Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Flowise: Hardcoded CORS wildcard on TTS endpoint enables cross-origin credential abuse from any webpage CVE-2026-56277, GHSA-m837-xvxr-vqwg | Medium | 0.2% | 20 May, 2026 | npm flowise |
Apache Airflow Amazon provider: Prevent unauthorized access to team-scoped secrets in AWS Secrets Manager and SSM Parameter Store backends CVE-2026-42526, GHSA-g9qc-qf28-hhqx, PYSEC-2026-595 | Medium | 0.4% | 19 May, 2026 | PyPI apache-airflow-providers-amazon |
Regression in pymdownx.snippets reintroduces sibling-prefix path traversal bypass despite restrict_base_path CVE-2026-46338, GHSA-62q4-447f-wv8h, PYSEC-2026-2999 | Medium | 0.4% | 19 May, 2026 | PyPI pymdown-extensions |
FPDI: Memory Exhaustion and Endless Loop in FPDI leads to Denial of Service CVE-2026-45802, GHSA-2mgw-7q6p-8grg | Medium | 0.3% | 19 May, 2026 | Packagist setasign/fpdi |
HAX CMS: Denial of Service using Malicious Import Request CVE-2026-46357, GHSA-9r33-xhw8-4qqp | Medium | 0.2% | 19 May, 2026 | npm @haxtheweb/haxcms-nodejs |
Apify Model Context Protocol (MCP) server: Domain Allowlist Bypass in fetch-apify-docs via String Prefix Matching CVE-2026-46341, GHSA-jwp7-wg77-3w9v | Medium | 0.2% | 19 May, 2026 | npm @apify/actors-mcp-server |
Budibase: Missing Cache Invalidation on Public API Role Unassignment Allows Revoked Users to Retain Privileges for Up to 1 Hour CVE-2026-46424, GHSA-6vp2-6r7m-2jvx | Medium | 0.2% | 19 May, 2026 | npm @budibase/backend-core |
AVideo: Unauthenticated Arbitrary Image Read via Path Traversal in `view/img/image404Raw.php` CVE-2026-46337, GHSA-w4qq-74h6-58wq | Medium | 0.5% | 19 May, 2026 | Packagist WWBN/AVideo |
n8n: Credential exfiltration via Allowed HTTP Request Domains Bypass CVE-2026-56348, GHSA-3875-8gcx-7v46 | Medium | 0.5% | 19 May, 2026 | npm n8n |
n8n: Legacy ExecuteWorkflow Node Bypassed File Path Restrictions CVE-2026-56352, GHSA-2vx9-7wpg-88jq | Medium | 0.3% | 19 May, 2026 | npm n8n |
Strawberry GraphQL: Default GraphiQL may expose HTTP headers in URLs CVE-2026-45739, GHSA-x97m-qp5c-w9xj, PYSEC-2026-2282 | Medium | 0.2% | 19 May, 2026 | PyPI strawberry-graphql |
Nuxt: Dev server exposes built source over LAN to malicious sites (incomplete fix for GHSA-4gf7-ff8x-hq99) CVE-2026-45670, GHSA-6m52-m754-pw2g | Medium | 0.2% | 19 May, 2026 | npm @nuxt/rspack-builder npm @nuxt/webpack-builder |
Nuxt: Reflected XSS in `navigateTo()` external redirect CVE-2026-45669, GHSA-fx6j-w5w5-h468 | Medium | 0.2% | 19 May, 2026 | npm nuxt |
Internationalized Domain Names in Applications (IDNA): Specially crafted inputs to idna.encode() can bypass CVE-2024-3651 fix CVE-2026-45409, GHSA-65pc-fj4g-8rjx, PYSEC-2026-215 | Medium | 0.4% | 19 May, 2026 | PyPI idna |
TYPO3 ke_search path traversal due to lack of normalization on config directory from file indexer CVE-2026-46724, GHSA-c72x-mc2p-wv7x | Medium | 0.4% | 19 May, 2026 | Packagist tpwd/ke_search |
TYPO3 ke_search path traversal from arbitrary table configuration input CVE-2026-46723, GHSA-67j3-jmm3-32xc | Medium | 0.3% | 19 May, 2026 | Packagist tpwd/ke_search |
