Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
OpenStack Keystone doesn't verify that the user supplied in the authentication request matches the owner of the application credential CVE-2026-42998, GHSA-8f8m-wrvr-wcvf, PYSEC-2026-599 | High | 0.3% | 28 May, 2026 | PyPI keystone |
compliance-trestle Vulnerable to Remote Code Execution via Recursive Server-Side Template Injection (SSTI) CVE-2026-46439, GHSA-gg2g-p7xc-qqmm, PYSEC-2026-2425 | High | 0.3% | 28 May, 2026 | PyPI compliance-trestle |
compliance-trestle - jinja has an Arbitrary File Write via Path Traversal CVE-2026-46345, GHSA-4q5v-7g7x-j79w, PYSEC-2026-2423 | High | 0.2% | 28 May, 2026 | PyPI compliance-trestle |
Symfony's JsonPath Evaluates Attacker-Controlled Regular Expressions in match()/search() Without Limits — ReDoS CVE-2026-45756, GHSA-8v8v-g73j-492j | High | 0.6% | 28 May, 2026 | Packagist symfony/json-path Packagist symfony/symfony |
PyJWT: Public-key JWK accepted as HMAC secret enables forged HS256 tokens when mixed families are allowed CVE-2026-48526, GHSA-xgmm-8j9v-c9wx, PYSEC-2026-179 | High | 0.4% | 28 May, 2026 | PyPI pyjwt |
TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments CVE-2026-47762, GHSA-v98h-vmpc-fpqv | High | 0.3% | 28 May, 2026 | NuGet TinyMCE Packagist tinymce/tinymce npm tinymce |
TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection CVE-2026-47761, GHSA-vg35-5wq7-3x7w | High | 0.3% | 28 May, 2026 | NuGet TinyMCE Packagist tinymce/tinymce npm tinymce |
TinyMCE Cross-Site Scripting (XSS) vulnerability using sanitization bypass through nested SVGs CVE-2026-47760, GHSA-mh5m-5hw4-5c69 | High | 0.2% | 28 May, 2026 | NuGet TinyMCE Packagist tinymce/tinymce npm tinymce |
TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes CVE-2026-47759, GHSA-q742-qvgc-gc2f | High | 0.3% | 28 May, 2026 | NuGet TinyMCE Packagist tinymce/tinymce npm tinymce |
compliance-trestle Remote Fetching Mechanism has an Arbitrary File Write via Cache Path Traversal CVE-2026-45725, GHSA-g3vg-vx23-3858, PYSEC-2026-2424 | High | 0.5% | 27 May, 2026 | PyPI compliance-trestle |
FUXA's Unauthenticated Project Data Disclosure Exposes Server-Side Scripts and Device Configurations CVE-2026-47717, GHSA-q3w6-q3hc-c5x6 | High | 1.4% | 27 May, 2026 | npm fuxa-server |
Pimcore has a CustomReports Share Bypass CVE-2026-45704, GHSA-jwcc-gv4m-93x6 | High | 0.4% | 27 May, 2026 | Packagist pimcore/pimcore |
AsyncSSH `AuthorizedKeysFile %u` path traversal allows attacker-selected authorized keys to authenticate a traversal username CVE-2026-45309, GHSA-g794-3fmp-753h, PYSEC-2026-2384 | High | 0.6% | 27 May, 2026 | PyPI asyncssh |
Symfony's YAML Parser has a ReDoS via Catastrophic Backtracking in Parser::cleanup() Regex CVE-2026-45305, GHSA-9frc-8383-795m | High | 0.7% | 27 May, 2026 | Packagist symfony/symfony Packagist symfony/yaml |
Symfony's YAML Parser Vulnerable to Exponential Memory Allocation via Recursive Collection-Alias Expansion ("Billion Laughs") CVE-2026-45304, GHSA-4qpc-3hr4-r2p4 | High | 0.7% | 27 May, 2026 | Packagist symfony/symfony Packagist symfony/yaml |
Symfony hardened the parser when handling untrusted input CVE-2026-45133, GHSA-c2p3-7m5p-cv8x | High | 0.6% | 27 May, 2026 | Packagist symfony/symfony Packagist symfony/yaml |
