsheet |
dnspython dns.name.from_wire_parser() excessive CPU use CVE-2026-114605, GHSA-45c3-73f7-pv4m | High | 0.3% | 7 days ago | PyPI dnspython |
Pillow: Bundled libopenjp2 2.5.4 in all wheels since 11.1.0 carries OSV-2025-219 heap-buffer-overflow write reachable from Image.open().load() GHSA-78g4-xqwv-q3g8 | High | Not scored | 7 days ago | PyPI pillow |
GraphQL Tools: Prototype pollution in mergeIncrementalResult via non-primitive path segments CVE-2026-114604, GHSA-c4qx-w738-7hr3 | High | Not scored | 7 days ago | npm @graphql-tools/utils |
GraphQL-core: Denial of service via comment tokens bypassing the parser's max_tokens limit CVE-2026-75508, GHSA-r77w-qph3-7vf8 | High | 0.6% | 7 days ago | PyPI graphql-core |
GraphQL-core: Denial of service via quadratic complexity in the OverlappingFieldsCanBeMerged validation rule CVE-2026-75507, GHSA-vj8h-fx38-h3vc | High | 0.6% | 7 days ago | PyPI graphql-core |
DOMPurify IN_PLACE: hook that removes a parent or sibling leaves the detached subtree's event handlers armed (incomplete fix for GHSA-p98j-92pf-mc4p) CVE-2026-116803, GHSA-mrv2-3pqr-j5jr | High | 0.2% | 7 days ago | npm dompurify |
Black: GitHub Action installs unvalidated required-version from pyproject.toml CVE-2026-114134, GHSA-cg8m-r9f2-5wm2 | High | Not scored | 7 days ago | PyPI black |
Next.js: Denial of Service in App Router using Server Actions CVE-2026-94482, GHSA-p3m5-59mp-jv5r | High | 0.4% | 7 days ago | npm next |
PyJWT: HS256/384/512 verify accepts empty HMAC key via oct JWK (PyJWK/PyJWKClient) enabling token forgery GHSA-pxh4-856f-4h89 | High | Not scored | 7 days ago | PyPI pyjwt |
Flexible GraphRAG: Cypher/Graph Injection via broken string-escaping in FalkorDB adapter (_escape()) - full graph wipe from ingested-document content CVE-2026-114510, GHSA-vqrg-773h-4wxc | High | 0.2% | 7 days ago | PyPI flexible-graphrag |
multer vulnerable to Denial of Service via a pending asynchronous fileFilter after request teardown CVE-2026-113872, GHSA-q7qp-rjg7-q26m | High | 0.4% | 7 days ago | npm multer |
body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body CVE-2026-111181, GHSA-27r3-jxmh-p828 | High | 0.4% | 7 days ago | npm body-parser |
Pillow: Memory disclosure and segfault in libtiff encoder via crafted TIFF tags CVE-2026-112902, GHSA-xvh5-g6gv-559v | High | Not scored | 8 days ago | PyPI Pillow PyPI pillow |
Pillow: Heap buffer overflow writing JPEG comment after ICC profile fills buffer BIT-pillow-2026-96778, CVE-2026-96778, GHSA-g7cr-3p24-7wf7 | High | 0.5% | 8 days ago | PyPI Pillow PyPI pillow |
Pillow: Heap over-read in WMF/EMF rendering via 16-bit dimension truncation (Windows builds) BIT-pillow-2026-96644, CVE-2026-96644, GHSA-9v9v-9qvf-h2hj, PYSEC-2026-4343 | High | 0.4% | 8 days ago | PyPI Pillow PyPI pillow |
Pillow: PNG eXIf chunk makes EXIF parsing run in quadratic time BIT-pillow-2026-96643, CVE-2026-96643, GHSA-g4qv-2jxx-769h, PYSEC-2026-4342 | High | 0.4% | 8 days ago | PyPI Pillow PyPI pillow |
Pillow: TarIO negative size field causes infinite CPU-spin loop BIT-pillow-2026-96642, CVE-2026-96642, GHSA-3j72-p6qg-6xp7, PYSEC-2026-4341 | High | 0.3% | 8 days ago | PyPI Pillow PyPI pillow |
Pillow PDF append accepts malformed shared page-tree DAG causing resource exhaustion BIT-pillow-2026-96640, CVE-2026-96640, GHSA-mrfp-p49p-3hf2 | High | 0.6% | 8 days ago | PyPI Pillow PyPI pillow |
Pillow: Decompression bomb check bypass in SpiderImagePlugin.seek() leads to unbounded allocation DoS BIT-pillow-2026-96637, CVE-2026-96637, GHSA-g842-9rc4-69pw, PYSEC-2026-4338 | High | 0.4% | 8 days ago | PyPI pillow |
GitPython validates a submodule's ".git" path only after cloning into it (RCE) CVE-2026-114145, GHSA-83vg-56qc-22m7 | High | 0.4% | 8 days ago | PyPI Gitpython PyPI gitpython |
toml-node: Uncontrolled resource consumption (CPU DoS) via unbounded-length integer literals in toml.parse() CVE-2026-114144, GHSA-9qmh-m7c6-f92p | High | 0.4% | 8 days ago | npm toml |
toml-node: Quadratic-complexity DoS via long dotted keys or table paths in toml.parse() CVE-2026-114143, GHSA-9j65-hcg3-gc64 | High | 0.5% | 8 days ago | npm toml |
toml-node: Prototype pollution: parsing a TOML document can write to Object.prototype CVE-2026-114142, GHSA-h895-cgqg-jf52 | High | 0.4% | 8 days ago | npm tome npm toml |
toml-node: Quadratic-complexity DoS via many array-of-tables headers in toml.parse() CVE-2026-114141, GHSA-4qx8-w7c3-pj3p | High | 0.4% | 8 days ago | npm toml |
nbconvert: Arbitrary file write through path traversal in cell output filenames when exporting to md, latex, rst and asciidoc CVE-2026-114140, GHSA-pjvx-prjx-h659 | High | 0.4% | 8 days ago | PyPI nbconvert |
Django REST framework: Accept header with many large quoted parameters burns ~19s of CPU per request in content negotiation CVE-2026-114138, GHSA-33wh-fxxf-88vv | High | 0.5% | 8 days ago | PyPI djangorestframework |
Django REST framework: TokenProxy.delete() reports success and revokes nothing CVE-2026-114137, GHSA-xw6w-gcfp-cf8m | High | 0.5% | 8 days ago | PyPI djangorestframework |
Django REST framework: JSONParser applies an attacker-named codec to the request stream CVE-2026-114136, GHSA-3547-9m27-7rxg | High | 0.4% | 8 days ago | PyPI djangorestframework |
Jupyter Server: Gateway WebSocket handler bypasses kernel execute authorization CVE-2026-114135, GHSA-354v-3q48-cv69 | High | 0.5% | 8 days ago | PyPI jupyter-server |
Storybook dev server vulnerable to code injection from the local network CVE-2026-114126, GHSA-px85-f4q5-jh77 | High | 0.5% | 8 days ago | npm @storybook/addon-mcp npm @storybook/addon-vitest npm @storybook/core npm @storybook/core-server +2 more |