Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
OpenClaw: Voice-call realtime WebSocket accepted oversized frames CVE-2026-42437, GHSA-vw3h-q6xq-jjm5 | High | 0.4% | 17 Apr, 2026 | npm openclaw |
OpenClaw: config.get redaction bypass through sourceConfig and runtimeConfig aliases CVE-2026-43528, GHSA-8372-7vhw-cm6q | High | 0.3% | 17 Apr, 2026 | npm openclaw |
OpenClaw: Collect-mode queue batches could reuse the last sender authorization context CVE-2026-43535, GHSA-jwrq-8g5x-5fhm | High | 0.2% | 17 Apr, 2026 | npm openclaw |
Flowise: Unauthenticated TTS endpoint accepts arbitrary credential IDs — enables API credit abuse via stored credentials CVE-2026-41279, GHSA-5fw2-mwhh-9947 | High | 0.3% | 17 Apr, 2026 | npm flowise |
Flowise: Public chatflow endpoints return unsanitized flowData including plaintext API keys, passwords, and credential IDs CVE-2026-41278, GHSA-w47f-j8rh-wx87 | High | 0.4% | 17 Apr, 2026 | npm flowise |
Flowise: Mass Assignment in DocumentStore Create Endpoint Leads to Cross-Workspace Object Takeover (IDOR) CVE-2026-41277, GHSA-3prp-9gf7-4rxx | High | 3.1% | 17 Apr, 2026 | npm flowise |
Complete Bypass of CVE-2026-24884 Patch via Git-Delivered Symlink Poisoning in compressing CVE-2026-40931, GHSA-4c3q-x735-j3r5 | High | 0.3% | 17 Apr, 2026 | npm compressing |
Craftql vulnerable to Server-Side Request Forgery CVE-2026-31317, GHSA-8wmw-prw8-2ggm | High | 0.5% | 17 Apr, 2026 | Packagist markhuot/craftql |
Paperclip: codex_local inherited ChatGPT/OpenAI-connected Gmail and was able to send real email GHSA-gqqj-85qm-8qhf | High | Not scored | 16 Apr, 2026 | npm paperclipai |
Paperclip: Unauthenticated Access to Multiple API Endpoints in Authenticated Mode GHSA-xfqj-r5qw-8g4j | High | Not scored | 16 Apr, 2026 | npm @paperclipai/server |
Paperclip: Malicious skills able to exfiltrate and destroy all user data GHSA-w8hx-hqjv-vjcq | High | Not scored | 16 Apr, 2026 | npm @paperclipai/server |
Paperclip: Privilege Escalation via Agent-Controlled workspaceStrategy.provisionCommand Leading to OS Command Execution CVE-2026-41208, GHSA-265w-rf2w-cjh4 | High | 0.6% | 16 Apr, 2026 | npm @paperclipai/server |
OAuth 2.1 Provider: Unprivileged users can register OAuth clients CVE-2026-41427, GHSA-xr8f-h2gw-9xh6 | High | 0.2% | 16 Apr, 2026 | npm @better-auth/oauth-provider |
Unsafe object property setter in mathjs CVE-2026-40897, GHSA-29qv-4j9f-fjw5 | High | 0.6% | 16 Apr, 2026 | npm mathjs |
Angular: SSRF via protocol-relative and backslash URLs in Angular Platform-Server CVE-2026-41423, GHSA-45q2-gjvg-7973 | High | 0.3% | 16 Apr, 2026 | npm @angular/platform-server |
Flowise: resetPassword Authentication Bypass Vulnerability CVE-2026-41276, GHSA-f6hc-c5jr-878p | High | 6.9% | 16 Apr, 2026 | npm flowise |
Flowise: Password Reset Link Sent Over Unsecured HTTP CVE-2026-41275, GHSA-x5w6-38gp-mrqh | High | 0.2% | 16 Apr, 2026 | npm flowise |
