Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Backstage: Improper task state validation in Scaffolder backend CVE-2026-106500, GHSA-xvgh-hmx8-9xxf | High | 0.3% | 25 days ago | npm @backstage/plugin-scaffolder-backend |
Backstage: Secret-derived values may be exposed in scaffolder task logs CVE-2026-106499, GHSA-mfvq-x7vr-rgqg | Medium | 0.3% | 25 days ago | npm @backstage/plugin-scaffolder-backend |
Backstage: Improper URL validation in catalog entity placeholder resolution CVE-2026-106498, GHSA-qgvj-qcf8-xq73 | High | 0.3% | 25 days ago | npm @backstage/plugin-catalog-backend |
Backstage: Inconsistent enforcement of allowed location types during catalog processing CVE-2026-106496, GHSA-pcmq-25r3-5w9v | Medium | 0.2% | 25 days ago | npm @backstage/plugin-catalog-backend |
Backstage: Improper input validation in cloud storage URL readers CVE-2026-106494, GHSA-7649-wm97-w3j3 | Medium | 0.3% | 25 days ago | npm @backstage/backend-defaults |
Backstage: Cloud storage catalog locations may cross configured storage boundaries CVE-2026-106493, GHSA-xvh9-35w9-42m4 | Medium | 0.3% | 25 days ago | npm @backstage/backend-defaults npm @backstage/plugin-catalog-backend-module-aws npm @backstage/plugin-catalog-backend-module-azure |
Backstage: Improper preservation of access restrictions during service credential delegation CVE-2026-106492, GHSA-cq7v-rfgc-5c7v | High | 0.2% | 25 days ago | npm @backstage/backend-defaults |
Backstage: Improper input validation in proxy-backend CVE-2026-106491, GHSA-9ghw-48h5-v2w5 | Medium | 0.3% | 25 days ago | npm @backstage/plugin-proxy-backend |
Backstage: Improper input validation in TechDocs static content requests CVE-2026-106490, GHSA-7mfx-xg57-53c9 | Medium | 0.4% | 25 days ago | npm @backstage/plugin-techdocs-backend |
Backstage: Improper authorization enforcement for TechDocs static content CVE-2026-106489, GHSA-rg9r-hr7g-5gc2 | Medium | 0.3% | 25 days ago | npm @backstage/plugin-techdocs-backend |
Backstage: Improper authentication in the OIDC provider CVE-2026-106488, GHSA-826h-28h9-65hg | High | 0.3% | 25 days ago | npm @backstage/plugin-auth-backend-module-oidc-provider |
Backstage: Unsupported catalog cluster authentication mode in kubernetes backend CVE-2026-106487, GHSA-h53x-hjx6-25gr | Medium | 0.3% | 25 days ago | npm @backstage/plugin-kubernetes-backend |
Backstage has iImproper filesystem validation in Bitbucket pull-request scaffolder actions CVE-2026-106486, GHSA-g8rx-f7m5-7794 | Critical | 0.4% | 25 days ago | npm @backstage/plugin-scaffolder-backend-module-bitbucket-cloud npm @backstage/plugin-scaffolder-backend-module-bitbucket-server |
Backstage has improper authorization in GitLab organizational user ingestion CVE-2026-106463, GHSA-gp6m-x9vw-5c5x | Medium | 0.2% | 25 days ago | npm @backstage/plugin-catalog-backend-module-gitlab |
Backstage's scaffolder credential handling may allow unintended GitHub authentication fallback CVE-2026-106462, GHSA-29gx-h2m3-xw44 | Medium | 0.2% | 25 days ago | npm @backstage/plugin-scaffolder-backend npm @backstage/plugin-scaffolder-backend-module-azure npm @backstage/plugin-scaffolder-backend-module-bitbucket-cloud npm @backstage/plugin-scaffolder-backend-module-bitbucket-server +2 more |
