Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
PyMongo: PYTHON-5996 Heap out-of-bounds write via signed size overflow in BSON document encoding CVE-2026-96749, GHSA-v4x9-3549-crwv, PYSEC-2026-4296 | High | 0.2% | 24 Sep, 2026 | PyPI pymongo |
PyMongo: PYTHON-5986 Host injection in PyMongo connection string parsing via percent-encoded delimiters CVE-2026-96748, GHSA-vp6j-j7w5-5xjj, PYSEC-2026-4297 | High | 0.4% | 24 Sep, 2026 | PyPI pymongo |
PyMongo: PYTHON-5990 Forced Unix domain socket connection via a .sock KMS endpoint in client-side field level encryption CVE-2026-96747, GHSA-qx36-8mw2-4r3x, PYSEC-2026-4295 | Medium | 0.2% | 24 Sep, 2026 | PyPI pymongo |
code16/sharp has a stored XSS via data-html-content Sanitizer Bypass CVE-2026-61825, GHSA-vj3q-vp3g-j9c8 | High | 0.2% | 24 Sep, 2026 | Packagist code16/sharp |
code16 Sharp vulnerable to stored XSS via iframe srcdoc Attribute CVE-2026-61823, GHSA-qxg3-46rw-79j8 | High | 0.2% | 24 Sep, 2026 | Packagist code16/sharp |
Mediawiki EmbedVideo Extension has stored XSS via malformed src url with $wgEmbedVideoRequireConsent disabled CVE-2026-57440, GHSA-v65j-hff3-753c | High | 0.3% | 24 Sep, 2026 | Packagist starcitizenwiki/embedvideo |
zbateson/mail-mime-parser has uncontrolled resource consumption (CPU/memory DoS) parsing untrusted MIME CVE-2026-61816, GHSA-f6v3-2qmr-vfjx | High | 0.4% | 24 Sep, 2026 | Packagist zbateson/mail-mime-parser |
zbateson/mail-mime-parser has CRLF header injection via attachment filename CVE-2026-61815, GHSA-36h5-qg4p-q2qf | High | 0.2% | 24 Sep, 2026 | Packagist zbateson/mail-mime-parser |
@bytebase/dbhub's read-only mode does not prevent database writes CVE-2026-61788, GHSA-mwwr-p57h-56pf | High | 0.4% | 24 Sep, 2026 | npm @bytebase/dbhub |
xhtml-purifier has HTML attribute-injection (sanitizer bypass) that leads to XSS CVE-2026-61784, GHSA-j8r4-32c5-33rc | Medium | 0.2% | 24 Sep, 2026 | npm xhtml-purifier |
@rsdoctor/rspack-plugin has Unauthenticated HTTP API that Exposes Project Source Code and Build Metadata CVE-2026-61782, GHSA-jmg2-rcxh-w8q3 | High | 0.4% | 24 Sep, 2026 | npm @rsdoctor/rspack-plugin |
DBHub HTTP transport DNS rebinding allows unauthenticated browser-origin SQL execution CVE-2026-61742, GHSA-fm8p-53ww-hf6w | Critical | 0.2% | 24 Sep, 2026 | npm @bytebase/dbhub |
Decepticon: Role-boundary forgery via ChatML special-token literals in web crawl output composed into LLM context CVE-2026-61732, GHSA-g5f9-3xfg-p9mf, PYSEC-2026-4032, PYSEC-2026-4033, PYSEC-2026-4034 | Critical | 1.5% | 24 Sep, 2026 | PyPI decepticon PyPI decepticon-core PyPI decepticon-sdk |
social-auth-core has a Session Fixation issue CVE-2026-57179, GHSA-vqg6-3fw6-j9jg, PYSEC-2026-4168 | Medium | 0.2% | 24 Sep, 2026 | PyPI social-auth-core |
social-auth-core: VK App backend accepts unsigned callback data when auth_key is missing CVE-2026-57178, GHSA-3c93-f73f-qc9h, PYSEC-2026-4165 | High | 0.2% | 24 Sep, 2026 | PyPI social-auth-core |
