Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Flowise Missing Authentication on NVIDIA NIM Endpoints CVE-2026-30824, GHSA-5f53-522j-j454 | High | 36.9% | 06 Mar, 2026 | npm flowise |
Flowise has IDOR leading to Account Takeover and Enterprise Feature Bypass via SSO Configuration CVE-2026-30823, GHSA-cwc3-p92j-g7qm | High | 0.4% | 06 Mar, 2026 | npm flowise |
Flowise Allows Mass Assignment in `/api/v1/leads` Endpoint CVE-2026-30822, GHSA-mq4r-h2gh-qv7x | High | 13.4% | 06 Mar, 2026 | npm flowise |
TSPortal: Any user can forge self-deletion requests for any account CVE-2026-29788, GHSA-gfhq-7499-f3f2 | High | 0.3% | 06 Mar, 2026 | Packagist miraheze/ts-portal |
Flowise has Arbitrary File Upload via MIME Spoofing CVE-2026-30821, GHSA-j8g8-j7fc-43v6 | High | 15.2% | 06 Mar, 2026 | npm flowise |
Flowise has Authorization Bypass via Spoofed x-request-from Header CVE-2026-30820, GHSA-wvhq-wp8g-c7vq | High | 0.5% | 06 Mar, 2026 | npm flowise |
parse-server's endpoint `/loginAs` allows `readOnlyMasterKey` to gain full read and write access as any user BIT-parse-2026-30229, CVE-2026-30229, GHSA-79wj-8rqv-jvp5 | High | 0.4% | 06 Mar, 2026 | npm parse-server |
express-rate-limit: IPv4-mapped IPv6 addresses bypass per-client rate limiting on servers with dual-stack network CVE-2026-30827, GHSA-46wh-pxpv-q5gq | High | 0.5% | 06 Mar, 2026 | npm express-rate-limit |
Snipe-IT has sensitive user attributes related to account privileges that are insufficiently protected against mass assignment CVE-2025-15602, GHSA-5448-v74m-7mv7 | High | 0.5% | 06 Mar, 2026 | Packagist snipe/snipe-it |
GitHub Copilot CLI Dangerous Shell Expansion Patterns Enable Arbitrary Code Execution CVE-2026-29783, GHSA-g8r9-g2v8-jv6f | High | 0.4% | 06 Mar, 2026 | npm @github/copilot |
SageMaker Python SDK replaced eval() with safe parser in JumpStart search functionality GHSA-5r2p-pjr8-7fh7 | High | Not scored | 05 Mar, 2026 | PyPI sagemaker |
Plane is Vulnerable to Unauthenticated Workspace Member Information Disclosure CVE-2026-30244, GHSA-87x4-j8vh-p5qf | High | 0.4% | 05 Mar, 2026 | PyPI plane |
Plane has SSRF via Incomplete IP Validation in Webhook URL Serializer CVE-2026-30242, GHSA-fpx8-73gf-7x73 | High | 0.4% | 05 Mar, 2026 | PyPI plane |
@perfood/couch-auth has an Observable Timing Discrepancy CVE-2025-70949, GHSA-mjqr-5c55-g77h | High | 0.4% | 05 Mar, 2026 | npm @perfood/couch-auth |
LangGraph checkpoint loading has unsafe msgpack deserialization CVE-2026-28277, GHSA-g48c-2wqr-h844, PYSEC-2026-83 | High | 4.9% | 05 Mar, 2026 | PyPI langgraph |
RAGAS has an Arbitrary File Read vulnerability CVE-2025-45691, GHSA-v2xr-wvrv-p969, PYSEC-2026-3047 | High | 0.6% | 05 Mar, 2026 | PyPI ragas |
xgrammar vulnerable to DoS via multi-layer nesting CVE-2026-25048, GHSA-7rgv-gqhr-fxg3, PYSEC-2026-2322 | High | 1.2% | 05 Mar, 2026 | PyPI xgrammar |
Python-Markdown has an Uncaught Exception CVE-2025-69534, GHSA-5wmx-573v-2qwq, PYSEC-2026-89 | High | 0.6% | 05 Mar, 2026 | PyPI Markdown PyPI markdown |
tar has Hardlink Path Traversal via Drive-Relative Linkpath CVE-2026-29786, GHSA-qffp-2rhf-9h96 | High | 0.5% | 05 Mar, 2026 | npm tar |
Ghost has incomplete CSRF protections around OTC use BIT-ghost-2026-29784, CVE-2026-29784, GHSA-9m84-wc28-w895 | High | 0.2% | 05 Mar, 2026 | npm ghost |
Parse Server's Cloud Hooks and Cloud Jobs bypass `readOnlyMasterKey` write restriction BIT-parse-2026-29182, CVE-2026-29182, GHSA-vc89-5g3r-cmhh | High | 0.4% | 05 Mar, 2026 | npm parse-server |
