Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
OpenClaw: Endpoint persists after trust decline, leaking gateway credentials CVE-2026-41300, GHSA-9f4w-67g7-mqwv | Medium | 0.3% | 03 Apr, 2026 | npm openclaw |
OpenClaw: diffs viewer misclassifies proxied remote requests as loopback when `allowRemoteViewer` is disabled CVE-2026-41403, GHSA-3xv9-89fm-7h4r | Medium | 0.3% | 03 Apr, 2026 | npm openclaw |
OpenClaw: Telegram legacy allowFrom migration fans default-account trust into all named accounts CVE-2026-41340, GHSA-f693-58pc-2gfr | Medium | 0.3% | 03 Apr, 2026 | npm openclaw |
OpenClaw: Tlon Startup Migration Rehydrates Empty-Array Revocations From File Config CVE-2026-41388, GHSA-3pm9-5j7m-59vc | Medium | 0.3% | 03 Apr, 2026 | npm openclaw |
OpenClaw: Discord voice manager bypasses channel-level member access allowlist CVE-2026-41381, GHSA-cqgw-44wg-44rf | Medium | 0.2% | 03 Apr, 2026 | npm openclaw |
OpenClaw: Telegram audio preflight transcription enables resource consumption by unauthorized senders CVE-2026-41331, GHSA-m6fx-m8hc-572m | Medium | 0.3% | 03 Apr, 2026 | npm openclaw |
OpenClaw: Voice-call still parses large WebSocket frames before start validation (Incomplete fix for CVE-2026-32062) CVE-2026-41400, GHSA-2w79-r9g8-wmcr | Medium | 0.5% | 03 Apr, 2026 | npm openclaw |
OpenClaw: Fake DeviceToken Bypasses Shared Auth Rate Limiting CVE-2026-41333, GHSA-6p8r-6m93-557f | Medium | 0.4% | 03 Apr, 2026 | npm openclaw |
OpenClaw Has a Gateway Control Interface Information Disclosure Vulnerability CVE-2026-41335, GHSA-hr8g-2q7x-3f4w | Medium | 0.3% | 03 Apr, 2026 | npm openclaw |
OpenClaw: Sandbox file operations use check-then-act, bypassing fd-based TOCTOU defenses CVE-2026-41338, GHSA-rm5c-4rmf-vvhw | Medium | 0.1% | 03 Apr, 2026 | npm openclaw |
OpenClaw: Telnyx Webhook Replay Detection Bypass via Base64 Signature Re-encoding CVE-2026-41351, GHSA-37v6-fxx8-xjmx | Medium | 0.3% | 03 Apr, 2026 | npm openclaw |
OpenClaw: Host exec environment overrides miss proxy, TLS, Docker, and Git TLS controls CVE-2026-41330, GHSA-9gp8-hjxr-6f34 | Medium | 0.1% | 03 Apr, 2026 | npm openclaw |
OpenClaw runs Discord audio preflight transcription before member authorization CVE-2026-41374, GHSA-hhff-fj5f-qg48 | Medium | 0.5% | 03 Apr, 2026 | npm openclaw |
OpenClaw: Media download follows cross-origin redirects with Authorization headers intact CVE-2026-41345, GHSA-68v4-hmwv-f43h | Medium | 0.3% | 03 Apr, 2026 | npm openclaw |
Electron: Service worker can spoof executeJavaScript IPC replies CVE-2026-34778, GHSA-xj5x-m3f3-5x3h | Medium | 0.1% | 03 Apr, 2026 | npm electron |
Electron: Incorrect origin passed to permission request handler for iframe requests CVE-2026-34777, GHSA-r5p7-gp4j-qhrx | Medium | 0.1% | 03 Apr, 2026 | npm electron |
