Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Concrete CMS has an unauthorized file access issue CVE-2026-7879, GHSA-fqg3-8w8r-8g94 | Medium | 0.2% | 21 May, 2026 | Packagist concrete5/concrete5 |
Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv4-mapped IPv6 (Incomplete fix of CVE-2026-25580) CVE-2026-46678, GHSA-cqp8-fcvh-x7r3, PYSEC-2026-2978, PYSEC-2026-2982 | Medium | 0.4% | 21 May, 2026 | PyPI pydantic-ai PyPI pydantic-ai-slim |
SQLAdmin: Authorization Bypass on `ajax_lookup` CVE-2026-46645, GHSA-54mc-gghv-4cfj, PYSEC-2026-3073 | Medium | 0.3% | 21 May, 2026 | PyPI sqladmin |
Twig: `{% sandbox %}{% include %}` skips checkSecurity() on cached templates (incomplete fix for CVE-2024-45411) CVE-2026-46638, GHSA-7fxw-r6jv-74c8 | Medium | 0.5% | 21 May, 2026 | Packagist twig/twig |
Twig: HTML-output filters in twig/* extras incorrectly declared `is_safe => ['all']` CVE-2026-46637, GHSA-jv8m-2544-3pg3 | Medium | 0.3% | 21 May, 2026 | Packagist twig/cssinliner-extra Packagist twig/markdown-extra |
Twig: Sandbox property allowlist bypass via the `column` filter (array_column on objects) CVE-2026-46635, GHSA-vcc8-phrv-43wj | Medium | 0.3% | 21 May, 2026 | Packagist twig/twig |
twig/intl-extra: Unbounded formatter memoisation in keyed on template-controlled arguments CVE-2026-46629, GHSA-35wc-cvqg-78fp | Medium | 0.5% | 21 May, 2026 | Packagist twig/intl-extra |
Twig: The `spaceless` filter implicitly marks its output as safe CVE-2026-46628, GHSA-4j38-f5cw-54h7 | Medium | 0.3% | 21 May, 2026 | Packagist twig/twig |
Concrete CMS is vulnerable to authorization bypass in the Calendar Block CVE-2026-8205, GHSA-46xh-7854-f568 | Medium | 0.2% | 21 May, 2026 | Packagist concrete5/concrete5 |
Concrete CMS is vulnerable to authorization bypass in the Calendar Event Frontend Dialog CVE-2026-8204, GHSA-x2fp-hj8c-mmxh | Medium | 0.2% | 21 May, 2026 | Packagist concrete5/concrete5 |
Concrete CMS is vulnerable to unauthenticated file usage disclosure CVE-2026-6826, GHSA-4g7q-44qp-cc5c | Medium | 1.5% | 21 May, 2026 | Packagist concrete5/concrete5 |
FlaskBB: SSRF in get_image_info() via unrestricted avatar URL CVE-2026-46556, GHSA-xq32-9g7q-7297, PYSEC-2026-2479 | Medium | 0.4% | 21 May, 2026 | PyPI flaskbb |
NocoDB: Shared-base link access can invite arbitrary users as persistent base members CVE-2026-46552, GHSA-chqv-vrj7-qffp | Medium | 0.3% | 21 May, 2026 | npm nocodb |
NocoDB: Missing File Size Enforcement in Upload-by-URL Allows Denial of Service via Disk Exhaustion CVE-2026-46551, GHSA-99vc-2jx2-688p | Medium | 0.4% | 21 May, 2026 | npm nocodb |
NocoDB: Refresh Token Cookie Set Without `secure` and `sameSite` Flags CVE-2026-46550, GHSA-f74w-272x-mqcv | Medium | 0.2% | 21 May, 2026 | npm nocodb |
NocoDB: SSRF Protection Bypass in Notification Webhook Plugins (Slack, Discord, Mattermost, Teams) CVE-2026-46548, GHSA-2c5x-4jgf-88mj | Medium | 0.3% | 21 May, 2026 | npm nocodb |
NocoDB: Reflected Cross-Site Scripting via Page Leaving Redirect URL CVE-2026-46547, GHSA-9qgr-6vpg-9gh9 | Medium | 0.3% | 21 May, 2026 | npm nocodb |