Automad has Broken Access Control: Unauthenticated exposure of administrator bcrypt password hashes and TOTP secrets via public API endpoint CVE-2026-45332, GHSA-xm76-r88j-vm3g | High | 1.4% | 27 May, 2026 | Packagist automad/automad |
Symfony has Unauthenticated PHP Object Deserialization in MonologBridge server:log Listener CVE-2026-45077, GHSA-m7v2-7gxm-vc2v | High | 0.7% | 27 May, 2026 | Packagist symfony/monolog-bridge Packagist symfony/symfony |
Symfony's HEAD Request Bypasses methods: ['GET'] Filter in #[IsGranted] / #[IsSignatureValid] / #[IsCsrfTokenValid] CVE-2026-45075, GHSA-6439-2f28-8p8q | High | 0.4% | 27 May, 2026 | Packagist symfony/http-kernel Packagist symfony/security-http Packagist symfony/symfony |
Symfony's Cas2Handler Derives CAS service URL from Client Host Header → Cross-Service Ticket Replay CVE-2026-45074, GHSA-j8gj-9rm5-4xhx | High | 0.5% | 27 May, 2026 | Packagist symfony/security-http Packagist symfony/symfony |
Symfony has XXE (Local File Disclosure) in DomCrawler::addXmlContent() via validateOnParse = true CVE-2026-45071, GHSA-x6g4-fwcc-jj8w | High | 0.6% | 27 May, 2026 | Packagist symfony/dom-crawler Packagist symfony/symfony |
Symfony's OidcTokenHandler Accepts JWTs Missing aud/iss/exp Claims CVE-2026-45069, GHSA-29fc-p6c4-24cg | High | 0.3% | 27 May, 2026 | Packagist symfony/security-http Packagist symfony/symfony |
Symfony has an Argument Injection in SendmailTransport via Dash-Prefixed Recipient Address CVE-2026-45068, GHSA-xx3c-qf5g-hc39 | High | 0.5% | 27 May, 2026 | Packagist symfony/mailer Packagist symfony/symfony |
Symfony has Email Header / SMTP Command Injection via CRLF in Symfony\Component\Mime\Address CVE-2026-45067, GHSA-qpmx-3rfj-7rhv | High | 0.6% | 27 May, 2026 | Packagist symfony/mime Packagist symfony/symfony |
Budibase: SSRF via OAuth2 token endpoint URL reaches internal hosts and cloud metadata CVE-2026-48153, GHSA-4q6h-8p4v-67vq | High | 0.2% | 27 May, 2026 | npm @budibase/server |
Budibase: Basic app users can exfiltrate stored REST datasource auth by rewriting datasource base URL CVE-2026-48152, GHSA-3gp5-q4jw-3v94 | High | 0.3% | 27 May, 2026 | npm @budibase/server |
Budibase: Webhook schema endpoint authorization bypass allows unauthenticated mutation of webhook and automation schema CVE-2026-48151, GHSA-qhv3-wjg8-6fx6 | High | 0.2% | 27 May, 2026 | npm @budibase/server |
Budibase: SSRF via OAuth2 Config Validation — Missing fetchWithBlacklist Protection CVE-2026-48146, GHSA-g6qx-g4pr-92v7 | High | 0.2% | 27 May, 2026 | npm @budibase/server |
LiquidJS Vulnerable to ReDoS via Quadratic Backtracking in `strip_html` Filter Regex CVE-2026-45617, GHSA-r7g9-xpmj-5fcq | High | 0.5% | 27 May, 2026 | npm liquidjs |
Kirby CMS vulnerable to cross-site scripting (XSS) from links in KirbyTags and image blocks in the site frontend CVE-2026-45368, GHSA-qvjf-922g-pj44 | High | 0.5% | 27 May, 2026 | Packagist getkirby/cms |
LiquidJS has a memory and render limit bypass via unbounded width padding in `date` filter (strftime) CVE-2026-45357, GHSA-hh27-hf48-9f5q | High | 0.4% | 27 May, 2026 | npm liquidjs |
Pimcore: Missing Authorization in WebDAV MOVE via unchecked asset move handling CVE-2026-45260, GHSA-wc7j-g8wx-m2qx | High | 0.6% | 27 May, 2026 | Packagist pimcore/pimcore |
