Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
pyOpenSSL DTLS cookie callback buffer overflow CVE-2026-27459, GHSA-5pwr-322w-8jr4, PYSEC-2026-2269 | High | 0.7% | 16 Mar, 2026 | PyPI pyopenssl |
Uncontrolled memory allocation via crafted SVG dimensions in @dicebear/converter CVE-2026-29112, GHSA-v3r3-4qgc-vw66 | High | 0.4% | 16 Mar, 2026 | npm @dicebear/converter |
Authlib: Fail-Open Cryptographic Verification in OIDC Hash Binding CVE-2026-28498, GHSA-m344-f55w-2m6j, PYSEC-2026-2117 | High | 0.2% | 16 Mar, 2026 | PyPI authlib |
Authlib Vulnerable to JWE RSA1_5 Bleichenbacher Padding Oracle CVE-2026-28490, GHSA-7432-952r-cw78, PYSEC-2026-2116 | High | 0.1% | 16 Mar, 2026 | PyPI authlib |
FastMCP OAuth Proxy token reuse across MCP servers CVE-2025-69196, GHSA-5h2m-4q8j-pqpj, PYSEC-2026-2474 | High | 0.4% | 16 Mar, 2026 | PyPI fastmcp |
MLflow has a command injection in mlflow/sagemaker/__init__.py BIT-mlflow-2025-14287, CVE-2025-14287, GHSA-xch3-2f9x-wh9f, PYSEC-2026-2661 | High | 1.5% | 16 Mar, 2026 | PyPI mlflow |
SimpleEval: Objects (including modules) can leak dangerous modules through to direct access inside the sandbox CVE-2026-32640, GHSA-44vg-5wv2-h2hg, PYSEC-2026-132 | High | 0.5% | 13 Mar, 2026 | PyPI simpleeval |
Angular vulnerable to XSS in i18n attribute bindings CVE-2026-32635, GHSA-g93w-mfhg-p222 | High | 0.5% | 13 Mar, 2026 | npm @angular/compiler npm @angular/core |
OpenClaw: Feishu webhook mode accepted forged events when only `verificationToken` was configured CVE-2026-32974, GHSA-g353-mgv3-8pcj | High | 0.3% | 13 Mar, 2026 | npm openclaw |
OpenClaw: Gateway `agent` calls could override the workspace boundary CVE-2026-33573, GHSA-2rqg-gjgv-84jm | High | 0.3% | 13 Mar, 2026 | npm openclaw |
OpenClaw: Workspace plugin auto-discovery allowed code execution from cloned repositories CVE-2026-32920, GHSA-99qw-6mr3-36qr | High | 0.3% | 13 Mar, 2026 | npm openclaw |
OpenClaw: Command-authorized non-owners could reach owner-only `/config` and `/debug` surfaces CVE-2026-32914, GHSA-r7vr-gr74-94p8 | High | 0.3% | 13 Mar, 2026 | npm openclaw |
OpenClaw: Exec approval allowlist patterns overmatched on POSIX paths CVE-2026-32973, GHSA-f8r2-vg7x-gh8m | High | 0.4% | 13 Mar, 2026 | npm openclaw |
OpenClaw: `browser.request` let `operator.write` persist admin-only browser profile changes CVE-2026-32972, GHSA-vmhq-cqm9-6p7q | High | 0.3% | 13 Mar, 2026 | npm openclaw |
OpenClaw: Pairing setup codes exposed long-lived shared gateway credentials instead of short-lived bootstrap tokens CVE-2026-33575, GHSA-7h7g-x2px-94hj | High | 0.3% | 13 Mar, 2026 | npm openclaw |
simplesamlphp/xml-security: Missing AES-GCM Authentication Tag Validation on Encrypted Nodes Allows for Unauthorized Decryption CVE-2026-32600, GHSA-r353-4845-pr5p | High | 0.2% | 13 Mar, 2026 | Packagist simplesamlphp/xml-security |
