Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
GoBGP confederation validation panics on empty AS_PATH attribute CVE-2026-49838, GHSA-frrj-87jh-2772, GO-2026-5954 | Medium | 0.4% | 09 Jul, 2026 | Go github.com/osrg/gobgp/v4 |
GoBGP: BGP OPEN capability parser may read capability values outside declared CapLen boundaries CVE-2026-49837, GHSA-gjrg-jjr3-56cm, GO-2026-5955 | Medium | 0.3% | 09 Jul, 2026 | Go github.com/osrg/gobgp/v4 |
psd-tools vulnerable to arbitrary file write via smart-object filename CVE-2026-49836, GHSA-2rmg-vrx8-9j2f, PYSEC-2026-2969 | Medium | 0.2% | 09 Jul, 2026 | PyPI psd-tools |
sigstore-go has a multi-log threshold bypass via single compromised log CVE-2026-49834, GHSA-9vcr-p3rj-q5q6, GO-2026-5952 | Medium | 0.2% | 09 Jul, 2026 | Go github.com/sigstore/sigstore-go |
Rattler vulnerable to package cache path traversal via conda package build string CVE-2026-53956, GHSA-h672-p7h7-97v9, PYSEC-2026-2970 | Medium | 0.3% | 09 Jul, 2026 | PyPI py-rattler PyPI py_rattler crates.io rattler_cache |
OpenRun: Redirect URL validation bypass using //host paths leads to Open Redirect CVE-2026-55252, GHSA-h5g6-xmh4-hc37, GO-2026-5956 | Medium | 0.4% | 09 Jul, 2026 | Go github.com/openrundev/openrun |
Malicious release: Malicious code in dc-repro (npm) MAL-2026-10102 | Malicious | Not scored | 09 Jul, 2026 | npm dc-repro |
Malicious release: Malicious code in date-kit-lite (npm) MAL-2026-10101 | Malicious | Not scored | 09 Jul, 2026 | npm date-kit-lite |
Malicious release: Malicious code in pxpure8 (npm) MAL-2026-10105 | Malicious | Not scored | 09 Jul, 2026 | npm pxpure8 |
Malicious release: Malicious code in px8my (npm) GHSA-9869-r2r5-fff6, MAL-2026-10104 | Malicious | Not scored | 09 Jul, 2026 | npm px8my |
Malicious release: Malicious code in validator-string (npm) MAL-2026-10109 | Malicious | Not scored | 09 Jul, 2026 | npm validator-string |
Malicious release: Malicious code in url-func-registry (npm) MAL-2026-10108 | Malicious | Not scored | 09 Jul, 2026 | npm url-func-registry |
Malicious release: Malicious code in security-node (npm) GHSA-h82v-g9rg-f32j, MAL-2026-10107 | Malicious | Not scored | 09 Jul, 2026 | npm security-node |
Malicious release: Malicious code in optimize-regex (npm) GHSA-vrj5-6f7q-fx9g, MAL-2026-10103 | Malicious | Not scored | 09 Jul, 2026 | npm optimize-regex |
Malicious release: Malicious code in rallycoding (npm) GHSA-xh99-h4gh-gcv6, MAL-2026-10106 | Malicious | Not scored | 09 Jul, 2026 | npm rallycoding |
Malicious release: Malicious code in polipoli-pak (npm) GHSA-9rgw-9wxh-3pp2, MAL-2026-10099 | Malicious | Not scored | 09 Jul, 2026 | npm polipoli-pak |
Malicious release: Malicious code in @kl-starfish/test-01 (npm) GHSA-q8q2-g7r6-wg9x, MAL-2026-10097 | Malicious | Not scored | 09 Jul, 2026 | npm @kl-starfish/test-01 |
@arikusi/deepseek-mcp-server: Missing Authentication on Self-Hosted HTTP MCP Endpoint CVE-2026-55605, GHSA-72f3-6w86-7rv3 | Medium | 0.5% | 09 Jul, 2026 | npm @arikusi/deepseek-mcp-server |