TYPO3 ke_search XML External Entity Injection CVE-2026-46722, GHSA-fq39-62gx-8hqx | Medium | 0.3% | 19 May, 2026 | Packagist tpwd/ke_search |
TYPO3 sf_register extension allows unauthorized assignment of frontend user groups CVE-2026-46721, GHSA-v348-vr4q-fv9p | Medium | 0.4% | 19 May, 2026 | Packagist evoweb/sf-register |
ExifReader is vulnerable to denial of service via unbounded decompression of image metadata CVE-2026-8814, GHSA-rr89-w3h9-m66j | Medium | 0.5% | 19 May, 2026 | npm exifreader |
NiceGUI: Unauthenticated log-volume denial of service in dynamic resource routes CVE-2026-45554, GHSA-pq7c-x8g4-rvp6, PYSEC-2026-2680 | Medium | 0.3% | 18 May, 2026 | PyPI nicegui |
Summarize's hover summary feature allows malicious pages to dispatch synthetic mouseover events over attacker-controlled links CVE-2026-45245, GHSA-2r69-qgv3-hr65 | Medium | 0.3% | 18 May, 2026 | npm @steipete/summarize |
Summarize contains a missing authorization vulnerability CVE-2026-45243, GHSA-5624-2pmv-jx46 | Medium | 0.2% | 18 May, 2026 | npm @steipete/summarize |
AVideo: Authenticated Arbitrary File Read in view/update.php CVE-2026-45731, GHSA-3mjv-375j-6h92 | Medium | 0.5% | 18 May, 2026 | Packagist WWBN/AVideo |
Budibase: CouchDB Reduce Injection via Unsanitized Calculation Parameter in V1 Views API CVE-2026-45719, GHSA-363w-hvwh-w7m6 | Medium | 0.3% | 18 May, 2026 | npm @budibase/server |
Budibase: Row Action Trigger Bypasses View Row Filter Security Boundary Allowing Action on Out-of-Scope Rows CVE-2026-45718, GHSA-3263-v5v9-xq8q | Medium | 0.1% | 18 May, 2026 | npm budibase |
Sulu: Weak Cryptographical usage for API Key generation and Reset Tokens CVE-2026-45701, GHSA-7fv8-6pp7-6h85 | Medium | 0.2% | 18 May, 2026 | Packagist sulu/sulu |
shopper/framework: Race condition on Discount.usage_limit allows silent over-redemption CVE-2026-47741, GHSA-9rh9-hf3w-9fgg | Medium | 0.2% | 18 May, 2026 | Packagist shopper/cart |
CI4MS Fileeditor allows deletion and rename of critical application files due to missing extension allowlist on destructive operations CVE-2026-45139, GHSA-245j-xjvr-xvm5 | Medium | 0.3% | 18 May, 2026 | Packagist ci4-cms-erp/ci4ms |
CI4MS: Stored XSS in Blog Content via Broken `html_purify` Validation Rule CVE-2026-45138, GHSA-2m69-jmvh-6chr | Medium | 0.2% | 18 May, 2026 | Packagist ci4-cms-erp/ci4ms |
eduMFA: Unauthenticated Failcounter Increment on Resolver Tokens via /validate/check GHSA-74r7-3mjm-jc5v | Medium | Not scored | 18 May, 2026 | PyPI edumfa |
Statamic CMS: Server-Side Request Forgery via Glide CVE-2026-45660, GHSA-pf9c-ch8r-2958 | Medium | 0.2% | 18 May, 2026 | Packagist statamic/cms |
Neotoma: Unauthenticated Inspector/API access via reverse-proxy loopback auth bypass CVE-2026-45577, GHSA-5cvp-p7p4-mcx9 | Medium | 0.2% | 18 May, 2026 | npm neotoma |
AVideo CVE-2026-43881 incomplete fix - `objects/mention.json.php:17` is an unauthenticated user enumeration sibling that survives `d9cdc7024` CVE-2026-45620, GHSA-vpfx-pxqw-2w79 | Medium | 0.2% | 18 May, 2026 | Packagist WWBN/AVideo |
