Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
OpenClaw SSRF guard misses four IPv6 special-use ranges CVE-2026-41361, GHSA-g86v-f9qv-rh6m | Medium | 0.2% | 31 Mar, 2026 | npm openclaw |
OpenClaw's Discord component interaction ingress skips guild/channel policy enforcement CVE-2026-41367, GHSA-jp4j-q5fc-58gv | Medium | 0.2% | 31 Mar, 2026 | npm openclaw |
OpenClaw: Gateway `operator.write` can reach admin-only persisted `verboseLevel` via `chat.send` `/verbose` CVE-2026-41344, GHSA-5h2w-qmfp-ggp6 | Medium | 0.2% | 31 Mar, 2026 | npm openclaw |
OpenClaw host-env blocklist missing `GIT_TEMPLATE_DIR` and `AWS_CONFIG_FILE` allows code execution via env override CVE-2026-41332, GHSA-m866-6qv5-p2fg | Medium | 0.1% | 31 Mar, 2026 | npm openclaw |
OpenClaw: Feishu extension resolveUploadInput bypasses file-system sandbox and allows arbitrary file reads via upload_image CVE-2026-41363, GHSA-qf48-qfv4-jjm9 | Medium | 0.3% | 31 Mar, 2026 | npm openclaw |
Nuxt OG Image vulnerable to Server-Side Request Forgery via user-controlled parameters GHSA-pqhr-mp3f-hrpp | Medium | Not scored | 31 Mar, 2026 | npm nuxt-og-image |
phpMyFAQ is Vulnerable to Stored XSS via Unsanitized Email Field in Admin FAQ Editor CVE-2026-32629, GHSA-98gw-w575-h2ph | Medium | 0.3% | 31 Mar, 2026 | Packagist phpmyfaq/phpmyfaq Packagist thorsten/phpmyfaq |
Claude SDK for Python: Memory Tool Path Validation Race Condition Allows Sandbox Escape CVE-2026-34452, GHSA-w828-4qhx-vxx3, PYSEC-2026-2115 | Medium | 0.1% | 31 Mar, 2026 | PyPI anthropic |
Claude SDK for TypeScript: Memory Tool Path Validation Allows Sandbox Escape to Sibling Directories CVE-2026-34451, GHSA-5474-4w2j-mq4c | Medium | 0.4% | 31 Mar, 2026 | npm @anthropic-ai/sdk |
Claude SDK for Python has Insecure Default File Permissions in Local Filesystem Memory Tool CVE-2026-34450, GHSA-q5f5-3gjm-7mfm, PYSEC-2026-2114 | Medium | 0.1% | 31 Mar, 2026 | PyPI anthropic |
Nuxt OG Image is vulnerable to reflected XSS via query parameter injection into HTML attributes CVE-2026-34405, GHSA-mg36-wvcr-m75h | Medium | 0.2% | 31 Mar, 2026 | npm nuxt-og-image |
Nuxt OG Image is vulnerable to Denial of Service via unbounded image dimensions CVE-2026-34404, GHSA-c7xp-q6q8-hg76 | Medium | 0.3% | 31 Mar, 2026 | npm nuxt-og-image |
alerta-server has potential SQL Injection vulnerability in Query String Syntax (q=) API CVE-2026-34400, GHSA-8prr-286p-4w7j, PYSEC-2026-2341 | Medium | 0.5% | 31 Mar, 2026 | PyPI alerta-server |
AVideo: Stored SSRF via Video EPG Link Missing isSSRFSafeURL() Validation CVE-2026-34740, GHSA-x5vx-vrpf-r45f | Medium | 0.3% | 31 Mar, 2026 | Packagist wwbn/avideo |
AVideo: Reflected XSS via Unescaped ip Parameter in User_Location testIP.php CVE-2026-34739, GHSA-jqrj-chh6-8h78 | Medium | 0.2% | 31 Mar, 2026 | Packagist wwbn/avideo |
AVideo: Video Publishing Workflow Bypass via Unauthorized overrideStatus Request Parameter CVE-2026-34738, GHSA-m577-w9j8-ch7j | Medium | 0.2% | 31 Mar, 2026 | Packagist wwbn/avideo |