Electron: Out-of-bounds read in second-instance IPC on macOS and Linux CVE-2026-34776, GHSA-3c8v-cfp5-9885 | Medium | 0.2% | 03 Apr, 2026 | npm electron |
Electron: HTTP Response Header Injection in custom protocol handlers and webRequest CVE-2026-34767, GHSA-4p4r-m79c-wq3v | Medium | 0.2% | 03 Apr, 2026 | npm electron |
Electron: USB device selection not validated against filtered device list CVE-2026-34766, GHSA-9899-m83m-qhpj | Medium | 0.2% | 03 Apr, 2026 | npm electron |
OpenClaw: Security Scan Failure Does Not Block Plugin Installation (Fail-Open) CVE-2026-41377, GHSA-cwq8-6f96-g3q4 | Medium | 0.2% | 02 Apr, 2026 | npm openclaw |
OpenClaw: SSRF via Unguarded `fetch()` in Marketplace Plugin Download and Ollama Model Discovery CVE-2026-41302, GHSA-9q7v-8mr7-g23p | Medium | 0.2% | 02 Apr, 2026 | npm openclaw |
OpenClaw: SSH-based sandbox backends pass unsanitized process.env to child processes CVE-2026-41357, GHSA-j9pv-rrcj-6pfx | Medium | 0.2% | 02 Apr, 2026 | npm openclaw |
OpenClaw: MSTeams thread history bypasses sender allowlist via Graph API CVE-2026-41365, GHSA-chfm-xgc4-47rj | Medium | 0.2% | 02 Apr, 2026 | npm openclaw |
OpenClaw: LINE webhook handler lacks shared pre-auth concurrency budget before signature verification CVE-2026-41343, GHSA-qcc3-jqwp-5vh2 | Medium | 0.5% | 02 Apr, 2026 | npm openclaw |
OpenClaw: Feishu thread history and quoted messages bypass sender allowlist CVE-2026-41406, GHSA-877v-w3f5-3pcq | Medium | 0.2% | 02 Apr, 2026 | npm openclaw |
OpenClaw: Voice-call Plivo replay mutates in-process callback origin before replay rejection CVE-2026-41337, GHSA-89r3-6x4j-v7wf | Medium | 0.2% | 02 Apr, 2026 | npm openclaw |
OpenClaw's complex interpreter pipelines could skip exec script preflight validation CVE-2026-34425, GHSA-fvx6-pj3r-5q4q | Medium | 0.3% | 02 Apr, 2026 | npm openclaw |
Signal K Server: OAuth Authorization Code Theft via Unvalidated Host Header in OIDC Flow CVE-2026-34083, GHSA-cxj8-ggf2-p57c | Medium | 0.1% | 02 Apr, 2026 | npm signalk-server |
Signal K Server: Unauthenticated Source Priorities Manipulation CVE-2026-33951, GHSA-gfmv-vh34-h2x5 | Medium | 0.3% | 02 Apr, 2026 | npm signalk-server |
phpMyFAQ: SVG Sanitizer Bypass via HTML Entity Encoding Leads to Stored XSS and Privilege Escalation CVE-2026-34974, GHSA-5crx-pfhq-4hgg | Medium | 0.2% | 01 Apr, 2026 | Packagist thorsten/phpmyfaq |
phpMyFAQ has a LIKE Wildcard Injection in Search.php — Unescaped % and _ Metacharacters Enable Broad Content Disclosure CVE-2026-34973, GHSA-gcp9-5jc8-976x | Medium | 0.3% | 01 Apr, 2026 | Packagist thorsten/phpmyfaq |
AVideo has Stored XSS via Unescaped Menu Item Fields in TopMenu Plugin CVE-2026-56347, GHSA-gmpc-fxg2-vcmq | Medium | 0.2% | 01 Apr, 2026 | Packagist wwbn/avideo |
Copier `_external_data` allows path traversal and absolute-path local file read without unsafe mode CVE-2026-34730, GHSA-hgjq-p8cr-gg4h, PYSEC-2026-2135 | Medium | 0.3% | 01 Apr, 2026 | PyPI copier |
