Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
PySpector has a Plugin Code Execution Bypass via Incomplete Static Analysis in PluginSecurity.validate_plugin_code CVE-2026-41206, GHSA-vp22-38m5-r39r, PYSEC-2026-3031 | Medium | 0.2% | 16 Apr, 2026 | PyPI pyspector |
hono Improperly Handles JSX Attribute Names Allows HTML Injection in hono/jsx SSR CVE-2026-56761, GHSA-458j-xx4x-4375 | Medium | 0.3% | 16 Apr, 2026 | npm hono |
ProcessWire: server-side request forgery vulnerability in the admin panel's 'Add Module From URL' feature CVE-2026-40500, GHSA-gmwr-9j4p-96vm | Medium | Not scored | 16 Apr, 2026 | Packagist processwire/processwire |
Froxlor has an Email Sender Alias Domain Ownership Bypass via Wrong Array Index Allows Cross-Customer Email Spoofing CVE-2026-41232, GHSA-vmjj-qr7v-pxm6 | Medium | 0.2% | 16 Apr, 2026 | Packagist froxlor/froxlor |
Froxlor has a Reseller Domain Quota Bypass via Unvalidated adminid Parameter in Domains.add() CVE-2026-41233, GHSA-jvx4-xv3m-hrj4 | Medium | 0.3% | 16 Apr, 2026 | Packagist froxlor/froxlor |
DOMPurify's ADD_TAGS function form bypasses FORBID_TAGS due to short-circuit evaluation CVE-2026-65903, GHSA-39q2-94rc-95cp | Medium | 0.3% | 16 Apr, 2026 | npm dompurify |
sanitize-html allowedTags Bypass via Entity-Decoded Text in nonTextTags Elements CVE-2026-40186, GHSA-9mrh-v2v3-xpfm | Medium | 0.2% | 15 Apr, 2026 | npm sanitize-html |
ApostropheCMS: Information Disclosure via choices/counts Query Parameters Bypassing publicApiProjection Field Restrictions CVE-2026-39857, GHSA-c276-fj82-f2pq | Medium | 0.4% | 15 Apr, 2026 | npm apostrophe |
ApostropheCMS: Stored XSS via CSS Custom Property Injection in @apostrophecms/color-field Escaping Style Tag Context CVE-2026-33889, GHSA-97v6-998m-fp4g | Medium | 0.2% | 15 Apr, 2026 | npm apostrophe |
ApostropheCMS: publicApiProjection Bypass via project Query Builder in Piece-Type REST API CVE-2026-33888, GHSA-xhq9-58fw-859p | Medium | 0.5% | 15 Apr, 2026 | npm apostrophe |
Kimai's User Preferences API allows standard users to modify restricted attributes: hourly_rate, internal_rate CVE-2026-40486, GHSA-qh43-xrjm-4ggp | Medium | 0.3% | 15 Apr, 2026 | Packagist kimai/kimai |
Kimai has Stored XSS via Incomplete HTML Attribute Escaping in Team Member Widget CVE-2026-40479, GHSA-g82g-m9vx-vhjg | Medium | 0.2% | 15 Apr, 2026 | Packagist kimai/kimai |
python-multipart affected by Denial of Service via large multipart preamble or epilogue data CVE-2026-40347, GHSA-mj87-hwqh-73pj, PYSEC-2026-3038 | Medium | 0.4% | 15 Apr, 2026 | PyPI python-multipart |
NocoBase has SSRF in Workflow HTTP Request and Custom Request Plugins CVE-2026-40346, GHSA-mvvv-v22x-xqwp | Medium | 0.4% | 15 Apr, 2026 | npm @nocobase/plugin-workflow-request |
PocketMine-MP has LogDoS by many junk properties in client data JWT in LoginPacket CVE-2026-86200, GHSA-xp4f-g2cm-rhg7 | Medium | 0.6% | 15 Apr, 2026 | Packagist pocketmine/pocketmine-mp |
pypdf has long runtimes for wrong size values in cross-reference and object streams CVE-2026-41168, GHSA-jj6c-8h6c-hppx, PYSEC-2026-3021 | Medium | 0.3% | 15 Apr, 2026 | PyPI pypdf |