social-auth-core has Login CSRF via Missing State Parameter in LoginRadius Backend CVE-2026-57177, GHSA-x7qq-23vw-7pfg, PYSEC-2026-4169 | Medium | 0.1% | 24 Sep, 2026 | PyPI social-auth-core |
social-auth-core Vulnerable to Account Takeover via Identity Binding Flaw in Vend Backend CVE-2026-57176, GHSA-fp7w-m676-w7gc, PYSEC-2026-4166 | Medium | 0.2% | 24 Sep, 2026 | PyPI social-auth-core |
social-auth-core has an Improper Authentication issue CVE-2026-57175, GHSA-vq6g-g6c7-5f2j, PYSEC-2026-4167 | Medium | 0.2% | 24 Sep, 2026 | PyPI social-auth-core |
Snipe-IT: Stored XSS via Inline XML Rendering in the Uploaded Files API CVE-2026-63498, GHSA-396x-xmvh-p563 | High | 0.2% | 24 Sep, 2026 | Packagist snipe/snipe-it |
Snipe-IT: Stored XSS via Custom Field name in asset-list column headers CVE-2026-62368, GHSA-p9h3-gvpq-5539 | High | 0.4% | 24 Sep, 2026 | Packagist snipe/snipe-it |
`@bsv/wallet-toolbox` / `-client` / `-mobile` don't verify storage-supplied recipient output scripts against caller-requested outputs in createAction CVE-2026-56744, GHSA-36f9-7rg5-cpf8 | High | 0.4% | 24 Sep, 2026 | npm @bsv/wallet-toolbox npm @bsv/wallet-toolbox-client npm @bsv/wallet-toolbox-mobile |
phpMyFAQ has SQL Injection in `StopWords::add()` — Unescaped Stop Word Insertion CVE-2026-56738, GHSA-rw77-vq4g-x3hp | High | 0.3% | 24 Sep, 2026 | Packagist phpmyfaq/phpmyfaq Packagist thorsten/phpmyfaq |
Snipe-IT: 2FA bypass via the API token flow CVE-2026-63493, GHSA-hxcx-9h4f-42xx | High | 0.3% | 24 Sep, 2026 | Packagist snipe/snipe-it |
phpMyFAQ's two-factor authentication login bypasses the password factor CVE-2026-56737, GHSA-8gpw-xvpf-hvx5 | High | 0.5% | 24 Sep, 2026 | Packagist phpmyfaq/phpmyfaq Packagist thorsten/phpmyfaq |
phpMyFAQ has Stored XSS in Admin FAQ Editor via HTML Entity Bypass in Frontend FAQ Submission CVE-2026-56736, GHSA-pgwp-vc7q-cvj3 | High | 0.2% | 24 Sep, 2026 | Packagist phpmyfaq/phpmyfaq Packagist thorsten/phpmyfaq |
Malicious release: Malicious code in analytics-widget (npm) GHSA-548g-r2c9-6chm, MAL-2026-17163 | Malicious | Not scored | 24 Sep, 2026 | npm analytics-widget |
Malicious release: Malicious code in building-build (npm) GHSA-2fq4-2r26-qr64, MAL-2026-17164 | Malicious | Not scored | 24 Sep, 2026 | npm building-build |
Malicious release: Malicious code in cache-swipper (npm) MAL-2026-17166 | Malicious | Not scored | 24 Sep, 2026 | npm cache-swipper |
Malicious release: Malicious code in c2-client (npm) MAL-2026-17165 | Malicious | Not scored | 24 Sep, 2026 | npm c2-client |
Malicious release: Malicious code in simple-date-formatter-new-16 (npm) MAL-2026-17162 | Malicious | Not scored | 24 Sep, 2026 | npm simple-date-formatter-new-16 |
Malicious release: Malicious code in eslint-config-compact-base (npm) GHSA-gx7g-jjf6-c7jg, MAL-2026-17157 | Malicious | Not scored | 24 Sep, 2026 | npm eslint-config-compact-base |
Malicious release: Malicious code in simple-date-formatter-new-14 (npm) MAL-2026-17160 | Malicious | Not scored | 24 Sep, 2026 | npm simple-date-formatter-new-14 |