@arikusi/deepseek-mcp-server has an Authorization Bypass Through User-Controlled Key CVE-2026-55604, GHSA-fh3r-g96v-f578 | High | 0.4% | 09 Jul, 2026 | npm @arikusi/deepseek-mcp-server |
decompress allows arbitrary hardlink creation during archive extraction CVE-2026-39243, GHSA-jwp9-9v96-94mx | Medium | 0.3% | 09 Jul, 2026 | npm decompress |
Malicious release: Malicious code in proxy-check-i (PyPI) MAL-2026-10100 | Malicious | Not scored | 09 Jul, 2026 | PyPI proxy-check-i |
Malicious release: Malicious code in fastify-addone (npm) MAL-2026-10098 | Malicious | Not scored | 09 Jul, 2026 | npm fastify-addone |
Pimcore: Insufficient Permission Check on Class Definition Creation Endpoint Allows Privilege Escalation CVE-2026-55212, GHSA-f97c-ph8j-8vff | High | 0.4% | 09 Jul, 2026 | Packagist pimcore/studio-backend-bundle |
Pimcore: SQL Injection via Column Name in DateFilter allows authenticated user to extract arbitrary database data including admin password hashes CVE-2026-55208, GHSA-79cw-hfcc-7mw9 | High | 0.4% | 09 Jul, 2026 | Packagist pimcore/studio-backend-bundle |
Pimcore: Account Takeover via Password Reset URL Injection allows unauthenticated attacker to hijack any admin account with 2FA bypass CVE-2026-55207, GHSA-h854-c3m3-mh5v | High | 0.7% | 09 Jul, 2026 | Packagist pimcore/studio-backend-bundle |
Sylius: IDOR on Shop Payment Request API endpoints CVE-2026-53639, GHSA-mr9r-h354-966r | Medium | 0.5% | 09 Jul, 2026 | Packagist sylius/sylius |
Sylius: Channel-based payment method restriction bypass on shop account orders API endpoint CVE-2026-53638, GHSA-6955-hrm5-c4qp | Medium | 0.3% | 09 Jul, 2026 | Packagist sylius/sylius |
Sylius: Cart FormComponent allows modification or deletion of an already-completed order CVE-2026-53637, GHSA-5597-7rmh-97q5 | Medium | 0.4% | 09 Jul, 2026 | Packagist sylius/sylius |
YesWiki Vulnerable to Authenticated PHP Object Injection in BazarImportAction via unserialize CVE-2026-52777, GHSA-9369-69wj-7m2f | Critical | 0.3% | 09 Jul, 2026 | Packagist yeswiki/yeswiki |
YesWiki has Authenticated SQL Injection via ReactionManager CVE-2026-52775, GHSA-4pf7-cc4r-g63h | High | 0.5% | 09 Jul, 2026 | Packagist yeswiki/yeswiki |
YesWiki Vulnerable to Reflected XSS via Unescaped `id` Parameter in Bazar Widget HTML Attributes CVE-2026-52774, GHSA-r5xw-gcgw-hwp5 | Medium | 0.7% | 09 Jul, 2026 | Packagist yeswiki/yeswiki |
YesWiki Vulnerable to Reflected XSS via Unescaped Archived-Revision `time` Parameter in `handlers/page/show.php` CVE-2026-52773, GHSA-35f3-pg38-486f | Medium | 0.6% | 09 Jul, 2026 | Packagist yeswiki/yeswiki |
YesWiki has stored XSS in Bazar form-field templates via unescaped field.label / field.hint (|raw('html')) CVE-2026-52772, GHSA-xc7j-3g8q-9vh4 | Medium | 0.3% | 09 Jul, 2026 | Packagist yeswiki/yeswiki |
YesWiki: Second-Order SQL Injection in Page Delete API via Unescaped Page Tag (`ApiController::deletePage`) CVE-2026-52771, GHSA-8f2v-2qhj-gfwg | High | 0.5% | 09 Jul, 2026 | Packagist yeswiki/yeswiki |
