Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in @wizloft/harness-cli-adapter (npm) GHSA-hmmw-27v2-3qc8, MAL-2026-16424 | Malicious | Not scored | 23 Sep, 2026 | npm @wizloft/harness-cli-adapter |
Malicious release: Malicious code in @wizloft/harness-project (npm) GHSA-xj44-gx57-mm59, MAL-2026-16432 | Malicious | Not scored | 23 Sep, 2026 | npm @wizloft/harness-project |
Malicious release: Malicious code in @wizloft/harness-memory (npm) GHSA-3mjw-625p-wvhf, MAL-2026-16428 | Malicious | Not scored | 23 Sep, 2026 | npm @wizloft/harness-memory |
Malicious release: Malicious code in @wizloft/harness-plugin-file-memory (npm) GHSA-64w5-qg43-54g7, MAL-2026-16430 | Malicious | Not scored | 23 Sep, 2026 | npm @wizloft/harness-plugin-file-memory |
Malicious release: Malicious code in @wizloft/harness-plugin-file-events (npm) GHSA-6866-wx9h-j2rh, MAL-2026-16429 | Malicious | Not scored | 23 Sep, 2026 | npm @wizloft/harness-plugin-file-events |
Malicious release: Malicious code in @wizloft/harness-authority (npm) GHSA-8h24-fp89-4cw3, MAL-2026-16423 | Malicious | Not scored | 23 Sep, 2026 | npm @wizloft/harness-authority |
Malicious release: Malicious code in @wizloft/harness-evidence (npm) GHSA-mjfj-x5qx-p7v8, MAL-2026-16426 | Malicious | Not scored | 23 Sep, 2026 | npm @wizloft/harness-evidence |
Malicious release: Malicious code in @wizloft/harness-plugin-memory-context (npm) GHSA-r4qq-8p58-gfpv, MAL-2026-16431 | Malicious | Not scored | 23 Sep, 2026 | npm @wizloft/harness-plugin-memory-context |
Malicious release: Malicious code in @httttt/mcp-npx-fetch-1 (npm) GHSA-q6m6-3rfx-7f62, MAL-2026-16422 | Malicious | Not scored | 23 Sep, 2026 | npm @httttt/mcp-npx-fetch-1 |
Malicious release: Malicious code in @memtensor/memos-cloud-openclaw-plugin (npm) GHSA-mhjf-v53x-7p87, MAL-2026-16476 | Malicious | Not scored | 23 Sep, 2026 | npm @memtensor/memos-cloud-openclaw-plugin |
Malicious release: Malicious code in memoryos (PyPI) MAL-2026-16475, PYSEC-2026-3987 | Malicious | Not scored | 23 Sep, 2026 | PyPI memoryos |
Malicious release: Malicious code in kerokwis (PyPI) MAL-2026-16421 | Malicious | Not scored | 22 Sep, 2026 | PyPI kerokwis |
ReactPress has SQL injection via dynamic column names in TypeORM query builders CVE-2026-61685, GHSA-wmw4-mw6x-6vfm | High | 0.5% | 22 Sep, 2026 | npm @fecommunity/reactpress |
plone.app.dexterity has a Denial of Service due to excessive title or description length CVE-2026-57576, GHSA-5426-92w4-wvhv, PYSEC-2026-4137 | Medium | 0.8% | 22 Sep, 2026 | PyPI plone-app-dexterity PyPI plone.app.dexterity |
Malicious release: Malicious code in @gsutevil/hta-stage (npm) MAL-2026-16419 | Malicious | Not scored | 22 Sep, 2026 | npm @gsutevil/hta-stage |
Malicious release: Malicious code in n8n-nodes-data-transformer-utils (npm) MAL-2026-16418 | Malicious | Not scored | 22 Sep, 2026 | npm n8n-nodes-data-transformer-utils |
Malicious release: Malicious code in @tvg-mar/promos-context (npm) GHSA-f42w-v662-25cr, MAL-2026-16412 | Malicious | Not scored | 22 Sep, 2026 | npm @tvg-mar/promos-context |
