Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Shopper: Multiple data integrity and disclosure issues in admin Livewire components CVE-2026-47743, GHSA-hr9v-r8r2-hg7j | High | 0.4% | 05 Jun, 2026 | Packagist shopper/framework |
DbGate: Remote Code Execution via functionName injection in loadReader endpoint CVE-2026-48017, GHSA-hv83-ggc4-v385 | High | 0.5% | 05 Jun, 2026 | npm dbgate-api |
Sync-in Server: SSRF protection bypass via IPv4-mapped IPv6 addresses in regExpPrivateIP CVE-2026-47684, GHSA-q4x5-8cj6-52wg | High | 0.2% | 05 Jun, 2026 | npm @sync-in/server |
praisonai-platform: Agent endpoints accept any agent_id without workspace ownership check, cross-workspace read/update/delete IDOR CVE-2026-47419, GHSA-7p8g-6c6g-h9w7, PYSEC-2026-2931 | High | 0.3% | 05 Jun, 2026 | PyPI praisonai-platform |
NocoDB: Stored Cross-Site Scripting via Form View Redirect URL CVE-2026-47387, GHSA-hj85-ph9q-78jg | High | 0.4% | 05 Jun, 2026 | npm nocodb |
NocoDB: Stored Cross-Site Scripting via Row Comments CVE-2026-47383, GHSA-jf3g-4gwg-4h66 | High | 0.4% | 05 Jun, 2026 | npm nocodb |
ansible-core: Argument injection in ansible-galaxy role install leads to arbitrary code execution CVE-2026-11332, GHSA-w8p5-mx5w-cpqj, PYSEC-2026-3458 | High | 0.2% | 05 Jun, 2026 | PyPI ansible-core |
OpenStack Ironic: Crafted JSON String to Certain Endpoints on the API or JSON-RPC Service May Result in Service Crash CVE-2026-50589, GHSA-q3g8-rjrx-59ph, PYSEC-2026-216 | High | 0.4% | 05 Jun, 2026 | PyPI ironic |
Cisco Catalyst SD-WAN Manager Improper Encoding or Escaping of Output Vulnerability CVE-2026-20245 | HighExploited | 25.3% | 04 Jun, 2026 | |
WWBN AVideo: Stored XSS via autoEvalCodeOnHTML Bypass in MessageSQLite WebSocket Handler (CVE-2026-43874 Bypass) CVE-2026-49279, GHSA-2fhx-q92v-5fhv | High | 0.4% | 04 Jun, 2026 | Packagist wwbn/avideo |
OpenStack oslo.messaging does not verify RabbitMQ broker hostname during TLS handshake CVE-2026-44393, GHSA-76qh-xr7q-h39m, PYSEC-2026-3492 | High | 0.2% | 04 Jun, 2026 | PyPI oslo-messaging PyPI oslo.messaging |
SolarWinds Serv-U Uncontrolled Resource Consumption Vulnerability CVE-2026-28318 | HighExploited | 43.7% | 04 Jun, 2026 | |
Better Auth: Device authorization approve and deny accept any authenticated session while the user code is pending CVE-2026-45337, GHSA-cq3f-vc6p-68fh | High | 0.2% | 04 Jun, 2026 | npm better-auth |
Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection CVE-2026-44496, GHSA-hfxv-24rg-xrqf | High | 5.4% | 04 Jun, 2026 | npm axios |
Allocation of Resources Without Limits or Throttling in Axios CVE-2026-44488, GHSA-777c-7fjr-54vf | High | 0.7% | 04 Jun, 2026 | npm axios |
Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter CVE-2026-44487, GHSA-p92q-9vqr-4j8v | High | 0.7% | 04 Jun, 2026 | npm axios |
Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connection CVE-2026-44486, GHSA-j5f8-grm9-p9fc | High | 0.6% | 04 Jun, 2026 | npm axios |
