Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Grav: XSS Blueprint Validation Bypass via Twig String Concatenation CVE-2026-61453, GHSA-2c4f-86xc-cr74 | Medium | 0.2% | 15 Jul, 2026 | Packagist getgrav/grav |
Grav: Decompression-bomb size cap bypassed by forged ZIP size in ZipArchiver/Installer CVE-2026-61449, GHSA-8h9x-89f2-m7x3 | High | 0.3% | 15 Jul, 2026 | Packagist getgrav/grav |
PraisonAI: Plugin Auto-Discovery Executes Arbitrary Python Files Without Verification CVE-2026-61446, GHSA-m6wp-h223-4c8g, PYSEC-2026-4271 | High | 0.3% | 15 Jul, 2026 | PyPI praisonaiagents |
PraisonAI: SkillTools Executes Scripts Without Path Containment Validation CVE-2026-61443, GHSA-c44f-37qr-gw3f, PYSEC-2026-4270 | High | 0.6% | 15 Jul, 2026 | PyPI praisonaiagents |
PraisonAI: Platform members can rewrite shared labels and owner issue labels without owner/admin authorization CVE-2026-61440, GHSA-xxgv-vgvj-qvxh, PYSEC-2026-4264 | High | 0.3% | 15 Jul, 2026 | PyPI praisonai-platform |
PraisonAI vulnerable to Remote Code Execution via Broken AST Sandbox CVE-2026-61438, GHSA-26mh-57q7-jfvr | High | 0.3% | 15 Jul, 2026 | PyPI praisonai |
PraisonAI: AgentMail webhook mode accepts forged unsigned message.received events and invokes agents CVE-2026-61436, GHSA-7c92-x8vg-4258, PYSEC-2026-4252 | High | 0.4% | 15 Jul, 2026 | PyPI praisonai |
PraisonAI: Call API localhost-only authentication bypass via spoofed Host header CVE-2026-61435, GHSA-2gpf-2492-q9jh, PYSEC-2026-4247 | High | 0.5% | 15 Jul, 2026 | PyPI praisonai |
PraisonAI: API deploy code generator embeds unescaped YAML fields into Python source CVE-2026-61433, GHSA-79fv-7hq9-w7xg, PYSEC-2026-4251 | High | 0.2% | 15 Jul, 2026 | PyPI praisonai |
PraisonAI: DNS rebinding bypass in `web_crawl` SSRF protection allows internal response disclosure CVE-2026-61430, GHSA-qg25-6gc4-48mg, PYSEC-2026-4272 | High | 0.3% | 15 Jul, 2026 | PyPI praisonaiagents |
PraisonAI: MCP HTTP-stream transport is unauthenticated by default, exposing tool enumeration and an unvalidated tool-call surface CVE-2026-61427, GHSA-hc5v-gxvj-58wh, PYSEC-2026-4257 | High | 0.4% | 15 Jul, 2026 | PyPI praisonai |
PraisonAI: Human-in-the-loop tool approval is cached by tool name and silently reused for all subsequent calls with arbitrary arguments CVE-2026-60087, GHSA-29r9-67vg-qj56, PYSEC-2026-4265 | Medium | 0.3% | 15 Jul, 2026 | PyPI praisonaiagents |
PraisonAI: SecurityPolicy command/path/import restrictions are completely unenforced by the default SubprocessSandbox backend CVE-2026-60085, GHSA-5r6c-gj4g-r697, PYSEC-2026-4250 | High | 0.3% | 15 Jul, 2026 | PyPI praisonai |
n8n: External Secrets Permission Bypass via Expression Parser Mismatch CVE-2026-59259, GHSA-jp7m-xcgx-57qm | Medium | 0.4% | 15 Jul, 2026 | npm n8n |
n8n: External Secrets Accessible via Workflow Expressions Outside Credentials CVE-2026-59254, GHSA-2434-3x6q-8r99 | Medium | 0.4% | 15 Jul, 2026 | npm n8n |
Malicious release: Malicious code in rakibox (npm) MAL-2026-10679 | Malicious | Not scored | 15 Jul, 2026 | npm rakibox |
Malicious release: Malicious code in ls-env-config (npm) MAL-2026-10678 | Malicious | Not scored | 15 Jul, 2026 | npm ls-env-config |
Malicious release: Malicious code in deployowl (npm) MAL-2026-10677 | Malicious | Not scored | 15 Jul, 2026 | npm deployowl |
Malicious release: Malicious code in syncgrove (npm) MAL-2026-10680 | Malicious | Not scored | 15 Jul, 2026 | npm syncgrove |
Malicious release: Malicious code in commonjs-assert (npm) GHSA-hcmm-fvc7-pjv3, MAL-2026-10676 | Malicious | Not scored | 15 Jul, 2026 | npm commonjs-assert |
Malicious release: Malicious code in ac-raf-emitter (npm) MAL-2026-10675 | Malicious | Not scored | 15 Jul, 2026 | npm ac-raf-emitter |
Malicious release: Malicious code in northstart-sdk (PyPI) MAL-2026-10672 | Malicious | Not scored | 15 Jul, 2026 | PyPI northstart-sdk |
Malicious release: Malicious code in gulp-jscrambler (npm) GHSA-2cjx-v4hm-f5gf, MAL-2026-10673 | Malicious | Not scored | 15 Jul, 2026 | npm gulp-jscrambler |
