Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
MCP Atlassian: MCP HTTP Client Server-Local File Exfiltration via Unvalidated Attachment Upload Path CVE-2026-77246, GHSA-wv8v-v4c5-v75j, PYSEC-2026-4104 | High | 0.5% | 22 Sep, 2026 | PyPI mcp-atlassian |
plone.app.portlets Vulnerable to Remote Code Execution via TALES Injection CVE-2026-57149, GHSA-rr49-f9g6-c9r5, PYSEC-2026-4138 | Critical | 0.6% | 22 Sep, 2026 | PyPI plone-app-portlets PyPI plone.app.portlets |
Malicious release: Malicious code in snap-queue (PyPI) MAL-2026-16408 | Malicious | Not scored | 22 Sep, 2026 | PyPI snap-queue |
Malicious release: Malicious code in poly-check-b (PyPI) MAL-2026-16407 | Malicious | Not scored | 22 Sep, 2026 | PyPI poly-check-b |
Malicious release: Malicious code in crypto-trader-py (PyPI) MAL-2026-16406 | Malicious | Not scored | 22 Sep, 2026 | PyPI crypto-trader-py |
Malicious release: Malicious code in tailwind-form-styles (npm) GHSA-h48r-xx59-h44r, MAL-2026-16405 | Malicious | Not scored | 22 Sep, 2026 | npm tailwind-form-styles |
Malicious release: Malicious code in node-env-buffer (npm) GHSA-2g29-f3qp-c7gf, MAL-2026-16403 | Malicious | Not scored | 22 Sep, 2026 | npm node-env-buffer |
Malicious release: Malicious code in envforge3 (npm) GHSA-7chm-5cxc-2wx2, MAL-2026-16393 | Malicious | Not scored | 22 Sep, 2026 | npm envforge3 |
Malicious release: Malicious code in envforge2 (npm) GHSA-h8xg-3hfp-rx6q, MAL-2026-16392 | Malicious | Not scored | 22 Sep, 2026 | npm envforge2 |
Malicious release: Malicious code in envparse2 (npm) GHSA-q747-c2cv-gfhj, MAL-2026-16394 | Malicious | Not scored | 22 Sep, 2026 | npm envparse2 |
Malicious release: Malicious code in envparse3 (npm) GHSA-vq77-3r62-c2cx, MAL-2026-16395 | Malicious | Not scored | 22 Sep, 2026 | npm envparse3 |
Malicious release: Malicious code in sysverify (npm) GHSA-jpfv-9923-q8rq, MAL-2026-16404 | Malicious | Not scored | 22 Sep, 2026 | npm sysverify |
MCP Atlassian: SSRF Protection Bypass CVE-2026-77274, GHSA-hgcf-4mq8-5266, PYSEC-2026-4096 | High | 0.3% | 22 Sep, 2026 | PyPI mcp-atlassian |
MCP Atlassian: Incomplete path traversal fix allows intra-CWD module overwrite and RCE (bypass of GHSA-xjgw-4wvw-rgm4) CVE-2026-77271, GHSA-6vmq-24h2-pj7j, PYSEC-2026-4087 | High | 0.6% | 22 Sep, 2026 | PyPI mcp-atlassian |
MCP Atlassian: Arbitrary File Read via Upload Attachment Tools CVE-2026-77270, GHSA-f26r-j276-ggg4, PYSEC-2026-4090 | Medium | 0.5% | 22 Sep, 2026 | PyPI mcp-atlassian |
mcp-atlassian has an incomplete SSRF remediation CVE-2026-77267, GHSA-5wf4-jqxh-8gm3, PYSEC-2026-4084 | High | 0.3% | 22 Sep, 2026 | PyPI mcp-atlassian |
MCP Atlassian: SSRF via DNS Rebinding in Header-Based Authentication Flow CVE-2026-77265, GHSA-49xv-9743-pw8w, PYSEC-2026-4083 | High | 0.3% | 22 Sep, 2026 | PyPI mcp-atlassian |
MCP Atlassian: SSRF redirect protection missing for basic-auth and OAuth authentication branches CVE-2026-77261, GHSA-6529-c226-h328, PYSEC-2026-4085 | High | 0.4% | 22 Sep, 2026 | PyPI mcp-atlassian |
MCP Atlassian: Arbitrary local file READ via unconstrained file_path in upload_attachment (Confluence + Jira) CVE-2026-77260, GHSA-f4p7-qx46-wc5j, PYSEC-2026-4091 | High | 0.4% | 22 Sep, 2026 | PyPI mcp-atlassian |
MCP Atlassian: Arbitrary file read/exfiltration via upload_attachment missing validate_safe_path() CVE-2026-77258, GHSA-93xw-j965-9mx3, PYSEC-2026-4088 | High | 0.4% | 22 Sep, 2026 | PyPI mcp-atlassian |
MCP Atlassian: JIRA_PROJECTS_FILTER / CONFLUENCE_SPACES_FILTER allow forbidden-project content exfiltration (one LIVE-proven on Atlassian Cloud) CVE-2026-77251, GHSA-w66g-j6c4-hcfc, PYSEC-2026-4102 | High | 0.3% | 22 Sep, 2026 | PyPI mcp-atlassian |
MCP Atlassian: OAuth fallback token storage writes plaintext access and refresh tokens with group-readable permissions CVE-2026-77250, GHSA-g5xv-mhgm-v5f6, PYSEC-2026-4094 | Medium | 0.1% | 22 Sep, 2026 | PyPI mcp-atlassian |
[mcp-atlassian] Authentication bypass in HTTP transport: AtlassianOpaqueTokenVerifier accepts any non-empty token CVE-2026-77244, GHSA-wrhw-j3f9-8vc6, PYSEC-2026-4103 | Critical | 0.3% | 22 Sep, 2026 | PyPI mcp-atlassian |
