Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Azure AI Language Authoring Elevation of Privilege Vulnerability can Lead to RCE CVE-2026-21531, GHSA-436v-jg82-p533, PYSEC-2026-289 | Critical | 2.6% | 10 Feb, 2026 | PyPI azure-ai-language-conversations-authoring |
CASL Ability is Vulnerable to Prototype Pollution CVE-2026-1774, GHSA-x9vf-53q3-cvx6 | Critical | 0.7% | 10 Feb, 2026 | npm @casl/ability |
FUXA Unauthenticated Remote Arbitrary Scheduler Write CVE-2026-25939, GHSA-c869-jx4c-q5fc | Critical | 12.7% | 09 Feb, 2026 | npm fuxa-server |
FUXA Unauthenticated Remote Code Execution in Node-RED Integration CVE-2026-25938, GHSA-v4p5-w6r3-2x4f | Critical | 1.1% | 09 Feb, 2026 | npm fuxa-server |
@nyariv/sandboxjs has host prototype pollution from sandbox via array intermediary (sandbox escape) CVE-2026-25881, GHSA-ww7g-4gwx-m7wj | Critical | 0.6% | 09 Feb, 2026 | npm @nyariv/sandboxjs |
BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) OS Command Injection Vulnerability CVE-2026-1731 | CriticalExploited | 93.1% | 06 Feb, 2026 | |
Keylime Missing Authentication for Critical Function and Improper Authentication CVE-2026-1709, GHSA-4jqp-9qjv-57m2, PYSEC-2026-74 | Critical | 5.8% | 06 Feb, 2026 | PyPI keylime |
A single post-release of dydx-v4-client contained obfuscated multi-stage loader GHSA-4f84-67cv-qrv3 | Critical | Not scored | 06 Feb, 2026 | PyPI dydx-v4-client |
Semantic Kernel has Arbitrary File Write via AI Agent Function Calling in .NET SDK CVE-2026-25592, GHSA-2ww3-72rp-wpp4, PYSEC-2026-531 | Critical | 2.6% | 06 Feb, 2026 | NuGet Microsoft.SemanticKernel.Core PyPI semantic-kernel |
OpenSTAManager has an OS Command Injection in P7M File Processing CVE-2025-69212, GHSA-25fp-8w8p-mx36 | Critical | 1.9% | 06 Feb, 2026 | Packagist devcode-it/openstamanager |
Fortinet FortiClient EMS SQL Injection Vulnerability CVE-2026-21643 | CriticalExploited | 97.7% | 06 Feb, 2026 | |
@nyariv/sandboxjs vulnerable to sandbox escape via TOCTOU bug on keys in property accesses CVE-2026-25641, GHSA-7x3h-rm86-3342 | Critical | 0.5% | 05 Feb, 2026 | npm @nyariv/sandboxjs |
@nyariv/sandboxjs has a Sandbox Escape vulnerability CVE-2026-25587, GHSA-66h4-qj4x-38xp | Critical | 0.7% | 05 Feb, 2026 | npm @nyariv/sandboxjs |
@nyariv/sandboxjs has Sandbox Escape via Prototype Whitelist Bypass and Host Prototype Pollution CVE-2026-25586, GHSA-jjpw-65fv-8g48 | Critical | 0.7% | 05 Feb, 2026 | npm @nyariv/sandboxjs |
@payloadcms/drizzle has SQL Injection in JSON/RichText Queries on PostgreSQL/SQLite Adapters CVE-2026-25544, GHSA-xx6w-jxg9-2wh8 | Critical | 0.8% | 05 Feb, 2026 | npm @payloadcms/drizzle |
@nyariv/sandboxjs has a Sandbox Escape issue CVE-2026-25520, GHSA-58jh-xv4v-pcx4 | Critical | 0.9% | 05 Feb, 2026 | npm @nyariv/sandboxjs |
