Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in @web3-helpers/core (npm) MAL-2026-10611 | Malicious | Not scored | 14 Jul, 2026 | npm @web3-helpers/core |
TsDProxy: X-Forwarded-For header injection allows IP spoofing in proxied requests to backend services GHSA-pqg7-v6wh-3pfp, GO-2026-5982 | High | Not scored | 14 Jul, 2026 | Go github.com/almeidapaulopt/tsdproxy |
Prototype pollution in @feathersjs/commons _.merge via JSON-parsed __proto__ CVE-2026-54335, GHSA-28xv-ph75-77wh | Low | 0.4% | 14 Jul, 2026 | npm @feathersjs/commons |
yutu: Arbitrary File Write via MCP `caption-download` Tool CVE-2026-50158, GHSA-2c7f-fxww-6w6c, GO-2026-5980 | High | 0.2% | 14 Jul, 2026 | Go github.com/eat-pray-ai/yutu |
Auth0 Symfony SDK Accepted Bearer Tokens via URL Query Parameter CVE-2026-50157, GHSA-ffq7-hh2j-r24p | Medium | 0.5% | 14 Jul, 2026 | Packagist auth0/symfony |
n8n-MCP: Cross-tenant access to workflow version backups in multi-tenant HTTP deployments CVE-2026-54052, GHSA-j6r7-6fhx-77wx | Critical | 0.4% | 14 Jul, 2026 | npm n8n-mcp |
Woodpecker gRPC agent_id metadata can be spoofed- cross-tenant agent impersonation CVE-2026-50141, GHSA-g7mm-9vx7-jm7h, GO-2026-5976 | High | 0.4% | 14 Jul, 2026 | Go go.woodpecker-ci.org/woodpecker Go go.woodpecker-ci.org/woodpecker/v2 Go go.woodpecker-ci.org/woodpecker/v3 |
Anyquery: Arbitrary File Write (AFW) which could lead to Remote Code Execution (RCE) via Unrestricted ATTACH DATABASE in Server Mode CVE-2026-50006, GHSA-xrcf-6jh3-ggvx, GO-2026-5979 | Critical | 1.0% | 14 Jul, 2026 | Go github.com/julien040/anyquery |
Microsoft SharePoint Weak Authentication Vulnerability CVE-2026-55040 | CriticalExploited | 69.5% | 14 Jul, 2026 | |
MKP: Unbounded Pod Log Read via Attacker-Controlled `limitBytes`/`tailLines` Causes Memory Exhaustion CVE-2026-50125, GHSA-qw5r-ppcg-f8rj, GO-2026-5978 | High | 0.5% | 14 Jul, 2026 | Go github.com/StacklokLabs/mkp |
Hoverfly: Denial of Service via Goroutine Leak in Remote Post-Serve Actions CVE-2026-50018, GHSA-42j2-w334-qxw7, GO-2026-5975 | Medium | 0.5% | 14 Jul, 2026 | Go github.com/SpectoLabs/hoverfly |
Hoverfly: Process Crash via Concurrent Map Write Race Condition in Diff Mode CVE-2026-50013, GHSA-qrh4-p6v4-mrfg, GO-2026-5977 | High | 0.5% | 14 Jul, 2026 | Go github.com/SpectoLabs/hoverfly |
Malicious release: Malicious code in utils-style-engine (npm) MAL-2026-10609 | Malicious | Not scored | 14 Jul, 2026 | npm utils-style-engine |
Malicious release: Malicious code in @radivi-ui/react-dialog (npm) MAL-2026-10605 | Malicious | Not scored | 14 Jul, 2026 | npm @radivi-ui/react-dialog |
K3s: ZIP Archive Path Traversal Vulnerability in etcd Snapshot Decompression CVE-2026-54250, GHSA-jxr7-mqhw-9p98, GO-2026-5973 | Medium | 0.2% | 14 Jul, 2026 | Go github.com/k3s-io/k3s |
Malicious release: Malicious code in chain-sdk-js (npm) GHSA-2p8p-vrrr-9f6c, MAL-2026-10608 | Malicious | Not scored | 14 Jul, 2026 | npm chain-sdk-js |
Malicious release: Malicious code in chai-as-act (npm) MAL-2026-10607 | Malicious | Not scored | 14 Jul, 2026 | npm chai-as-act |
Malicious release: Malicious code in base58-utils (npm) MAL-2026-10606 | Malicious | Not scored | 14 Jul, 2026 | npm base58-utils |