Malicious release: Malicious code in simple-date-formatter-new-13 (npm) MAL-2026-17159 | Malicious | Not scored | 24 Sep, 2026 | npm simple-date-formatter-new-13 |
Malicious release: Malicious code in aliftech-ui (npm) MAL-2026-17156 | Malicious | Not scored | 24 Sep, 2026 | npm aliftech-ui |
Malicious release: Malicious code in @osl-design/react (npm) MAL-2026-17155 | Malicious | Not scored | 24 Sep, 2026 | npm @osl-design/react |
Malicious release: Malicious code in simple-date-formatter-new-15 (npm) MAL-2026-17161 | Malicious | Not scored | 24 Sep, 2026 | npm simple-date-formatter-new-15 |
Malicious release: Malicious code in simple-date-formatter-new-11 (npm) MAL-2026-17158 | Malicious | Not scored | 24 Sep, 2026 | npm simple-date-formatter-new-11 |
Malicious release: Malicious code in @nf-addons/am-global-header (npm) MAL-2026-17154 | Malicious | Not scored | 24 Sep, 2026 | npm @nf-addons/am-global-header |
Malicious release: Malicious code in @birbalo/aliftech-ui (npm) MAL-2026-17153 | Malicious | Not scored | 24 Sep, 2026 | npm @birbalo/aliftech-ui |
Malicious release: Malicious code in @baanx/domain (npm) GHSA-qhfc-6rp6-pwv6, MAL-2026-16486 | Malicious | Not scored | 24 Sep, 2026 | npm @baanx/domain |
Malicious release: Malicious code in @baanx/common (npm) GHSA-27jh-hjhg-vg2p, MAL-2026-16485 | Malicious | Not scored | 24 Sep, 2026 | npm @baanx/common |
hpack: Unbounded variable integer decoding can cause run-away computation on malformed input CVE-2026-59980, GHSA-8v8h-hg4w-mvq2, PYSEC-2026-4053 | Medium | 0.3% | 23 Sep, 2026 | PyPI hpack |
Malicious release: Malicious code in @rixxcodex/baileys (npm) MAL-2026-16483 | Malicious | Not scored | 23 Sep, 2026 | npm @rixxcodex/baileys |
Malicious release: Malicious code in pino-testkit (npm) GHSA-9q39-547h-rfpc, MAL-2026-16484 | Malicious | Not scored | 23 Sep, 2026 | npm pino-testkit |
plone.app.contenttypes has a Denial of Service in File Upload due to excessive filename length GHSA-8pcw-h6w9-h46g | Medium | Not scored | 23 Sep, 2026 | PyPI plone-app-contenttypes PyPI plone.app.contenttypes |
OpenC3 COSMOS: Stored, cross-user XSS via Telemetry screen BUTTON widget CVE-2026-77394, GHSA-gvf2-2rh5-mpgf | High | 0.4% | 23 Sep, 2026 | npm @openc3/vue-common |
Formie: Missing authorization on sent notification resend modal exposes submission PII CVE-2026-76089, GHSA-9rg8-2wvr-fgjh | High | 0.4% | 23 Sep, 2026 | Packagist verbb/formie |
Mesop: Unauthenticated ANSI Escape Sequence Injection in CSP Reporting Endpoint CVE-2026-93421, GHSA-g7f6-rxc4-qhph, PYSEC-2026-4105 | Medium | 0.5% | 23 Sep, 2026 | PyPI mesop |
Formie: Unauthenticated users can overwrite incomplete submissions via submit action CVE-2026-76087, GHSA-584p-f93j-wpgc | High | 0.4% | 23 Sep, 2026 | Packagist verbb/formie |
Formie: Integration form-settings action allows SSRF and exfiltration of stored integration credentials CVE-2026-76086, GHSA-v3f3-cmj4-cvj9 | High | 0.5% | 23 Sep, 2026 | Packagist verbb/formie |