Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Saloon has insecure deserialization in AccessTokenAuthenticator CVE-2026-33942, GHSA-rf88-776r-rcq9 | High | 0.6% | 26 Mar, 2026 | Packagist saloonphp/saloon |
Saloon has a Fixture Name Path Traversal Vulnerability CVE-2026-33183, GHSA-f7xc-5852-fj99 | High | 0.6% | 25 Mar, 2026 | Packagist saloonphp/saloon |
Picomatch has a ReDoS vulnerability via extglob quantifiers CVE-2026-33671, GHSA-c2c7-rcm5-vvqj | High | 0.4% | 25 Mar, 2026 | npm picomatch |
Protobuf: Denial of Service issue through malicious messages containing negative varints or deep recursion CVE-2026-6409, GHSA-p2gh-cfq4-4wjc | High | 0.4% | 25 Mar, 2026 | Packagist google/protobuf |
Sharp is Vulnerable to Path Traversal via Unsanitized Extension in FileUtil CVE-2026-33686, GHSA-9ffq-6457-8958 | High | 0.6% | 25 Mar, 2026 | Packagist code16/sharp |
Sharp has Unrestricted File Upload via Client-Controlled Validation Rules CVE-2026-33687, GHSA-fr76-5637-w3g9 | High | 0.5% | 25 Mar, 2026 | Packagist code16/sharp |
PrestaShop has multiple stored XSS vulnerabilities via unprotected Template variables CVE-2026-33673, GHSA-35pf-37c6-jxjv | High | 0.3% | 25 Mar, 2026 | Packagist prestashop/prestashop |
WeChat Pay callback signature verification bypassed when Host header is localhost CVE-2026-33661, GHSA-q938-ghwv-8gvc | High | 0.5% | 25 Mar, 2026 | Packagist yansongda/pay |
n8n Has External Secrets Authorization Bypass in Credential Saving CVE-2026-33722, GHSA-fxcw-h3qj-8m8p | High | 0.3% | 25 Mar, 2026 | npm n8n |
Signify allows a remote attacker to escalate privileges via the signed_data.py and the context.py components CVE-2025-70887, GHSA-p4hh-mq57-gq8x, PYSEC-2026-2278 | High | 0.3% | 25 Mar, 2026 | PyPI signify |
n8n has SQL Injection in Data Table Node via orderByColumn Expression CVE-2026-33713, GHSA-98c2-4cr3-4jc3 | High | 0.4% | 25 Mar, 2026 | npm n8n |
n8n: LDAP Email-Based Account Linking Allows Privilege Escalation and Account Takeover CVE-2026-33665, GHSA-c545-x2rh-82fc | High | 0.3% | 25 Mar, 2026 | npm n8n |
n8n is Vulnerable to Credential Theft via Name-Based Resolution and Permission Checker Bypass in Community Edition CVE-2026-33663, GHSA-m63j-689w-3j35 | High | 0.4% | 25 Mar, 2026 | npm n8n |
Seafile Server has multiple stored XSS vulnerabilities CVE-2026-30587, GHSA-rqj3-x344-qvxc | High | 0.3% | 25 Mar, 2026 | npm @seafile/sdoc-editor |
LiquidJS has Exponential Memory Amplification through its replace_first Filter $& Pattern CVE-2026-33287, GHSA-6q5m-63h6-5x4v | High | 0.5% | 25 Mar, 2026 | npm liquidjs |
LiquidJS: memoryLimit Bypass through Negative Range Values Leads to Process Crash CVE-2026-33285, GHSA-9r5m-9576-7f6x | High | 0.4% | 25 Mar, 2026 | npm liquidjs |
@grackle-ai/server has Missing WebSocket Origin Header Validation GHSA-w3hv-x4fp-6h6j | High | Not scored | 25 Mar, 2026 | npm @grackle-ai/server |
@grackle-ai/mcp has a workspace authorization bypass in its knowledge_search MCP tool GHSA-647h-p824-99w7 | High | Not scored | 25 Mar, 2026 | npm @grackle-ai/mcp |
