Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
OpenClaw: `session_status` still bypasses configured `tools.sessions.visibility` for unsandboxed invocations CVE-2026-41350, GHSA-fwjq-xwfj-gv75 | Medium | 0.2% | 07 Apr, 2026 | npm openclaw |
OpenClaw: Marketplace Plugin Download Follows Redirects Without SSRF Protection CVE-2026-41297, GHSA-vjx8-8p7h-82gr | Medium | 0.2% | 07 Apr, 2026 | npm openclaw |
OpenClaw: Tlon media downloads can bypass core safety limits and exhaust disk CVE-2026-41408, GHSA-4g5x-2jfc-xm98 | Medium | 0.3% | 07 Apr, 2026 | npm openclaw |
coursevault-preview has a path traversal due to improper base-directory boundary validation CVE-2026-35613, GHSA-9h9m-rr67-9jpg | Medium | 0.1% | 07 Apr, 2026 | npm coursevault-preview |
pyload-ng: Incomplete Tar Path Traversal Fix in UnTar._safe_extractall via os.path.commonprefix Bypass CVE-2026-35592, GHSA-mvwx-582f-56r7, PYSEC-2026-124 | Medium | 0.3% | 07 Apr, 2026 | PyPI pyload-ng |
pyload-ng: Authorization Bypass for SSL Certificate/Key Configuration Due to Option Name Mismatch in pyload-ng CVE-2026-35586, GHSA-ppvx-rwh9-7rj7, PYSEC-2026-123 | Medium | 0.1% | 07 Apr, 2026 | PyPI pyload-ng |
yaffa vulnerable to Cross Site Scripting CVE-2025-70844, GHSA-pq95-94c9-j987 | Medium | 0.3% | 07 Apr, 2026 | Packagist kantorge/yaffa |
Django has potential DoS via MultiPartParser through crafted multipart uploads BIT-django-2026-33033, CVE-2026-33033, GHSA-5mf9-h53q-7mhq, PYSEC-2026-48 | Medium | 0.9% | 07 Apr, 2026 | PyPI Django PyPI django |
MLflow is vulnerable to an authorization bypass affecting the AJAX endpoint BIT-mlflow-2026-33866, CVE-2026-33866, GHSA-46r5-x6jq-v8g6, PYSEC-2026-94 | Medium | 0.4% | 07 Apr, 2026 | PyPI mlflow |
MLflow is vulnerable to Stored Cross-Site Scripting (XSS) caused by unsafe parsing of YAML-based MLmodel artifacts in its web interface BIT-mlflow-2026-33865, CVE-2026-33865, GHSA-fh64-r2vc-xvhr, PYSEC-2026-93 | Medium | 0.2% | 07 Apr, 2026 | PyPI mlflow |
PocketMine-MP: Player entities can still die and drop items in flaggedForDespawn state CVE-2026-86203, GHSA-f9jp-856v-8642 | Medium | 0.3% | 06 Apr, 2026 | Packagist pocketmine/pocketmine-mp |
PocketMine-MP: Network amplification vulnerability with `ActorEventPacket` CVE-2026-86202, GHSA-7hmv-4j2j-pp6f | Medium | 0.4% | 06 Apr, 2026 | Packagist pocketmine/pocketmine-mp |
Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling CVE-2026-39365, GHSA-4w7w-66w2-5vf9 | Medium | 0.9% | 06 Apr, 2026 | npm vite |
@nestjs/core Improperly Neutralizes Special Elements in Output Used by a Downstream Component ('Injection') CVE-2026-35515, GHSA-36xv-jgw5-4q75 | Medium | 0.2% | 06 Apr, 2026 | npm @nestjs/core |
kedro-datasets has a path traversal vulnerability in PartitionedDataset that allows arbitrary file write CVE-2026-111170, CVE-2026-35492, GHSA-cjg8-h5qc-hrjv, PYSEC-2026-2545 | Medium | 0.4% | 06 Apr, 2026 | PyPI kedro-datasets |
Feehi CMS has an authenticated stored cross-site scripting (XSS) vulnerability via the creation/editing module CVE-2026-31313, GHSA-hj9c-p59c-vqph | Medium | 0.1% | 06 Apr, 2026 | Packagist feehi/cms |