AVideo: Arbitrary Stripe Subscription Cancellation via Debug Endpoint and retrieveSubscriptions() Bug CVE-2026-34737, GHSA-38rh-4v39-vfxv | Medium | 0.3% | 31 Mar, 2026 | Packagist wwbn/avideo |
AVideo: DOM XSS via Unsanitized Display Name in WebSocket Call Notification CVE-2026-34716, GHSA-w4hp-w536-jg64 | Medium | 0.3% | 31 Mar, 2026 | Packagist wwbn/avideo |
AVideo: CSRF on Plugin Enable/Disable Endpoint Allows Disabling Security Plugins CVE-2026-34613, GHSA-hqxf-mhfw-rc44 | Medium | 0.2% | 31 Mar, 2026 | Packagist wwbn/avideo |
AVideo: CSRF on emailAllUsers.json.php Enables Mass Phishing Email to All Users CVE-2026-34611, GHSA-c4xj-x7p8-3x7q | Medium | 0.2% | 31 Mar, 2026 | Packagist wwbn/avideo |
AVideo has Stored XSS via Unescaped Plugin Configuration Values in Admin Panel CVE-2026-34396, GHSA-v4h7-3x43-qqw4 | Medium | 0.2% | 31 Mar, 2026 | Packagist wwbn/avideo |
AVideo vulnerable to Mass User PII Disclosure via Missing Authorization in YPTWallet users.json.php CVE-2026-34395, GHSA-77jp-mgcw-rfmr | Medium | 0.3% | 31 Mar, 2026 | Packagist wwbn/avideo |
Admidio has CSRF and Form Validation Bypass in Inventory Item Save via `imported` Parameter CVE-2026-34383, GHSA-4rwm-c5mj-wh7x | Medium | 0.1% | 31 Mar, 2026 | Packagist admidio/admidio |
Admidio has Missing CSRF Protections on Custom List Deletion in mylist_function.php CVE-2026-34382, GHSA-g3mx-8jm6-rc85 | Medium | 0.1% | 31 Mar, 2026 | Packagist admidio/admidio |
Nautobot: Management of users via REST API does not apply configured password validators CVE-2026-34203, GHSA-xmpv-j7p2-j873, PYSEC-2026-2224 | Medium | 0.3% | 31 Mar, 2026 | PyPI nautobot |
lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit` CVE-2026-2950, GHSA-f23m-r3pf-42rh | Medium | 0.3% | 31 Mar, 2026 | npm lodash npm lodash-amd npm lodash-es npm lodash.unset |
Parse Server has a LiveQuery protected-field guard bypass via array-like logical operator value BIT-parse-2026-34595, CVE-2026-34595, GHSA-mmg8-87c5-jrc2 | Medium | 0.3% | 31 Mar, 2026 | npm parse-server |
Parse Server has a session field immutability bypass via falsy-value guard BIT-parse-2026-34574, CVE-2026-34574, GHSA-f6j3-w9v3-cq22 | Medium | 0.2% | 31 Mar, 2026 | npm parse-server |
OpenClaw affected by SSRF via unguarded image download in fal provider CVE-2026-34504, GHSA-qxgf-hmcj-3xw3 | Medium | 0.2% | 31 Mar, 2026 | npm openclaw |
OpenClaw's Nextcloud Talk webhook missing rate limiting on shared secret authentication CVE-2026-33580, GHSA-9528-x887-j2fp | Medium | 0.4% | 31 Mar, 2026 | npm openclaw |
OpenClaw: Google Chat and Zalouser group sender allowlist bypass via policy downgrade CVE-2026-33578, GHSA-63mg-xp9j-jfcm | Medium | 0.3% | 31 Mar, 2026 | npm openclaw |
OpenClaw: Zalo channel downloads media before sender authorization CVE-2026-33576, GHSA-v2v2-f783-358j | Medium | 0.4% | 31 Mar, 2026 | npm openclaw |
OpenStack Glance is affected by Server-Side Request Forgery (SSRF) CVE-2026-34881, GHSA-mc26-q38v-83gv, PYSEC-2026-2492 | Medium | 0.3% | 31 Mar, 2026 | PyPI glance |