Backstage: Incorrect authorization in scaffolder task listing CVE-2026-106461, GHSA-7hfw-grcm-cqm6 | Medium | 0.2% | 25 days ago | npm @backstage/plugin-scaffolder-backend |
Backstage: Explicit negative email verification can be ignored during shared OAuth profile normalization CVE-2026-106460, GHSA-xm5q-p7w3-x6cp | Medium | 0.3% | 25 days ago | npm @backstage/plugin-auth-node |
Backstage: Improper input validation in Sentry scaffolder actions CVE-2026-106459, GHSA-g734-fhp4-7mfp | High | 0.2% | 25 days ago | npm @backstage/plugin-scaffolder-backend-module-sentry |
Backstage: Inconsistent repository filtering in Bitbucket Server catalog event updates CVE-2026-106458, GHSA-c36c-cf6r-ghgj | Medium | 0.3% | 25 days ago | npm @backstage/plugin-catalog-backend-module-bitbucket-server |
Backstage: Insufficient audience validation in the Cloudflare Access auth provider CVE-2026-106457, GHSA-q333-f498-w2x7 | High | 0.3% | 25 days ago | npm @backstage/plugin-auth-backend-module-cloudflare-access-provider |
Backstage: Inconsistent credential enforcement for overlapping proxy routes CVE-2026-106456, GHSA-472h-9c5j-prrr | Medium | 0.2% | 25 days ago | npm @backstage/plugin-proxy-backend |
Backstage: Improper validation of MkDocs plugin configuration in TechDocs CVE-2026-106455, GHSA-q38j-6vcm-2f5m | High | 0.3% | 25 days ago | npm @backstage/plugin-techdocs-node |
Malicious release: Malicious code in lore-cs (PyPI) MAL-2026-17639 | Malicious | Not scored | 25 days ago | PyPI lore-cs |
Twisted: IMAP wildcardToRegexp() ReDoS CVE-2026-106454, GHSA-8pqf-f4m5-798g, PYSEC-2026-4304 | Medium | 0.4% | 25 days ago | PyPI Twisted PyPI twisted |
Handlebars: JavaScript Injection via AST Type Confusion in compile (bypass of CVE-2026-33937) CVE-2026-106446, GHSA-8r5x-fm3f-whwj | Critical | 0.8% | 25 days ago | npm handlebars |
Handlebars: JavaScript Injection via Own Property Check Bypass CVE-2026-106445, GHSA-p8wg-vrv2-v86f | Critical | 0.6% | 25 days ago | npm handlebars |
Handlebars: JavaScript Injection via Unsafe Inline Embedding of Precompiled Templates CVE-2026-106444, GHSA-xw65-4hp5-5hc7 | Medium | 0.3% | 25 days ago | npm handlebars |
Malicious release: Malicious code in css-jptvix-polyfill (npm) MAL-2026-17638 | Malicious | Not scored | 25 days ago | npm css-jptvix-polyfill |
WeasyPrint: EPS images reach the Ghostscript interpreter resulting in RCE CVE-2026-106443, GHSA-r543-q48m-4c9j, PYSEC-2026-4311 | High | 0.9% | 25 days ago | PyPI WeasyPrint PyPI weasyprint |
Hydra instantiate target blacklist bypasses permit code execution CVE-2026-106442, GHSA-rqx7-p7vv-w7hr, PYSEC-2026-4223 | High | 0.2% | 25 days ago | PyPI hydra-core |
Hydra logging configuration permits unsafe callable resolution CVE-2026-106441, GHSA-c3wx-c55w-pxjq, PYSEC-2026-4221 | High | 0.2% | 25 days ago | PyPI hydra-core |
Hydra: Optuna custom_search_space can resolve and execute untrusted callables via get_method CVE-2026-106440, GHSA-5jjj-9xc3-rm56, PYSEC-2026-4224 | High | 0.3% | 25 days ago | PyPI hydra-optuna-sweeper |