FUXA Unauthenticated Remote Arbitrary Device Tag Write CVE-2026-25752, GHSA-ggxw-g3cp-mgf8 | Critical | 0.5% | 05 Feb, 2026 | npm fuxa-server |
FUXA Unauthenticated Remote Code Execution via Arbitrary File Write in Upload API CVE-2026-25895, GHSA-88qh-cphv-996c | Critical | 13.0% | 05 Feb, 2026 | npm fuxa-server |
FUXA Unauthenticated Remote Code Execution via Hardcoded JWT Secret in Default Configuration CVE-2026-25894, GHSA-32cc-x95p-fxcg | Critical | 0.9% | 05 Feb, 2026 | npm fuxa-server |
FUXA Unauthenticated Exposure of Plaintext Database Credentials CVE-2026-25751, GHSA-c5gq-4h56-4mmx | Critical | 0.3% | 05 Feb, 2026 | npm fuxa-server |
FUXA Unauthenticated Remote Code Execution via Admin JWT Minting CVE-2026-25893, GHSA-vwcg-c828-9822 | Critical | 0.8% | 05 Feb, 2026 | npm fuxa-server |
EPyT-Flow vulnerable to unsafe JSON deserialization (__type__) CVE-2026-25632, GHSA-74vm-8frp-7w68, PYSEC-2026-330 | Critical | 0.8% | 04 Feb, 2026 | PyPI epyt-flow |
survey-pdf Upgraded jsPDF Version Due to Security Vulnerability CVE-2026-25630, GHSA-h3q6-jfrg-3x6q | Critical | Not scored | 04 Feb, 2026 | npm survey-pdf |
n8n Vulnerable to Command Injection in Community Package Installation CVE-2026-21893, GHSA-7c4h-vh2m-743m | Critical | 1.6% | 04 Feb, 2026 | npm n8n |
n8n has a Python sandbox escape CVE-2026-25115, GHSA-8398-gmmx-564h | Critical | 0.6% | 04 Feb, 2026 | npm n8n |
n8n Merge Node has Arbitrary File Write leading to RCE CVE-2026-25056, GHSA-hv53-3329-vmrm | Critical | 0.7% | 04 Feb, 2026 | npm n8n |
n8n has OS Command Injection in Git Node CVE-2026-25053, GHSA-9g95-qf3f-ggrw | Critical | 0.6% | 04 Feb, 2026 | npm n8n |
n8n's Improper File Access Controls Allow Arbitrary File Read by Authenticated Users CVE-2026-25052, GHSA-gfvg-qv54-r4pc | Critical | 0.3% | 04 Feb, 2026 | npm n8n |
n8n Has Expression Escape Vulnerability Leading to RCE CVE-2026-25049, GHSA-6cqr-8cfr-67f8 | Critical | 1.6% | 04 Feb, 2026 | npm n8n |
Prototype Pollution via FormData Processing in Qwik City CVE-2026-25150, GHSA-xqg6-98cw-gxhq | Critical | 0.7% | 03 Feb, 2026 | npm @builder.io/qwik-city |
@isaacs/brace-expansion has Uncontrolled Resource Consumption CVE-2026-25547, GHSA-7h2j-956f-4vf2 | Critical | 0.5% | 03 Feb, 2026 | npm @isaacs/brace-expansion |
FUXA allows Remote Code Execution (RCE) via the project import functionality. CVE-2025-69983, GHSA-5r63-q8hg-p8qx | Critical | 0.5% | 03 Feb, 2026 | npm fuxa-server |
FUXA contains an Unrestricted File Upload vulnerability CVE-2025-69981, GHSA-7g56-fwxj-cm23 | Critical | 0.8% | 03 Feb, 2026 | npm fuxa-server |
FUXA has a hardcoded fallback JWT signing secret CVE-2025-69971, GHSA-c8m8-3jcr-6rj5 | Critical | 2.2% | 03 Feb, 2026 | npm @frangoteam/fuxa |