YesWiki: SQL Injection possible through public Bazar entry-listing APIs via numeric `query`/`queries` filters CVE-2026-52770, GHSA-qg78-vmvc-fhjw | High | 0.5% | 09 Jul, 2026 | Packagist yeswiki/yeswiki |
YesWiki has Unauthenticated Server-Side Request Forgery via ActivityPub `Signature.keyId` CVE-2026-52769, GHSA-vw42-752g-5mrp | High | 0.5% | 09 Jul, 2026 | Packagist yeswiki/yeswiki |
YesWiki Vulnerable to Unauthenticated ActivityPub Signature-Verification Bypass via `!openssl_verify(...)` accepting `int(-1)` CVE-2026-52767, GHSA-mv28-wj57-f57g | High | 0.4% | 09 Jul, 2026 | Packagist yeswiki/yeswiki |
YesWiki vulnerable to unauthenticated arbitrary page deletion via `{{erasespamedcomments}}` action CVE-2026-52766, GHSA-6x7x-gcmf-7r8x | Critical | 0.6% | 09 Jul, 2026 | Packagist yeswiki/yeswiki |
YesWiki: SQL injection via the `recentchanges` action `period` argument leads to arbitrary DB read CVE-2026-52763, GHSA-89v6-j5x6-cmj3 | Medium | 0.4% | 09 Jul, 2026 | Packagist yeswiki/yeswiki |
YesWiki: Authenticated (Admin) Server-Side Template Injection to Remote Code Execution via Bazar Semantic Templates CVE-2026-52762, GHSA-65p8-9433-jpcp | High | 0.8% | 09 Jul, 2026 | Packagist yeswiki/yeswiki |
Avo: Direct attachment upload endpoint lacks upload authorization and bypasses field-level upload policy CVE-2026-53769, GHSA-pqpw-cvm4-8mv9 | Medium | 0.4% | 09 Jul, 2026 | RubyGems avo |
laravel-backup-restore has an OS Command Injection during database restore CVE-2026-53932, GHSA-w9mx-xmg4-gc4r | High | 1.7% | 09 Jul, 2026 | Packagist wnx/laravel-backup-restore |
nebula-mesh: Host revocation is not durable - blocked/offboarded hosts can regain a valid certificate CVE-2026-53602, GHSA-339v-266x-79xr, GO-2026-5950 | Medium | 0.3% | 09 Jul, 2026 | Go github.com/forgekeep/nebula-mesh |
Malicious release: Malicious code in guest-app-ui (npm) MAL-2026-10096 | Malicious | Not scored | 09 Jul, 2026 | npm guest-app-ui |
Malicious release: Malicious code in fury_frontend-andes-ui (npm) MAL-2026-10095 | Malicious | Not scored | 09 Jul, 2026 | npm fury_frontend-andes-ui |
Malicious release: Malicious code in @equansservices/setup (npm) MAL-2026-10094 | Malicious | Not scored | 09 Jul, 2026 | npm @equansservices/setup |
Malicious release: Malicious code in @andrewstory18/is-real-odd (npm) MAL-2026-10093 | Malicious | Not scored | 09 Jul, 2026 | npm @andrewstory18/is-real-odd |
@Mockoon/commons-server: Path traversal in templated `filePath` lets a request escape the served directory (prefix-only base check) CVE-2026-59149, GHSA-8wqc-v2q8-vff2 | Medium | 0.5% | 09 Jul, 2026 | npm @mockoon/cli npm @mockoon/commons-server |
@Mockoon/commons-server: Unauthenticated admin API + wildcard CORS allows mock-state hijack and secret theft CVE-2026-59148, GHSA-rqx4-3f6q-3x2v | High | 0.3% | 09 Jul, 2026 | npm @mockoon/cli npm @mockoon/commons-server |
Malicious release: Malicious code in vite-pwa-config (npm) MAL-2026-10092 | Malicious | Not scored | 09 Jul, 2026 | npm vite-pwa-config |