Hydra: Mutable instantiate policy sets allow target blocklist bypass CVE-2026-106439, GHSA-mwj6-rfh8-7qf4, PYSEC-2026-4222 | High | 0.5% | 25 days ago | PyPI hydra-core |
LiquidJS: ownPropertyOnly bypass for inherited array indices in first/last/join/reverse/slice/compact, `.first`/`.last`, negative index, and for-loop iteration CVE-2026-106120, GHSA-fwxr-j5w2-587m | Medium | 0.4% | 25 days ago | npm liquidjs |
LangChain: MongoDBChatMessageHistory query injection can allow cross-session access CVE-2026-106119, GHSA-m6rx-h84q-8r95 | Medium | 0.5% | 25 days ago | npm @langchain/mongodb |
Quasar Framework: App Vite build cleanup can recursively remove unsafe configured output directories CVE-2026-106109, GHSA-q9mq-245r-4g93 | Medium | 0.1% | 25 days ago | npm @quasar/app-vite |
Quasar Framework: App Vite SSR and SSG nonce attributes are not safely constrained CVE-2026-106107, GHSA-5m6h-8g35-p3m7 | High | 0.3% | 25 days ago | npm @quasar/app-vite |
Quasar Framework: SSR/SSG dev error page discloses the full shell environment and its </script> escape is bypassable CVE-2026-106106, GHSA-r5mf-4r5x-q78f | High | 0.3% | 25 days ago | npm @quasar/app-vite npm @quasar/render-ssr-error |
Quasar Framework: Development TLS private keys are cached with overly permissive filesystem permissions CVE-2026-106105, GHSA-fh39-c73x-5pjv | High | 0.1% | 25 days ago | npm @quasar/app-vite npm @quasar/cli npm @quasar/ssl-certificate |
Quasar Framework: Super-linear regex backtracking on User-Agent lets one request stall a Quasar SSR server CVE-2026-106104, GHSA-68jq-fhch-4xq4 | High | 0.4% | 25 days ago | npm quasar |
Quasar Framework: Path Traversal / Arbitrary File Write via crafted Icon Genie profile CVE-2026-106103, GHSA-wmpw-j6qv-mw88 | High | 0.3% | 25 days ago | npm @quasar/icongenie |
Quasar Framework: Stored/Reflected XSS via unescaped SSR meta tag rendering in getHead() CVE-2026-106102, GHSA-pq96-jpmf-w254 | Critical | 0.3% | 25 days ago | npm quasar |
Quasar Framework: DOM Clobbering in Quasar openURL() SafariViewController Integration Causes Client-Side Denial of Service CVE-2026-106101, GHSA-89vp-x45c-52cq | Low | 0.3% | 25 days ago | npm quasar |
Payload: Field-level write access bypass in Payload on MongoDB CVE-2026-106100, GHSA-4ww4-68q3-h7g5 | High | 0.2% | 25 days ago | npm @payloadcms/db-mongodb |
Payload: Uploaded XML files could execute same-origin JavaScript CVE-2026-105868, GHSA-9qpg-3cf8-w33x | High | 0.2% | 25 days ago | npm payload |
Payload: Client uploads could overwrite S3 objects CVE-2026-105867, GHSA-7vg8-29qx-jgj8 | High | 0.2% | 25 days ago | npm @payloadcms/storage-s3 |
Payload: Unauthenticated account-lockout denial of service CVE-2026-105866, GHSA-v5gf-vpjc-pc7w | Medium | 0.4% | 25 days ago | npm payload |
Payload: Incomplete validation during the upload file lifecycle CVE-2026-105865, GHSA-p223-2wr2-j562 | High | 0.4% | 25 days ago | npm payload |
@payloadcms/plugin-multi-tenant has a cross-tenant create issue CVE-2026-105864, GHSA-xhm9-gwgw-3q2q | Medium | 0.2% | 25 days ago | npm @payloadcms/plugin-multi-tenant |
Payload authentication token field handling issue CVE-2026-105863, GHSA-66wr-7vmr-p5jq | Critical | 0.4% | 25 days ago | npm payload |