baserCMS has a cross-site scripting vulnerability in blog posts CVE-2026-30879, GHSA-jmq3-x8q7-j9qm | Medium | 0.2% | 31 Mar, 2026 | Packagist baserproject/basercms |
baserCMS has Mail Form Acceptance Bypass via Public API CVE-2026-30878, GHSA-8cr7-r8qw-gp3c | Medium | 0.4% | 31 Mar, 2026 | Packagist baserproject/basercms |
baserCMS has an SQL injection vulnerability in its blog post functionality CVE-2026-27697, GHSA-vh89-rjph-2g7p | Medium | 0.4% | 31 Mar, 2026 | Packagist baserproject/basercms |
Apache Airflow Provider for Databricks: TLS Certificate Verification is Disabled in Databricks Provider K8s Token Exchange CVE-2026-32794, GHSA-wrpj-755p-x363, PYSEC-2026-2357 | Medium | 0.4% | 30 Mar, 2026 | PyPI apache-airflow |
OpenClaw: Non-owner command-authorized sender can change the owner-only `/send` session delivery policy CVE-2026-35620, GHSA-39mp-545q-w789 | Medium | 0.4% | 30 Mar, 2026 | npm openclaw |
OpenClaw: Mutating internal `/allowlist` chat commands missed `operator.admin` scope enforcement GHSA-vqvg-86cc-cg83 | Medium | Not scored | 30 Mar, 2026 | npm openclaw |
OpenClaw has a Gateway HTTP /v1/models Route Bypasses Operator Read Scope CVE-2026-35619, GHSA-68f8-9mhj-h2mp | Medium | 0.3% | 30 Mar, 2026 | npm openclaw |
OpenClaw has incomplete Fix for CVE-2026-32011: Feishu Webhook Pre-Auth Body Parsing DoS (Slow-Body / Slowloris Variant) CVE-2026-35665, GHSA-w6m8-cqvj-pg5v | Medium | 0.3% | 30 Mar, 2026 | npm openclaw |
OpenClaw has incomplete Fix for CVE-2026-27486: Unvalidated SIGKILL in `!stop` Chat Command via `shell-utils.ts` CVE-2026-35667, GHSA-3298-56p6-rpw2 | Medium | 0.1% | 30 Mar, 2026 | npm openclaw |
GraphQL API endpoint ignores CORS origin restriction BIT-parse-2026-34373, CVE-2026-34373, GHSA-q3p6-g7c4-829c | Medium | 0.2% | 30 Mar, 2026 | npm parse-server |
Sulu checks fix permissions for subentities endpoints CVE-2026-34372, GHSA-6h7h-m7p5-hjqp | Medium | 0.3% | 30 Mar, 2026 | Packagist sulu/sulu |
Slippers Vulnerable to Cross-Site Scripting (XSS) in `attrs` Template Tag CVE-2026-34231, GHSA-w7rv-gfp4-j9j3, PYSEC-2026-2279 | Medium | 0.2% | 30 Mar, 2026 | PyPI slippers |
OpenClaw has ACP CLI approval prompt ANSI escape sequence injection CVE-2026-35651, GHSA-4hmj-39m8-jwc7 | Medium | 0.3% | 29 Mar, 2026 | npm openclaw |
OpenClaw: Telegram DM-Scoped Inline Button Callbacks Bypass DM Pairing and Mutate Session State CVE-2026-35661, GHSA-j4c9-w69r-cw33 | Medium | 0.3% | 29 Mar, 2026 | npm openclaw |
OpenClaw: Synology Chat Webhook Pre-Auth Rate-Limit Bypass Enables Brute-Force Guessing of Webhook Token CVE-2026-35646, GHSA-mf5g-6r6f-ghhm | Medium | 0.2% | 29 Mar, 2026 | npm openclaw |
OpenClaw: MS Teams Feedback Invocation Bypasses Sender Allowlists and Records Unauthorized Session Feedback CVE-2026-35654, GHSA-rf6h-5gpw-qrgq | Medium | 0.2% | 29 Mar, 2026 | npm openclaw |
OpenClaw: Gateway Plugin Subagent Fallback `deleteSession` Uses Synthetic `operator.admin` CVE-2026-35645, GHSA-h4jx-hjr3-fhgc | Medium | 0.3% | 29 Mar, 2026 | npm openclaw |