FUXA contains an insecure default configuration vulnerability CVE-2025-69970, GHSA-r5m2-fqcf-qrf7 | Critical | 0.5% | 03 Feb, 2026 | npm fuxa-server |
Unstructured has Path Traversal via Malicious MSG Attachment that Allows Arbitrary File Write CVE-2025-64712, GHSA-gm8q-m8mv-jj5m, PYSEC-2026-558 | Critical | 0.7% | 03 Feb, 2026 | PyPI unstructured |
Moodle has an authorization logic flaw BIT-moodle-2025-67856, CVE-2025-67856, GHSA-hcm6-q6pc-xfhm | Critical | 0.3% | 03 Feb, 2026 | Packagist moodle/moodle |
locutus is vulnerable to Prototype Pollution CVE-2026-25521, GHSA-rxrv-835q-v5mh | Critical | 0.3% | 02 Feb, 2026 | npm locutus |
CI4MS Vulnerable to Remote Code Execution (RCE) via Arbitrary File Creation and Save in File Editor CVE-2026-25510, GHSA-gp56-f67f-m4px | Critical | 0.9% | 02 Feb, 2026 | Packagist ci4-cms-erp/ci4ms |
Bambuddy Uses Hardcoded Secret Key + Many API Endpoints do not Require Authentication CVE-2026-25505, GHSA-gc24-px2r-5qmf | Critical | 0.8% | 02 Feb, 2026 | PyPI bambuddy |
picklescan missing detection by simple obfuscation of a `builtins.eval` call CVE-2026-53874, GHSA-9m3x-qqw2-h32h, PYSEC-2026-1789 | Critical | 0.5% | 02 Feb, 2026 | PyPI picklescan |
Langroid has WAF Bypass Leading to RCE in TableChatAgent CVE-2026-25481, GHSA-x34r-63hx-w57f, PYSEC-2026-383 | Critical | 0.7% | 02 Feb, 2026 | PyPI langroid |
SandboxJS Vulnerable to Prototype Pollution -> Sandbox Escape -> RCE CVE-2026-25142, GHSA-9p4w-fq8m-2hp7 | Critical | 1.2% | 02 Feb, 2026 | npm @nyariv/sandboxjs |
FacturaScripts has Stored Cross-Site Scripting (XSS) in "Observations" field via History View CVE-2026-23997, GHSA-4v7v-7v7r-3r5h | Critical | 0.4% | 02 Feb, 2026 | Packagist facturascripts/facturascripts |
Signal K set-system-time plugin vulnerable to RCE - Command Injection CVE-2026-23515, GHSA-p8gp-2w28-mhwg | Critical | 4.5% | 02 Feb, 2026 | npm @signalk/set-system-time |
vLLM has RCE In Video Processing CVE-2026-22778, GHSA-4r2x-xpjr-7cvv, PYSEC-2026-565 | Critical | 18.3% | 02 Feb, 2026 | PyPI vllm |
H2O has an External Control of File Name or Path vulnerability CVE-2024-5986, GHSA-wj3h-wx8g-x699, PYSEC-2026-353 | Critical | 0.7% | 02 Feb, 2026 | Maven ai.h2o:h2o-core PyPI h2o |
Orval has Code Injection via unsanitized x-enum-descriptions using JS comments CVE-2026-25141, GHSA-gch2-phqh-fg9q | Critical | 0.7% | 30 Jan, 2026 | npm @orval/core |
CAI find_file Agent Tool has Command Injection Vulnerability Through Argument Injection CVE-2026-25130, GHSA-jfpc-wj3m-qw2m, PYSEC-2026-303 | Critical | 0.9% | 30 Jan, 2026 | PyPI cai-framework |
deepHas vulnerable to Prototype Pollution via constructor.prototype CVE-2026-25047, GHSA-2733-6c58-pf27 | Critical | 0.8% | 29 Jan, 2026 | npm deephas |