Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in mlflow-ui (PyPI) MAL-2026-10779 | Malicious | Not scored | 18 Jul, 2026 | PyPI mlflow-ui |
Malicious release: Malicious code in relativity-pdfjs-dist (npm) MAL-2026-10778 | Malicious | Not scored | 18 Jul, 2026 | npm relativity-pdfjs-dist |
Malicious release: Malicious code in telemetry-axios (npm) GHSA-89mf-39r2-ff96, MAL-2026-10773 | Malicious | Not scored | 17 Jul, 2026 | npm telemetry-axios |
Malicious release: Malicious code in axios-native (npm) GHSA-9j78-5mc3-56h7, MAL-2026-10772 | Malicious | Not scored | 17 Jul, 2026 | npm axios-native |
Malicious release: Malicious code in dwh-kafka-client (PyPI) MAL-2026-10915 | Malicious | Not scored | 17 Jul, 2026 | PyPI dwh-kafka-client |
Skipper: Incomplete fix for CVE-2026-50197: an oversized body can bypass OPA deny-on-presence Rego policies CVE-2026-65838, GHSA-8qqm-fp2q-v734, GO-2026-6019 | High | 0.5% | 17 Jul, 2026 | Go github.com/zalando/skipper |
Skipper's routesrv-no-auth component: All routesrv API Endpoints Lack Authentication CVE-2026-54246, GHSA-5587-2x54-jj6h, GO-2026-6018 | Medium | 0.3% | 17 Jul, 2026 | Go github.com/zalando/skipper |
CloudTAK: Authenticated full-read SSRF in the /api/esri* routes — user-controlled URL fetched with no IP-classification guard CVE-2026-55177, GHSA-r95q-fp26-h3hc | High | 0.4% | 17 Jul, 2026 | npm @tak-ps/cloudtak |
PocketSphinx: Buffer overflows in language and acoustic model loading code CVE-2026-54559, GHSA-56r5-2p2f-7cxp, PYSEC-2026-3498 | Medium | 0.5% | 17 Jul, 2026 | PyPI pocketsphinx |
Malicious release: Malicious code in trongridme (PyPI) GHSA-4fhx-73c8-xxhv, MAL-2026-10771 | Malicious | Not scored | 17 Jul, 2026 | PyPI trongridme |
PRoot-Distro has Path Traversal in proot-distro copy — Arbitrary Read, Write, and Persistent Code Execution Outside Container Rootfs GHSA-mfr4-mq8w-vmg6 | Medium | Not scored | 17 Jul, 2026 | PyPI proot-distro |
ExifReader HEIC/AVIF ISO-BMFF parser throws uncaught RangeError on truncated boxes CVE-2026-53496, GHSA-g77h-45rf-hcx4 | Medium | 0.5% | 17 Jul, 2026 | npm exifreader |
Langflow: Unauthenticated Flow Execution via Webhook Authentication Bypass CVE-2026-8505, GHSA-cf6m-vc3m-7cgm, PYSEC-2026-4233 | Critical | 0.9% | 17 Jul, 2026 | PyPI langflow |
WordPress Core Interpretation Conflict Vulnerability CVE-2026-63030 | CriticalExploited | 10.6% | 17 Jul, 2026 | |
WordPress Core SQL Injection Vulnerability CVE-2026-60137 | MediumExploited | 5.3% | 17 Jul, 2026 | |
Flask-Reuploaded: Extension-denylist bypass via case-folding asymmetry in name-override path (incomplete-fix variant of CVE-2026-27641) CVE-2026-54567, GHSA-937x-gpqr-72gg, PYSEC-2026-3466 | High | 0.6% | 17 Jul, 2026 | PyPI Flask-Reuploaded PyPI flask-reuploaded |
mcp-memory-keeper: Arbitrary local file read in context_import via unvalidated filePath CVE-2026-54561, GHSA-f7wf-v2vw-mpcx | Medium | 0.2% | 17 Jul, 2026 | npm mcp-memory-keeper |