Modoboa has OS Command Injection CVE-2026-27602, GHSA-wwv8-cqpr-vx3m, PYSEC-2026-2223 | High | 0.6% | 25 Mar, 2026 | PyPI modoboa |
n8n has In-Process Memory Disclosure in its Task Runner CVE-2026-27496, GHSA-xvh5-5qg4-x9qp | High | 0.3% | 25 Mar, 2026 | npm n8n |
JustHTML is vulnerable to XSS via code fence breakout in <pre> content CVE-2026-5389, GHSA-5vp3-3cg6-2rq3 | High | 0.2% | 24 Mar, 2026 | PyPI justhtml |
Parse Server exposes auth data via /users/me endpoint BIT-parse-2026-33627, CVE-2026-33627, GHSA-37mj-c2wf-cx96 | High | 0.4% | 24 Mar, 2026 | npm parse-server |
Astro: Memory exhaustion DoS due to missing request body size limit in Server Islands CVE-2026-29772, GHSA-3rmj-9m5h-8fpv | High | 0.4% | 24 Mar, 2026 | npm @astrojs/node |
Parse Server has SQL Injection through aggregate and distinct field names in PostgreSQL adapter BIT-parse-2026-33539, CVE-2026-33539, GHSA-p2w6-rmh7-w8q3 | High | 0.5% | 24 Mar, 2026 | npm parse-server |
Parse Server: Denial of Service via unindexed database query for unconfigured auth providers BIT-parse-2026-33538, CVE-2026-33538, GHSA-g4cf-xj29-wqqr | High | 0.4% | 24 Mar, 2026 | npm parse-server |
fido2-lib is vulnerable to DoS via cbor-extract heap buffer over-read in CBOR attestation parsing GHSA-g3qj-j598-cxmq | High | Not scored | 24 Mar, 2026 | npm fido2-lib |
Craft CMS is Vulnerable to Authenticated Remote Code Execution via Malicious Attached Behavior CVE-2026-33157, GHSA-2fph-6v5w-89hh | High | 1.1% | 24 Mar, 2026 | Packagist craftcms/cms |
Froxlor is vulnerable to BIND zone file injection via unsanitized DNS record content in DomainZones API CVE-2026-30932, GHSA-x6w6-2xwp-3jh6 | High | 0.6% | 24 Mar, 2026 | Packagist froxlor/froxlor |
H3: Unbounded Chunked Cookie Count in Session Cleanup Loop may Lead to Denial of Service CVE-2026-86250, GHSA-q5pr-72pq-83v3 | High | 0.5% | 23 Mar, 2026 | npm h3 |
Briefcase: Windows MSI Installer Privilege Escalation via Insecure Directory Permissions CVE-2026-33430, GHSA-r3r2-35v9-v238, PYSEC-2026-27 | High | 0.1% | 23 Mar, 2026 | PyPI briefcase |
Indico discloses local files resulting in Remote Code Execution through LaTeX injection CVE-2026-33046, GHSA-rm2q-f7jv-3cfp, PYSEC-2026-2184 | High | 0.8% | 23 Mar, 2026 | PyPI indico |
Connect CMS: Improper Authorization in the My Page Profile Update Feature Allows Modification of Arbitrary User Information CVE-2026-32300, GHSA-qr6x-wvxr-8hm9 | High | 0.3% | 23 Mar, 2026 | Packagist opensource-workshop/connect-cms |
Connect CMS: Information Disclosure Due to Improper Authorization through the Page Content Retrieval Feature CVE-2026-32299, GHSA-62ch-j6x7-722j | High | 0.3% | 23 Mar, 2026 | Packagist opensource-workshop/connect-cms |
Connect CMS has Stored Cross-site Scripting (XSS) in the File Field of its Form Plugin CVE-2026-32278, GHSA-mv3p-7p89-wq9p | High | 0.2% | 23 Mar, 2026 | Packagist opensource-workshop/connect-cms |