Snappy : SSRF and local file read via the xsl-style-sheet option CVE-2026-46683, GHSA-c5fp-p67m-gq56 | Medium | 0.2% | 21 May, 2026 | Packagist knplabs/knp-snappy |
pyload-ng: SSRF via HTTP Redirect Bypass in parse_urls API CVE-2026-46561, GHSA-8rp3-xc6w-5qp5, PYSEC-2026-2991 | Medium | 0.2% | 21 May, 2026 | PyPI pyload-ng |
@sveltejs/kit: `query.batch` cross-talk CVE-2026-82258, GHSA-hgv7-v322-mmgr | Medium | 0.2% | 21 May, 2026 | npm @sveltejs/kit |
Mobile Verification Toolkit (MVT): Path Traversal via unsanitized File identifiers in iOS Backup processing CVE-2026-46486, GHSA-5h3g-px23-w6vw, PYSEC-2026-2671 | Medium | 0.4% | 21 May, 2026 | PyPI mvt |
Trend Micro Apex One (On-Premise) Directory Traversal Vulnerability CVE-2026-34926 | MediumExploited | 13.4% | 21 May, 2026 | |
MLflow authenticated users can enumerate any registered model versions due to lack of per-model permissions checks BIT-mlflow-2026-2734, CVE-2026-2734, GHSA-w5xq-c4pf-ghq7, PYSEC-2026-2660 | Medium | 0.4% | 21 May, 2026 | PyPI mlflow |
CryptPad has a Sanitizer Bypass in Diffmarked.js that Allows Arbitrary HTML Injection and Potential XSS CVE-2026-26028, GHSA-g2g4-47gv-p72v | Medium | 0.2% | 20 May, 2026 | npm cryptpad |
@cyntler/react-doc-viewer's TXTRenderer fails to sanitize file content and explicitly casts raw data as a ReactNode CVE-2026-30691, GHSA-fvhg-p4hf-79x3 | Medium | 0.3% | 20 May, 2026 | npm @cyntler/react-doc-viewer |
Flowise: Cross-Workspace Chatflow Disclosure via chatflows/apikey Endpoint Returns All Unprotected Chatflows CVE-2026-56268, GHSA-c2c9-mfw7-p8hw | Medium | 0.4% | 20 May, 2026 | npm flowise |
Flowise: Mass Assignment in PUT /api/v1/user Allows Authenticated Users to Override Password Hash and Bypass Password Change Verification CVE-2026-56276, GHSA-59fh-9f3p-7m39 | Medium | 0.4% | 20 May, 2026 | npm flowise |
Flowise: Hardcoded CORS wildcard on TTS endpoint enables cross-origin credential abuse from any webpage CVE-2026-56277, GHSA-m837-xvxr-vqwg | Medium | 0.2% | 20 May, 2026 | npm flowise |
Apache Airflow Amazon provider: Prevent unauthorized access to team-scoped secrets in AWS Secrets Manager and SSM Parameter Store backends CVE-2026-42526, GHSA-g9qc-qf28-hhqx, PYSEC-2026-595 | Medium | 0.4% | 19 May, 2026 | PyPI apache-airflow-providers-amazon |
Regression in pymdownx.snippets reintroduces sibling-prefix path traversal bypass despite restrict_base_path CVE-2026-46338, GHSA-62q4-447f-wv8h, PYSEC-2026-2999 | Medium | 0.4% | 19 May, 2026 | PyPI pymdown-extensions |
FPDI: Memory Exhaustion and Endless Loop in FPDI leads to Denial of Service CVE-2026-45802, GHSA-2mgw-7q6p-8grg | Medium | 0.3% | 19 May, 2026 | Packagist setasign/fpdi |
HAX CMS: Denial of Service using Malicious Import Request CVE-2026-46357, GHSA-9r33-xhw8-4qqp | Medium | 0.2% | 19 May, 2026 | npm @haxtheweb/haxcms-nodejs |
Apify Model Context Protocol (MCP) server: Domain Allowlist Bypass in fetch-apify-docs via String Prefix Matching CVE-2026-46341, GHSA-jwp7-wg77-3w9v | Medium | 0.2% | 19 May, 2026 | npm @apify/actors-mcp-server |