Feehi CMS has authenticated stored cross-site scripting (XSS) vulnerabilities via the Permissions module CVE-2026-31354, GHSA-xqm9-6qmm-xrqh | Medium | 0.2% | 06 Apr, 2026 | Packagist feehi/cms |
Feehi CMS has an authenticated stored cross-site scripting (XSS) vulnerability via the Category module CVE-2026-31353, GHSA-664p-j3q6-p843 | Medium | 0.2% | 06 Apr, 2026 | Packagist feehi/cms |
Feehi CMS has an authenticated stored cross-site scripting (XSS) vulnerability via the Role Management module CVE-2026-31352, GHSA-hqjc-wfvx-x2fv | Medium | 0.2% | 06 Apr, 2026 | Packagist feehi/cms |
Feehi CMS has an authenticated stored cross-site scripting (XSS) vulnerability via the creation/editing module CVE-2026-31351, GHSA-cvjh-88c8-2jjx | Medium | 0.2% | 06 Apr, 2026 | Packagist feehi/cms |
Feehi CMS has an authenticated stored cross-site scripting (XSS) vulnerability via the Page Sign parameter CVE-2026-31350, GHSA-cgxr-v74v-g9mm | Medium | 0.2% | 06 Apr, 2026 | Packagist feehi/cms |
Nodcms contains a cross-site request forgery vulnerability CVE-2016-20054, GHSA-3qcm-pj6q-w4c5 | Medium | 0.1% | 04 Apr, 2026 | Packagist khodakhah/nodcms |
web3.py: SSRF via CCIP Read (EIP-3668) OffchainLookup URL handling CVE-2026-111171, CVE-2026-40072, GHSA-5hr4-253g-cpx2, PYSEC-2026-3414 | Medium | 0.3% | 04 Apr, 2026 | PyPI web3 |
AVideo: Unauthenticated Information Disclosure via Missing Auth on CloneSite client.log.php CVE-2026-35452, GHSA-99j6-hj87-6fcf | Medium | 0.4% | 04 Apr, 2026 | Packagist wwbn/avideo |
AVideo: Unauthenticated FFmpeg Remote Server Status Disclosure via check.ffmpeg.json.php CVE-2026-35450, GHSA-2vg4-rrx4-qcpq | Medium | 0.4% | 04 Apr, 2026 | Packagist wwbn/avideo |
AVideo: Unauthenticated Information Disclosure via Disabled CLI Guard in install/test.php CVE-2026-35449, GHSA-hg8q-8wqr-35xx | Medium | 0.3% | 04 Apr, 2026 | Packagist wwbn/avideo |
Directus: GraphQL Alias Amplification Denial of Service Due to Missing Query Cost/Complexity Limits CVE-2026-35441, GHSA-ph52-67fq-75wj | Medium | 0.4% | 04 Apr, 2026 | npm directus |
Directus: Sensitive fields exposed in revision history CVE-2026-39943, GHSA-mvv8-v4jj-g47j | Medium | 0.2% | 04 Apr, 2026 | npm directus |
Directus: GraphQL Schema SDL Disclosure Setting CVE-2026-35413, GHSA-wxwm-3fxv-mrvx | Medium | 0.3% | 04 Apr, 2026 | npm directus |
Directus: Open Redirect via Parser Bypass in OAuth2/SAML Authentication Flow CVE-2026-35410, GHSA-cf45-hxwj-4cfj | Medium | 0.3% | 04 Apr, 2026 | npm directus |
Directus: Open Redirect in Admin 2FA Setup Page CVE-2026-35411, GHSA-q75c-4gmv-mg9x | Medium | 0.3% | 04 Apr, 2026 | npm directus |
AVideo: CSRF on Player Skin Configuration via admin/playerUpdate.json.php CVE-2026-35181, GHSA-4q27-4rrq-fx95 | Medium | 0.1% | 03 Apr, 2026 | Packagist wwbn/avideo |
AVideo: Unauthenticated Instagram Graph API Proxy via publishInstagram.json.php CVE-2026-35179, GHSA-x9w5-xccw-5h9w | Medium | 0.2% | 03 Apr, 2026 | Packagist wwbn/avideo |
