Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Grav: Stored XSS via page title (data[header][title]) in admin panel CVE-2026-44737, GHSA-fmg2-f5r9-24qc | Medium | 0.3% | 08 May, 2026 | Packagist getgrav/grav |
Bunsink has an SSRF bypass in `validate_webhook_url` CVE-2026-44502, GHSA-fp53-qcf8-2xx2, PYSEC-2026-2405 | Medium | 0.3% | 08 May, 2026 | PyPI bugsink |
`potato-annotation` has a Project-Boundary Bypass GHSA-q9m2-fhv9-3jcf | Medium | Not scored | 08 May, 2026 | PyPI potato-annotation |
fast-xml-builder Comment Value regex can be bypassed CVE-2026-44664, GHSA-45c6-75p6-83cc | Medium | 0.2% | 08 May, 2026 | npm fast-xml-builder |
vm2 has access to `VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL` CVE-2026-92963, GHSA-2cm2-m3w5-gp2f | Medium | 0.3% | 08 May, 2026 | npm vm2 |
PraisonAI knowledge-store backends interpolate unvalidated collection names into SQL and CQL queries CVE-2026-44337, GHSA-3643-7v76-5cj2, PYSEC-2026-2897 | Medium | 0.2% | 08 May, 2026 | PyPI PraisonAI PyPI praisonai |
Kimai has an arbitrary file read in its invoice PDF renderer (admin) CVE-2026-44298, GHSA-h5fh-7hwr-97mw | Medium | 0.3% | 08 May, 2026 | Packagist kimai/kimai |
Electerm's full process.env exposed to renderer via window.pre.env CVE-2026-43942, GHSA-37j4-88rp-2f6h | Medium | 0.1% | 08 May, 2026 | npm electerm |
short-video-maker has a path traversal vulnerability CVE-2026-8115, GHSA-935g-9rq5-q95c | Medium | 0.6% | 07 May, 2026 | npm short-video-maker |
utcp-http vulnerable to SSRF via attacker-controlled OpenAPI servers[0].url in HTTP communication protocol CVE-2026-44661, GHSA-39j6-4867-gg4w, PYSEC-2026-3396 | Medium | 0.2% | 07 May, 2026 | PyPI utcp-http |
OpenStack Cyborg's Accelerator Request (ARQ) API does not enforce project ownership at any layer CVE-2026-40214, GHSA-mmpc-xjxr-5hf8, PYSEC-2026-2854 | Medium | 0.2% | 07 May, 2026 | PyPI openstack-cyborg |
FacturaScripts Vulnerable to Authenticated Remote Code Execution (RCE) via GIF Image Upload in Product Images CVE-2026-42879, GHSA-vf3q-frmr-vrr9 | Medium | 0.2% | 07 May, 2026 | Packagist facturascripts/facturascripts |
FacturaScripts Vulnerable to Unauthenticated phpinfo() Disclosure via Installer Endpoint CVE-2026-42878, GHSA-vrxf-vrc4-22p7 | Medium | 0.9% | 07 May, 2026 | Packagist facturascripts/facturascripts |
FacturaScripts vulnerable to stored XSS via product reference in sales/purchases CVE-2026-42877, GHSA-r736-2678-fcrx | Medium | 0.2% | 07 May, 2026 | Packagist facturascripts/facturascripts |
FacturaScripts Vulnerable to Unstripped Image Metadata (EXIF) Leakage via Library Module File Upload/Download CVE-2026-27892, GHSA-q7f2-rv22-2xgr | Medium | 0.2% | 07 May, 2026 | Packagist facturascripts/facturascripts |
BentoML has Information Disclosure in `bentoml build` via symlink traversal in the build context CVE-2026-40610, GHSA-mcfx-4vc6-qgxv, PYSEC-2026-2399 | Medium | 0.3% | 07 May, 2026 | PyPI bentoml |
Webkul Krayin CRM is Vulnerable to Cross-Site Scripting in the /admin/activities/create endpoint CVE-2026-36341, GHSA-j822-46r5-h4qx | Medium | 0.2% | 07 May, 2026 | Packagist krayin/laravel-crm |
