Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
OpenClaw: Feishu Raw Card Send Surface Can Mint Legacy Card Callbacks That Bypass DM Pairing CVE-2026-35664, GHSA-77w2-crqv-cmv3 | Medium | 0.3% | 29 Mar, 2026 | npm openclaw |
OpenClaw: Feishu webhook reads and parses unauthenticated request bodies before signature validation CVE-2026-35640, GHSA-3h52-cx59-c456 | Medium | 0.4% | 29 Mar, 2026 | npm openclaw |
OpenCC has an Out-of-bounds read when processing truncated UTF-8 input GHSA-7fqq-q52p-2jjg | Medium | Not scored | 29 Mar, 2026 | PyPI OpenCC PyPI opencc npm opencc |
Handlebars.js has a Prototype Method Access Control Gap via Missing __lookupSetter__ Blocklist Entry GHSA-7rx3-28cr-v5wh | Medium | Not scored | 29 Mar, 2026 | npm handlebars |
mppx has Stripe charge credential replay via missing idempotency check CVE-2026-34210, GHSA-8mhj-rffc-rcvw | Medium | 0.5% | 29 Mar, 2026 | npm mppx |
OpenClaw: Telegram Webhook Missing Guess Rate Limiting Enables Brute-Force Guessing of Weak Webhook Secret CVE-2026-35628, GHSA-vcx4-4qxg-mfp4 | Medium | 0.3% | 27 Mar, 2026 | npm openclaw |
OpenClaw: BlueBubbles Group Reactions Bypass requireMention and Still Enqueue Agent-Visible System Events CVE-2026-35642, GHSA-mw7w-g3mg-xqm7 | Medium | 0.2% | 27 Mar, 2026 | npm openclaw |
OpenClaw: Matrix Verification Notices Bypass Matrix DM Policy and Reply to Unpaired DM Peers CVE-2026-35647, GHSA-9wqx-g2cw-vc7r | Medium | 0.3% | 27 Mar, 2026 | npm openclaw |
OpenClaw: BlueBubbles Webhook Missing Rate Limiting Enables Brute-Force Password Guessing CVE-2026-35623, GHSA-xq8g-hgh6-87hv | Medium | 0.4% | 27 Mar, 2026 | npm openclaw |
DOMPurify is vulnerable to mutation-XSS via Re-Contextualization CVE-2026-65914, GHSA-h8r8-wccr-v5f2 | Medium | 0.3% | 27 Mar, 2026 | npm dompurify |
AVideo has Video Password Protection Bypass via API Endpoints Returning Full Playback Sources Without Password Verification CVE-2026-34369, GHSA-q6jj-r49p-94fh | Medium | 0.4% | 27 Mar, 2026 | Packagist wwbn/avideo |
AVideo Vulnerable to Wallet Balance Double-Spend via TOCTOU Race Condition in transferBalance CVE-2026-34368, GHSA-h54m-c522-h6qr | Medium | 0.2% | 27 Mar, 2026 | Packagist wwbn/avideo |
AVideo has User Group-Based Category Access Control Bypass via Missing and Broken Group Filtering in categories.json.php CVE-2026-34364, GHSA-73gr-r64q-7jh4 | Medium | 0.3% | 27 Mar, 2026 | Packagist wwbn/avideo |
n8n has XSS in its Credential Management Flow CVE-2026-56359, GHSA-364x-8g5j-x2pr | Medium | 0.2% | 27 Mar, 2026 | npm n8n |
n8n has XSS in Chat Trigger Node through Custom CSS CVE-2026-56356, GHSA-3c7f-5hgj-h279 | Medium | 0.3% | 27 Mar, 2026 | npm n8n |
n8n: Authenticated XSS and Open Redirect via Form Node CVE-2026-56354, GHSA-w673-8fjw-457c | Medium | 0.2% | 27 Mar, 2026 | npm n8n |
n8n has a Stored XSS Vulnerability in its Form Trigger CVE-2026-56358, GHSA-q4fm-pjq6-m63g | Medium | 0.2% | 27 Mar, 2026 | npm n8n |