xmlseclibs: Missing AES-GCM Authentication Tag Validation on Encrypted Nodes Allows for Unauthorized Decryption CVE-2026-32313, GHSA-4v26-v6cg-g6f9 | High | 0.2% | 13 Mar, 2026 | Packagist robrichards/xmlseclibs |
Scrapy: Arbitrary Module Import via Referrer-Policy Header in RefererMiddleware CVE-2026-105782, GHSA-cwxj-rr6w-m6w7, PYSEC-2026-4299 | High | 0.4% | 13 Mar, 2026 | PyPI Scrapy PyPI scrapy |
@google/clasp vulnerable to unsafe path traversal cloning or pulling a malicious script CVE-2026-4092, GHSA-hqjg-pww4-pcgq | High | 0.5% | 13 Mar, 2026 | npm @google/clasp |
Google Chromium V8 Improper Restriction of Operations Within the Bounds of a Memory Buffer Vulnerability CVE-2026-3910 | HighExploited | 2.7% | 13 Mar, 2026 | |
Google Skia Out-of-Bounds Write Vulnerability CVE-2026-3909 | HighExploited | 2.3% | 13 Mar, 2026 | |
PyJWT accepts unknown `crit` header extensions CVE-2026-32597, GHSA-752w-5fwx-jx9f, PYSEC-2026-120 | High | 0.3% | 13 Mar, 2026 | PyPI PyJWT PyPI pyjwt |
OneUptime: Stored XSS via Mermaid Diagram Rendering (securityLevel: "loose") CVE-2026-32308, GHSA-wvh5-6vjm-23qh | High | 0.2% | 13 Mar, 2026 | npm oneuptime |
CairoSVG vulnerable to Exponential DoS via recursive <use> element amplification CVE-2026-31899, GHSA-f38f-5xpm-9r7c, PYSEC-2026-2122 | High | 0.5% | 13 Mar, 2026 | PyPI CairoSVG PyPI cairosvg |
OpenClaw: Sandbox staged writes could escape the verified parent directory before commit CVE-2026-32988, GHSA-mj4p-rc52-m843 | High | 0.1% | 13 Mar, 2026 | npm openclaw |
OpenClaw: Channel commands could bypass account-scoped `configWrites` restrictions CVE-2026-32976, GHSA-8jhh-jcqg-mj5p | High | 0.2% | 13 Mar, 2026 | npm openclaw |
OpenClaw: Node-host approvals could show misleading shell payloads instead of the executed argv CVE-2026-32971, GHSA-rw39-5899-8mxp | High | 0.3% | 13 Mar, 2026 | npm openclaw |
OpenClaw: Unbound interpreter and runtime commands could bypass node-host approval integrity CVE-2026-32979, GHSA-xf99-j42q-5w5p | High | 0.1% | 13 Mar, 2026 | npm openclaw |
Dagu: SSE Authentication Bypass in Basic Auth Mode CVE-2026-31882, GHSA-9wmw-9wph-2vwp | High | 0.8% | 13 Mar, 2026 | npm dagu |
Undici has Unhandled Exception in WebSocket Client Due to Invalid server_max_window_bits Validation CVE-2026-2229, GHSA-v9p9-hfj2-hcw8 | High | 0.9% | 12 Mar, 2026 | npm undici |
Undici: Malicious WebSocket 64-bit length overflows parser and crashes the client CVE-2026-1528, GHSA-f269-vfmq-vjvj | High | 0.5% | 12 Mar, 2026 | npm undici |
Undici has Unbounded Memory Consumption in WebSocket permessage-deflate Decompression CVE-2026-1526, GHSA-vrm6-8vpv-qv8q | High | 1.2% | 12 Mar, 2026 | npm undici |
OpenClaw: Untrusted web origins can obtain authenticated operator.admin access in trusted-proxy mode CVE-2026-32302, GHSA-5wcw-8jjv-m286 | High | 0.2% | 12 Mar, 2026 | npm openclaw |