Pimcore has Unsafe PHP Deserialization in Multiple Locations Without allowed_classes Restriction CVE-2026-45162, GHSA-36fc-7wjg-mfvj | High | 1.0% | 27 May, 2026 | Packagist pimcore/pimcore |
Gradio contains a cookie injection vulnerability CVE-2026-48545, GHSA-7hp7-4p35-3cx2, PYSEC-2026-2178 | High | 0.4% | 27 May, 2026 | PyPI gradio |
Taipy contains a path traversal vulnerability CVE-2026-48544, GHSA-28gh-q3gw-pvx8, PYSEC-2026-3081 | High | 0.5% | 27 May, 2026 | PyPI taipy |
OpenStack Swift: s3api middleware enters an infinite loop when processing a truncated aws-chunked PUT request body CVE-2026-49017, GHSA-g7jq-j257-rww2, PYSEC-2026-3080 | High | 0.4% | 27 May, 2026 | PyPI swift |
GDAL: scanForGeometryContainers in the netCDF driver allows code execution via a stack-based buffer overflow BIT-gdal-2026-49014, CVE-2026-49014, GHSA-wphc-7cm7-8mf7, PYSEC-2026-193 | High | 0.1% | 27 May, 2026 | PyPI gdal |
@hapi/content header parser has a parameter smuggling issue that allows upload-filter bypass via duplicate parameters CVE-2026-44974, GHSA-36hh-x5p5-jgc8 | High | 0.5% | 27 May, 2026 | npm @hapi/content |
Pimcore Admin Classic Bundle Vulnerable to SQL Injection in Translation Grid Date Filter via Unsanitized Property Parameter CVE-2026-44741, GHSA-h4ph-crvj-9h92 | High | 0.5% | 27 May, 2026 | Packagist pimcore/admin-ui-classic-bundle |
Pimcore Vulnerable to SQL Injection in Custom Reports Column Configuration CVE-2026-44739, GHSA-3234-gxc3-pq6f | High | 0.4% | 27 May, 2026 | Packagist pimcore/pimcore |
tmp has Path Traversal via unsanitized prefix/postfix that enables directory escape CVE-2026-44705, GHSA-ph9p-34f9-6g65 | High | 0.4% | 27 May, 2026 | npm tmp |
Kirby CMS has pre-authentication path traversal and PHP file inclusion during user lookup CVE-2026-44177, GHSA-9hx7-c53c-v6x8 | High | 1.8% | 26 May, 2026 | Packagist getkirby/cms |
Kirby CMS vulnerable to cross-site scripting (XSS) from list field content in the site frontend CVE-2026-44175, GHSA-5fhx-9q32-q257 | High | 0.4% | 26 May, 2026 | Packagist getkirby/cms |
Kirby CMS has an Arbitrary Method Call via REST API Search and Collection Query Endpoints CVE-2026-44174, GHSA-86rh-h242-j8xp | High | 0.5% | 26 May, 2026 | Packagist getkirby/cms |
FUXA Vulnerable to Unauthenticated Remote Code Execution via Script Test Mode Authorization Bypass CVE-2026-43947, GHSA-rg3m-cfq7-g6h6 | High | 0.9% | 26 May, 2026 | npm fuxa-server |
FUXA has an unauthenticated arbitrary tag value disclosure via /api/getTagValue CVE-2026-43946, GHSA-fwcm-rqvw-j3p7 | High | 0.6% | 26 May, 2026 | npm fuxa-server |
FUXA Vulnerable to Pre-auth RCE via Path Manipulation & Configuration Injection CVE-2026-43945, GHSA-p69w-mmfv-xrfj | High | 0.8% | 26 May, 2026 | npm @frangoteam/fuxa |
Fedify has an LD-Signature Bypass via JSON-LD Named-Graph Restructuring CVE-2026-42462, GHSA-9rfg-v8g9-9367 | High | 0.2% | 26 May, 2026 | npm @fedify/fedify |
yeoman-environment Vulnerable to Arbitrary Package Installation without User Confirmation CVE-2026-42089, GHSA-vv9j-gjw2-j8wp | High | 0.2% | 26 May, 2026 | npm yeoman-environment |
OpenCTI: Privilege escalation via graphQL API is abusable by organization admins, due to incorrect ACL on userEdit relationAdd CVE-2026-44730, GHSA-q537-qhj4-wcjx, PYSEC-2026-167 | High | 0.3% | 26 May, 2026 | PyPI pycti |