Dolibarr Core Discloses Sensitive Data via Authenticated Local File Inclusion in selectobject.php CVE-2026-34036, GHSA-2mfj-r695-5h9r | Medium | 1.5% | 27 Mar, 2026 | Packagist dolibarr/dolibarr |
Locutus Prototype Pollution due to incomplete fix for CVE-2026-25521 CVE-2026-33994, GHSA-vc8f-x9pp-wf5p | Medium | 0.6% | 27 Mar, 2026 | npm locutus |
Locutus has Prototype Pollution via __proto__ Key Injection in unserialize() CVE-2026-33993, GHSA-4mph-v827-f877 | Medium | 0.6% | 27 Mar, 2026 | npm locutus |
AVideo's WebSocket Token Never Expires Due to Commented-Out Timeout Validation in verifyTokenSocket() CVE-2026-34362, GHSA-2mg4-pfgx-64cf | Medium | 0.3% | 27 Mar, 2026 | Packagist wwbn/avideo |
AVideo: IDOR in uploadPoster.php Allows Any Authenticated User to Overwrite Scheduled Live Stream Posters and Trigger False Socket Notifications CVE-2026-34247, GHSA-g3hj-mf85-679g | Medium | 0.2% | 27 Mar, 2026 | Packagist wwbn/avideo |
AVideo: Missing Authorization in Playlist Schedule Creation Allows Cross-User Broadcast Hijacking CVE-2026-34245, GHSA-2rm7-j397-3fqg | Medium | 0.3% | 27 Mar, 2026 | Packagist wwbn/avideo |
python-ecdsa: Denial of Service via improper DER length validation in crafted private keys CVE-2026-33936, GHSA-9f5j-8jwj-x28g, PYSEC-2026-2467 | Medium | 0.5% | 27 Mar, 2026 | PyPI ecdsa |
Open WebUI's Insecure Direct Object Reference (IDOR) allows access to other users' memories CVE-2026-29071, GHSA-w9f8-gxf9-rhvw, PYSEC-2026-2765 | Medium | 0.3% | 27 Mar, 2026 | PyPI open-webui |
Open WebUI vulnerable to Path Traversal in `POST /api/v1/audio/transcriptions` CVE-2026-28786, GHSA-vvxm-vxmr-624h, PYSEC-2026-2764 | Medium | 0.6% | 27 Mar, 2026 | PyPI open-webui |
Handlebars.js has Prototype Pollution Leading to XSS through Partial Template Injection CVE-2026-33916, GHSA-2qvq-rjwj-gvw9 | Medium | 0.3% | 26 Mar, 2026 | npm handlebars |
Apollo Server: Browser bug allows for bypass of XS-Search (read-only Cross-Site Request Forgery) prevention GHSA-9q82-xgwf-vj6h | Medium | Not scored | 26 Mar, 2026 | npm @apollo/server npm apollo-server-core |
OpenClaw: Symlink Traversal via IDENTITY.md appendFile in agents.create/update (Incomplete Fix for CVE-2026-32013) CVE-2026-35632, GHSA-7xr2-q9vf-x4r5 | Medium | 0.4% | 26 Mar, 2026 | npm openclaw |
OpenClaw: Image Tool `tools.fs.workspaceOnly` Bypass via Sandbox Bridge Mounts CVE-2026-35658, GHSA-cfp9-w5v9-3q4h | Medium | 0.3% | 26 Mar, 2026 | npm openclaw |
OpenClaw's Conflicting Tool Identity Hints Bypass Dangerous-Tool Prompting CVE-2026-35655, GHSA-74wf-h43j-vvmj | Medium | 0.2% | 26 Mar, 2026 | npm openclaw |
OpenClaw Bypasses DM Policy Separation via Synology Chat Webhook Path Collision CVE-2026-35635, GHSA-rqp8-q22p-5j9q | Medium | 0.2% | 26 Mar, 2026 | npm openclaw |
OpenClaw leaf subagents can bypass controlScope restrictions to send messages to child sessions CVE-2026-35662, GHSA-x2cm-hg9c-mf5w | Medium | 0.2% | 26 Mar, 2026 | npm openclaw |