Drupal core allows Cross-Site Scripting (XSS) BIT-drupal-2026-6367, CVE-2026-6367, DRUPAL-CORE-2026-003, GHSA-pw6f-3999-xp7g | Medium | 0.2% | 15 Apr, 2026 | Packagist drupal/core |
Drupal core allows Object Injection BIT-drupal-2026-6366, CVE-2026-6366, DRUPAL-CORE-2026-002, GHSA-xmjc-63pr-2mpg | Medium | 0.4% | 15 Apr, 2026 | Packagist drupal/core |
Drupal core is Vulnerable to Cross-Site Scripting BIT-drupal-2026-6365, CVE-2026-6365, DRUPAL-CORE-2026-001, GHSA-f3cj-mjqm-fhvj | Medium | 0.2% | 15 Apr, 2026 | Packagist drupal/core |
Weblate: Prefix-Based Repository Boundary Check Bypass via Symlink/Junction Path Prefix Collision CVE-2026-40256, GHSA-ffgh-3jrf-8wvh, PYSEC-2026-2315 | Medium | 0.3% | 15 Apr, 2026 | PyPI weblate |
Weblate: SSRF via the webhook add-on using unprotected fetch_url() CVE-2026-39845, GHSA-f8hv-g549-hwg2, PYSEC-2026-156 | Medium | 0.3% | 15 Apr, 2026 | PyPI weblate |
Weblate: SSRF via Project-Level Machinery Configuration CVE-2026-34244, GHSA-xrwr-fcw6-fmq8, PYSEC-2026-2314 | Medium | 0.3% | 15 Apr, 2026 | PyPI weblate |
Weblate: Authenticated SSRF via redirect bypass of ALLOWED_ASSET_DOMAINS in screenshot URL uploads CVE-2026-33440, GHSA-5fhx-9jwj-867m, PYSEC-2026-2312 | Medium | 0.2% | 15 Apr, 2026 | PyPI weblate |
Weblate: JavaScript localization CDN add-on allows arbitrary local file read outside the repository CVE-2026-33220, GHSA-mqph-7h49-hqfm, PYSEC-2026-153 | Medium | 0.3% | 15 Apr, 2026 | PyPI weblate |
Sync-in Server has Username Enumeration via Timing Attack CVE-2026-41161, GHSA-43fj-qp3h-hrh5 | Medium | 0.3% | 15 Apr, 2026 | npm @sync-in/server |
Mafintosh's protocol-buffers-schema is vulnerable to prototype pollution CVE-2026-5758, GHSA-j452-xhg8-qg39 | Medium | 0.5% | 15 Apr, 2026 | npm protocol-buffers-schema |
Weblate: Improper access control for the translation memory in API CVE-2026-33214, GHSA-mpf5-3vph-q75r, PYSEC-2026-152 | Medium | 0.2% | 15 Apr, 2026 | PyPI weblate |
Apache Airlfow: Sensitive Azure Service Bus connection string (and possibly other providers) exposed to users with view access BIT-airflow-2026-25219, CVE-2026-25219, GHSA-4g48-54q2-fg7q, PYSEC-2026-2344 | Medium | 0.6% | 15 Apr, 2026 | PyPI apache-airflow |
Craft CMS has a host header injection leading to SSRF via resource-js endpoint CVE-2026-41130, GHSA-95wr-3f2v-v2wh | Medium | 0.3% | 14 Apr, 2026 | Packagist craftcms/cms |
Server-Side Request Forgery (SSRF) in Craft CMS with Asset Uploads Mutations CVE-2026-41129, GHSA-3m9m-24vh-39wx | Medium | 0.3% | 14 Apr, 2026 | Packagist craftcms/cms |
Craft CMS has a Missing Authorization Check on User Group Removal via save-permissions Action CVE-2026-41128, GHSA-jq2f-59pj-p3m3 | Medium | 0.2% | 14 Apr, 2026 | Packagist craftcms/cms |
WWBN AVideo has an incomplete fix for CVE-2026-33500: XSS CVE-2026-41063, GHSA-m7r8-6q9j-m2hc | Medium | 0.2% | 14 Apr, 2026 | Packagist wwbn/avideo |
WWBN AVideo has an Incomplete fix: Directory traversal bypass via query string in ReceiveImage downloadURL parameters CVE-2026-41062, GHSA-m63r-m9jh-3vc6 | Medium | 0.7% | 14 Apr, 2026 | Packagist wwbn/avideo |