phpMyFAQ: Stored XSS via Regex Bypass in Filter::removeAttributes() CVE-2026-34729, GHSA-cv2g-8cj8-vgc7 | Medium | 0.3% | 01 Apr, 2026 | Packagist phpmyfaq/phpmyfaq |
Copier `_subdirectory` allows template root escape via parent-directory traversal CVE-2026-34726, GHSA-85v3-4m8g-hrh6, PYSEC-2026-2134 | Medium | 0.4% | 01 Apr, 2026 | PyPI copier |
StableLib Ed25519 Signature Malleability via Missing S < L Check GHSA-x3ff-w252-2g7j | Medium | Not scored | 01 Apr, 2026 | npm @stablelib/ed25519 |
SillyTavern: Incomplete IP validation in /api/search/visit allows SSRF via localhost and IPv6 CVE-2026-34526, GHSA-wm7j-m6jm-8797 | Medium | 0.2% | 01 Apr, 2026 | npm sillytavern |
SillyTavern: Path Traversal allows file existence oracle CVE-2026-34523, GHSA-525j-2hrj-m8fp | Medium | 0.5% | 01 Apr, 2026 | npm sillytavern |
AIOHTTP accepts duplicate Host headers CVE-2026-34525, GHSA-c427-h43c-vf67, PYSEC-2026-2103 | Medium | 0.3% | 01 Apr, 2026 | PyPI aiohttp |
AIOHTTP has a Multipart Header Size Bypass CVE-2026-34516, GHSA-m5qp-6w8w-w647, PYSEC-2026-2098 | Medium | 0.5% | 01 Apr, 2026 | PyPI aiohttp |
AIOHTTP affected by UNC SSRF/NTLMv2 Credential Theft/Local File Read in static resource handler on Windows CVE-2026-34515, GHSA-p998-jp59-783m, PYSEC-2026-2097 | Medium | 0.4% | 01 Apr, 2026 | PyPI aiohttp |
poetry-plugin-tweak-dependencies-version affected by CVE-2026-25645 GHSA-5qvp-pr9f-2g2v | Medium | Not scored | 01 Apr, 2026 | PyPI poetry-plugin-tweak-dependencies-version |
c2cciutils affected by CVE-2022-40896 GHSA-qc22-xmq4-qg46 | Medium | Not scored | 01 Apr, 2026 | PyPI c2cciutils |
Payload has Insufficient Filename Validation in Client-Upload Signed-URL Endpoints CVE-2026-34750, GHSA-frq9-7j6g-v74x | Medium | 0.4% | 01 Apr, 2026 | npm @payloadcms/storage-azure npm @payloadcms/storage-gcs npm @payloadcms/storage-r2 npm @payloadcms/storage-s3 |
Payload has a CSRF Protection Bypass in Authentication Flow CVE-2026-34749, GHSA-p6mr-xf3r-ghq4 | Medium | 0.1% | 01 Apr, 2026 | npm payload |
aiohttp allows unlimited trailer headers, leading to possible uncapped memory usage CVE-2026-22815, GHSA-w2fm-2cpv-w7v5, PYSEC-2026-2094 | Medium | 0.5% | 01 Apr, 2026 | PyPI aiohttp |
ONNX: External Data Symlink Traversal CVE-2026-34447, GHSA-p433-9wv8-28xj, PYSEC-2026-104 | Medium | 0.3% | 01 Apr, 2026 | PyPI onnx |
ONNX: Arbitrary File Read via ExternalData Hardlink Bypass in ONNX load CVE-2026-34446, GHSA-cmw6-hcpp-c6jp, PYSEC-2026-2241 | Medium | 0.2% | 01 Apr, 2026 | PyPI onnx |
Replicator deserializes untrusted user input CVE-2026-2265, GHSA-2gmp-34j9-fqjm | Medium | 0.4% | 01 Apr, 2026 | npm replicator |
YesWiki has Multiple Reflected Cross-site Scripting Vulnerabilities CVE-2026-104473, GHSA-5724-x3rh-5qqq | Medium | 0.2% | 01 Apr, 2026 | Packagist yeswiki/yeswiki |