Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
ApostropheCMS: Host header controls server-side image fetch origin in @apostrophecms/ai-helper, enabling authenticated SSRF CVE-2026-113671, GHSA-527g-ff96-x6wj | Medium | 0.3% | 9 days ago | npm @apostrophecms/ai-helper |
ApostropheCMS: Cross-domain session token in URL confers session takeover CVE-2026-113669, GHSA-hhvr-8m24-qqr3 | Medium | 0.4% | 9 days ago | npm @apostrophecms/passport-bridge npm apostrophe |
ApostropheCMS: CAPTCHA response token not URL-encoded CVE-2026-113667, GHSA-44qr-rrjg-2cqq | Medium | 0.4% | 9 days ago | npm @apostrophecms/form npm @apostrophecms/login-hcaptcha npm @apostrophecms/login-recaptcha |
ApostropheCMS: Unauthenticated unbounded multipart upload → disk-exhaustion DoS CVE-2026-113656, GHSA-89mh-mm8c-mv7f | Medium | 0.5% | 9 days ago | npm @apostrophecms/form |
ApostropheCMS: Same-parent page reorder in @apostrophecms/page move() re-ranks a restricted parent's children without create authorization CVE-2026-113655, GHSA-2jrp-qc93-h2j8 | Medium | 0.3% | 9 days ago | npm apostrophe |
ApostropheCMS sanitize-html: nonTextTags discard region ends early on an implied close, letting <noscript> content render CVE-2026-113654, GHSA-x3q4-9hxx-gx8m | Medium | 0.3% | 9 days ago | npm sanitize-html |
ApostropheCMS: The general public can access @apostrophecms/user objects via a relationship (viewRole is not applied to the general public) CVE-2026-113653, GHSA-xf6w-q65w-4f2w | Medium | 0.4% | 9 days ago | npm apostrophe |
ApostropheCMS uploadfs Azure backend leaks account-level SAS token into every public attachment URL (sas: true) CVE-2026-113652, GHSA-hhph-8536-gfq5 | Medium | 0.3% | 9 days ago | npm uploadfs |
ApostropheCMS sanitize-html: unbounded recursion when re-sanitizing the fallback of a discarded iframe (stack overflow, nestingLimit not enforced) CVE-2026-113650, GHSA-c9rx-x947-fp3h | Medium | 0.4% | 9 days ago | npm sanitize-html |
ApostropheCMS: Import API bypasses publication roles for protected content CVE-2026-113649, GHSA-5m22-7pfq-vp65 | Medium | 0.3% | 9 days ago | npm @apostrophecms/import-export npm apostrophe |
ApostropheCMS: Stored XSS via Unescaped Widget Style Attribute Serialization CVE-2026-112958, GHSA-7jg5-frgc-c67w | Medium | 0.3% | 9 days ago | npm apostrophe |
ApostropheCMS: GET /api/v1/@apostrophecms/page/:id bypasses viewRole restriction and exposes viewPermission-gated fields to lower-privileged users CVE-2026-112957, GHSA-vh56-5m88-39rq | Medium | 0.3% | 9 days ago | npm apostrophe |
ApostropheCMS: Archive duplicate continuation lets contributors overwrite published content CVE-2026-112956, GHSA-jf5h-36mg-rp6x | Medium | 0.3% | 9 days ago | npm @apostrophecms/import-export |
ApostropheCMS: Import archives can exhaust server storage and deny service CVE-2026-112955, GHSA-9g7p-m758-rp72 | Medium | 0.5% | 9 days ago | npm @apostrophecms/import-export |
ApostropheCMS: Unauthenticated publicApiProjection bypass via search and sort query builders in the public REST API CVE-2026-112954, GHSA-rqgm-cfrp-4hx8 | Medium | 0.4% | 9 days ago | npm apostrophe |
