Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
youtube-regex vulnerable to Regex Denial of Service CVE-2025-65122, GHSA-vpxx-h23g-gxh2 | High | 0.3% | 07 May, 2026 | npm youtube-regex |
node-ts-ocr is vulnerable to OS Command Injection via the invokeImageOcr function in src/index.js CVE-2025-63705, GHSA-8jh2-3mw6-6pfm | High | 1.2% | 07 May, 2026 | npm node-ts-ocr |
Diffusers has a `trust_remote_code` bypass via `custom_pipeline` and local custom components CVE-2026-44513, GHSA-98h9-4798-4q5v, PYSEC-2026-40 | High | 1.1% | 07 May, 2026 | PyPI diffusers |
vm2 has a NodeVM require.root bypass via symlink traversal that allows sandbox escape CVE-2026-43998, GHSA-cp6g-6699-wx9c | High | 0.7% | 07 May, 2026 | npm vm2 |
vm2 Host Promise Resolution Preserves Object Identity Across Sandbox Boundary CVE-2026-44000, GHSA-mpf8-4hx2-7cjg | High | 0.2% | 07 May, 2026 | npm vm2 |
vm2 Sandbox Access to Host Buffer.alloc Allows timeout Bypass Resulting in Memory Exhaustion CVE-2026-44004, GHSA-6785-pvv7-mvg7 | High | 0.4% | 07 May, 2026 | npm vm2 |
vm2 has a Sandbox Escape via Promise Constructor Unhandled Rejection (Process Crash DoS) CVE-2026-44001, GHSA-hw58-p9xv-2mjh | High | 0.4% | 07 May, 2026 | npm vm2 |
Diffusers has a `trust_remote_code` bypass via `custom_pipeline` and local custom components CVE-2026-44827, GHSA-j7w6-vpvq-j3gm, PYSEC-2026-41 | High | 0.7% | 07 May, 2026 | PyPI diffusers |
Aegra has cross-user run injection in /threads/{thread_id}/runs (IDOR) CVE-2026-44504, GHSA-m98r-6667-4wq7, PYSEC-2026-2328 | High | 0.3% | 07 May, 2026 | PyPI aegra-api |
Kiota abstractions RedirectHandler leaks Cookie/Proxy-Authorization headers on cross-host redirect CVE-2026-44503, GHSA-7j59-v9qr-6fq9, GO-2026-5224, PYSEC-2026-2647 | High | 0.6% | 07 May, 2026 | Go github.com/microsoft/kiota-http-go Maven com.microsoft.kiota:microsoft-kiota-abstractions NuGet Microsoft.Kiota.Abstractions PyPI microsoft-kiota-http +1 more |
Grav Form Plugin has an Anonymous Page Content Overwrite via Form File Upload filename Override CVE-2026-42845, GHSA-w4rc-p66m-x6qq | High | 0.7% | 06 May, 2026 | Packagist getgrav/grav-plugin-form |
PraisonAI has unauthenticated RCE via `tool_override.py` (CVE-2026-40287 patch bypass) CVE-2026-44334, GHSA-xcmw-grxf-wjhj, PYSEC-2026-2926 | High | 0.2% | 06 May, 2026 | PyPI praisonai |
PraisonAI has an SSRF bypass CVE-2026-44335, GHSA-q9pw-vmhh-384g, PYSEC-2026-2950 | High | 0.4% | 06 May, 2026 | PyPI praisonaiagents |
GitPython: Newline injection in config_writer().set_value() enables RCE via core.hooksPath CVE-2026-44244, GHSA-v87r-6q3f-2j67, PYSEC-2026-2163 | High | 0.2% | 06 May, 2026 | PyPI GitPython PyPI gitpython |
python-multipart has Denial of Service via unbounded multipart part headers CVE-2026-42561, GHSA-pp6c-gr5w-3c5g, PYSEC-2026-3039 | High | 0.7% | 06 May, 2026 | PyPI python-multipart |
Mako vulnerable to path traversal via backslash URI on Windows in TemplateLookup CVE-2026-44307, GHSA-2h4p-vjrc-8xpq, PYSEC-2026-2617 | High | 0.7% | 06 May, 2026 | PyPI Mako PyPI mako |