Flowise: Unauthenticated OAuth 2.0 Access Token Disclosure via Public Chatflow in Flowise CVE-2026-41273, GHSA-6f7g-v4pp-r667 | High | 0.3% | 16 Apr, 2026 | npm flowise |
Flowise: APIChain Prompt Injection SSRF in GET/POST API Chains CVE-2026-41271, GHSA-6r77-hqx7-7vw8 | High | 0.2% | 16 Apr, 2026 | npm flowise npm flowise-components |
Flowise: SSRF Protection Bypass (TOCTOU & Default Insecure) CVE-2026-41272, GHSA-2x8m-83vc-6wv4 | High | 0.3% | 16 Apr, 2026 | npm flowise npm flowise-components |
Flowise: SSRF Protection Bypass via Unprotected Built-in HTTP Modules in Custom Function Sandbox CVE-2026-41270, GHSA-xhmj-rg95-44hv | High | 0.2% | 16 Apr, 2026 | npm flowise npm flowise-components |
Flowise: File Upload Validation Bypass in createAttachment CVE-2026-41269, GHSA-rh7v-6w34-w2rr | High | 0.5% | 16 Apr, 2026 | npm flowise |
Flowise: Sensitive Data Leak in public-chatbotConfig CVE-2026-41266, GHSA-4jpm-cgx2-8h37 | High | 4.1% | 16 Apr, 2026 | npm flowise |
Flowise: Remote code execution vulnerability in AirtableAgent.ts caused by lack of input verification when using `Pandas`. CVE-2026-41138, GHSA-f228-chmx-v6j6 | High | 0.6% | 16 Apr, 2026 | npm flowise npm flowise-components |
basic-ftp vulnerable to denial of service via unbounded memory consumption in Client.list() CVE-2026-41324, GHSA-rp42-5vxx-qpwr | High | 0.3% | 16 Apr, 2026 | npm basic-ftp |
Unauthenticated Information Disclosure (IDOR) via Multisite switch_to_blog in My Calendar CVE-2026-40308, GHSA-2mvx-f5qm-v2ch | High | 0.9% | 16 Apr, 2026 | Packagist joedolson/my-calendar |
Statamic: Unsafe method invocation via query value resolution allows data destruction CVE-2026-41175, GHSA-4jjr-vmv7-wh4w | High | 0.3% | 16 Apr, 2026 | Packagist statamic/cms |
WWBN AVideo: RCE cause by clonesite plugin CVE-2026-41304, GHSA-xr6f-h4x7-r6qp | High | 2.2% | 16 Apr, 2026 | Packagist wwbn/avideo |
Flowise: Unauthenticated Information Disclosure of OAuth Secrets (Cleartext) via GET Request CVE-2026-56270, GHSA-6pcv-j4jx-m4vx | High | 2.0% | 16 Apr, 2026 | npm flowise |
Mako: Path traversal via double-slash URI prefix in TemplateLookup CVE-2026-41205, GHSA-v92g-xgxw-vvmm, PYSEC-2026-88 | High | 0.4% | 16 Apr, 2026 | PyPI Mako PyPI mako |
PsiTransfer: Upload PATCH path traversal can create `config.<NODE_ENV>.js` and lead to code execution on restart CVE-2026-41180, GHSA-533q-w4g6-5586 | High | 0.4% | 16 Apr, 2026 | npm psitransfer |
MCP-Framework: Unbounded memory allocation in readRequestBody allows denial of service via HTTP transport CVE-2026-39313, GHSA-353c-v8x9-v7c3 | High | 0.5% | 16 Apr, 2026 | npm mcp-framework |
Apache Airflow: JWT token appearing in logs BIT-airflow-2026-31987, CVE-2026-31987, GHSA-phv5-vq5p-qhp7, PYSEC-2026-2352 | High | 0.7% | 16 Apr, 2026 | PyPI apache-airflow |