Malicious release: Malicious code in jscrambler-metro-plugin (npm) GHSA-v442-7fpg-636g, MAL-2026-10674 | Malicious | Not scored | 15 Jul, 2026 | npm jscrambler-metro-plugin |
Malicious release: Malicious code in chain-as-log (npm) MAL-2026-10668 | Malicious | Not scored | 15 Jul, 2026 | npm chain-as-log |
Malicious release: Malicious code in spytrack (npm) MAL-2026-10671 | Malicious | Not scored | 15 Jul, 2026 | npm spytrack |
Malicious release: Malicious code in dbconnectify (npm) GHSA-p5xv-vqcx-vm42, MAL-2026-10669 | Malicious | Not scored | 15 Jul, 2026 | npm dbconnectify |
Malicious release: Malicious code in eslintcmd (npm) GHSA-73c6-pgjj-9v82, MAL-2026-10670 | Malicious | Not scored | 15 Jul, 2026 | npm eslintcmd |
Malicious release: Malicious code in @fhkry/baileys-v2 (npm) GHSA-g5qp-fx35-w54m, MAL-2026-10664 | Malicious | Not scored | 15 Jul, 2026 | npm @fhkry/baileys-v2 |
Malicious release: Malicious code in @fhkry/x-baileys (npm) GHSA-mxxc-f6p6-98j7, MAL-2026-10665 | Malicious | Not scored | 15 Jul, 2026 | npm @fhkry/x-baileys |
Malicious release: Malicious code in crypto-hasher (npm) GHSA-886f-w6pq-7w7j, MAL-2026-10666 | Malicious | Not scored | 15 Jul, 2026 | npm crypto-hasher |
Malicious release: Malicious code in true (npm) GHSA-f59f-vj5q-c725, MAL-2026-10667 | Malicious | Not scored | 15 Jul, 2026 | npm true |
Malicious release: Malicious code in @sauruslord/eslint-config (npm) GHSA-j2wh-xp56-gp35, MAL-2026-10658 | Malicious | Not scored | 15 Jul, 2026 | npm @sauruslord/eslint-config |
Malicious release: Malicious code in ssweb-wp (npm) GHSA-mcxp-9g3h-6rjx, MAL-2026-10662 | Malicious | Not scored | 15 Jul, 2026 | npm ssweb-wp |
Malicious release: Malicious code in @sauruslord/libsignal (npm) GHSA-p9pv-49fq-8f6m, MAL-2026-10659 | Malicious | Not scored | 15 Jul, 2026 | npm @sauruslord/libsignal |
Malicious release: Malicious code in zaldy-baileys (npm) GHSA-chjv-gxch-4gwg, MAL-2026-10663 | Malicious | Not scored | 15 Jul, 2026 | npm zaldy-baileys |
Malicious release: Malicious code in @sauruslord/baileys (npm) GHSA-gq5v-w47h-r596, MAL-2026-10657 | Malicious | Not scored | 15 Jul, 2026 | npm @sauruslord/baileys |
Malicious release: Malicious code in sauruslord-baileys (npm) GHSA-h2r9-2p5m-9f8g, MAL-2026-10661 | Malicious | Not scored | 15 Jul, 2026 | npm sauruslord-baileys |
Malicious release: Malicious code in saurus-assets (npm) GHSA-hp4j-58vc-g6px, MAL-2026-10660 | Malicious | Not scored | 15 Jul, 2026 | npm saurus-assets |
Malicious release: Malicious code in @debile/require-dir (npm) MAL-2026-10654 | Malicious | Not scored | 15 Jul, 2026 | npm @debile/require-dir |
Malicious release: Malicious code in gmail-changer (npm) MAL-2026-10635 | Malicious | Not scored | 15 Jul, 2026 | npm gmail-changer |
Malicious release: Malicious code in monogrok (npm) GHSA-548c-qh8j-h895, MAL-2026-10638 | Malicious | Not scored | 15 Jul, 2026 | npm monogrok |
Malicious release: Malicious code in core-dotenv (npm) GHSA-h5mc-5vgx-x5xq, MAL-2026-10631 | Malicious | Not scored | 15 Jul, 2026 | npm core-dotenv |
Malicious release: Malicious code in estore-client (npm) MAL-2026-10634 | Malicious | Not scored | 15 Jul, 2026 | npm estore-client |
Malicious release: Malicious code in ogensec-sdk (npm) MAL-2026-10639 | Malicious | Not scored | 15 Jul, 2026 | npm ogensec-sdk |
Malicious release: Malicious code in creditgauge (npm) MAL-2026-10633 | Malicious | Not scored | 15 Jul, 2026 | npm creditgauge |
Malicious release: Malicious code in data-proxy-for-test (PyPI) MAL-2026-10642 | Malicious | Not scored | 15 Jul, 2026 | PyPI data-proxy-for-test |
Malicious release: Malicious code in ethereum-input-decorder (PyPI) MAL-2026-10643 | Malicious | Not scored | 15 Jul, 2026 | PyPI ethereum-input-decorder |
Malicious release: Malicious code in polygon-toolkit-validator (npm) GHSA-67fh-9pjj-6cpw, MAL-2026-10641 | Malicious | Not scored | 15 Jul, 2026 | npm polygon-toolkit-validator |
Malicious release: Malicious code in webpack-session-cache (npm) GHSA-93h2-wqcj-75h4, MAL-2026-10653 | Malicious | Not scored | 15 Jul, 2026 | npm webpack-session-cache |