Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Muhammara has a NULL pointer dereference in LZWDecode filter when DecodeParms omits EarlyChange key CVE-2026-125107, GHSA-fhp4-pr5j-46m5 | High | 0.3% | 26 Jun, 2026 | npm muhammara |
Pterodactyl Panel: Client email change endpoint allows enumeration of accounts in system GHSA-j7f5-gfqm-pcx3 | Medium | Not scored | 26 Jun, 2026 | Packagist pterodactyl/panel |
Pterodactyl Wings: Chmod operation can be used to change permissions of files outside of the server container GHSA-rhq6-9rgh-v45c, GO-2026-5814 | Medium | Not scored | 26 Jun, 2026 | Go github.com/pterodactyl/wings |
Flawfinder output manipulation via untrusted filenames and source text CVE-2026-48813, GHSA-4c3c-r6p8-c863, PYSEC-2026-2480 | High | 0.4% | 26 Jun, 2026 | PyPI flawfinder |
python-socketio: Binary attachment accumulation can cause denial of service CVE-2026-48804, GHSA-5w7q-77mv-v69f, PYSEC-2026-3042 | High | 0.5% | 26 Jun, 2026 | PyPI python-socketio |
python-engineio has unbound thread allocation that can cause denial of service CVE-2026-48802, GHSA-cgwc-pv48-fhj5, PYSEC-2026-3032 | High | 0.6% | 26 Jun, 2026 | PyPI python-engineio |
semantic-router exposed to compromised litellm wheel (CVE-2026-42208) via unbounded transitive pin GHSA-98x5-vq43-vc5p | Critical | Not scored | 26 Jun, 2026 | PyPI semantic-router |
python-engineio has possible denial of service due to maximum payload size sometimes not being enforced CVE-2026-48809, GHSA-m9gh-vj53-gvh9, PYSEC-2026-3033 | High | 0.5% | 26 Jun, 2026 | PyPI python-engineio |
LinkifyIt#match scan loop has quadratic algorithmic complexity CVE-2026-48801, GHSA-22p9-wv53-3rq4 | High | 0.4% | 26 Jun, 2026 | npm linkify-it |
turso-cli persists Turso platform JWT with world-readable (0o644) file permissions CVE-2026-48790, GHSA-57f6-pvx8-hwj6, GO-2026-5811 | Medium | 0.1% | 26 Jun, 2026 | Go github.com/tursodatabase/turso-cli |
nono-py's policy JSON accepts unknown security fields GHSA-m8j6-rc5x-wv36 | Medium | Not scored | 26 Jun, 2026 | PyPI nono-py |
nono-py vulnerable to authorization bypass / policy confusion GHSA-9j7f-3r4p-pwh6 | Medium | Not scored | 26 Jun, 2026 | PyPI nono-py |
Malicious release: Malicious code in pdf-converter-pro (PyPI) MAL-2026-6541 | Malicious | Not scored | 26 Jun, 2026 | PyPI pdf-converter-pro |
nono-py has proxy-only network fallback bypass on older Linux kernels GHSA-72w7-mf9g-733p | Medium | Not scored | 26 Jun, 2026 | PyPI nono-py |
Fleet DM Vulnerable to Cross-Team Policy Data Exposure via Global Policy Read Endpoint CVE-2026-41262, GHSA-gm7f-v959-fr2g, GO-2026-5812 | Medium | 0.3% | 26 Jun, 2026 | Go github.com/fleetdm/fleet/v4 |
Malicious release: Malicious code in @krentzen/buffer-reverse (npm) MAL-2026-6536 | Malicious | Not scored | 26 Jun, 2026 | npm @krentzen/buffer-reverse |
Hysteria: http large header with sniff cause server DoS GHSA-jqc5-2p7q-fqfc, GO-2026-5813 | High | Not scored | 26 Jun, 2026 | Go github.com/apernet/hysteria |
Malicious release: Malicious code in gptmini (npm) MAL-2026-6537 | Malicious | Not scored | 26 Jun, 2026 | npm gptmini |
Panic decoding image with out-of-bounds strip offset in x/image/tiff in golang.org/x/image CVE-2026-46604, GO-2026-5066 | 0.6% | 26 Jun, 2026 | Go golang.org/x/image | |
