Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
SandboxJS has an execution-quota bypass (cross-sandbox currentTicks race) in SandboxJS timers CVE-2026-32723, GHSA-7p5m-xrh7-769r | Medium | 0.2% | 16 Mar, 2026 | npm @nyariv/sandboxjs |
Stored XSS in Memray-generated HTML reports via unescaped command-line metadata CVE-2026-32722, GHSA-r5pr-887v-m2w9, PYSEC-2026-2203 | Medium | 0.3% | 16 Mar, 2026 | PyPI memray |
Glances's REST/WebUI Lacks Host Validation and Remains Exposed to DNS Rebinding CVE-2026-32632, GHSA-hhcg-r27j-fhv9, PYSEC-2026-2171 | Medium | 0.2% | 16 Mar, 2026 | PyPI Glances PyPI glances |
Vanna has a SQL injection in the remove_training_data function CVE-2026-4229, GHSA-6mj8-jmp2-g8q7, PYSEC-2026-3397 | Medium | 0.3% | 16 Mar, 2026 | PyPI vanna |
Aureus ERP vulnerable to cross-site scripting in the Chatter Message Handler CVE-2026-4175, GHSA-76c2-3q6g-xvpm | Medium | 0.3% | 16 Mar, 2026 | Packagist aureuserp/aureuserp |
Vulnogram contains a stored cross-site scripting vulnerability in comment hypertext handling CVE-2026-32774, GHSA-pg4p-2985-gvxr, GHSA-vggc-6pg2-xvp9 | Medium | 0.3% | 16 Mar, 2026 | npm vulnogram |
fickling's `platform` module subprocess invocation evades `check_safety()` with `LIKELY_SAFE` GHSA-5cxw-w2xg-2m8h | Medium | Not scored | 13 Mar, 2026 | PyPI fickling |
fickling modules linecache, difflib and gc are missing from the unsafe modules blocklist GHSA-r48f-3986-4f9c | Medium | Not scored | 13 Mar, 2026 | PyPI fickling |
file-type: ZIP Decompression Bomb DoS via [Content_Types].xml entry CVE-2026-32630, GHSA-j47w-4g3g-c36v | Medium | 0.3% | 13 Mar, 2026 | npm file-type |
OpenClaw: Zalo webhook rate limiting could be bypassed before secret validation CVE-2026-34505, GHSA-5m9r-p9g7-679c | Medium | 0.3% | 13 Mar, 2026 | npm openclaw |
OpenClaw: Feishu reaction events could bypass group authorization and mention gating CVE-2026-32924, GHSA-m69h-jm2f-2pv8 | Medium | 0.3% | 13 Mar, 2026 | npm openclaw |
OpenClaw's Zalouser allowlist authorization matched mutable group names by default CVE-2026-32975, GHSA-f5mf-3r52-r83w | Medium | 0.3% | 13 Mar, 2026 | npm openclaw |
Parse Server's GraphQL WebSocket endpoint bypasses security middleware BIT-parse-2026-32594, CVE-2026-32594, GHSA-p2x3-8689-cwpg | Medium | 0.4% | 13 Mar, 2026 | npm parse-server |
Statamic vulnerable to privilege escalation via stored cross-site scripting CVE-2026-32612, GHSA-hcch-w73c-jp4m | Medium | 0.2% | 13 Mar, 2026 | Packagist statamic/cms |
OneUptime: Password Reset Token Logged at INFO Level CVE-2026-32598, GHSA-4524-cj9j-g4fj | Medium | 0.2% | 13 Mar, 2026 | npm oneuptime |
OpenClaw: Discord guild reaction ingress could bypass users and roles allowlists CVE-2026-32923, GHSA-9vvh-2768-c8vp | Medium | 0.2% | 13 Mar, 2026 | npm openclaw |
OpenClaw: Write-scoped callers could reach admin-only session reset logic through `agent` CVE-2026-32919, GHSA-jf6w-m8jw-jfxc | Medium | 0.1% | 13 Mar, 2026 | npm openclaw |