vm2's Transformer Fast-Path Bypass Exposes Internal State Variable CVE-2026-44003, GHSA-wp5r-2gw5-m7q7 | Medium | 0.2% | 07 May, 2026 | npm vm2 |
vm2 is Vulnerable to Host File Path Disclosure via Stack Trace Information Leak CVE-2026-44002, GHSA-v27g-jcqj-v8rw | Medium | 0.2% | 07 May, 2026 | npm vm2 |
docling-graph has SSRF via Missing Internal IP Validation in URLInputHandler CVE-2026-44520, GHSA-fqph-j6v6-jvgx, PYSEC-2026-2458 | Medium | 0.2% | 07 May, 2026 | PyPI docling-graph |
Vercel: Non-interactive mode includes CLI arguments in suggested command output CVE-2026-44479, GHSA-pgf8-2hgj-grqg | Medium | 0.2% | 07 May, 2026 | npm vercel |
Weblate vulnerable to XSS via crafted Markdown CVE-2026-44264, GHSA-5cmv-3rc4-7279, PYSEC-2026-2319 | Medium | 0.3% | 07 May, 2026 | PyPI weblate |
Weblate Vulnerable to Private Translation Enumeration via Screenshot API CVE-2026-44263, GHSA-gcg5-86jr-f7jg, PYSEC-2026-2318 | Medium | 0.3% | 07 May, 2026 | PyPI weblate |
Hono: bodyLimit() can be bypassed for chunked / unknown-length requests CVE-2026-44456, GHSA-9vqf-7f2p-gf9v | Medium | 0.2% | 06 May, 2026 | npm hono |
hono/jsx has Unvalidated JSX Tag Names that May Allow HTML Injection CVE-2026-44455, GHSA-69xw-7hcm-h432 | Medium | 0.1% | 06 May, 2026 | npm hono |
Playwright Capture permits access to local files and internal network resources during page capture CVE-2026-44439, GHSA-687h-xw6f-q2qw, PYSEC-2026-2259 | Medium | 0.4% | 06 May, 2026 | PyPI PlaywrightCapture PyPI playwrightcapture |
Angular SSR has Open Redirect and Request Steering via Encoded X-Forwarded-Prefix CVE-2026-44437, GHSA-69xr-m8h6-h664 | Medium | 0.2% | 06 May, 2026 | npm @angular/ssr |
@axonflow/openclaw fix introduces plugin cache and credential-file permission hardening GHSA-cqmh-pcgr-q42f | Medium | Not scored | 06 May, 2026 | npm @axonflow/openclaw |
axonflow-sdk-typescript: Webhook signing-key (HMAC-SHA256) not exposed by SDK type, preventing signature verification GHSA-mph8-9v29-pm42 | Medium | Not scored | 06 May, 2026 | npm @axonflow/sdk |
axonflow-sdk-python: Webhook signing-key (HMAC-SHA256) not exposed by SDK type, preventing signature verification GHSA-7f4h-6264-89fr | Medium | Not scored | 06 May, 2026 | PyPI axonflow |
Backstage: Catalog unprocessed read endpoints allow authenticated cross-owner data access without permission checks CVE-2026-44374, GHSA-p7g9-rp3g-mgfg | Medium | 0.2% | 06 May, 2026 | npm @backstage/plugin-catalog-backend-module-unprocessed npm @backstage/plugin-catalog-unprocessed-entities npm @backstage/plugin-catalog-unprocessed-entities-common |
Nitro has an Open Redirect via Protocol-Relative URL Bypass in Wildcard Route Rules CVE-2026-44372, GHSA-9phm-9p8f-hw5m | Medium | 0.3% | 06 May, 2026 | npm nitro npm nitropack |
Nitro has a proxy scope bypass via percent-encoded path traversal in `routeRules` CVE-2026-44373, GHSA-5w89-w975-hf9q | Medium | 0.5% | 06 May, 2026 | npm nitro npm nitropack |
pyquorum: Timing side‑channel in mul_mod CVE-2026-44368, GHSA-7r92-3jgr-r65q, PYSEC-2026-3028 | Medium | 0.3% | 06 May, 2026 | PyPI pyquorum |