MCP Atlassian: ENABLED_TOOLS / Toolset authorization bypass CVE-2026-77243, GHSA-3r68-hf9h-887v, PYSEC-2026-4081 | High | 0.5% | 22 Sep, 2026 | PyPI mcp-atlassian |
Malicious release: Malicious code in cloudndmcedu (npm) GHSA-3r7g-wjh4-5228, MAL-2026-16391 | Malicious | Not scored | 22 Sep, 2026 | npm cloudndmcedu |
Malicious release: Malicious code in ndmcjcxiebysfdb (npm) GHSA-8344-w2r2-rxp2, MAL-2026-16400 | Malicious | Not scored | 22 Sep, 2026 | npm ndmcjcxiebysfdb |
Malicious release: Malicious code in ndmcmsujey (npm) GHSA-fjp4-jprr-4jp6, MAL-2026-16402 | Malicious | Not scored | 22 Sep, 2026 | npm ndmcmsujey |
Malicious release: Malicious code in ndmckauxuoincv (npm) GHSA-q5vm-6mhj-qq8c, MAL-2026-16401 | Malicious | Not scored | 22 Sep, 2026 | npm ndmckauxuoincv |
Malicious release: Malicious code in fdhcxvnwhjiofv (npm) GHSA-299v-cwvm-ffx4, MAL-2026-16396 | Malicious | Not scored | 22 Sep, 2026 | npm fdhcxvnwhjiofv |
Malicious release: Malicious code in luftmvfiwgxydes (npm) GHSA-j2f6-x53f-2qqf, MAL-2026-16398 | Malicious | Not scored | 22 Sep, 2026 | npm luftmvfiwgxydes |
Malicious release: Malicious code in kambxjowhdsgyw (npm) GHSA-pmhv-gqr9-wrgr, MAL-2026-16397 | Malicious | Not scored | 22 Sep, 2026 | npm kambxjowhdsgyw |
Malicious release: Malicious code in lufxchwmxwyps (npm) GHSA-xvmw-wchq-f7p8, MAL-2026-16399 | Malicious | Not scored | 22 Sep, 2026 | npm lufxchwmxwyps |
Malicious release: Malicious code in oracle-redis (npm) MAL-2026-16390 | Malicious | Not scored | 22 Sep, 2026 | npm oracle-redis |
Malicious release: Malicious code in noverojava (npm) MAL-2026-16389 | Malicious | Not scored | 22 Sep, 2026 | npm noverojava |
Malicious release: Malicious code in nodetokyo (npm) MAL-2026-16388 | Malicious | Not scored | 22 Sep, 2026 | npm nodetokyo |
Malicious release: Malicious code in zeal-utils (npm) MAL-2026-16542 | Malicious | Not scored | 22 Sep, 2026 | npm zeal-utils |
Malicious release: Malicious code in zeal-util-hooks (npm) MAL-2026-16541 | Malicious | Not scored | 22 Sep, 2026 | npm zeal-util-hooks |
Malicious release: Malicious code in style-class-utils (npm) MAL-2026-16540 | Malicious | Not scored | 22 Sep, 2026 | npm style-class-utils |
Malicious release: Malicious code in spark-rpc (npm) MAL-2026-16538 | Malicious | Not scored | 22 Sep, 2026 | npm spark-rpc |
Malicious release: Malicious code in speaker_tagging_media_player (npm) MAL-2026-16539 | Malicious | Not scored | 22 Sep, 2026 | npm speaker_tagging_media_player |
Malicious release: Malicious code in spark-common (npm) MAL-2026-16537 | Malicious | Not scored | 22 Sep, 2026 | npm spark-common |
Malicious release: Malicious code in mx-www-locales-common (npm) MAL-2026-16536 | Malicious | Not scored | 22 Sep, 2026 | npm mx-www-locales-common |
Malicious release: Malicious code in mercuriusdream-oidc-replay-probe (npm) MAL-2026-16535 | Malicious | Not scored | 22 Sep, 2026 | npm mercuriusdream-oidc-replay-probe |
Malicious release: Malicious code in eslint-config-compact-utils (npm) MAL-2026-16417 | Malicious | Not scored | 22 Sep, 2026 | npm eslint-config-compact-utils |
Malicious release: Malicious code in halali-sample (npm) MAL-2026-16534 | Malicious | Not scored | 22 Sep, 2026 | npm halali-sample |
Malicious release: Malicious code in exodus-firestore-synchronize (npm) MAL-2026-16533 | Malicious | Not scored | 22 Sep, 2026 | npm exodus-firestore-synchronize |
WordPress Core Remote File Inclusion Vulnerability CVE-2026-87902 | HighExploited | 95.8% | 22 Sep, 2026 | |
lightrag-hku: Stored Cross-Site Scripting (XSS) in the LightRAG WebUI chat/answer renderer via ingested content CVE-2026-86062, GHSA-xpjq-3w4w-w5wr, PYSEC-2026-4065 | Medium | 0.3% | 22 Sep, 2026 | PyPI lightrag-hku |
lightrag-hku: SSRF via IPv6-transition address bypass (NAT64, IPv4-compatible, 6to4) of the native-markdown image-download guard CVE-2026-85740, GHSA-vv3m-f8x4-7377, PYSEC-2026-4064 | High | 0.3% | 22 Sep, 2026 | PyPI lightrag-hku |
lightrag-hku: No Rate Limiting on /login Endpoint Allows Brute-Force Attacks CVE-2026-85734, GHSA-frch-4w6v-q5xx, PYSEC-2026-4062 | Critical | 0.6% | 22 Sep, 2026 | PyPI lightrag-hku |