OpenStack Ironic allows file overwrite via directory traversal during deployment with a crafted ISO image CVE-2026-48681, GHSA-9v62-qx4c-44x5, PYSEC-2026-3470 | High | 0.6% | 04 Jun, 2026 | PyPI ironic |
OpenStack Ironic allows Boot Script Injection CVE-2026-46447, GHSA-jrh2-f5jc-xpgr, PYSEC-2026-3471 | High | 0.3% | 03 Jun, 2026 | PyPI ironic |
Froxlor's API Authentication bypasses 2FA Authentication CVE-2026-52793, GHSA-f9rx-7wf7-jr36 | High | 0.3% | 03 Jun, 2026 | Packagist froxlor/froxlor |
Docling Core: Unsafe remote filename resolution CVE-2026-44023, GHSA-jmmv-h3mp-59v8, PYSEC-2026-2457 | High | 0.4% | 03 Jun, 2026 | PyPI docling-core |
Docling Core: Insufficient validation of image reference URIs CVE-2026-44019, GHSA-j5xp-7m2f-49jv, PYSEC-2026-2456 | High | 0.4% | 03 Jun, 2026 | PyPI docling-core |
Docling: Unsafe URI and Path Handling in HTML Backend CVE-2026-47214, GHSA-q29v-xc37-wh5m, PYSEC-2026-2146 | High | 0.4% | 03 Jun, 2026 | PyPI docling |
Docling: Unsafe XML Entity Expansion in USPTO Patent Backend CVE-2026-44020, GHSA-m88r-rg27-5xfg, PYSEC-2026-240 | High | 0.6% | 03 Jun, 2026 | PyPI docling |
Docling: Unsafe Archive Extraction and XML Parsing in METS-GBS Backend CVE-2026-44018, GHSA-r3xg-rg9j-67fv, PYSEC-2026-2144 | High | 0.2% | 03 Jun, 2026 | PyPI docling |
Docling: Unsafe Playwright-based HTML Rendering CVE-2026-44016, GHSA-pj2v-ggqh-cmq2, PYSEC-2026-2142 | High | 0.6% | 03 Jun, 2026 | PyPI docling |
Froxlor: BIND Zone File Injection via TXT Record Content CVE-2026-41234, GHSA-37m5-m4q3-fc6x | High | 0.3% | 03 Jun, 2026 | Packagist froxlor/froxlor |
Docling: Unsafe Zip Extraction in EasyOCR Model Download CVE-2026-44017, GHSA-cjqg-rq2h-2fvj, PYSEC-2026-2143 | High | 0.7% | 03 Jun, 2026 | PyPI docling |
Concrete CMS is vulnerable to PHP Object Injection via unserialize() calls in the Workflow, Form block, and File/Set components CVE-2026-7888, GHSA-52pr-7vmf-2w7x | High | 0.2% | 03 Jun, 2026 | Packagist concrete5/concrete5 |
Cisco Unified Communications Manager Server-Side Request Forgery (SSRF) Vulnerability CVE-2026-20230 | HighExploited | 88.2% | 03 Jun, 2026 | |
Duplicate Advisory: jupyter-server is vulnerable to CORS origin validation bypass when the `allow_origin_pat` configuration is used CVE-2026-6657, GHSA-v42x-x7jp-845h, PYSEC-2026-3472 | High | 6.2% | 03 Jun, 2026 | PyPI jupyter-server |
daphne: Unauthenticated attackers can cause excessive memory consumption by sending arbitrarily large WebSocket messages/frames CVE-2026-44545, GHSA-rrc9-mx66-ffcm, PYSEC-2026-213 | High | 0.3% | 03 Jun, 2026 | PyPI daphne |
browserstack-runner has an unauthenticated arbitrary file read via path traversal in HTTP server CVE-2026-49144, GHSA-8rpw-6cqh-2v9h | High | 0.4% | 02 Jun, 2026 | npm browserstack-runner |
browserstack-runner vulnerable to Remote Code Execution via vm sandbox escape in _log HTTP handler CVE-2026-49143, GHSA-6vr3-7wcx-v5g5 | High | 0.8% | 02 Jun, 2026 | npm browserstack-runner |
