Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Prefect Unauthenticated Event Injection via /api/events/in WebSocket CVE-2026-7723, GHSA-hvph-5985-r63v, PYSEC-2026-2958 | Medium | 0.4% | 04 May, 2026 | PyPI prefect |
Prefect Auth Bypass via endswith() Health Check Exemption CVE-2026-7722, GHSA-6rr6-v7cj-mxpg, PYSEC-2026-2956 | Medium | 0.5% | 04 May, 2026 | PyPI prefect |
MindsDB has an Improper Access Control Issue CVE-2026-7711, GHSA-9f6m-65v9-x9g2, PYSEC-2026-2648 | Medium | 0.3% | 04 May, 2026 | PyPI MindsDB PyPI mindsdb |
SGLang has an Improper Input Validation/Injection Issue CVE-2026-7669, GHSA-6m5f-673f-5vh7, PYSEC-2026-3062 | Medium | 0.4% | 02 May, 2026 | PyPI sglang |
sublinear-time-solver has a Path Traversal Issue CVE-2026-7645, GHSA-gc2j-wpjv-jhrw | Medium | 0.5% | 02 May, 2026 | npm sublinear-time-solver |
MixPHP Framework has an SQL injection vulnerability CVE-2026-42475, GHSA-vf35-8m4j-gm8v | Medium | 0.2% | 01 May, 2026 | Packagist mix/mix |
MixPHP Framework has an SQL injection vulnerability via crafted `data` array CVE-2026-42474, GHSA-q57j-rwwx-7rwp | Medium | 0.2% | 01 May, 2026 | Packagist mix/mix |
AstrBot Makes Use of Hard-coded Password CVE-2026-7579, GHSA-mq9q-25hm-g4gp, GHSA-vrqm-xcfv-286r, PYSEC-2026-2382 | Medium | 0.3% | 01 May, 2026 | PyPI AstrBot PyPI astrbot |
@diplodoc/search-extension allows stored XSS via Markdown file title CVE-2026-40201, GHSA-rjmp-rwj4-mv82 | Medium | 0.2% | 01 May, 2026 | npm @diplodoc/search-extension |
CKAN has Unauthenticated Authorization Bypass in `datastore_search_sql` CVE-2026-42032, GHSA-cg4x-64p3-x59h, PYSEC-2026-2416 | Medium | 0.4% | 30 Apr, 2026 | PyPI ckan |
Weblate Vulnerable to Authenticated SSRF via Project Backup Import bypassing validate_repo_url CVE-2026-41654, GHSA-cwcx-382v-8m9g, PYSEC-2026-2317 | Medium | 0.4% | 30 Apr, 2026 | PyPI weblate |
Weblate Doesn't Invalidate API Token on Password Change CVE-2026-41519, GHSA-6j8j-4qp3-36p2, PYSEC-2026-2316 | Medium | 0.3% | 30 Apr, 2026 | PyPI weblate |
apache-airflow-providers-smtp: No certificate validation on SMTP STARTTLS connections in SMTP provider CVE-2026-41016, GHSA-x8mh-94wc-33gv, PYSEC-2026-24 | Medium | 0.3% | 30 Apr, 2026 | PyPI apache-airflow-providers-smtp |
mcp-server-semgrep has a Command Injection issue CVE-2026-7446, GHSA-86hp-qxqp-w9wv | Medium | 1.5% | 30 Apr, 2026 | npm mcp-server-semgrep |
Claude SDK for TypeScript has Insecure Default File Permissions in Local Filesystem Memory Tool CVE-2026-41686, GHSA-p7fg-763f-g4gf | Medium | 0.1% | 29 Apr, 2026 | npm @anthropic-ai/sdk |
Admidio: OIDC Token Introspection Endpoint Returns Active for All Tokens Without Validation CVE-2026-41671, GHSA-9xx5-cv6j-x533 | Medium | 0.3% | 29 Apr, 2026 | Packagist admidio/admidio |