Formie: Missing authorization in administrative settings allows low-privileged CP users to modify plugin configuration GHSA-cvpc-hccg-wmw4 | Medium | Not scored | 17 Jul, 2026 | Packagist verbb/formie |
Gitea has insufficient permission checks for Composer package source links CVE-2026-27771, GHSA-8qw8-rq86-9pc2, GO-2026-6017 | High | 1.4% | 17 Jul, 2026 | Go code.gitea.io/gitea |
TAK-PS-Stats Web UI: Authenticated full-read SSRF in CloudTAK basemap import (PUT /api/basemap) — no IP-classification guard CVE-2026-54546, GHSA-vqrw-qphh-p34v | Medium | 0.4% | 17 Jul, 2026 | npm @tak-ps/cloudtak |
oapi-codegen: OpenAPI Server Description Escapes Generated Go Comment and Injects Executable Code GHSA-rjwr-m7qx-3fjr, GO-2026-6016 | Low | Not scored | 17 Jul, 2026 | Go github.com/oapi-codegen/oapi-codegen Go github.com/oapi-codegen/oapi-codegen/v2 |
meta-ads-mcp: X-Pipeboard-Token Header Auth Bypass Reuses Operator Meta Token CVE-2026-54547, GHSA-2v2f-mvfg-ph56, PYSEC-2026-3484 | High | 0.5% | 17 Jul, 2026 | PyPI meta-ads-mcp |
meta-ads-mcp: Server-Side Request Forgery (SSRF) in `upload_ad_image` via Unrestricted `image_url` Fetch CVE-2026-54549, GHSA-45gf-fjxp-cjpq, PYSEC-2026-3485 | High | 0.4% | 17 Jul, 2026 | PyPI meta-ads-mcp |
sh _uid does not drop supplementary groups (incomplete privilege drop) CVE-2026-54552, GHSA-q38v-wp89-2w55, PYSEC-2026-3540 | High | 0.2% | 17 Jul, 2026 | PyPI sh |
plone.restapi: Stored XSS by spoofing mime type GHSA-8rqh-vxpr-x77p | Medium | Not scored | 17 Jul, 2026 | PyPI plone-restapi PyPI plone.restapi |
plone.app.textfield: Stored XSS by spoofing mime type CVE-2026-54503, GHSA-4r4f-gg25-rmg5, PYSEC-2026-3497 | Medium | 0.4% | 17 Jul, 2026 | PyPI plone-app-textfield PyPI plone.app.textfield |
IBM Langflow Code Injection Vulnerability CVE-2026-9198 | CriticalExploited | 28.7% | 17 Jul, 2026 | |
Skipper: Unbounded Request Body Read in Admission Webhook Causes Memory Exhaustion DoS CVE-2026-54247, GHSA-cwxq-rc9x-2jvv, GO-2026-6015 | Medium | 0.3% | 17 Jul, 2026 | Go github.com/zalando/skipper |
Sangoma Switchvox SQL Injection Vulnerability CVE-2026-9586 | CriticalExploited | 19.0% | 17 Jul, 2026 | |
Malicious release: Malicious code in govpkg (PyPI) MAL-2026-10770 | Malicious | Not scored | 17 Jul, 2026 | PyPI govpkg |
Malicious release: Malicious code in n8n-nodes-final-mile (npm) MAL-2026-10776 | Malicious | Not scored | 17 Jul, 2026 | npm n8n-nodes-final-mile |
Malicious release: Malicious code in n8n-nodes-devops-utils (npm) MAL-2026-10775 | Malicious | Not scored | 17 Jul, 2026 | npm n8n-nodes-devops-utils |
Malicious release: Malicious code in n8n-nodes-probe (npm) MAL-2026-10777 | Malicious | Not scored | 17 Jul, 2026 | npm n8n-nodes-probe |
Malicious release: Malicious code in easyway2 (npm) MAL-2026-10769 | Malicious | Not scored | 17 Jul, 2026 | npm easyway2 |
Malicious release: Malicious code in n8n-nodes-api-finder (npm) MAL-2026-10774 | Malicious | Not scored | 17 Jul, 2026 | npm n8n-nodes-api-finder |