OpenClaw: Sandbox `writeFile` commit could race outside the validated path CVE-2026-32977, GHSA-xvx8-77m6-gwg6 | Medium | 0.1% | 13 Mar, 2026 | npm openclaw |
Undici has Unbounded Memory Consumption in its DeduplicationHandler via Response Buffering that leads to DoS CVE-2026-2581, GHSA-phc3-fgpg-7m6h | Medium | 0.6% | 12 Mar, 2026 | npm undici |
Undici has CRLF Injection in undici via `upgrade` option CVE-2026-1527, GHSA-4992-7rv2-5pvq | Medium | 0.3% | 12 Mar, 2026 | npm undici |
Parse Server OAuth2 adapter app ID validation sends wrong token to introspection endpoint BIT-parse-2026-32269, CVE-2026-32269, GHSA-69xg-f649-w5g2 | Medium | 0.3% | 12 Mar, 2026 | npm parse-server |
Trix has a Stored XSS vulnerability through serialized attributes CVE-2026-73426, GHSA-qmpg-8xg6-ph5q | Medium | 0.3% | 12 Mar, 2026 | RubyGems action_text-trix npm trix |
Hyperterse: Raw exposure of database statements in MCP search tool CVE-2026-31841, GHSA-92gp-jfgx-9qpv | Medium | 0.2% | 12 Mar, 2026 | npm hyperterse |
TinaCMS CLI has Arbitrary File Read via Disabled Vite Filesystem Restriction CVE-2026-29066, GHSA-m48g-4wr2-j2h6 | Medium | 1.0% | 12 Mar, 2026 | npm @tinacms/cli |
@tinacms/graphql has a Path Traversal issue CVE-2026-24125, GHSA-2238-xc5r-v9hj | Medium | 0.5% | 12 Mar, 2026 | npm @tinacms/graphql |
@backstage/plugin-scaffolder-backend: Possible exposure of defaultEnvironment secrets using dry-run endpoint CVE-2026-32237, GHSA-8wq8-6859-qx77 | Medium | 0.3% | 12 Mar, 2026 | npm @backstage/plugin-scaffolder-backend |
@backstage/plugin-auth-backend: OAuth redirect URI allowlist bypass CVE-2026-32235, GHSA-wqvh-63mv-9w92 | Medium | 0.1% | 12 Mar, 2026 | npm @backstage/plugin-auth-backend |
Uptime Kuma is Missing Authorization Checks on Ping Badge Endpoint, Leaks Ping times of monitors without needing to be on a status page CVE-2026-32230, GHSA-c7hf-c5p5-5g6h | Medium | 0.9% | 12 Mar, 2026 | npm uptime-kuma |
OpenClaw: /api/channels gateway-auth boundary bypass via path canonicalization mismatch CVE-2026-32031, GHSA-8j2w-6fmm-m587 | Medium | 0.2% | 12 Mar, 2026 | npm openclaw |
OpenClaw: Slack system events bypass sender authorization in member and message subtype handlers CVE-2026-32895, GHSA-v8cg-4474-49v8 | Medium | 0.2% | 12 Mar, 2026 | npm openclaw |
OpenClaw's MS Teams sender allowlist bypass when route allowlist is configured and sender allowlist is empty CVE-2026-34506, GHSA-g7cr-9h7q-4qxq | Medium | 0.3% | 12 Mar, 2026 | npm openclaw |
OpenClaw's skills-install-download can be redirected outside the tools root by rebinding the validated base path CVE-2026-33574, GHSA-vhwf-4x96-vqx2 | Medium | 0.1% | 12 Mar, 2026 | npm openclaw |
OpenClaw's system.run approvals did not bind mutable script operands across approval and execution CVE-2026-32921, GHSA-8g75-q649-6pv6 | Medium | 0.2% | 12 Mar, 2026 | npm openclaw |