JupyterLab's command linker attributes in HTML enable one-click command execution from untrusted content BIT-jupyter-base-notebook-2026-42557, BIT-jupyter-notebook-2026-42557, BIT-jupyterlab-2026-42557, CVE-2026-42557, GHSA-mqcg-5x36-vfcg, PYSEC-2026-2537, PYSEC-2026-2681 | High | 0.4% | 06 May, 2026 | PyPI jupyterlab PyPI notebook |
Flight vulnerable to sensitive information disclosure via default error handler CVE-2026-42552, GHSA-qrch-52m5-vv85 | High | 0.3% | 06 May, 2026 | Packagist flightphp/core |
Flight: HTTP method override enabled by default, facilitating CSRF escalation and middleware bypass CVE-2026-42551, GHSA-vxrr-w42w-w76g | High | 0.4% | 06 May, 2026 | Packagist flightphp/core |
Flight vulnerable to SQL Injection via unvalidated identifiers in SimplePdo::insert / update / delete CVE-2026-42550, GHSA-xwqr-rcqg-22mr | High | 0.5% | 06 May, 2026 | Packagist flightphp/core |
Flight has reflected XSS through an unvalidated JSONP callback in Flight::jsonp() CVE-2026-42548, GHSA-fcx8-ph5r-mxr4 | High | 0.4% | 06 May, 2026 | Packagist flightphp/core |
Granian vulnerable to unauthenticated DoS via WebSocket subprotocol header panic CVE-2026-42544, GHSA-vrg7-482j-p6f6, PYSEC-2026-2503 | High | 0.4% | 06 May, 2026 | PyPI granian |
Low-privileged Grav API users can create super-admin accounts via blueprint-upload CVE-2026-42844, GHSA-6xx2-m8wv-756h | High | 0.3% | 06 May, 2026 | Packagist getgrav/grav |
phpMyFAQ: Path Traversal in Client::deleteClientFolder enables arbitrary directory deletion by non-super-admin admins CVE-2026-45008, GHSA-gh9p-q46p-57g2 | High | 0.3% | 06 May, 2026 | Packagist phpmyfaq/phpmyfaq Packagist thorsten/phpmyfaq |
phpMyFAQ has unauthenticated FAQ permission bypass via getFaqBySolutionId fallback query CVE-2026-46366, GHSA-99qv-g4x9-mgc3 | High | 0.3% | 06 May, 2026 | Packagist phpmyfaq/phpmyfaq Packagist thorsten/phpmyfaq |
phpMyFAQ has SQL Injection in CurrentUser::setTokenData through unescaped OAuth token fields CVE-2026-46359, GHSA-pm8c-3qq3-72w7 | High | 0.3% | 06 May, 2026 | Packagist phpmyfaq/phpmyfaq Packagist thorsten/phpmyfaq |
phpMyFAQ has stored XSS via | raw Filter in search.twig — html_entity_decode(strip_tags()) Bypass in Search Result Rendering CVE-2026-46361, GHSA-pqh6-8fxf-jx22 | High | 0.3% | 06 May, 2026 | Packagist phpmyfaq/phpmyfaq Packagist thorsten/phpmyfaq |
phpMyFAQ has an Authorization Bypass in All Admin Pages Due to Non-Terminating Permission Check CVE-2026-46362, GHSA-hpgw-ww76-c68r | High | 0.3% | 06 May, 2026 | Packagist phpmyfaq/phpmyfaq Packagist thorsten/phpmyfaq |
phpMyFAQ has stored XSS via Utils::parseUrl() in comment rendering CVE-2026-46367, GHSA-9525-27vj-c8r8 | High | 0.2% | 06 May, 2026 | Packagist phpmyfaq/phpmyfaq Packagist thorsten/phpmyfaq |
wger: CSV/TSV formula injection in gym member export (first_name/last_name) CVE-2026-86257, GHSA-xq9m-hmp9-fw87 | High | 0.3% | 06 May, 2026 | PyPI wger |
GitPython reference APIs has a path traversal vulnerability that allows arbitrary file write and delete outside the repository CVE-2026-44243, GHSA-7545-fcxq-7j24, PYSEC-2026-2162 | High | 0.4% | 06 May, 2026 | PyPI GitPython PyPI gitpython |
basic-ftp allows a malicious FTP server to cause client-side denial of service via unbounded multiline control response buffering CVE-2026-44240, GHSA-rpmf-866q-6p89 | High | 0.5% | 06 May, 2026 | npm basic-ftp |
