Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in tailwind-animates (npm) GHSA-3cr6-gpr8-pjfm, MAL-2026-6727 | Malicious | Not scored | 02 Jul, 2026 | npm tailwind-animates |
GoFiber Vulnerable to X-Real-IP Spoofing via Header.Add() in BalancerForward CVE-2026-45045, GHSA-gcfq-8gqf-4876, GO-2026-5887 | Medium | 0.5% | 02 Jul, 2026 | Go github.com/gofiber/fiber/v2 Go github.com/gofiber/fiber/v3 |
GoFiber Vulnerable to Username Enumeration via Timing Oracle in BasicAuth Default Authorizer CVE-2026-44332, GHSA-g5vh-55hw-rxm8, GO-2026-5886 | Medium | 0.5% | 02 Jul, 2026 | Go github.com/gofiber/fiber/v3 |
Malicious release: Malicious code in db-convertor (npm) GHSA-p467-3jcx-48q5, MAL-2026-6726 | Malicious | Not scored | 02 Jul, 2026 | npm db-convertor |
Malicious release: Malicious code in @modhamanish/rn-mm-template (npm) GHSA-7v96-p295-826q, MAL-2026-6725 | Malicious | Not scored | 02 Jul, 2026 | npm @modhamanish/rn-mm-template |
MLflow: trace API endpoints lack proper authorization validators BIT-mlflow-2026-8147, CVE-2026-8147, GHSA-2cm6-r77w-6g96, PYSEC-2026-3686 | High | 0.5% | 02 Jul, 2026 | PyPI mlflow |
Craft CMS: Potential authenticated Remote Code Execution via referrer redirect CVE-2026-55794, GHSA-f74w-488g-8x5r | High | 0.4% | 02 Jul, 2026 | Packagist craftcms/cms |
Craft CMS: Sensitive File Disclosure / Server-Side File Read CVE-2026-55792, GHSA-287w-mxq6-x2cp | Medium | 0.3% | 02 Jul, 2026 | Packagist craftcms/cms |
Craft CMS: Authorization bypass in `entries/move-to-section` via missing target-section save check CVE-2026-50280, GHSA-43cq-c2gq-pfpw | Medium | 0.4% | 02 Jul, 2026 | Packagist craftcms/cms |
Craft CMS: Authorship spoofing in `entries/save-entry` via pre-check/post-mutation authorization gap CVE-2026-50279, GHSA-qq2c-2q8j-jh27 | High | 0.4% | 02 Jul, 2026 | Packagist craftcms/cms |
Malicious release: Malicious code in @marketfront/actualordersnippetpopup (npm) MAL-2026-6763 | Malicious | Not scored | 02 Jul, 2026 | npm @marketfront/actualordersnippetpopup |
Malicious release: Malicious code in @marketfront/advertisingdevtool (npm) MAL-2026-6764 | Malicious | Not scored | 02 Jul, 2026 | npm @marketfront/advertisingdevtool |
Malicious release: Malicious code in @marketfront/bannerpopup (npm) MAL-2026-6765 | Malicious | Not scored | 02 Jul, 2026 | npm @marketfront/bannerpopup |
Malicious release: Malicious code in @marketfront/baobabtech (npm) MAL-2026-6766 | Malicious | Not scored | 02 Jul, 2026 | npm @marketfront/baobabtech |
Malicious release: Malicious code in @marketfront/basemarkettemplate (npm) MAL-2026-6767 | Malicious | Not scored | 02 Jul, 2026 | npm @marketfront/basemarkettemplate |
Malicious release: Malicious code in @marketfront/blenderdevtool (npm) MAL-2026-6768 | Malicious | Not scored | 02 Jul, 2026 | npm @marketfront/blenderdevtool |
Malicious release: Malicious code in @marketfront/captchaservice (npm) MAL-2026-6769 | Malicious | Not scored | 02 Jul, 2026 | npm @marketfront/captchaservice |
Malicious release: Malicious code in @marketfront/changefilter (npm) MAL-2026-6770 | Malicious | Not scored | 02 Jul, 2026 | npm @marketfront/changefilter |
Malicious release: Malicious code in @marketfront/commonecommerce (npm) MAL-2026-6771 | Malicious | Not scored | 02 Jul, 2026 | npm @marketfront/commonecommerce |
Malicious release: Malicious code in @marketfront/customdealsfeed (npm) MAL-2026-6772 | Malicious | Not scored | 02 Jul, 2026 | npm @marketfront/customdealsfeed |
Malicious release: Malicious code in @marketfront/designsystemdevtool (npm) MAL-2026-6773 | Malicious | Not scored | 02 Jul, 2026 | npm @marketfront/designsystemdevtool |
Malicious release: Malicious code in @marketfront/devtoolsloader (npm) MAL-2026-6774 | Malicious | Not scored | 02 Jul, 2026 | npm @marketfront/devtoolsloader |
Malicious release: Malicious code in @marketfront/digitalherobannercarousel (npm) MAL-2026-6775 | Malicious | Not scored | 02 Jul, 2026 | npm @marketfront/digitalherobannercarousel |
Malicious release: Malicious code in @marketfront/dynamicpageparams (npm) MAL-2026-6776 | Malicious | Not scored | 02 Jul, 2026 | npm @marketfront/dynamicpageparams |
Malicious release: Malicious code in @marketfront/errorcounter (npm) MAL-2026-6777 | Malicious | Not scored | 02 Jul, 2026 | npm @marketfront/errorcounter |