Unhead Vulnerable to Bypass of URI Scheme Sanitization in makeTagSafe via Case-Sensitivity CVE-2026-31873, GHSA-5339-hvwr-7582 | Medium | 0.2% | 12 Mar, 2026 | npm unhead |
Unhead has XSS bypass in `useHeadSafe` via attribute name injection and case-sensitive protocol check CVE-2026-31860, GHSA-g5xx-pwrp-g3fv | Medium | 0.3% | 12 Mar, 2026 | npm unhead |
yauzl contains an off-by-one error CVE-2026-31988, GHSA-gmq8-994r-jv83 | Medium | 0.5% | 11 Mar, 2026 | npm yauzl |
ha-mcp has XSS via Unescaped HTML in OAuth Consent Form CVE-2026-32112, GHSA-pf93-j98v-25pv, PYSEC-2026-2508 | Medium | 0.2% | 11 Mar, 2026 | PyPI ha-mcp |
ha-mcp OAuth 2.1 DCR mode enables network reconnaissance via an error oracle CVE-2026-32111, GHSA-fmfg-9g7c-3vq7, PYSEC-2026-2507 | Medium | 0.3% | 11 Mar, 2026 | PyPI ha-mcp |
Copyparty has unexpected JavaScript execution via crafted URL to folder with `.prologue.html` CVE-2026-32109, GHSA-rcp6-88mm-9vgf, PYSEC-2026-32 | Medium | 0.2% | 11 Mar, 2026 | PyPI copyparty |
StudioCMS: IDOR in User Notification Preferences Allows Any Authenticated User to Modify Any User's Settings CVE-2026-32104, GHSA-9v82-xrm4-mp52 | Medium | 0.3% | 11 Mar, 2026 | npm studiocms |
Parse Server has a SQL injection via query field name when using PostgreSQL BIT-parse-2026-32234, CVE-2026-32234, GHSA-c442-97qw-j6c6 | Medium | 0.2% | 11 Mar, 2026 | npm parse-server |
Parse Server has a protected fields bypass via LiveQuery subscription WHERE clause BIT-parse-2026-32098, CVE-2026-32098, GHSA-j7mm-f4rv-6q6q | Medium | 0.3% | 11 Mar, 2026 | npm parse-server |
Shescape escape() leaves bracket glob expansion active on Bash, BusyBox, and Dash CVE-2026-32094, GHSA-9jfh-9xrq-4vwm | Medium | 0.2% | 11 Mar, 2026 | npm shescape |
Shopware has user enumeration via distinct error codes on Store API login endpoint CVE-2026-31888, GHSA-gqc5-xv7m-gcjq | Medium | 0.2% | 11 Mar, 2026 | Packagist shopware/core Packagist shopware/platform |
devalue has prototype pollution in devalue.parse and devalue.unflatten CVE-2026-30226, GHSA-cfw5-2vxh-hr84 | Medium | 0.4% | 11 Mar, 2026 | npm devalue |
Craft CMS Vulnerable to Stored XSS via User Group Name in User Permissions Page CVE-2026-56381, GHSA-g3hp-vvqf-8vw6 | Medium | 0.2% | 11 Mar, 2026 | Packagist craftcms/cms |
Parse Server vulnerable to user enumeration via email verification endpoint BIT-parse-2026-31901, CVE-2026-31901, GHSA-w54v-hf9p-8856 | Medium | 0.3% | 11 Mar, 2026 | npm parse-server |
Parse Server vulnerable to stored XSS via file upload of HTML-renderable file types BIT-parse-2026-31868, CVE-2026-31868, GHSA-v5hf-f4c3-m5rv | Medium | 0.3% | 11 Mar, 2026 | npm parse-server |
Hono vulnerable to Prototype Pollution possible through __proto__ key allowed in parseBody({ dot: true }) CVE-2026-56763, GHSA-v8w9-8mx6-g223 | Medium | 0.3% | 11 Mar, 2026 | npm hono |
CraftCMS vulnerable to reflective XSS via incomplete return URL sanitization CVE-2026-31859, GHSA-fvwq-45qv-xvhv | Medium | 0.2% | 11 Mar, 2026 | Packagist craftcms/cms |