Admidio Missing Minimum Administrator Check in Role Membership Removal CVE-2026-41662, GHSA-c7xm-r6vj-8vg6 | Medium | 0.3% | 29 Apr, 2026 | Packagist admidio/admidio |
Admidio vulnerable to reflected XSS in msg_window.php via Square Bracket to HTML Tag Conversion CVE-2026-41661, GHSA-gq27-fc8w-vcmp | Medium | 0.2% | 29 Apr, 2026 | Packagist admidio/admidio |
Admidio's Missing Authorization on Inventory Module Destructive Endpoints Allows Any Authenticated User to Delete Items CVE-2026-41658, GHSA-xqv4-xm7h-52cv | Medium | 0.2% | 29 Apr, 2026 | Packagist admidio/admidio |
Admidio Exposes Cross-Organization Member Data via Permission Check Mismatch in contacts_data.php CVE-2026-41657, GHSA-g8p8-94f2-28gr | Medium | 0.3% | 29 Apr, 2026 | Packagist admidio/admidio |
Admidio has Path Traversal via Unvalidated `name` Parameter in Document Add Mode that Enables Arbitrary Server File Read CVE-2026-41656, GHSA-m9h6-8pqm-xrhf | Medium | 0.4% | 29 Apr, 2026 | Packagist admidio/admidio |
Admidio has Path Traversal in ECard Preview that Allows Reading Arbitrary Server Files Including Database Credentials CVE-2026-41655, GHSA-m3vp-3jjm-gpmx | Medium | 0.3% | 29 Apr, 2026 | Packagist admidio/admidio |
OpenClaw: Webchat audio embedding could read local files without local-root containment CVE-2026-44996, GHSA-gfg9-5357-hv4c | Medium | 0.3% | 29 Apr, 2026 | npm openclaw |
OpenClaw: Owner-enforced commands could accept wildcard channel senders as command owners CVE-2026-44991, GHSA-c28g-vh7m-fm7v | Medium | 0.2% | 29 Apr, 2026 | npm openclaw |
n8n has Public API Variables IDOR that Allows Cross-Project Secret Disclosure CVE-2026-42227, GHSA-756q-gq9h-fp22 | Medium | 0.2% | 29 Apr, 2026 | npm n8n |
n8n Vulnerable to Hijacking of Unauthenticated Chat Execution CVE-2026-42228, GHSA-f77h-j2v7-g6mw | Medium | 0.4% | 29 Apr, 2026 | npm n8n |
mcpo-simple-server has a Path Traversal issue CVE-2026-7404, GHSA-3jmq-qhg3-f58j, PYSEC-2026-2632 | Medium | 0.5% | 29 Apr, 2026 | PyPI mcpo-simple-server |
n8n has SQL Injection in SeaTable Node CVE-2026-42229, GHSA-mp4j-h6gh-f6mp | Medium | 0.3% | 29 Apr, 2026 | npm n8n |
n8n has Open Redirect in MCP OAuth Consent Flow CVE-2026-42230, GHSA-f6x8-65q6-j9m9 | Medium | 0.2% | 29 Apr, 2026 | npm n8n |
n8n has SQL Injection in Oracle Database Node via Limit Field CVE-2026-42233, GHSA-r6jc-mpqw-m755 | Medium | 0.3% | 29 Apr, 2026 | npm n8n |
n8n has SQL Injection in Snowflake and MySQL Nodes CVE-2026-42237, GHSA-hp3c-vfpm-q4f7 | Medium | 0.3% | 29 Apr, 2026 | npm n8n |
OpenID Connect nonce generated but never validated — ID token replay attack CVE-2026-42206, GHSA-3gx8-q682-38mx | Medium | 0.2% | 29 Apr, 2026 | Packagist roadiz/openid |
CKAN has CSRF exemption primed by anonymous requests CVE-2026-41255, GHSA-mcvf-jxcw-vj73, PYSEC-2026-2418 | Medium | 0.1% | 29 Apr, 2026 | PyPI ckan |
