Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Langflow: IDOR/BOLA in Monitor API — Missing Ownership Enforcement on 7 Endpoints CVE-2026-33760, GHSA-9c59-2mvc-vfr8, PYSEC-2026-242 | High | 0.5% | 16 Jun, 2026 | PyPI langflow |
Galaxy NG: command injection vulnerability CVE-2026-12398, GHSA-6hw7-j4jw-wpff, PYSEC-2026-2486 | High | 0.9% | 16 Jun, 2026 | PyPI galaxy-ng |
Astro: Host header SSRF in prerendered error page fetch CVE-2026-54299, GHSA-2pvr-wf23-7pc7 | High | 0.3% | 16 Jun, 2026 | npm astro |
Natural Language Toolkit (NLTK): URL-Encoded Path Traversal in nltk.data.load() Allows Arbitrary Local File Read CVE-2026-54293, GHSA-p4gq-832x-fm9v, PYSEC-2026-2078 | High | 0.6% | 16 Jun, 2026 | PyPI nltk |
hono: CORS Middleware reflects any Origin with credentials when `origin` defaults to the wildcard CVE-2026-54290, GHSA-88fw-hqm2-52qc | High | 0.3% | 16 Jun, 2026 | npm hono |
Astro: Reflected XSS via unescaped slot name CVE-2026-50146, GHSA-8hv8-536x-4wqp | High | 0.3% | 16 Jun, 2026 | npm astro |
Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability CVE-2026-7273 | HighExploited | 2.8% | 16 Jun, 2026 | |
Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS CVE-2026-54283, GHSA-82w8-qh3p-5jfq, PYSEC-2026-249 | High | 0.5% | 15 Jun, 2026 | PyPI starlette |
Tornado: CurlAsyncHTTPClient leaks per-request credentials on handle reuse CVE-2026-91992, GHSA-pw6j-qg29-8w7f | High | 0.2% | 15 Jun, 2026 | PyPI tornado |
Nest: Middleware Bypass on Fastify via Trailing Slash CVE-2026-54281, GHSA-6v32-fjc9-9qf6 | High | 0.5% | 15 Jun, 2026 | npm @nestjs/platform-fastify |
python-multipart: Quadratic-time querystring parsing with semicolon separators causes CPU denial of service CVE-2026-53539, GHSA-5rvq-cxj2-64vf, PYSEC-2026-3036 | High | 0.5% | 15 Jun, 2026 | PyPI python-multipart |
Tornado: Authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClient CVE-2026-49853, GHSA-3x9g-8vmp-wqvf, PYSEC-2026-3387 | High | 0.4% | 15 Jun, 2026 | PyPI tornado |
tornado AsyncHTTPClient accumulates decompressed chunks without size limit (gzip bomb) CVE-2026-49855, GHSA-mgf9-4vpg-hj56, PYSEC-2026-3389 | High | 0.6% | 15 Jun, 2026 | PyPI tornado |
Koillection has an authenticated Server-Side Request Forgery issue CVE-2026-50888, GHSA-gmxh-hjfv-qc2w | High | 0.2% | 15 Jun, 2026 | Packagist koillection/koillection |
Starlette: SSRF and NTLM credential theft via UNC paths in StaticFiles on Windows CVE-2026-48818, GHSA-wqp7-x3pw-xc5r, PYSEC-2026-2281 | High | 0.4% | 15 Jun, 2026 | PyPI starlette |
protobufjs-cli: Code injection in pbjs static output from crafted JSON descriptor names CVE-2026-54271, GHSA-pr59-h9ph-3fr8 | High | 0.3% | 15 Jun, 2026 | npm protobufjs-cli |
Vulnerable OpenSSL included in cryptography wheels GHSA-537c-gmf6-5ccf | High | Not scored | 15 Jun, 2026 | PyPI cryptography |
Nodemailer: Improper TLS Certificate Validation in OAuth2 Token Fetch Enables Credential Interception CVE-2026-82662, GHSA-r7g4-qg5f-qqm2 | High | 0.2% | 15 Jun, 2026 | npm nodemailer |
protobufjs: Denial of service through unbounded Any expansion during JSON conversion CVE-2026-48712, GHSA-wcpc-wj8m-hjx6 | High | 0.5% | 15 Jun, 2026 | npm protobufjs |
Symfony: Security Firewall Bypass via failure_forward Subrequest: Unauthenticated Access to access_control-Protected GET Routes CVE-2026-48489, GHSA-6h46-9jf5-q59x | High | 0.6% | 15 Jun, 2026 | Packagist symfony/security-http Packagist symfony/symfony |
@angular/service-worker: Sensitive Header Leakage on Cross-Origin Redirects in Angular Service Worker CVE-2026-54264, GHSA-qxh6-94w6-9r5p | High | 0.4% | 15 Jun, 2026 | npm @angular/service-worker |
@angular/common: Denial of Service (DoS) via OOM in Date Formatting (formatDate) CVE-2026-54268, GHSA-48r7-hpm6-gfxm | High | 0.6% | 15 Jun, 2026 | npm @angular/common |
@angular/common: Weak 32-Bit Cache Key Hashing in `HttpTransferCache` Leading to Cross-Request Data Leakage and State Poisoning CVE-2026-54266, GHSA-39pv-4j6c-2g6v | High | 0.1% | 15 Jun, 2026 | npm @angular/common |
@angular/platform-server: Missing `<noscript>` Raw-Text Serialization Escaping leads to Cross-Site Scripting (XSS) in Angular SSR CVE-2026-50556, GHSA-gxx4-3xcv-f8qx | High | 0.4% | 15 Jun, 2026 | npm @angular/platform-server |