Malicious release: Malicious code in trongridev (PyPI) GHSA-hx6g-6877-qvg8, MAL-2026-10768 | Malicious | Not scored | 17 Jul, 2026 | PyPI trongridev |
Malicious release: Malicious code in my-tailwind-gutenberg-block (npm) GHSA-mhvw-mw3c-6mc5, MAL-2026-10761 | Malicious | Not scored | 16 Jul, 2026 | npm my-tailwind-gutenberg-block |
Malicious release: Malicious code in abseil-py (PyPI) MAL-2026-10760 | Malicious | Not scored | 16 Jul, 2026 | PyPI abseil-py |
Genql: inject arbitrary JavaScript or TypeScript via a GraphQL schema CVE-2026-63397, GHSA-w757-xvvv-vgfw | High | 0.5% | 16 Jul, 2026 | npm @genql/cli |
Whistle vulnerable to path traversal CVE-2026-55629, GHSA-3vfr-4gwf-qxfp | High | 0.6% | 16 Jul, 2026 | npm whistle |
Pheditor: Hardcoded default password 'admin' with no forced change enables full application compromise CVE-2026-55579, GHSA-p4h7-p9rj-2pq2 | Critical | 0.8% | 16 Jul, 2026 | Packagist pheditor/pheditor |
Pheditor: Incomplete command sanitization in terminal feature allows RCE via pipe operator, backtick substitution, and newline injection CVE-2026-55578, GHSA-wg4w-wr5q-6vjc | High | 0.7% | 16 Jul, 2026 | Packagist pheditor/pheditor |
kuma-dp connects to control plane without verifying TLS certificate when no CA is configured CVE-2026-18679, CVE-2026-52724, GHSA-wvmp-6r4v-j6cv, GO-2026-6013 | Medium | 0.4% | 16 Jul, 2026 | Go github.com/kumahq/kuma Go github.com/kumahq/kuma/v2 |
Pheditor has an authenticated terminal command whitelist bypass CVE-2026-54540, GHSA-9643-6xjp-vx57 | High | 0.7% | 16 Jul, 2026 | Packagist pheditor/pheditor |
Nuclio: Unauthenticated path traversal in spec.handler allows arbitrary file write in Dashboard container CVE-2026-52832, GHSA-wpcj-rmv4-86qg, GO-2026-6012 | Medium | 0.6% | 16 Jul, 2026 | Go github.com/nuclio/nuclio |
Nuclio: Unsanitized runtimeAttributes.repositories injected into Groovy build.gradle leads to build-time RCE CVE-2026-52833, GHSA-3v79-m2cg-89ww, GO-2026-6004 | High | 0.6% | 16 Jul, 2026 | Go github.com/nuclio/nuclio |
Envoy Gateway: xDS Control Plane Information Disclosure when operating in GatewayNamespaceMode BIT-envoy-gateway-2026-53714, CVE-2026-53714, GHSA-22xc-xg2r-9j7v, GO-2026-6003 | High | 0.3% | 16 Jul, 2026 | Go github.com/envoyproxy/gateway |
Envoy Gateway: Authentication Bypass via Improper Input Validation in EnvoyExtensionPolicy Lua Allows Secret Disclosure BIT-envoy-gateway-2026-53713, CVE-2026-53713, GHSA-wcrf-9vrr-854f, GO-2026-6011 | Critical | 0.4% | 16 Jul, 2026 | Go github.com/envoyproxy/gateway |
Envoy Gateway: Wasm cache ServeHTTP reads mappingPath2Cache without lock BIT-envoy-gateway-2026-53715, CVE-2026-53715, GHSA-8fv2-88gg-hm7q, GO-2026-6005 | Medium | 0.5% | 16 Jul, 2026 | Go github.com/envoyproxy/gateway |
Envoy Gateway: OCI layer extraction allocates make([]byte, h.Size) from untrusted tar header BIT-envoy-gateway-2026-53717, CVE-2026-53717, GHSA-h7pq-86h8-rp5x, GO-2026-6008 | Medium | 0.7% | 16 Jul, 2026 | Go github.com/envoyproxy/gateway |