Budibase: Missing Cache Invalidation on Public API Role Unassignment Allows Revoked Users to Retain Privileges for Up to 1 Hour CVE-2026-46424, GHSA-6vp2-6r7m-2jvx | Medium | 0.2% | 19 May, 2026 | npm @budibase/backend-core |
AVideo: Unauthenticated Arbitrary Image Read via Path Traversal in `view/img/image404Raw.php` CVE-2026-46337, GHSA-w4qq-74h6-58wq | Medium | 0.5% | 19 May, 2026 | Packagist WWBN/AVideo |
n8n: Credential exfiltration via Allowed HTTP Request Domains Bypass CVE-2026-56348, GHSA-3875-8gcx-7v46 | Medium | 0.5% | 19 May, 2026 | npm n8n |
n8n: Legacy ExecuteWorkflow Node Bypassed File Path Restrictions CVE-2026-56352, GHSA-2vx9-7wpg-88jq | Medium | 0.3% | 19 May, 2026 | npm n8n |
Strawberry GraphQL: Default GraphiQL may expose HTTP headers in URLs CVE-2026-45739, GHSA-x97m-qp5c-w9xj, PYSEC-2026-2282 | Medium | 0.2% | 19 May, 2026 | PyPI strawberry-graphql |
Nuxt: Dev server exposes built source over LAN to malicious sites (incomplete fix for GHSA-4gf7-ff8x-hq99) CVE-2026-45670, GHSA-6m52-m754-pw2g | Medium | 0.2% | 19 May, 2026 | npm @nuxt/rspack-builder npm @nuxt/webpack-builder |
Nuxt: Reflected XSS in `navigateTo()` external redirect CVE-2026-45669, GHSA-fx6j-w5w5-h468 | Medium | 0.2% | 19 May, 2026 | npm nuxt |
Internationalized Domain Names in Applications (IDNA): Specially crafted inputs to idna.encode() can bypass CVE-2024-3651 fix CVE-2026-45409, GHSA-65pc-fj4g-8rjx, PYSEC-2026-215 | Medium | 0.4% | 19 May, 2026 | PyPI idna |
TYPO3 ke_search path traversal due to lack of normalization on config directory from file indexer CVE-2026-46724, GHSA-c72x-mc2p-wv7x | Medium | 0.4% | 19 May, 2026 | Packagist tpwd/ke_search |
TYPO3 ke_search path traversal from arbitrary table configuration input CVE-2026-46723, GHSA-67j3-jmm3-32xc | Medium | 0.3% | 19 May, 2026 | Packagist tpwd/ke_search |
TYPO3 ke_search XML External Entity Injection CVE-2026-46722, GHSA-fq39-62gx-8hqx | Medium | 0.3% | 19 May, 2026 | Packagist tpwd/ke_search |
TYPO3 sf_register extension allows unauthorized assignment of frontend user groups CVE-2026-46721, GHSA-v348-vr4q-fv9p | Medium | 0.4% | 19 May, 2026 | Packagist evoweb/sf-register |
ExifReader is vulnerable to denial of service via unbounded decompression of image metadata CVE-2026-8814, GHSA-rr89-w3h9-m66j | Medium | 0.5% | 19 May, 2026 | npm exifreader |
NiceGUI: Unauthenticated log-volume denial of service in dynamic resource routes CVE-2026-45554, GHSA-pq7c-x8g4-rvp6, PYSEC-2026-2680 | Medium | 0.3% | 18 May, 2026 | PyPI nicegui |
Summarize's hover summary feature allows malicious pages to dispatch synthetic mouseover events over attacker-controlled links CVE-2026-45245, GHSA-2r69-qgv3-hr65 | Medium | 0.3% | 18 May, 2026 | npm @steipete/summarize |
Summarize contains a missing authorization vulnerability CVE-2026-45243, GHSA-5624-2pmv-jx46 | Medium | 0.2% | 18 May, 2026 | npm @steipete/summarize |
AVideo: Authenticated Arbitrary File Read in view/update.php CVE-2026-45731, GHSA-3mjv-375j-6h92 | Medium | 0.5% | 18 May, 2026 | Packagist WWBN/AVideo |