ApostropheCMS: Exposure of Sensitive Information via predictable export filenames CVE-2026-112953, GHSA-5gc8-frw3-3vqm | Medium | 0.6% | 9 days ago | npm @apostrophecms/import-export |
ApostropheCMS: POST /api/v1/@apostrophecms/doc/slugTaken discloses existence of private/admin-only content to any authenticated user CVE-2026-112952, GHSA-f66c-mpj2-3r8h | Medium | 0.3% | 9 days ago | npm apostrophe |
ApostropheCMS: Color field validation bypass allows stored XSS via HTML appended after rgb()/hsl() prefix CVE-2026-112951, GHSA-vmgj-9cwm-cf3h | Medium | 0.3% | 9 days ago | npm apostrophe |
Vitest: Windows backslash traversal bypasses the @vitest/mocker redirect allowlist fix CVE-2026-112950, GHSA-xp26-3454-mjgp | Medium | 0.5% | 9 days ago | npm @vitest/mocker |
Vitest: Code injection via unauthenticated manual mock registration CVE-2026-112949, GHSA-qxg6-89mg-rqv8 | Medium | 0.3% | 9 days ago | npm @vitest/mocker |
Vitest: Servers misapply `server.fs.deny`, serving `.env`, private keys, `.git`, and the API token file CVE-2026-112948, GHSA-p458-7748-mcp3 | Medium | 0.4% | 9 days ago | npm @vitest/browser npm @vitest/ui npm vite-plus |
Vite: First 4 bytes of files outside of `server.fs` setting is exposed by `?vite-wasm-instance` CVE-2026-112947, GHSA-vfpm-58rq-9qcg | Medium | 0.5% | 9 days ago | npm vite npm vite-plus |
Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine CVE-2026-112946, GHSA-rq7h-c2jc-7f22 | Medium | 0.9% | 9 days ago | npm vite npm vite-plus |
launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors CVE-2026-112944, GHSA-r825-w8mm-5pxw | Medium | 0.7% | 9 days ago | npm launch-editor npm vite npm vite-plus |
launch-editor: escapeCmdArgs() omits % escaping on Windows CVE-2026-112943, GHSA-698v-4r3x-3vcv | Medium | 0.4% | 9 days ago | npm launch-editor npm vite npm vite-plus |
filelock: SoftFileLock removes a live holder's marker when another user forges the PID in a writable marker CVE-2026-112939, GHSA-rfpc-qcw5-3pc4 | Medium | 0.1% | 9 days ago | PyPI filelock |
filelock: ReadWriteLock on the hard-link route deletes any directory another user renames onto its .filelock-* link directory name CVE-2026-112937, GHSA-jqc4-5cvw-7w85 | Medium | 0.2% | 9 days ago | PyPI filelock |
filelock: ReadWriteLock follows a symlink at the lock path into SQLite CVE-2026-112936, GHSA-j8f7-rjxc-mr56 | Medium | 0.2% | 9 days ago | PyPI filelock |
filelock: SoftFileLock stale-lock break removes a live lock file on a reused inode number and admits two holders CVE-2026-112935, GHSA-fq56-3cx3-fjxp | Medium | 0.1% | 9 days ago | PyPI filelock |
filelock: SoftReadWriteLock holder refresh writes through a hard link and hangs on a named pipe that another local user renames over its record CVE-2026-112934, GHSA-fj95-fr6c-h845 | Medium | 0.2% | 9 days ago | PyPI filelock |
filelock ReadWriteLock: a crafted lock database makes every acquire stall or hang regardless of timeout CVE-2026-112915, GHSA-cwqr-hh33-gh44 | Medium | 0.2% | 9 days ago | PyPI filelock |
filelock: SoftFileLock stale-break restore follows a swapped-in symbolic link and hard-links a file of the user running the lock into the lock directory CVE-2026-112914, GHSA-crv4-6mhj-j5jh | Medium | 0.2% | 9 days ago | PyPI filelock |
