Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
CredSweeper: Recursive archive size-limit bypass in deep scanner allows crafted compressed inputs to exhaust resources GHSA-9mqm-qcwf-5qhg | Medium | Not scored | 10 Jul, 2026 | PyPI credsweeper |
Excelize: Unbounded Row Index Allocation in Worksheet Parser (checkSheet OOM/Panic DoS) CVE-2026-54063, GHSA-h69g-9hx6-f3v4, GO-2026-5960 | High | 0.6% | 10 Jul, 2026 | Go github.com/xuri/excelize/v2 |
Authorizer: Unvalidated redirect_uri in /authorize leaks OAuth2 tokens to attacker-controlled URL CVE-2026-54072, GHSA-h29v-hj44-q8cv, GO-2026-5959 | Critical | 0.5% | 10 Jul, 2026 | Go github.com/authorizerdev/authorizer |
SiYuan: Stored XSS to RCE via CSS-snippet <style> breakout in renderSnippet() CVE-2026-54067, GHSA-mvjr-vv3c-w4qv, GO-2026-5963 | Critical | 0.4% | 10 Jul, 2026 | Go github.com/siyuan-note/siyuan/kernel |
SiYuan: Path Traversal via Double URL Encoding in /assets/*path (publish mode arbitrary file─read), Incomplete fix of CVE-2026-41894 CVE-2026-54066, GHSA-p4m3-mgmm-c664, GO-2026-5964 | High | 2.2% | 10 Jul, 2026 | Go github.com/siyuan-note/siyuan/kernel |
mcp-server-kubernetes argument injection can expose Kubernetes cluster credentials CVE-2026-61459, GHSA-wmg3-h8mf-wgvr, PYSEC-2026-3685 | Critical | 2.4% | 10 Jul, 2026 | PyPI mcp-server-kubernetes npm mcp-server-kubernetes |
Prowler: SAML Domain Claiming Enables Cross-Tenant Account Takeover CVE-2026-100169, CVE-2026-59151, GHSA-h8m9-jgf8-vwvp, PYSEC-2026-3725 | Critical | 0.9% | 10 Jul, 2026 | PyPI prowler-cloud |
Snipe-IT has an Improper Privilege Management issue CVE-2026-55843, GHSA-j5g3-42wp-gqm3 | High | 0.5% | 10 Jul, 2026 | Packagist snipe/snipe-it |
Snipe-IT vulnerable to cross-company asset maintenance re-parenting via API update CVE-2026-55516, GHSA-575r-357h-fhch | High | 0.4% | 10 Jul, 2026 | Packagist snipe/snipe-it |
Snipe-IT has missing object-level authorization in Kits API CVE-2026-55478, GHSA-crv3-j83j-f3r6 | Medium | 0.3% | 10 Jul, 2026 | Packagist snipe/snipe-it |
Snipe-IT Vulnerable to Unauthorized Asset Request Cancellation via Unguarded cancel_by_admin Parameter CVE-2026-55476, GHSA-53jc-27pc-x8r8 | Medium | 0.3% | 10 Jul, 2026 | Packagist snipe/snipe-it |
Snipe-IT vulnerable to directory traversal in displaySig CVE-2026-55474, GHSA-c6f4-wj38-m3g3 | High | 0.5% | 10 Jul, 2026 | Packagist snipe/snipe-it |
Snipe-IT's API Location Creation Bypasses FMCS Parent-Child Company Boundary Validation CVE-2026-55472, GHSA-8w8c-8mx9-52cw | Medium | 0.3% | 10 Jul, 2026 | Packagist snipe/snipe-it |
Snipe-IT vulnerable to stored XSS via Markdown custom field CVE-2026-55464, GHSA-r52f-r9v5-66xr | Medium | 0.3% | 10 Jul, 2026 | Packagist snipe/snipe-it |
Snipe-IT has an authorization bypass on bulk editing users CVE-2026-55460, GHSA-vgx7-c78r-69w9 | High | 0.4% | 10 Jul, 2026 | Packagist snipe/snipe-it |
Malicious release: Malicious code in @injectivelabs/sdk-ts (npm) GHSA-5fc4-fm2x-6f4r, MAL-2026-10165 | Malicious | Not scored | 10 Jul, 2026 | npm @injectivelabs/sdk-ts |
Malicious release: Malicious code in paysafe-vault (npm) MAL-2026-10173 | Malicious | Not scored | 10 Jul, 2026 | npm paysafe-vault |
Malicious release: Malicious code in paysafe-payments (npm) MAL-2026-10172 | Malicious | Not scored | 10 Jul, 2026 | npm paysafe-payments |
Malicious release: Malicious code in paysafe-node (npm) MAL-2026-10171 | Malicious | Not scored | 10 Jul, 2026 | npm paysafe-node |
Malicious release: Malicious code in paysafe-kyc (npm) MAL-2026-10170 | Malicious | Not scored | 10 Jul, 2026 | npm paysafe-kyc |
Malicious release: Malicious code in paysafe-fraud (npm) MAL-2026-10168 | Malicious | Not scored | 10 Jul, 2026 | npm paysafe-fraud |
Malicious release: Malicious code in paysafe-js (npm) MAL-2026-10169 | Malicious | Not scored | 10 Jul, 2026 | npm paysafe-js |
Malicious release: Malicious code in paysafe-checkout (npm) MAL-2026-10167 | Malicious | Not scored | 10 Jul, 2026 | npm paysafe-checkout |
Malicious release: Malicious code in paysafe-api (npm) MAL-2026-10166 | Malicious | Not scored | 10 Jul, 2026 | npm paysafe-api |