wger has Broken Access Control in Global Gym Configuration Update Endpoint CVE-2026-40474, GHSA-xppv-4jrx-qf8m, PYSEC-2026-3424 | High | 0.3% | 16 Apr, 2026 | PyPI wger |
Path traversal in vite-plus/binding downloadPackageManager() writes outside VP_HOME CVE-2026-41211, GHSA-33r3-4whc-44c2 | High | 0.3% | 16 Apr, 2026 | npm vite-plus |
Froxlor has a BIND Zone File Injection via Unsanitized DNS Record Content in DomainZones::add() CVE-2026-41230, GHSA-47hf-23pw-3m8c | High | 0.3% | 16 Apr, 2026 | Packagist froxlor/froxlor |
Froxlor has Incomplete Symlink Validation in DataDump.add() Allows Arbitrary Directory Ownership Takeover via Cron CVE-2026-41231, GHSA-75h4-c557-j89r | High | 0.4% | 16 Apr, 2026 | Packagist froxlor/froxlor |
Stored XSS in SEO Fields Leads to Authenticated API Data Exposure in ApostropheCMS CVE-2026-35569, GHSA-855c-r2vq-c292 | High | 0.3% | 15 Apr, 2026 | npm apostrophe |
Weblate: Privilege escalation in the user API endpoint CVE-2026-34393, GHSA-3382-gw9x-477v, PYSEC-2026-155 | High | 0.4% | 15 Apr, 2026 | PyPI weblate |
Weblate: Arbitrary File Read via Symlink CVE-2026-34242, GHSA-hv99-mxm5-q397, PYSEC-2026-2313 | High | 0.5% | 15 Apr, 2026 | PyPI weblate |
Weblate: Remote code execution during backup restoration CVE-2026-33435, GHSA-558g-h753-6m33, PYSEC-2026-154 | High | 0.7% | 15 Apr, 2026 | PyPI weblate |
Apache Airflow: RCE by race condition in example_xcom dag BIT-airflow-2025-54550, CVE-2025-54550, GHSA-q2hg-643c-gw8h, PYSEC-2026-2353 | High | 0.6% | 15 Apr, 2026 | PyPI apache-airflow |
pyLoad has Stale Session Privilege After Role/Permission Change (Privilege Revocation Bypass) CVE-2026-41133, GHSA-66hx-chf7-3332, PYSEC-2026-2990 | High | 0.3% | 14 Apr, 2026 | PyPI pyload-ng |
Novu has a XSS sanitization bypass GHSA-26wg-9xf2-q495 | High | Not scored | 14 Apr, 2026 | npm novu/api |
Novu has SSRF via conditions filter webhook bypasses validateUrlSsrf() protection GHSA-4x48-cgf9-q33f | High | Not scored | 14 Apr, 2026 | npm @novu/api |
WWBN AVideo has a SSRF via same-domain hostname with alternate port bypasses isSSRFSafeURL CVE-2026-41060, GHSA-j432-4w3j-3w8j | High | 0.3% | 14 Apr, 2026 | Packagist wwbn/avideo |
WWBN AVideo has an incomplete fix for CVE-2026-33293: Path Traversal CVE-2026-41058, GHSA-5879-4fmr-xwf2 | High | 0.5% | 14 Apr, 2026 | Packagist wwbn/avideo |
WWBN AVideo has a CORS Origin Reflection Bypass via plugin/API/router.php and allowOrigin(true) Exposes Authenticated API Responses CVE-2026-41057, GHSA-ff5q-cc22-fgp4 | High | 0.1% | 14 Apr, 2026 | Packagist wwbn/avideo |
WWBN AVideo has CORS Origin Reflection with Credentials on Sensitive API Endpoints Enables Cross-Origin Account Takeover CVE-2026-41056, GHSA-ccq9-r5cw-5hwq | High | 0.3% | 14 Apr, 2026 | Packagist wwbn/avideo |
WWBN AVideo has Multiple CSRF Vulnerabilities in Admin JSON Endpoints (Category CRUD, Plugin Update Script) CVE-2026-40926, GHSA-ffw8-fwxp-h64w | High | 0.2% | 14 Apr, 2026 | Packagist wwbn/avideo |