Connect-CMS has DOM-based Cross-Site Scripting (XSS) in the Cabinet Plugin List View CVE-2026-32277, GHSA-cmfh-mpmf-fmq4 | High | 0.3% | 23 Mar, 2026 | Packagist opensource-workshop/connect-cms |
Connect-CMS has Arbitrary Code Execution by an Authenticated User in its Code Study Plugin CVE-2026-32276, GHSA-hxqw-6qv7-cqfv | High | 0.5% | 23 Mar, 2026 | Packagist opensource-workshop/connect-cms |
MantisBT has Stored HTML Injection/XSS when displaying Tags in Timeline CVE-2026-33548, GHSA-73vx-49mv-v8w5 | High | 0.2% | 23 Mar, 2026 | Packagist mantisbt/mantisbt |
MantisBT Vulnerable to Stored HTML Injection in Tag Delete Confirmation CVE-2026-33517, GHSA-fh48-f69w-7vmp | High | 0.2% | 23 Mar, 2026 | Packagist mantisbt/mantisbt |
AVideo is Vulnerable to SQL Injection through Subscribe Endpoint via Unsanitized user_id Parameter CVE-2026-33723, GHSA-ffr8-fxhv-fv8h | High | 0.2% | 23 Mar, 2026 | Packagist wwbn/avideo |
AVideo: Unauthenticated CDN Configuration Takeover via Empty Default Key Bypass and Mass-Assignment CVE-2026-33719, GHSA-r64r-883r-wcwh | High | 0.4% | 23 Mar, 2026 | Packagist wwbn/avideo |
AVideo: Remote Code Execution via PHP Temp File in Encoder downloadURL CVE-2026-33717, GHSA-8wf4-c4x3-h952 | High | 0.4% | 23 Mar, 2026 | Packagist wwbn/avideo |
AVideo has Path Traversal in pluginRunDatabaseScript.json.php Enables Arbitrary SQL File Execution via Unsanitized Plugin Name CVE-2026-33681, GHSA-3hwv-x8g3-9qpr | High | 0.5% | 23 Mar, 2026 | Packagist wwbn/avideo |
AVideo has a Blind SQL Injection in Live Schedule Reminder via Unsanitized live_schedule_id in Scheduler_commands::getAllActiveOrToRepeat() CVE-2026-33651, GHSA-pvw4-p2jm-chjm | High | 0.4% | 23 Mar, 2026 | Packagist wwbn/avideo |
AVideo: Video Moderator Privilege Escalation via Ownership Transfer Enables Arbitrary Video Deletion CVE-2026-33650, GHSA-8x77-f38v-4m5j | High | 0.2% | 23 Mar, 2026 | Packagist wwbn/avideo |
AVideo's GET-Based CSRF in setPermission.json.php Enables Privilege Escalation via Arbitrary Permission Modification CVE-2026-33649, GHSA-g8x9-7mgh-7cvj | High | 0.2% | 23 Mar, 2026 | Packagist wwbn/avideo |
AVideo Vulnerable to OS Command Injection via Unsanitized `users_id` and `liveTransmitionHistory_id` in Restreamer Log File Path CVE-2026-33648, GHSA-5m4q-5cvx-36mw | High | 0.6% | 23 Mar, 2026 | Packagist wwbn/avideo |
AVideo Vulnerable to Remote Code Execution via MIME/Extension Mismatch in ImageGallery File Upload CVE-2026-33647, GHSA-wxjw-phj6-g75w | High | 0.7% | 23 Mar, 2026 | Packagist wwbn/avideo |
cbor2 has a Denial of Service via Uncontrolled Recursion in cbor2.loads CVE-2026-26209, GHSA-3c37-wwvx-h642, PYSEC-2026-2123 | High | 0.4% | 23 Mar, 2026 | PyPI cbor2 |
jsrsasign: Negative Exponent Handling Leads to Signature Verification Bypass CVE-2026-4602, GHSA-8qwj-4jxw-m8jw | High | 0.5% | 23 Mar, 2026 | npm jsrsasign |
jsrsasign: Missing cryptographic validation during DSA signing enables private key extraction CVE-2026-4601, GHSA-w8q8-93cx-6h7r | High | 0.3% | 23 Mar, 2026 | npm jsrsasign |