Hysteria vulnerable to server crash when max_datagram_frame_size very small GHSA-qh5x-rfwf-rvfv, GO-2026-5807 | High | Not scored | 26 Jun, 2026 | Go github.com/apernet/hysteria |
Hysteria has an authenticated UDP ACL bypass that enables localhost and private-network UDP SSRF GHSA-vgrc-hq28-p3xp, GO-2026-5809 | High | Not scored | 26 Jun, 2026 | Go github.com/apernet/hysteria/core Go github.com/apernet/hysteria/core/v2 |
@cyclonedx/cdxgen: Maven project scanning may allow shell command injection through repository-controlled module paths GHSA-5vwr-qchf-q4pf | Medium | Not scored | 26 Jun, 2026 | npm @cyclonedx/cdxgen |
Remark42: Cross-Site Scripting (XSS) on /api/v1/img via content-type spoofing CVE-2026-48788, GHSA-4c8j-mgm4-qqvp, GO-2026-5804 | High | 0.3% | 26 Jun, 2026 | Go github.com/umputun/remark42 |
Apptainer has incorrect path matching for 'limit container paths' directive CVE-2026-48785, GHSA-cr2j-534f-mf3g, GO-2026-5805 | Medium | 0.1% | 26 Jun, 2026 | Go github.com/apptainer/apptainer |
`nx graph` dev server permissive CORS policy CVE-2026-54753, GHSA-g2r8-wvmj-jf5w | Medium | 1.4% | 26 Jun, 2026 | npm nx |
Incus has an arbitrary file write on its client due to trusted image hash CVE-2026-48769, GHSA-f6m5-xw2g-xc4x, GO-2026-5806 | Critical | 0.8% | 26 Jun, 2026 | Go github.com/lxc/incus Go github.com/lxc/incus/v6 Go github.com/lxc/incus/v7 Go github.com/lxc/incus/v7/cmd/incusd |
@sigstore/core has DSSE payloadType type-binding failure CVE-2026-48758, GHSA-jfc7-64v2-mr8c | Medium | 0.2% | 26 Jun, 2026 | npm @sigstore/core |
Incus: CreateCustomVolumeFromBackup nil-pointer dereference on volume_snapshots[*].expires_at (sibling-field variant of GHSA-r7w7) CVE-2026-48756, GHSA-xhqx-mgh3-3h7q, GO-2026-5810 | Low | 0.4% | 26 Jun, 2026 | Go github.com/lxc/incus Go github.com/lxc/incus/v6 Go github.com/lxc/incus/v7 Go github.com/lxc/incus/v7/cmd/incusd |
Incus has an argument injection in backup compression algorithm leading to AFW and ACE CVE-2026-48755, GHSA-v6mj-8pf4-hhw4, GO-2026-5808 | Critical | 0.8% | 26 Jun, 2026 | Go github.com/lxc/incus Go github.com/lxc/incus/v6 Go github.com/lxc/incus/v7 Go github.com/lxc/incus/v7/cmd/incusd |
Malicious release: Malicious code in disksweep (npm) GHSA-257r-h9h2-65xg, MAL-2026-6535 | Malicious | Not scored | 26 Jun, 2026 | npm disksweep |
Incus: Nil-pointer dereference in createDependentVolumesFromBackup on disk.{Volume,VolumeSnapshots,Pool} CVE-2026-48754, GHSA-4xg6-52mh-fpw8, GO-2026-5800 | Low | 0.4% | 26 Jun, 2026 | Go github.com/lxc/incus Go github.com/lxc/incus/v6 Go github.com/lxc/incus/v7 Go github.com/lxc/incus/v7/cmd/incusd |
Incus has an arbitrary file write via path traversal in S3 multipart upload CVE-2026-48753, GHSA-ccjc-4qc3-jxqc, GO-2026-5802 | Critical | 0.7% | 26 Jun, 2026 | Go github.com/lxc/incus Go github.com/lxc/incus/v6 Go github.com/lxc/incus/v7 Go github.com/lxc/incus/v7/cmd/incusd |
Incus has arbitrary file read+write on host via templates/ symlink in malicious image CVE-2026-48752, GHSA-vxp5-584q-c479, GO-2026-5803 | Critical | 0.8% | 26 Jun, 2026 | Go github.com/lxc/incus Go github.com/lxc/incus/v6 Go github.com/lxc/incus/v7 Go github.com/lxc/incus/v7/cmd/incusd |
Incus has a restricted project bypass leading to arbitrary command execution CVE-2026-48751, GHSA-48q5-w887-33wv, GO-2026-5799 | Critical | 0.7% | 26 Jun, 2026 | Go github.com/lxc/incus Go github.com/lxc/incus/v6 Go github.com/lxc/incus/v7 Go github.com/lxc/incus/v7/cmd/incusd |