OpenClaw: Forwarding header spoofing bypasses gateway.trustedProxies origin detection CVE-2026-35656, GHSA-844j-xrrq-wgh4 | Medium | 0.3% | 26 Mar, 2026 | npm openclaw |
OpenClaw: Google Chat app-url webhook auth accepted non-deployment add-on principals CVE-2026-35622, GHSA-mp66-rf4f-mhh8 | Medium | 0.3% | 26 Mar, 2026 | npm openclaw |
OpenClaw: Tlon settings empty-allowlist reconciliation bypassed intended revocation CVE-2026-35649, GHSA-pw7h-9g6p-c378 | Medium | 0.3% | 26 Mar, 2026 | npm openclaw |
OpenClaw: Tlon cite expansion happens before channel and DM authorization is complete CVE-2026-35637, GHSA-vfg3-pqpq-93m4 | Medium | 0.2% | 26 Mar, 2026 | npm openclaw |
OpenClaw: Mattermost callback dispatch allowed non-allowlisted sender actions CVE-2026-35652, GHSA-8883-9w57-vwv6 | Medium | 0.4% | 26 Mar, 2026 | npm openclaw |
TSPortal's Uncontrolled User Creation via Validation Side Effects Leads to Potential Denial of Service CVE-2026-33541, GHSA-f346-8rp3-4h9h | Medium | 0.3% | 26 Mar, 2026 | Packagist miraheze/ts-portal |
OpenClaw is vulnerable to unauthenticated resource exhaustion through its voice call webhook handling CVE-2026-35626, GHSA-rm59-992w-x2mv | Medium | 0.5% | 26 Mar, 2026 | npm openclaw |
OpenClaw: Bonjour/DNS-SD TXT metadata steers CLI routing after failed service resolution CVE-2026-35659, GHSA-rvqr-hrcc-j9vv | Medium | 0.1% | 26 Mar, 2026 | npm openclaw |
path-to-regexp vulnerable to Regular Expression Denial of Service via multiple wildcards CVE-2026-4923, GHSA-27v5-c462-wpq7 | Medium | 0.4% | 26 Mar, 2026 | npm path-to-regexp |
OpenClaw: Synology Chat reply delivery could be rebound through username-based user resolution. CVE-2026-35670, GHSA-wv46-v6xc-2qhf | Medium | 0.2% | 26 Mar, 2026 | npm openclaw |
OpenClaw: Windows media loaders accepted remote-host file URLs before local path validation CVE-2026-34426, CVE-2026-34510, GHSA-98ch-45wp-ch47, GHSA-h3x4-hc5v-v2gm | Medium | 0.3% | 26 Mar, 2026 | npm openclaw |
Statamic allows unauthorized content access through missing authorization in its revision controllers CVE-2026-33887, GHSA-4hp7-3wxg-cv9q | Medium | 0.1% | 26 Mar, 2026 | Packagist statamic/cms |
Statamic's sensitive configuration values are exposed to content editors via Antlers-enabled fields CVE-2026-33886, GHSA-gcqf-5x9f-hq7f | Medium | 0.2% | 26 Mar, 2026 | Packagist statamic/cms |
Statamic has an Open Redirect on unauthenticated endpoints via URL parsing differential CVE-2026-33885, GHSA-7f74-7q5w-hj4r | Medium | 0.2% | 26 Mar, 2026 | Packagist statamic/cms |
Statamic's live preview token bypasses content protection for unrelated entries CVE-2026-33884, GHSA-8vwx-ccf6-5wg2 | Medium | 0.2% | 26 Mar, 2026 | Packagist statamic/cms |
Statamic has Reflected XSS via unescaped redirect parameter in its password reset form tag CVE-2026-33883, GHSA-3jg4-p23x-p4qx | Medium | 0.2% | 26 Mar, 2026 | Packagist statamic/cms |
Statamic's Markdown preview endpoint exposes sensitive user data CVE-2026-33882, GHSA-cvh3-23vq-w7h4 | Medium | 0.3% | 26 Mar, 2026 | Packagist statamic/cms |