misp-modules has nsafe remote resource fetching in expansion CVE-2026-44363, GHSA-fhq3-2gf3-8f3j, PYSEC-2026-2650 | Medium | 0.1% | 06 May, 2026 | PyPI misp-modules |
vLLM: extract_hidden_states speculative decoding crashes server on any request with penalty parameters CVE-2026-44223, GHSA-83vm-p52w-f9pw, PYSEC-2026-145 | Medium | 0.4% | 06 May, 2026 | PyPI vllm |
Flight has path traversal in `make:controller` CLI that creates arbitrary directories outside project root CVE-2026-42549, GHSA-3xjv-pmf2-gf2q | Medium | 0.2% | 06 May, 2026 | Packagist flightphp/core |
Granian vulnerable to DoS via WSGI response header panic CVE-2026-42545, GHSA-f5p7-9fr5-8jmj, PYSEC-2026-2502 | Medium | 0.3% | 06 May, 2026 | PyPI granian |
Magento LTS: Reflected XSS - Import -> Data Flow (profiles) CVE-2026-42458, GHSA-x8jv-q8j2-487c | Medium | 0.3% | 06 May, 2026 | Packagist openmage/magento-lts |
Statamic CMS vulnerable to email enumeration via forgot password endpoint CVE-2026-44306, GHSA-m24v-f7g5-gq67 | Medium | 0.2% | 06 May, 2026 | Packagist statamic/cms |
phpMyFAQ: Ordinary Authenticated User Can Access Admin-Only API Endpoints Due to Insufficient Authorization Check in phpMyFAQ CVE-2026-45009, GHSA-jrc5-w569-h7h5 | Medium | 0.2% | 06 May, 2026 | Packagist phpmyfaq/phpmyfaq Packagist thorsten/phpmyfaq |
phpMyFAQ's Missing CONFIGURATION_EDIT Permission Check on 12 Admin API Configuration Tab Endpoints Allows Information Disclosure by Any Authenticated User CVE-2026-45007, GHSA-rm98-82fr-mcfx | Medium | 0.3% | 06 May, 2026 | Packagist phpmyfaq/phpmyfaq Packagist thorsten/phpmyfaq |
phpMyFAQ has a SVG Sanitizer Entity Decoding Depth Limit Bypass Leading to Stored XSS CVE-2026-46360, GHSA-whqh-9pq5-c7r3 | Medium | 0.2% | 06 May, 2026 | Packagist phpmyfaq/phpmyfaq Packagist thorsten/phpmyfaq |
phpMyFAQ has Stored XSS in FAQ Question/Answer via Encode-Decode Bypass of removeAttributes() Sanitization CVE-2026-46363, GHSA-f5p7-2c9q-8896 | Medium | 0.2% | 06 May, 2026 | Packagist phpmyfaq/phpmyfaq Packagist thorsten/phpmyfaq |
phpMyFAQ's Missing Authorization on Tag Deletion Allows Any Authenticated User to Delete Tags CVE-2026-46365, GHSA-7cx3-2qx2-3g6w | Medium | 0.2% | 06 May, 2026 | Packagist phpmyfaq/phpmyfaq Packagist thorsten/phpmyfaq |
wger: trainer_login open redirect - ?next= parameter not validated against host CVE-2026-86256, GHSA-vqv8-j3mj-wjxj | Medium | 0.2% | 06 May, 2026 | PyPI wger |
Lemur: LDAP Authentication Globally Disables TLS Certificate Verification When LDAP_USE_TLS Is Enabled CVE-2026-44305, GHSA-vr7c-r5gj-j3w5, PYSEC-2026-2590 | Medium | 0.1% | 06 May, 2026 | PyPI lemur |
PyLoad vulnerable to unauthenticated traceback disclosure via global exception handler in WebUI CVE-2026-44226, GHSA-c3gc-9pf2-84gg, PYSEC-2026-2993 | Medium | 0.3% | 06 May, 2026 | PyPI pyload-ng |
next-intl has prototype pollution with `experimental.messages.precompile` via attacker-controlled translation catalog keys GHSA-4c35-wcg5-mm9h | Medium | Not scored | 06 May, 2026 | npm next-intl |
Flowise: Bcrypt Password Hash Exposure CVE-2026-8026, GHSA-8f47-4rh3-x44m | Medium | 0.3% | 06 May, 2026 | npm flowise |