FacturaScripts: Stored XSS in WidgetVariante and WidgetSubcuenta modal lists via HTML-attribute decoding of `Tools::noHtml`-escaped quotes inside `onclick=` CVE-2026-45710, GHSA-3x7p-v8hj-xh5m | Low | Not scored | 14 Jul, 2026 | Packagist facturascripts/facturascripts |
Infinite loop on invalid input in golang.org/x/text CVE-2026-56852, GO-2026-5970 | 0.5% | 14 Jul, 2026 | Go golang.org/x/text | |
Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage BIT-golang-2026-46600, CVE-2026-46600, GO-2026-5942 | 0.5% | 14 Jul, 2026 | Go golang.org/x/net Go stdlib | |
Malicious release: Malicious code in monitoring-service (npm) GHSA-538g-pxj3-w58h, MAL-2026-10597 | Malicious | Not scored | 14 Jul, 2026 | npm monitoring-service |
Malicious release: Malicious code in monitoring-service-util (npm) GHSA-mc6r-4967-53wm, MAL-2026-10598 | Malicious | Not scored | 14 Jul, 2026 | npm monitoring-service-util |
FacturaScripts: CSV formula injection in CSVExport allows authenticated low-priv users to plant payloads that execute when an admin opens the export CVE-2026-45263, GHSA-2p5x-4jr6-x5jg | High | Not scored | 14 Jul, 2026 | Packagist facturascripts/facturascripts |
Credential confusion in @sigstore/oci can leak registry credentials to an attacker-controlled registry CVE-2026-59891, GHSA-pf56-329r-95rw | Critical | 0.5% | 14 Jul, 2026 | npm @sigstore/oci |
pyasn1: Uncontrolled resource consumption when converting decoded REAL values CVE-2026-59886, GHSA-hm4w-wwcw-mr6r, PYSEC-2026-3457 | High | 0.4% | 14 Jul, 2026 | PyPI pyasn1 |
pyasn1: Quadratic complexity in OBJECT IDENTIFIER and RELATIVE-OID processing allows denial of service CVE-2026-59885, GHSA-8ppf-4f7h-5ppj, PYSEC-2026-3456 | High | 0.6% | 14 Jul, 2026 | PyPI pyasn1 |
pyasn1 BER/CER/DER decoder denial of service via unbounded long-form tag IDs CVE-2026-59884, GHSA-m4p7-r5rc-7g4j, PYSEC-2026-3455 | High | 0.6% | 14 Jul, 2026 | PyPI pyasn1 |
Pillow: Decompression Bomb DoS via PdfParser.PdfStream.decode() BIT-pillow-2026-59200, CVE-2026-59200, GHSA-jjj6-mw9f-p565, PYSEC-2026-3495 | High | 0.4% | 14 Jul, 2026 | PyPI Pillow PyPI pillow |
Pillow: Heap out-of-bounds write in `ImageFilter.RankFilter` via integer overflow in `ImagingExpand` BIT-pillow-2026-59197, CVE-2026-59197, GHSA-xj96-63gp-2gmr, PYSEC-2026-3454 | High | 0.4% | 14 Jul, 2026 | PyPI Pillow PyPI pillow |
Microsoft SharePoint Deserialization of Untrusted Data Vulnerability CVE-2026-58644 | CriticalExploited | 15.9% | 14 Jul, 2026 | |
Microsoft SharePoint Server Missing Authentication for Critical Function Vulnerability CVE-2026-56164 | CriticalExploited | 1.0% | 14 Jul, 2026 | |
Microsoft Active Directory Federation Services Insufficient Granularity of Access Control Vulnerability CVE-2026-56155 | HighExploited | 0.3% | 14 Jul, 2026 | |
Pillow: Out-of-bounds read via attacker-controlled row stride on Pillow's mmap path (McIdas AREA files) BIT-pillow-2026-54058, CVE-2026-54058, GHSA-62p4-gmf7-7g93, PYSEC-2026-3493 | High | 0.5% | 14 Jul, 2026 | PyPI pillow |
Microsoft SharePoint Deserialization of Untrusted Data Vulnerability CVE-2026-50522 | CriticalExploited | 3.0% | 14 Jul, 2026 | |