Incus has an arbitrary file write on host via `exec-output` symlink in crafted image CVE-2026-48750, GHSA-73hr-m85f-64v9, GO-2026-5801 | Critical | 0.8% | 26 Jun, 2026 | Go github.com/lxc/incus Go github.com/lxc/incus/v6 Go github.com/lxc/incus/v7 Go github.com/lxc/incus/v7/cmd/incusd |
Incus has an arbitrary file read+write on host via rootfs/ symlink in malicious image CVE-2026-48749, GHSA-2q3f-q5pq-g8wv, GO-2026-5798 | Critical | 0.8% | 26 Jun, 2026 | Go github.com/lxc/incus Go github.com/lxc/incus/v6 Go github.com/lxc/incus/v7 Go github.com/lxc/incus/v7/cmd/incusd |
Malicious release: Malicious code in @appupdate/cdn-sync (npm) MAL-2026-6531 | Malicious | Not scored | 26 Jun, 2026 | npm @appupdate/cdn-sync |
extract-zip unvalidated symlink path traversal CVE-2026-56876, GHSA-jmr9-qjv8-65gv | High | 0.5% | 26 Jun, 2026 | npm extract-zip |
Malicious release: Malicious code in react-dynamic-table-compenent (npm) GHSA-gv99-2c4m-pr2c, MAL-2026-6533 | Malicious | Not scored | 26 Jun, 2026 | npm react-dynamic-table-compenent |
Malicious release: Malicious code in chai-as-assured (npm) GHSA-m282-3m8c-qjwj, MAL-2026-6532 | Malicious | Not scored | 26 Jun, 2026 | npm chai-as-assured |
fluent-plugin-opentelemetry Has Denial of Service (DoS) via Large Payloads and Decompression Bombs in `in_opentelemetry` CVE-2026-44163, GHSA-2jc5-xhx8-qj6h | Medium | 0.4% | 26 Jun, 2026 | RubyGems fluent-plugin-opentelemetry |
Payload CMS default account-unlock access allows authenticated users to reset other accounts' lockouts CVE-2026-11779, GHSA-jg8r-5jh2-v2xj | Medium | 0.4% | 26 Jun, 2026 | npm payload |
fluent-plugin-s3 Vulnerable to Denial of Service (DoS) via Decompression Bomb in `in_s3` CVE-2026-44162, GHSA-xv9w-7v6q-hpjh | Low | 0.5% | 26 Jun, 2026 | RubyGems fluent-plugin-s3 |
Malicious release: Malicious code in xrblocks-remote-control (npm) GHSA-24xr-qqmw-jvvf, MAL-2026-6530 | Malicious | Not scored | 26 Jun, 2026 | npm xrblocks-remote-control |
Fluentd is Vulnerable to Server-Side Request Forgery (SSRF) via Placeholder Expansion in `out_http` BIT-fluentd-2026-44161, CVE-2026-44161, GHSA-72f5-rr8c-r6gr | High | 0.4% | 26 Jun, 2026 | RubyGems fluentd |
Fluentd is Vulnerable to Denial of Service (DoS) via Gzip Decompression Bomb in `in_http` and `in_forward` BIT-fluentd-2026-44160, CVE-2026-44160, GHSA-j9cw-hwqf-85w7 | High | 0.6% | 26 Jun, 2026 | RubyGems fluentd |
Fluentd is Vulnerable to Exposure of Sensitive Information via Monitor Agent API BIT-fluentd-2026-44025, CVE-2026-44025, GHSA-pr7j-96cj-549h | High | 0.5% | 26 Jun, 2026 | RubyGems fluentd |
Fluentd is Vulnerable to Remote Code Execution (RCE) via Arbitrary File Write in `${tag}` Placeholder BIT-fluentd-2026-44024, CVE-2026-44024, GHSA-44hj-4m45-frj3 | Critical | 1.1% | 26 Jun, 2026 | RubyGems fluentd |
Malicious release: Malicious code in react-dynammic-table-component (npm) GHSA-rghg-wjq8-jq2g, MAL-2026-6534 | Malicious | Not scored | 26 Jun, 2026 | npm react-dynammic-table-component |
Malicious release: Malicious code in @immobiliarelabs/backstage-plugin-gitlab-backend (npm) MAL-2026-6527 | Malicious | Not scored | 26 Jun, 2026 | npm @immobiliarelabs/backstage-plugin-gitlab-backend |