filelock: StrictSoftFileLock and SoftReadWriteLock adopt a protocol directory another user created first, losing mutual exclusion CVE-2026-112911, GHSA-9c4x-gm8v-wgc4 | Medium | 0.1% | 9 days ago | PyPI filelock |
filelock: UnixFileLock truncates and chmods any regular file another user renames or hard-links onto the lock path CVE-2026-112909, GHSA-69hj-f68j-2879 | Medium | 0.2% | 9 days ago | PyPI filelock |
filelock: SoftFileLock evicts a fresh lock file whose watched age another local user's pre-dated file passed on through inode reuse CVE-2026-112906, GHSA-2g95-wg33-c5x2 | Medium | 0.2% | 9 days ago | PyPI filelock |
@angular/platform-server: Open Redirect via Protocol-Relative URLs in Server-Side Rendering (SSR) CVE-2026-111754, GHSA-w739-gvwx-grc3 | Medium | Not scored | 9 days ago | npm @angular/platform-server |
fast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decoding CVE-2026-110306, GHSA-w74x-v6f9-j3xg | Medium | 0.3% | 9 days ago | npm fast-uri |
fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalization CVE-2026-110180, GHSA-wjr9-j795-jxcr | Medium | 0.3% | 9 days ago | npm fast-uri |
Pillow: ReDoS in XbmImagePlugin: 512-byte file stalls Image.open() for minutes BIT-pillow-2026-112901, CVE-2026-112901, GHSA-xgh8-jp6q-p5x8, PYSEC-2026-4335 | Medium | 0.5% | 10 days ago | PyPI Pillow PyPI pillow |
Pillow: Image.quantize() with empty palette leaks uninitialized stack memory BIT-pillow-2026-112898, CVE-2026-112898, GHSA-rfgq-q3w2-pmv2 | Medium | 0.3% | 10 days ago | PyPI Pillow PyPI pillow |
Pillow: Quadratic GIF comment copying during save BIT-pillow-2026-112891, CVE-2026-112891, GHSA-fc9g-5qg7-mf45 | Medium | 0.5% | 10 days ago | PyPI pillow |
Pillow: Quadratic GIF comment concatenation allows DoS in Image.open() BIT-pillow-2026-112401, CVE-2026-112401, GHSA-74r2-7ff9-mjj2 | Medium | 0.6% | 10 days ago | PyPI Pillow PyPI pillow |
Pillow: P;2L and P;4L decoders may read 1 to 3 bytes past the passed buffer size BIT-pillow-2026-112394, CVE-2026-112394, GHSA-4558-3h8r-v8xp, PYSEC-2026-4327 | Medium | 0.6% | 10 days ago | PyPI Pillow PyPI pillow |
Pillow: PdfParser can recurse without limit in get_value() and linearize_page_tree() BIT-pillow-2026-112391, CVE-2026-112391, GHSA-254f-3936-288h | Medium | 0.6% | 10 days ago | PyPI Pillow PyPI pillow |
Hono: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths CVE-2026-109955, CVE-2026-111757, GHSA-5r4p-p66f-jhc7 | Medium | 0.3% | 10 days ago | npm hono |
AIOHTTP: Pure-Python parser request smuggling CVE-2026-111750, GHSA-pqxq-w44r-73xw | Medium | 0.4% | 10 days ago | PyPI aiohttp |
AIOHTTP: Absolute-form request targets can spoof Request.scheme CVE-2026-111748, GHSA-f9xw-jh8m-3mwq | Medium | 0.4% | 10 days ago | PyPI aiohttp |
AIOHTTP: Connector pool exhaustion via Max-Age overflow CVE-2026-111065, GHSA-6cjc-53gc-5rqm | Medium | 0.4% | 10 days ago | PyPI aiohttp |
AIOHTTP: Secure attribute not enforced for shared cookie CVE-2026-111063, GHSA-494j-54xm-rwp3 | Medium | 0.2% | 10 days ago | PyPI aiohttp |
Mercury: Stored / DOM Cross-Site Scripting (XSS): mr.Markdown renders untrusted content as raw, unsanitized HTML CVE-2026-111059, GHSA-2658-85cv-9wwq | Medium | 0.3% | 10 days ago | PyPI mercury |