n8n-MCP: Workflow telemetry sanitizer could retain partial values from URL-shaped node parameters CVE-2026-45582, GHSA-f3rg-xqjj-cj9w | Medium | 0.3% | 18 May, 2026 | npm n8n-mcp |
qs has a remotely triggerable DoS: qs.stringify crashes with TypeError on null/undefined entries in comma-format arrays when encodeValuesOnly is set CVE-2026-8723, GHSA-q8mj-m7cp-5q26 | Medium | 0.4% | 17 May, 2026 | npm qs |
AVideo CVE-2026-43884 incomplete fix - six (or more) `isSSRFSafeURL()` call sites still discard the `$resolvedIP` out-param at master HEAD post-`603e7bf` CVE-2026-45619, GHSA-c3ch-22rq-xfwr | Medium | 0.1% | 15 May, 2026 | Packagist WWBN/AVideo |
AVideo: 2FA toggle endpoint has no CSRF protection, letting an attacker page silently disable a logged-in victim's 2FA CVE-2026-45610, GHSA-3mv2-vmwh-rwfx | Medium | 0.1% | 15 May, 2026 | Packagist WWBN/AVideo |
AVideo: stored XSS via unescaped stream key in modeYoutubeLive.php class attribute CVE-2026-45580, GHSA-m5j4-7r85-2cj2 | Medium | 0.1% | 15 May, 2026 | Packagist WWBN/AVideo |
Better Auth: OAuth callback accepts mismatched `state` when cookie-backed state storage is used without PKCE CVE-2026-67335, GHSA-wxw3-q3m9-c3jr | Medium | 0.3% | 15 May, 2026 | npm better-auth |
Microsoft APM: Windows absolute-path tar member overwrite during legacy-bundle probing in `apm install` CVE-2026-46383, GHSA-mq5j-pw29-jcv3, PYSEC-2026-2378 | Medium | 0.4% | 15 May, 2026 | PyPI apm-cli |
Cockpit CMS: Stored cross-site scripting vulnerability in the Set field type's Display template option CVE-2026-23695, GHSA-ch4j-vcf5-58x5 | Medium | 0.1% | 15 May, 2026 | Packagist cockpit-hq/cockpit |
Weblate: Stored HTML injection in editor search preview CVE-2026-45106, GHSA-6wxc-8mgq-w26m, PYSEC-2026-3415 | Medium | 0.2% | 15 May, 2026 | PyPI weblate |
SimpleSAMLphp casserver: Open Redirect in logout CVE-2025-65954, GHSA-cvrm-5hp6-h523 | Medium | 0.3% | 15 May, 2026 | Packagist simplesamlphp/simplesamlphp-module-casserver |
Turbo: Login callback CSRF/session fixation CVE-2026-45773, GHSA-hcf7-66rw-9f5r | Medium | 0.1% | 15 May, 2026 | npm turbo |
@utcp/http: SSRF via attacker-controlled OpenAPI servers[0].url in HTTP communication protocol CVE-2026-45366, GHSA-r8j5-8747-88cm | Medium | 0.1% | 14 May, 2026 | npm @utcp/http |
Svelte: SSR XSS via Insecure Promise Serialization in hydratable GHSA-f3cj-j4f6-wq85 | Medium | Not scored | 14 May, 2026 | npm svelte |
electerm's encrypt method not safe enough CVE-2026-45787, GHSA-g29v-q6h7-76wh | Medium | 0.1% | 14 May, 2026 | npm electerm |
Svelte Vulnerable to XSS via DOM Clobbering of Internal Framework State CVE-2026-42573, GHSA-rcqx-6q8c-2c42 | Medium | 0.3% | 14 May, 2026 | npm svelte |
Svelte: ReDoS in `<svelte:element>` Tag Validation CVE-2026-42567, GHSA-9rmh-mm8f-r9h6 | Medium | 0.5% | 14 May, 2026 | npm svelte |
Open WebUI: Unauthenticated endpoint can trigger embedding generation (cost/DoS) CVE-2026-45667, GHSA-m69w-p7m4-585j, PYSEC-2026-2747 | Medium | 0.3% | 14 May, 2026 | PyPI open-webui |