WWBN AVideo has Stored XSS via Unanchored Duration Regex in Video Encoder Receiver CVE-2026-41061, GHSA-8pv3-29pp-pf8f | Medium | 0.2% | 14 Apr, 2026 | Packagist wwbn/avideo |
WWBN AVideo has an incomplete fix for CVE-2026-33039: SSRF CVE-2026-41055, GHSA-793q-xgj6-7frp | Medium | 0.4% | 14 Apr, 2026 | Packagist wwbn/avideo |
Giskard has Unsandboxed Jinja2 Template Rendering in ConformityCheck CVE-2026-40320, GHSA-7xjm-g8f4-rp26, PYSEC-2026-2488 | Medium | 0.1% | 14 Apr, 2026 | PyPI giskard-checks |
CAPTCHA Bypass in WWBN/AVideo via Attacker-Controlled Length Parameter and Missing Token Invalidation on Failure CVE-2026-40935, GHSA-hg7g-56h5-5pqr | Medium | 0.2% | 14 Apr, 2026 | Packagist wwbn/avideo |
WWBN AVideo is missing CSRF protection in objects/commentDelete.json.php enables mass comment deletion against moderators and content creators CVE-2026-40929, GHSA-8qm8-g55h-xmqr | Medium | 0.1% | 14 Apr, 2026 | Packagist wwbn/avideo |
WWBN AVideo: Missing CSRF Protection on State-Changing JSON Endpoints Enables Forced Comment Creation, Vote Manipulation, and Category Asset Deletion CVE-2026-40928, GHSA-x2pw-9c38-cp2j | Medium | 0.1% | 14 Apr, 2026 | Packagist wwbn/avideo |
WWBN AVideo has an Unauthenticated Information Disclosure via git.json.php Exposes Developer Emails and Deployed Version CVE-2026-40908, GHSA-52hf-63q4-r926 | Medium | 0.3% | 14 Apr, 2026 | Packagist wwbn/avideo |
WWBN AVideo has an IDOR in Live Restreams list.json.php Exposes Other Users' Stream Keys and OAuth Tokens CVE-2026-40907, GHSA-gpgp-w4x2-h3h7 | Medium | 0.3% | 14 Apr, 2026 | Packagist wwbn/avideo |
Serendipity has a Host Header Injection allows authentication cookie scoping to attacker-controlled domain in functions_config.inc.php CVE-2026-39963, GHSA-4m6c-649p-f6gf | Medium | 0.2% | 14 Apr, 2026 | Packagist s9y/serendipity |
October Rain has Stored XSS via SVG Filter Bypass CVE-2026-25133, GHSA-gcqv-f29m-67gr | Medium | 0.2% | 14 Apr, 2026 | Packagist october/rain |
October Rain has Environment Variable Exfiltration via INI Parser Interpolation CVE-2026-25125, GHSA-g6v3-wv4j-x9hg | Medium | 0.3% | 14 Apr, 2026 | Packagist october/rain |
@adonisjs/http-server has an Open Redirect vulnerability CVE-2026-40255, GHSA-6qvv-pj99-48qm | Medium | 0.2% | 14 Apr, 2026 | npm @adonisjs/core npm @adonisjs/http-server |
Microsoft Windows Protection Mechanism Failure Vulnerability CVE-2026-32202 | MediumExploited | 70.9% | 14 Apr, 2026 | |
Microsoft SharePoint Server Improper Input Validation Vulnerability CVE-2026-32201 | MediumExploited | 43.4% | 14 Apr, 2026 | |
October CMS has Stored XSS in Event Log Mail Preview CVE-2026-24907, GHSA-j4j5-9x6g-rgxc | Medium | 0.2% | 14 Apr, 2026 | Packagist october/system |
October CMS has Stored XSS in Backend Editor Markup Classes CVE-2026-24906, GHSA-6qmh-j78v-ffp7 | Medium | 0.3% | 14 Apr, 2026 | Packagist october/system |
October Rain has a Twig Sandbox Bypass via Collection Methods CVE-2026-22692, GHSA-m5qg-jc75-4jp6 | Medium | 0.4% | 14 Apr, 2026 | Packagist october/rain |