Lemur: LDAP Filter Injection enables post-authentication privilege escalation CVE-2026-44304, GHSA-3r34-vq8m-39gh, PYSEC-2026-2585 | High | 0.2% | 06 May, 2026 | PyPI lemur |
Kimai's Twig function config() leaks server-wide secrets (LDAP bind password, SAML SP private key) via invoice/export templates CVE-2026-80198, GHSA-vrqv-52x7-rm4v | High | 0.4% | 06 May, 2026 | Packagist kimai/kimai |
dssrf: every IPv6 category bypasses is_url_safe CVE-2026-44232, GHSA-8p33-q827-ghj5 | High | 0.4% | 06 May, 2026 | npm dssrf |
Craft CMS's Missing Volume Permission Check in AssetsController::actionShowInFolder Allows Information Disclosure CVE-2026-44012, GHSA-33m5-hqp9-97pw | High | 0.3% | 06 May, 2026 | Packagist craftcms/cms |
Craft CMS has Potential Authenticated Remote Code Execution via Malicious Attached Behavior CVE-2026-44011, GHSA-qrgm-p9w5-rrfw | High | 0.6% | 06 May, 2026 | Packagist craftcms/cms |
Craft CMS's Missing Authorization in GraphQL Address Resolver Allows Cross-Scope PII Disclosure CVE-2026-44010, GHSA-gj2p-p9m4-c8gw | High | 0.4% | 06 May, 2026 | Packagist craftcms/cms |
Facebook React has a Denial of Service Vulnerability in React Server Components CVE-2026-23870, GHSA-rv78-f8rc-xrxh | High | 1.5% | 06 May, 2026 | npm react-server-dom-parcel npm react-server-dom-turbopack npm react-server-dom-webpack |
Auth.js SDK has Improper Permission Checking CVE-2026-42280, GHSA-8qjv-jj2q-x832 | High | 0.2% | 06 May, 2026 | npm auth0-js |
Mistune has a ReDoS in LINK_TITLE_RE that allows denial of service via crafted Markdown input CVE-2026-33079, GHSA-8mp2-v27r-99xp, PYSEC-2026-2651 | High | 0.6% | 06 May, 2026 | PyPI mistune |
vLLM Vulnerable to Remote DoS via Special-Token Placeholders CVE-2026-44222, GHSA-hpv8-x276-m59f, PYSEC-2026-3409 | High | 0.4% | 05 May, 2026 | PyPI vllm |
AVideo Vulnerable to Exposure of Sensitive Information to an Unauthorized Actor and Missing Authorization CVE-2026-43885, GHSA-xr49-f4rh-qcjf | High | 0.3% | 05 May, 2026 | Packagist wwbn/avideo |
AVideo has SSRF Protection Bypass via HTTP Redirect and DNS Rebinding in isSSRFSafeURL() CVE-2026-43884, GHSA-2hch-c97c-g99x | High | 0.3% | 05 May, 2026 | Packagist wwbn/avideo |
Mongoose's Improper Sanitization of $nor in sanitizeFilter May Allow NoSQL Injection BIT-mongoose-2026-42334, CVE-2026-42334, GHSA-wpg9-53fq-2r8h | High | 0.3% | 05 May, 2026 | npm mongoose |
Grav is Vulnerable to Stored XSS via Tag Injection CVE-2026-42611, GHSA-w8cg-7jcj-4vv2 | High | 0.3% | 05 May, 2026 | Packagist getgrav/grav |
Grav is Vulnerable to XXE via SVG Upload CVE-2026-56701, GHSA-3446-6mgw-f79p | High | 0.3% | 05 May, 2026 | Packagist getgrav/grav |
Grav has Unauthenticated Path Traversal & Arbitrary File Write in its FormFlash component CVE-2026-42608, GHSA-hmcx-ch82-3fv2 | High | 0.6% | 05 May, 2026 | Packagist getgrav/grav |
Grav Vulnerable to Administrative Account Disruption and Privilege De-escalation via User Overwrite Logic CVE-2026-42609, GHSA-rr73-568v-28f8 | High | 0.5% | 05 May, 2026 | Packagist getgrav/grav |
Grav Vulnerable to Publisher-Level Stored XSS via Unquoted Event Attributes CVE-2026-42612, GHSA-9695-8fr9-hw5q | High | 0.2% | 05 May, 2026 | Packagist getgrav/grav |