Malicious release: Malicious code in @tvg-mar/promos-gtm (npm) GHSA-8g69-976g-h44g, MAL-2026-16413 | Malicious | Not scored | 22 Sep, 2026 | npm @tvg-mar/promos-gtm |
Malicious release: Malicious code in @tvg-mar/storyblok-bridge (npm) GHSA-3wxx-x983-53mg, MAL-2026-16414 | Malicious | Not scored | 22 Sep, 2026 | npm @tvg-mar/storyblok-bridge |
Malicious release: Malicious code in @tvg-mar/utils (npm) GHSA-p6w4-mmhj-wc4v, MAL-2026-16416 | Malicious | Not scored | 22 Sep, 2026 | npm @tvg-mar/utils |
Malicious release: Malicious code in @tvg-mar/tvg-promos-atomic-ui (npm) GHSA-gj3c-r86r-hr43, MAL-2026-16415 | Malicious | Not scored | 22 Sep, 2026 | npm @tvg-mar/tvg-promos-atomic-ui |
Malicious release: Malicious code in auclean (PyPI) MAL-2026-16410 | Malicious | Not scored | 22 Sep, 2026 | PyPI auclean |
Unleash: Missing await on permission check + cross-project IDOR in admin API CVE-2026-77426, GHSA-72h8-wp98-7hch | High | 0.5% | 22 Sep, 2026 | npm unleash-server |
Unleash: A project member can reorder activation strategies belonging to any other project / environment (cross-project integrity write), bypassing project RBAC and the audit log CVE-2026-77425, GHSA-5ffh-6f9q-5hhr | Medium | 0.3% | 22 Sep, 2026 | npm unleash-server |
Unleash: Clone-feature lets a user copy a feature from a project they cannot read CVE-2026-76910, GHSA-8xcj-9hfr-fh9j | Medium | 0.4% | 22 Sep, 2026 | npm unleash-server |
Unleash: CR-approval email renders user-controlled raw HTML CVE-2026-76909, GHSA-7hvx-28gp-mf6j | Low | 0.5% | 22 Sep, 2026 | npm unleash-server |
wlc may disclose API tokens to project-configured URLs CVE-2026-62364, GHSA-3mqq-hv9c-85hc, PYSEC-2026-4180 | Low | 0.1% | 22 Sep, 2026 | PyPI wlc |
Nautobot: Authorization bypass in approval workflow REST API allows self-approval and unauthorized activation of scheduled jobs CVE-2026-83805, GHSA-q4c5-2j6f-r476, PYSEC-2026-4111 | Medium | 0.3% | 22 Sep, 2026 | PyPI nautobot |
Nautobot: Stored cross-site scripting (XSS) in object create/edit form help text CVE-2026-83801, GHSA-56v6-2fhr-wxgq, PYSEC-2026-4110 | Medium | 0.3% | 22 Sep, 2026 | PyPI nautobot |
MPXJ: Potential Path Traversal Vulnerability in Primavera P3 PRX and SureTrak STX readers CVE-2026-65829, GHSA-7952-gx68-cjqr, PYSEC-2026-4108 | Medium | 0.4% | 22 Sep, 2026 | Maven net.sf.mpxj:mpxj NuGet MPXJ.Net NuGet net.sf.mpxj NuGet net.sf.mpxj-for-csharp +3 more |
mppx: Gas Draining with access list CVE-2026-63628, GHSA-vc9j-9wph-qghj | Medium | 0.5% | 22 Sep, 2026 | npm mppx |
mppx: Gas Draining with padding CVE-2026-63627, GHSA-727h-3vm5-qwq6 | Medium | 0.5% | 22 Sep, 2026 | npm mppx |
MPXJ: XXE Vulnerability in MerlinReader CVE-2026-61570, GHSA-5vvx-3h34-f3gj, PYSEC-2026-4107 | High | 0.5% | 22 Sep, 2026 | Maven net.sf.mpxj:mpxj NuGet MPXJ.Net NuGet net.sf.mpxj NuGet net.sf.mpxj-for-csharp +3 more |
request-filtering-agent: Synchronous throw from createConnection() for literal private-IP hosts bypasses req.on('error'), crashing the Node.js process CVE-2026-62985, GHSA-r3r9-wp5j-pq5g | High | 0.6% | 22 Sep, 2026 | npm request-filtering-agent |