Electron: Use-after-free in offscreen shared texture release() callback CVE-2026-34764, GHSA-8x5q-pvf5-64mp | Medium | 0.1% | 03 Apr, 2026 | npm electron |
vLLM: Denial of Service via Unbounded Frame Count in video/jpeg Base64 Processing CVE-2026-34755, GHSA-pq5c-rjhq-qp7p, PYSEC-2026-144 | Medium | 0.5% | 03 Apr, 2026 | PyPI vllm |
vLLM: Server-Side Request Forgery (SSRF) in `download_bytes_from_url ` CVE-2026-34753, GHSA-pf3h-qjgv-vcpr, PYSEC-2026-3410 | Medium | 0.2% | 03 Apr, 2026 | PyPI vllm |
SandboxJS: Sandbox Escape via Prop Object Leak in New Handler CVE-2026-34217, GHSA-hg73-4w7g-q96w | Medium | 0.3% | 03 Apr, 2026 | npm @nyariv/sandboxjs |
SandboxJS: Stack overflow DoS via deeply nested expressions in recursive descent parser CVE-2026-34211, GHSA-8pfc-jjgw-6g26 | Medium | 0.4% | 03 Apr, 2026 | npm @nyariv/sandboxjs |
LTI JupyterHub Authenticator: Unbounded Memory Growth via Nonce Storage (Denial of Service) CVE-2026-34052, GHSA-8mxq-7xr7-2fxj, PYSEC-2026-2533 | Medium | 0.3% | 03 Apr, 2026 | PyPI jupyterhub-ltiauthenticator |
JupyterHub has an Open Redirect Vulnerability BIT-jupyterhub-2026-33709, CVE-2026-33709, GHSA-3vff-hjqv-m7h8, PYSEC-2026-2188 | Medium | 0.2% | 03 Apr, 2026 | PyPI jupyterhub |
vLLM: Unauthenticated OOM Denial of Service via Unbounded `n` Parameter in OpenAI API Server CVE-2026-34756, GHSA-3mwp-wvh9-7528, PYSEC-2026-2298 | Medium | 0.4% | 03 Apr, 2026 | PyPI vllm |
Roundcube Webmail: Insufficient CSS sanitization in HTML e-mail messages CVE-2026-35544, GHSA-xpqh-grpw-4xmg | Medium | 0.4% | 03 Apr, 2026 | Packagist roundcube/roundcubemail |
Roundcube Webmail: Bypass of remote image blocking via SVG content (with animate attributes) in an e-mail message CVE-2026-35543, GHSA-j2g6-8rvg-7mf6 | Medium | 0.4% | 03 Apr, 2026 | Packagist roundcube/roundcubemail |
Roundcube: Bypass of remote image blocking via crafted BODY background attribute CVE-2026-35542, GHSA-5hf6-crg4-fg59 | Medium | 0.4% | 03 Apr, 2026 | Packagist roundcube/roundcubemail |
Roundcube Webmail: Incorrect password comparison in the password plugin CVE-2026-35541, GHSA-46pv-mj2g-93gh | Medium | 0.2% | 03 Apr, 2026 | Packagist roundcube/roundcubemail |
Roundcube Webmail: Insufficient CSS sanitization in HTML e-mail messages CVE-2026-35540, GHSA-vxg2-hhgr-37fx | Medium | 0.4% | 03 Apr, 2026 | Packagist roundcube/roundcubemail |
Roundcube Webmail: Insufficient HTML attachment sanitization in preview mode CVE-2026-35539, GHSA-x4q5-8j5g-hpjc | Medium | 0.3% | 03 Apr, 2026 | Packagist roundcube/roundcubemail |
DOMPurify ADD_ATTR predicate skips URI validation CVE-2026-65912, GHSA-cjmm-f4jc-qw8r | Medium | 0.3% | 03 Apr, 2026 | npm dompurify |
DOMPurify USE_PROFILES prototype pollution allows event handlers CVE-2026-65913, GHSA-cj63-jhhr-wcxv | Medium | 0.3% | 03 Apr, 2026 | npm dompurify |
D-Tale: Remote Code Execution through redis/shelf storage CVE-2026-35052, GHSA-436g-fhfc-9g5w, PYSEC-2026-2460 | Medium | 0.6% | 03 Apr, 2026 | PyPI dtale |