Malicious release: Malicious code in @marketfront/fashiononboardingpopup (npm) MAL-2026-6778 | Malicious | Not scored | 02 Jul, 2026 | npm @marketfront/fashiononboardingpopup |
Malicious release: Malicious code in @marketfront/fingerprint (npm) MAL-2026-6779 | Malicious | Not scored | 02 Jul, 2026 | npm @marketfront/fingerprint |
Malicious release: Malicious code in @marketfront/footer (npm) MAL-2026-6780 | Malicious | Not scored | 02 Jul, 2026 | npm @marketfront/footer |
Malicious release: Malicious code in @marketfront/gotoauthpopup (npm) MAL-2026-6781 | Malicious | Not scored | 02 Jul, 2026 | npm @marketfront/gotoauthpopup |
Malicious release: Malicious code in @marketfront/header (npm) MAL-2026-6782 | Malicious | Not scored | 02 Jul, 2026 | npm @marketfront/header |
Malicious release: Malicious code in @marketfront/infopopup (npm) MAL-2026-6783 | Malicious | Not scored | 02 Jul, 2026 | npm @marketfront/infopopup |
Malicious release: Malicious code in @marketfront/livestreampreviewpopup (npm) MAL-2026-6784 | Malicious | Not scored | 02 Jul, 2026 | npm @marketfront/livestreampreviewpopup |
Malicious release: Malicious code in @marketfront/madvpopup (npm) MAL-2026-6785 | Malicious | Not scored | 02 Jul, 2026 | npm @marketfront/madvpopup |
Malicious release: Malicious code in @marketfront/mychatspreloader (npm) MAL-2026-6786 | Malicious | Not scored | 02 Jul, 2026 | npm @marketfront/mychatspreloader |
Malicious release: Malicious code in @marketfront/navbar (npm) MAL-2026-6787 | Malicious | Not scored | 02 Jul, 2026 | npm @marketfront/navbar |
Craft CMS: DOM XSS via GitHub issue title in CraftSupport widget CVE-2026-55790, GHSA-24x4-j6x9-rfw5 | High | 0.5% | 01 Jul, 2026 | Packagist craftcms/cms |
Craft CMS: Missing peer-permission check in `AssetsController::actionDeleteFolder` allows deletion of other users' assets CVE-2026-50284, GHSA-7h62-6v23-v8fm | High | 0.4% | 01 Jul, 2026 | Packagist craftcms/cms |
Craft CMS: Unauthorized Deletion of Source Assets During File Replacement CVE-2026-50283, GHSA-qh45-9g5p-m2v4 | Medium | 0.4% | 01 Jul, 2026 | Packagist craftcms/cms |
Craft CMS: Stored XSS via Structure entry title in table view CVE-2026-55793, GHSA-xrqc-p465-2xvg | Medium | 0.3% | 01 Jul, 2026 | Packagist craftcms/cms |
Wagtail: Reflected XSS in dynamic image URL generator view CVE-2026-54263, GHSA-23m2-mghx-vqmf, PYSEC-2026-616 | High | 0.4% | 01 Jul, 2026 | PyPI wagtail |
Wagtail: Pages translations can be created without page permissions when using simple_translation CVE-2026-54262, GHSA-8634-mr4j-r72c, PYSEC-2026-615 | Medium | 0.3% | 01 Jul, 2026 | PyPI wagtail |
Wagtail: Improper permission handling in image preview CVE-2026-54261, GHSA-r6p4-grq7-xm4m, PYSEC-2026-614 | Medium | 0.3% | 01 Jul, 2026 | PyPI wagtail |
Wagtail: Denial of service via unbounded filter specs in the image preview CVE-2026-54260, GHSA-f2p5-j6fg-5cxf, PYSEC-2026-613 | Medium | 0.4% | 01 Jul, 2026 | PyPI wagtail |
Wagtail: Improper restriction handling on Documents and Images chosen endpoints CVE-2026-54259, GHSA-h54r-xq46-qwqm, PYSEC-2026-612 | Medium | 0.3% | 01 Jul, 2026 | PyPI wagtail |
OpenClaw MCP SSE redirects could forward Authorization headers CVE-2026-62208, GHSA-9c3v-684m-579c | Medium | 0.4% | 01 Jul, 2026 | npm openclaw |
Apify Model Context Protocol (MCP) server: Actor MCP path authority injection leaks Apify token CVE-2026-50143, GHSA-6gr2-qh89-hxwm | High | 0.5% | 01 Jul, 2026 | npm @apify/actors-mcp-server |
goshs: Share-link ?token=… redemption races past download limit CVE-2026-50139, GHSA-j48m-h7xq-2xpj, GO-2026-5881 | Medium | 0.3% | 01 Jul, 2026 | Go goshs.de/goshs Go goshs.de/goshs/v2 |
goshs: WebDAV listener ignores --read-only, --upload-only, and --no-delete mode flags CVE-2026-50138, GHSA-3whc-qvhv-xqjp, GO-2026-5878 | High | 0.4% | 01 Jul, 2026 | Go goshs.de/goshs Go goshs.de/goshs/v2 |
ORAS Go forwards registry credentials across registry redirects GHSA-vh4v-2xq2-g5cg, GO-2026-5884 | Medium | Not scored | 01 Jul, 2026 | Go oras.land/oras-go/v2 |
`oras-go` tar extraction: Hardlink entry with relative Linkname escapes extract dir via process CWD resolution CVE-2026-50163, GHSA-fxhp-mv3v-67qp, GO-2026-5880 | High | 0.4% | 01 Jul, 2026 | Go oras.land/oras-go/v2 |