Malicious release: Malicious code in ubiquiti-agents-link-mcp (npm) GHSA-rqpx-hw2h-g3hc, MAL-2026-16409 | Malicious | Not scored | 22 Sep, 2026 | npm ubiquiti-agents-link-mcp |
psd-tools composite/numpy has uncontrolled memory allocation via crafted PSD geometry CVE-2026-59991, GHSA-8q6g-vjhf-jp8m, PYSEC-2026-4139 | High | 0.5% | 22 Sep, 2026 | PyPI psd-tools |
Home Assistant: XSS in Statistics Graph Card CVE-2026-91130, GHSA-wx4m-69m9-gx3m, PYSEC-2026-4052 | Critical | 0.5% | 22 Sep, 2026 | PyPI homeassistant |
Home Assistant: mDNS Server-Side Request Forgery CVE-2026-91129, GHSA-4ghv-53cq-7wp3, PYSEC-2026-4051 | Medium | 0.3% | 22 Sep, 2026 | PyPI homeassistant |
MCP Atlassian: Reflected XSS in OAuth Setup Callback Handler CVE-2026-77272, GHSA-g2r2-3j32-j27x, PYSEC-2026-4093 | Medium | 0.3% | 22 Sep, 2026 | PyPI mcp-atlassian |
MCP Atlassian: Path traversal in upload_attachment allows arbitrary file read (incomplete fix for CVE-2026-27825) CVE-2026-77269, GHSA-h7wj-5v37-59r2, PYSEC-2026-4095 | Medium | 0.4% | 22 Sep, 2026 | PyPI mcp-atlassian |
MCP Atlassian: Insecure File Permissions on OAuth Token Storage CVE-2026-77268, GHSA-4596-2p6p-28cv, PYSEC-2026-4082 | Medium | 0.2% | 22 Sep, 2026 | PyPI mcp-atlassian |
MCP Atlassian: Path traversal in upload_attachment allows arbitrary file read and exfiltration via MCP tool call CVE-2026-77266, GHSA-mfv2-4wvm-9pgp, PYSEC-2026-4097 | Medium | 0.5% | 22 Sep, 2026 | PyPI mcp-atlassian |
MCP Atlassian: Path Traversal / Arbitrary File Read in confluence_upload_attachment MCP tool (incomplete fix of GHSA-xjgw-4wvw-rgm4) CVE-2026-77262, GHSA-p6hp-93wp-fh6p, PYSEC-2026-4099 | High | 0.6% | 22 Sep, 2026 | PyPI mcp-atlassian |
MCP Atlassian: Arbitrary file read via confluence_upload_attachment allows exfiltration of server credentials CVE-2026-77259, GHSA-6cr4-ccf3-x7h4, PYSEC-2026-4086 | High | 0.4% | 22 Sep, 2026 | PyPI mcp-atlassian |
MCP Atlassian: HTTP upload tools accept arbitrary server-local file paths CVE-2026-77257, GHSA-mrq8-fv7v-hhjg, PYSEC-2026-4098 | High | 0.4% | 22 Sep, 2026 | PyPI mcp-atlassian |
MCP Atlassian: Arbitrary File Read & Exfiltration (Confused Deputy) in JIRA update_issue CVE-2026-77255, GHSA-2xj6-xx86-cwwc, PYSEC-2026-4080 | High | 0.5% | 22 Sep, 2026 | PyPI mcp-atlassian |
MCP Atlassian: Jira and Confluence attachment upload tools can read arbitrary server-local files CVE-2026-77253, GHSA-vc25-24vv-fxxm, PYSEC-2026-4101 | High | 0.4% | 22 Sep, 2026 | PyPI mcp-atlassian |
MCP Atlassian: Incomplete fix for GHSA-7r34-79r5-rcc9: redirect-based SSRF via unhooked requests session in Jira user-permission lookup CVE-2026-77249, GHSA-v9m3-wfh8-5646, PYSEC-2026-4100 | Medium | 0.3% | 22 Sep, 2026 | PyPI mcp-atlassian |
MCP Atlassian: Unauthenticated arbitrary local file read via upload_attachment file_path, chained with missing auth on streamable-http transport CVE-2026-77248, GHSA-cc5h-2pwp-pvcc, PYSEC-2026-4089 | High | 0.5% | 22 Sep, 2026 | PyPI mcp-atlassian |
MCP Atlassian: Arbitrary server-local file upload to Jira/Confluence attachments via unrestricted file_path parameters CVE-2026-77247, GHSA-f6pj-qv47-g96w, PYSEC-2026-4092 | High | 0.4% | 22 Sep, 2026 | PyPI mcp-atlassian |