@angular/platform-server: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CVE-2026-50555, GHSA-hqr9-c56f-3x7f | High | 0.3% | 15 Jun, 2026 | npm @angular/platform-server |
vite: `server.fs.deny` bypass on Windows alternate paths CVE-2026-53571, GHSA-fx2h-pf6j-xcff | High | 0.6% | 15 Jun, 2026 | npm vite npm vite-plus |
@angular/common: Denial of Service (DoS) via OOM in Number Formatting (digitsInfo) CVE-2026-50171, GHSA-p3vc-36g9-x9gr | High | 0.3% | 15 Jun, 2026 | npm @angular/common |
@angular/common: Information Leak via Default Caching of Credentialed Requests in HttpTransferCache CVE-2026-50170, GHSA-q6f4-qqrg-jv6x | High | 0.4% | 15 Jun, 2026 | npm @angular/common |
@angular/platform-server: URL Parser Differential leading to SSRF Allowlist Bypass CVE-2026-50168, GHSA-xrxm-cp7j-8xf6 | High | 0.2% | 15 Jun, 2026 | npm @angular/platform-server |
ws: Memory exhaustion DoS from tiny fragments and data chunks CVE-2026-48779, GHSA-96hv-2xvq-fx4p | High | 1.4% | 15 Jun, 2026 | npm ws |
Multer vulnerable to Denial of Service via incomplete cleanup of aborted uploads CVE-2026-5038, GHSA-3p4h-7m6x-2hcm | High | 0.4% | 15 Jun, 2026 | npm multer |
Angular Client Hydration DOM Clobbering & Response-Cache Poisoning CVE-2026-54267, GHSA-rgjc-h3x7-9mwg | High | 0.4% | 15 Jun, 2026 | npm @angular/core |
Multer vulnerable to Denial of Service via deeply nested field names CVE-2026-5079, GHSA-72gw-mp4g-v24j | High | 0.3% | 15 Jun, 2026 | npm multer |
LiteSpeed cPanel Plugin UNIX Symbolic Link (Symlink) Following Vulnerability CVE-2026-54420 | HighExploited | 1.4% | 14 Jun, 2026 | |
OpenClaw: Trusted retry endpoint checks could match hostname prefixes CVE-2026-53839, GHSA-77q5-rr5v-x43q | High | 0.3% | 12 Jun, 2026 | npm openclaw |
OpenClaw: PowerShell encoded-command aliases could miss exec allowlist checks CVE-2026-53836, GHSA-j472-gf56-x589 | High | 0.5% | 12 Jun, 2026 | npm openclaw |
OpenClaw: QQBot pre-dispatch slash commands could skip allowFrom checks CVE-2026-53834, GHSA-77pv-3w4q-vrj5 | High | 0.2% | 12 Jun, 2026 | npm openclaw |
OpenClaw: QQBot streaming command could mutate config without explicit allowFrom CVE-2026-53833, GHSA-jvm4-4j77-39p6 | High | 0.2% | 12 Jun, 2026 | npm openclaw |
OpenClaw: Same-host trusted-proxy deployments could accept local forged identity headers CVE-2026-53832, GHSA-rggc-m335-3wvj | High | 0.1% | 12 Jun, 2026 | npm openclaw |
OpenClaw's POSIX node system.run safe-bin allowlist could be widened by shell expansion CVE-2026-53831, GHSA-mhq8-78pj-5j79 | High | 0.2% | 12 Jun, 2026 | npm openclaw |
OpenClaw: Exec approval display truncation could hide the command being approved CVE-2026-53829, GHSA-xww8-gqvh-92x9 | High | 0.2% | 12 Jun, 2026 | npm openclaw |
OpenClaw: Native command authorization could skip owner-command enforcement CVE-2026-53828, GHSA-p73f-w79w-jqr5 | High | 0.3% | 12 Jun, 2026 | npm openclaw |
OpenClaw: memory-wiki ingest could read local files with operator.write scope CVE-2026-53825, GHSA-p2fh-f5fc-44hr | High | 0.4% | 12 Jun, 2026 | npm openclaw |
OpenClaw: Slack allowFrom could bind to mutable display names CVE-2026-53823, GHSA-c29c-2q9c-pc86 | High | 0.2% | 12 Jun, 2026 | npm openclaw |
OpenClaw: Shell wrapper argv could change between approval and execution CVE-2026-53822, GHSA-2j8v-hwgc-x698 | High | 1.1% | 12 Jun, 2026 | npm Openclaw |
OpenClaw: Trusted-proxy Control UI WebSocket accepted client-declared scopes before pairing CVE-2026-53821, GHSA-qjpc-qf9m-xwmr | High | 0.3% | 12 Jun, 2026 | npm openclaw |
@apostrophecms/seo Vulnerable to Stored XSS via Unsanitized Google Analytics / GTM ID Injected into Script Tag CVE-2026-53608, GHSA-wf43-fpp3-cf65 | High | 0.3% | 12 Jun, 2026 | npm @apostrophecms/seo |
form-data: CRLF injection in form-data via unescaped multipart field names and filenames CVE-2026-12143, GHSA-hmw2-7cc7-3qxx | High | 0.7% | 12 Jun, 2026 | npm form-data |
ChromaDB's SimpleRBACAuthorizationProvider doesn't check which tenant, database, or collection a permission applies to CVE-2026-45831, GHSA-xph7-9rjv-w5fr, PYSEC-2026-3815 | High | 0.2% | 12 Jun, 2026 | PyPI chromadb |
ChromaDB allows any authenticated users to arbitrarily read, write, update, or delete data in any tenant's collection CVE-2026-45830, GHSA-2wm9-hf6c-p5cr, PYSEC-2026-3813 | High | 0.3% | 12 Jun, 2026 | PyPI chromadb |