Malicious release: Malicious code in @ayunlove/bails (npm) GHSA-qv85-w97v-vpp2, MAL-2026-10596 | Malicious | Not scored | 14 Jul, 2026 | npm @ayunlove/bails |
FacturaScripts: Unauthenticated Path Traversal in Static File Controllers Reads Private MyFiles Documents CVE-2026-45693, GHSA-cv65-7cg8-r623 | High | Not scored | 14 Jul, 2026 | Packagist facturascripts/facturascripts |
FacturaScripts: Authenticated SQL injection in the FacturaScripts REST API filter parameter via parenthesis bypass in `Where::sqlColumn` CVE-2026-45262, GHSA-5qmh-x653-g8qj | Critical | Not scored | 14 Jul, 2026 | Packagist facturascripts/facturascripts |
Malicious release: Malicious code in proxy-check-ii (PyPI) MAL-2026-10610 | Malicious | Not scored | 14 Jul, 2026 | PyPI proxy-check-ii |
OpenCost ServiceKey Endpoint Unauthorized Credential Overwrite/Injection CVE-2026-44300, GHSA-wmj8-9953-vff5, GO-2026-5974 | High | 0.8% | 14 Jul, 2026 | Go github.com/opencost/opencost |
Pillow: Controlled heap out-of-bounds write in Pillow `ImageCmsTransform.apply()` via output mode mismatch BIT-pillow-2026-59205, CVE-2026-59205, GHSA-9hw9-ch79-4vh6, PYSEC-2026-3453 | High | 0.4% | 14 Jul, 2026 | PyPI pillow |
Pillow JPEG2000 tiled decode retains a growing scratch buffer and can be used for denial of service BIT-pillow-2026-59204, CVE-2026-59204, GHSA-vjc4-5qp5-m44j, PYSEC-2026-3496 | High | 0.4% | 14 Jul, 2026 | PyPI pillow |
Pillow EpsImagePlugin negative %%BeginBinary byte count causes infinite loop denial of service BIT-pillow-2026-59203, CVE-2026-59203, GHSA-pg7v-jwj7-p798, PYSEC-2026-3452 | High | 0.4% | 14 Jul, 2026 | PyPI pillow |
Pillow: Heap out-of-bounds write `Image.paste()` / `Image.crop()` via signed coordinate overflow BIT-pillow-2026-59199, CVE-2026-59199, GHSA-6r8x-57c9-28j4, PYSEC-2026-3451 | High | 0.4% | 14 Jul, 2026 | PyPI Pillow PyPI pillow |
Pillow TGA RLE encoder can serialize up to ~57 KB of adjacent heap data into generated images BIT-pillow-2026-59198, CVE-2026-59198, GHSA-fj7v-r99m-22gq, PYSEC-2026-3494 | High | 0.3% | 14 Jul, 2026 | PyPI Pillow PyPI pillow |
Easy!Appointments Vulnerable to Appointments Takeover via Excessive Data Exposure CVE-2026-55651, GHSA-4vmm-5qvc-w5p7 | High | 0.2% | 14 Jul, 2026 | Packagist alextselegidis/easyappointments |
Easy!Appointments: Authorization bypass in Google OAuth provider binding lets any backend user rebind a peer provider's Google sync CVE-2026-52841, GHSA-8hm4-r66f-29wr | Low | 0.2% | 14 Jul, 2026 | Packagist alextselegidis/easyappointments |
Easy!Appointments has server-side request forgery in CalDAV connection test that exposes the deployment's internal network CVE-2026-52840, GHSA-pm5p-7w5h-jm5q | Low | 0.2% | 14 Jul, 2026 | Packagist alextselegidis/easyappointments |
Easy!Appointments appointments/store and appointments/update allow cross-provider appointment injection — Authorization Bypass CVE-2026-52839, GHSA-w8xc-8g92-v77h | Low | 0.2% | 14 Jul, 2026 | Packagist alextselegidis/easyappointments |
Easy!Appointments disable_booking_message rendered as raw HTML on public booking page — Stored XSS CVE-2026-52838, GHSA-996f-334j-67g7 | Low | 0.2% | 14 Jul, 2026 | Packagist alextselegidis/easyappointments |