CKAN has no certificate validation on STMP connection CVE-2026-41132, GHSA-mpfm-fpgx-647q, PYSEC-2026-2419 | Medium | 0.2% | 29 Apr, 2026 | PyPI ckan |
beets has a Cross-site Scripting vulnerability CVE-2026-42052, GHSA-3gxm-wfjx-m847, PYSEC-2026-2397 | Medium | 0.3% | 29 Apr, 2026 | PyPI beets |
Cockpit is vulnerable to directory traversal CVE-2026-38993, GHSA-p46p-7pmj-m34f | Medium | 0.8% | 29 Apr, 2026 | Packagist cockpit-hq/cockpit |
PhpSpreadsheet has XSS via number format code with @ text placeholder bypasses htmlspecialchars in HTML writer CVE-2026-40296, GHSA-hrmw-qprp-wgmc | Medium | 0.2% | 28 Apr, 2026 | Packagist phpoffice/phpspreadsheet |
PhpSpreadsheet has XSS via NumberFormat @ Text Substitution in HTML Writer CVE-2026-35453, GHSA-6wpp-88cp-7q68 | Medium | 0.2% | 28 Apr, 2026 | Packagist phpoffice/phpspreadsheet |
FacturaScripts has Insecure Parameter Handling: Unauthorized Modification of Immutable 'nick' Field CVE-2026-32699, GHSA-pp79-hqv6-vmc3 | Medium | 0.3% | 28 Apr, 2026 | Packagist facturascripts/facturascripts |
BigSweetPotatoStudio HyperChat has a Server-Side Request Forgery issue CVE-2026-7223, GHSA-r2jq-4h3x-rfj6 | Medium | 0.3% | 28 Apr, 2026 | npm @dadigua/hyperchat |
notes-mcp has a Path Traversal issue CVE-2026-7212, GHSA-vc5j-42hh-j3mr, PYSEC-2026-2684 | Medium | 0.4% | 28 Apr, 2026 | PyPI notes-mcp |
sqlite-mcp has an Injection issue CVE-2026-7206, GHSA-4j28-22qp-rjcf, PYSEC-2026-3074 | Medium | 0.3% | 28 Apr, 2026 | PyPI sqlite-mcp |
mkdocs-mcp-plugin has a Path Traversal issue CVE-2026-7159, GHSA-wfr3-hf93-qgg3, PYSEC-2026-2653 | Medium | 0.4% | 27 Apr, 2026 | PyPI mkdocs-mcp-plugin |
mcp-url-downloader has a Server-Side Request Forgery issue CVE-2026-7158, GHSA-h7xc-4mv8-59fj, PYSEC-2026-2631 | Medium | 0.3% | 27 Apr, 2026 | PyPI mcp-url-downloader |
Pimcore has an authenticated Cross-site Scripting issue CVE-2026-5362, GHSA-7gxw-q9j5-mrj4 | Medium | 0.2% | 27 Apr, 2026 | Packagist pimcore/pimcore |
kaggle-mcp has a Path Traversal issue CVE-2026-7149, GHSA-q882-jc55-6343, PYSEC-2026-2542 | Medium | 0.4% | 27 Apr, 2026 | PyPI kaggle-mcp |
pip Vulnerable to Inclusion of Functionality from Untrusted Control Sphere CVE-2026-6357, GHSA-jp4c-xjxw-mgf9, PYSEC-2026-2876 | Medium | 0.1% | 27 Apr, 2026 | PyPI pip |
OpenClaw: Agent gateway config mutations could change protected operator settings CVE-2026-45001, GHSA-7jm2-g593-4qrc | Medium | 0.2% | 25 Apr, 2026 | npm openclaw |
OpenClaw: Bundled MCP/LSP tools could bypass configured tool policy CVE-2026-44998, GHSA-qrp5-gfw2-gxv4 | Medium | 0.7% | 25 Apr, 2026 | npm openclaw |
OpenClaw: Workspace dotenv MiniMax host override could redirect credentialed requests CVE-2026-44992, GHSA-h2vw-ph2c-jvwf | Medium | 0.1% | 25 Apr, 2026 | npm openclaw |