Malicious release: Malicious code in type-atob (npm) GHSA-w8g3-2xjv-6vf6, MAL-2026-10174 | Malicious | Not scored | 10 Jul, 2026 | npm type-atob |
MCP Atlassian: DNS-rebinding TOCTOU bypass of the SSRF fix (CVE-2026-27826) CVE-2026-73497, GHSA-489g-7rxv-6c8q | Medium | 0.4% | 10 Jul, 2026 | PyPI mcp-atlassian |
Malicious release: Malicious code in llama-tokenizer (npm) GHSA-q4hv-j85h-9h7j, MAL-2026-10163 | Malicious | Not scored | 10 Jul, 2026 | npm llama-tokenizer |
Malicious release: Malicious code in type-async (npm) GHSA-rfhj-93m8-qhgx, MAL-2026-10164 | Malicious | Not scored | 10 Jul, 2026 | npm type-async |
Grav CMS — Improper Handling of Highly Compressed Data in Installer::unZip() CVE-2026-59193, GHSA-2vcx-h8p2-9pg9 | Medium | 0.6% | 10 Jul, 2026 | Packagist getgrav/grav |
Apprise forwards configured auth headers across cross-origin HTTP redirects CVE-2026-59180, GHSA-856c-92hv-3vxx, PYSEC-2026-4200 | Low | 0.3% | 10 Jul, 2026 | PyPI apprise |
9router /v1 APIs has unauthenticated access via reverse proxy locality collapse CVE-2026-56675, GHSA-x5c9-v98j-722r | High | 0.5% | 10 Jul, 2026 | npm 9router |
9router: Unauthenticated `/v1` proxy access via `Host`-header spoofing → open AI relay + SSRF CVE-2026-55641, GHSA-86m2-fcxq-5q7c | High | 0.3% | 10 Jul, 2026 | npm 9router |
9router: Unauthenticated LLM proxy access via /codex rewrite authorization bypass CVE-2026-55638, GHSA-8gmq-j984-vp4r | High | 6.6% | 10 Jul, 2026 | npm 9router |
Grav: Unauthenticated denial of service via unbounded image derivative dimensions CVE-2026-53653, GHSA-4x9g-vw65-vvf9 | High | 0.5% | 10 Jul, 2026 | Packagist getgrav/grav |
adm-zip: Crafted ZIP file triggers 4GB memory allocation CVE-2026-39244, GHSA-xcpc-8h2w-3j85 | High | 0.8% | 10 Jul, 2026 | npm adm-zip |
Malicious release: Malicious code in @bcryptln/becryptjs (npm) GHSA-9qhg-2wvw-j95c, MAL-2026-10162 | Malicious | Not scored | 10 Jul, 2026 | npm @bcryptln/becryptjs |
Malicious release: Malicious code in rollup-packages-polyfill-core (npm) MAL-2026-10160 | Malicious | Not scored | 10 Jul, 2026 | npm rollup-packages-polyfill-core |
Malicious release: Malicious code in buffer-util-internal (npm) MAL-2026-10151 | Malicious | Not scored | 10 Jul, 2026 | npm buffer-util-internal |
Malicious release: Malicious code in ap3-components-ui (npm) GHSA-qhgr-v9vh-3784, MAL-2026-10150 | Malicious | Not scored | 10 Jul, 2026 | npm ap3-components-ui |
Malicious release: Malicious code in notify-utilities (npm) MAL-2026-10158 | Malicious | Not scored | 10 Jul, 2026 | npm notify-utilities |
Malicious release: Malicious code in notify-logs (npm) MAL-2026-10156 | Malicious | Not scored | 10 Jul, 2026 | npm notify-logs |
Malicious release: Malicious code in notify-theme (npm) MAL-2026-10157 | Malicious | Not scored | 10 Jul, 2026 | npm notify-theme |
Malicious release: Malicious code in notify-dist (npm) MAL-2026-10154 | Malicious | Not scored | 10 Jul, 2026 | npm notify-dist |
Malicious release: Malicious code in notify-funcs (npm) MAL-2026-10155 | Malicious | Not scored | 10 Jul, 2026 | npm notify-funcs |
Malicious release: Malicious code in notifier-log (npm) MAL-2026-10153 | Malicious | Not scored | 10 Jul, 2026 | npm notifier-log |
Malicious release: Malicious code in notifier-funcs (npm) MAL-2026-10152 | Malicious | Not scored | 10 Jul, 2026 | npm notifier-funcs |
Malicious release: Malicious code in npm-rce-safe-proof-yourname (npm) MAL-2026-10159 | Malicious | Not scored | 10 Jul, 2026 | npm npm-rce-safe-proof-yourname |
Malicious release: Malicious code in sidecar-mcp (npm) GHSA-6fg7-6wv2-gx3j, MAL-2026-10161 | Malicious | Not scored | 10 Jul, 2026 | npm sidecar-mcp |
Malicious release: Malicious code in @amtrav/webservice (npm) GHSA-frwh-6rv4-8cg3, MAL-2026-10140 | Malicious | Not scored | 10 Jul, 2026 | npm @amtrav/webservice |
Malicious release: Malicious code in @genie-auth/config (npm) GHSA-vmm7-6q5r-pfj9, MAL-2026-10141 | Malicious | Not scored | 10 Jul, 2026 | npm @genie-auth/config |