React Router vulnerable to DoS via unbounded path expansion in __manifest endpoint CVE-2026-42342, GHSA-8x6r-g9mw-2r78 | High | 0.3% | 02 Jun, 2026 | npm @remix-run/server-runtime npm react-router |
React Router's vendored turbo-stream v2 allows arbitrary constructor invocation via TYPE_ERROR deserialization leading to Unauth RCE CVE-2026-42211, GHSA-49rj-9fvp-4h2h | High | 0.4% | 02 Jun, 2026 | npm react-router |
AIOHTTP is Vulnerable to Deserialization of Untrusted Data CVE-2026-34993, GHSA-jg22-mg44-37j8, PYSEC-2026-2104 | High | 0.2% | 02 Jun, 2026 | PyPI aiohttp |
React Router vulnerable to Denial of Service via reflected user input in single-fetch CVE-2026-34077, GHSA-rxv8-25v2-qmq8 | High | 0.3% | 02 Jun, 2026 | npm react-router npm turbo-stream |
React Router vulnerable to XSS in unstable RSC redirect handling via javascript: redirect targets CVE-2026-33245, GHSA-8646-j5j9-6r62 | High | 0.2% | 02 Jun, 2026 | npm react-router |
Duplicate Advisory: Jupyter Server vulnerable to Path Traversal via incorrect root directory boundary check in _get_os_path() CVE-2026-5422, GHSA-gf7q-q4j7-hp7c, PYSEC-2026-2532 | High | 4.9% | 02 Jun, 2026 | PyPI jupyter-server |
Prefect has an Authentication Middleware Bypass when URL paths are appended with 'health' or 'ready' CVE-2026-3514, GHSA-c635-393c-hcx2, PYSEC-2026-2261 | High | 0.5% | 02 Jun, 2026 | PyPI prefect |
Android Framework Integer Overflow Vulnerability CVE-2025-48595 | HighExploited | 1.9% | 01 Jun, 2026 | |
launch-editor vulnerable to command injection via the crafted request on Windows CVE-2024-52011, GHSA-c27g-q93r-2cwf | High | 0.5% | 01 Jun, 2026 | npm launch-editor npm vite |
praisonai-platform: Any workspace member can delete the entire workspace via DELETE /workspaces/{id} CVE-2026-47412, GHSA-g8rr-7rj2-f627, PYSEC-2026-2934 | High | 0.5% | 01 Jun, 2026 | PyPI praisonai-platform |
praisonai-platform: Issue endpoints accept any issue_id without workspace ownership check, cross-workspace read/update/delete IDOR CVE-2026-47415, GHSA-xwq8-frcg-77q8, PYSEC-2026-2939 | High | 0.4% | 01 Jun, 2026 | PyPI praisonai-platform |
praisonai-platform: Comment endpoints accept any issue_id without workspace ownership check, cross-workspace comment read and post IDOR CVE-2026-47417, GHSA-cp4f-5m9r-5jc2, PYSEC-2026-2933 | High | 0.4% | 01 Jun, 2026 | PyPI praisonai-platform |
praisonai-platform: Project endpoints accept any project_id without workspace ownership check, cross-workspace read/update/delete IDOR CVE-2026-47418, GHSA-943m-6wx2-rc2j, PYSEC-2026-2932 | High | 0.4% | 01 Jun, 2026 | PyPI praisonai-platform |
DOMPurify XSS via selectedcontent re-clone CVE-2026-47423, GHSA-87xg-pxx2-7hvx | High | 0.4% | 01 Jun, 2026 | npm dompurify |
@agenticmail/mcp Missing Authentication for Critical Function CVE-2026-50287, GHSA-63gr-g7jc-v8rg | High | 0.4% | 01 Jun, 2026 | npm @agenticmail/mcp |
Apache Airflow: Execution API JWT leaked via KubernetesExecutor worker command-line args BIT-airflow-2026-49298, CVE-2026-49298, GHSA-5j6p-jrrm-6x94, PYSEC-2026-2358 | High | 0.5% | 01 Jun, 2026 | PyPI apache-airflow-core |