Black: Arbitrary file writes from unsanitized user input in cache file name CVE-2026-32274, GHSA-3936-cmfr-pm3m, PYSEC-2026-2121 | High | 0.6% | 12 Mar, 2026 | PyPI black |
flatted vulnerable to unbounded recursion DoS in parse() revive phase CVE-2026-32141, GHSA-25h7-pfq9-p65f | High | 0.8% | 12 Mar, 2026 | npm flatted |
Magic Wormhole: "wormhole receive" allows arbitrary local file overwrite CVE-2026-32116, GHSA-4g4c-mfqg-pj8r, PYSEC-2026-2615 | High | 0.4% | 12 Mar, 2026 | PyPI magic-wormhole |
Graphiti vulnerable to Cypher Injection via unsanitized node_labels in search filters CVE-2026-32247, GHSA-gg5m-55jj-8m5g, PYSEC-2026-2504 | High | 0.4% | 12 Mar, 2026 | PyPI graphiti-core |
TinaCMS Vulnerable to Path Traversal Leading to Arbitrary File Read, Write and Delete CVE-2026-28793, GHSA-2f24-mg4x-534q | High | 0.2% | 12 Mar, 2026 | npm @tinacms/cli |
Tina: Path Traversal in Media Upload Handle CVE-2026-28791, GHSA-5hxf-c7j4-279c | High | 0.3% | 12 Mar, 2026 | npm tinacms |
multipart vulnerable to ReDoS in `parse_options_header()` CVE-2026-28356, GHSA-p2m9-wcp5-6qw3, PYSEC-2026-2670 | High | 0.8% | 12 Mar, 2026 | PyPI multipart |
OpenCTI has Semi-Blind SSRF via Unvalidated External URL in Data Ingestion Feature CVE-2026-21887, GHSA-ffm6-vvph-g5f5, PYSEC-2026-118 | High | 0.2% | 12 Mar, 2026 | PyPI pycti |
OpenClaw: Sandbox dangling-symlink alias handling could bypass workspace-only write boundary GHSA-qcc4-p59m-p54m | High | Not scored | 12 Mar, 2026 | npm openclaw |
OpenClaw: workspace path guard bypass on non-existent out-of-root symlink leaf CVE-2026-32055, GHSA-mgrq-9f93-wpp5 | High | 0.3% | 12 Mar, 2026 | npm openclaw |
OpenClaw: LINE group allowlist scope mismatch with DM pairing-store entries GHSA-gp3q-wpq4-5c5h | High | Not scored | 12 Mar, 2026 | npm openclaw |
SGLangs `replay_request_dump.py` contains an insecure pickle.load() without validation and proper deserialization CVE-2026-3989, GHSA-hvwj-8w5g-28rg, PYSEC-2026-3063 | High | 0.5% | 12 Mar, 2026 | PyPI sglang |
Tornado has cookie attribute injection via .RequestHandler.set_cookie CVE-2026-35536, GHSA-78cv-mqj4-43f7, GHSA-fqwm-6jpj-5wxc, PYSEC-2026-2287 | High | 0.2% | 11 Mar, 2026 | PyPI tornado |
StudioCMS: REST API Missing Rank Check Allows Admin to Create Peer Admin Accounts CVE-2026-32106, GHSA-wj56-g96r-673q | High | 0.3% | 11 Mar, 2026 | npm studiocms |
StudioCMS: IDOR — Admin-to-Owner Account Takeover via Password Reset Link Generation CVE-2026-32103, GHSA-h7vr-cg25-jf8c | High | 0.4% | 11 Mar, 2026 | npm studiocms |
StudioCMS S3 Storage Manager Authorization Bypass via Missing `await` on Async Auth Check CVE-2026-32101, GHSA-mm78-fgq8-6pgr | High | 0.2% | 11 Mar, 2026 | npm @studiocms/s3-storage |
Tornado is vulnerable to DoS due to too many multipart parts CVE-2026-31958, GHSA-qjxf-f2mg-c6mc, PYSEC-2026-140 | High | 0.4% | 11 Mar, 2026 | PyPI tornado |