pyLoad has an Arbitrary File Write via Path Traversal in edit_package() CVE-2026-29778, GHSA-6px9-j4qr-xfjw, PYSEC-2026-121 | High | 0.5% | 05 Mar, 2026 | PyPI pyload-ng |
SVGO DoS through entity expansion in DOCTYPE (Billion Laughs) CVE-2026-29074, GHSA-xpqw-6gx7-v673 | High | 0.6% | 04 Mar, 2026 | npm svgo |
Fickling missing RCE-capable modules in UNSAFE_IMPORTS GHSA-5hwf-rc88-82xm | High | Not scored | 04 Mar, 2026 | PyPI fickling |
Fickling has `always_check_safety()` bypass: pickle.loads and _pickle.loads remain unhooked GHSA-wccx-j62j-r448 | High | Not scored | 04 Mar, 2026 | PyPI fickling |
changedetection.io has Zip Slip vulnerability in the backup restore functionality CVE-2026-29065, GHSA-25g8-2mcf-fcx9, PYSEC-2026-2129 | High | 0.5% | 04 Mar, 2026 | PyPI changedetection-io PyPI changedetection.io |
Immutable is vulnerable to Prototype Pollution CVE-2026-29063, GHSA-wf6x-7x77-mvgw | High | 1.0% | 04 Mar, 2026 | npm immutable |
changedetection.io vulnerable to XPath - Arbitrary File Read via unparsed-text() CVE-2026-29039, GHSA-6fmw-82m7-jq6p, PYSEC-2026-2128 | High | 0.5% | 04 Mar, 2026 | PyPI changedetection-io PyPI changedetection.io |
Authlib: Setting `alg: none` and a blank signature appears to bypass signature verification CVE-2026-28802, GHSA-7wc2-qxgw-g8gg, PYSEC-2026-2118 | High | 0.5% | 04 Mar, 2026 | PyPI authlib |
IRRd: web UI host header injection allows password reset poisoning via attacker-controlled email links CVE-2026-28681, GHSA-22m3-c7vp-49fj, PYSEC-2026-2186 | High | 0.4% | 04 Mar, 2026 | PyPI irrd |
locutus call_user_func_array vulnerable to Remote Code Execution (RCE) due to Code Injection CVE-2026-29091, GHSA-fp25-p6mj-qqg6 | High | 0.8% | 04 Mar, 2026 | npm locutus |
@hono/node-server has authorization bypass for protected static paths via encoded slashes in Serve Static Middleware CVE-2026-29087, GHSA-wc8c-qw6v-h7f6 | High | 0.3% | 04 Mar, 2026 | npm @hono/node-server |
OpenClaw: Hardlink alias checks could bypass workspace-only file boundaries in specific configurations GHSA-3jx4-q2m7-r496 | High | Not scored | 04 Mar, 2026 | npm openclaw |
OpenClaw Canvas Authentication Bypass Vulnerability CVE-2026-3690, GHSA-vvjh-f6p9-5vcf | High | 0.7% | 04 Mar, 2026 | npm openclaw |
NLTK has a Path Traversal issue CVE-2026-0847, GHSA-68j8-pq59-fqgm, PYSEC-2026-98 | High | 1.0% | 04 Mar, 2026 | PyPI nltk |
OpenClaw: Slack interactive callbacks could skip configured sender checks in some shared-workspace flows CVE-2026-32005, GHSA-x2ff-j5c2-ggpr | High | 0.3% | 04 Mar, 2026 | npm openclaw |
Multer Vulnerable to Denial of Service via Uncontrolled Recursion CVE-2026-3520, GHSA-5528-5vmv-3xc2 | High | 0.8% | 04 Mar, 2026 | npm multer |
Craft CMS has unauthenticated activation email trigger with potential user enumeration CVE-2026-29069, GHSA-234q-vvw3-mrfq | High | 0.3% | 04 Mar, 2026 | Packagist craftcms/cms |
Concrete CMS vulnerable to Remote Code Execution by stored PHP object injection CVE-2026-3452, GHSA-gj26-w59c-29mf | High | 0.7% | 04 Mar, 2026 | Packagist concrete5/concrete5 |
OpenClaw's commands.allowFrom sender authorization accepted conversation identifiers via ctx.From GHSA-2ch6-x3g4-7759 | High | Not scored | 03 Mar, 2026 | npm openclaw |
OpenClaw's exec allowlist wrapper analysis did not unwrap env/shell dispatch chains CVE-2026-27566, GHSA-jj82-76v6-933r | High | 0.4% | 03 Mar, 2026 | npm openclaw |
OpenClaw's sandbox bind validation could bypass allowed-root and blocked-path checks via symlink-parent missing-leaf paths CVE-2026-27523, GHSA-m8v2-6wwh-r4gc | High | 0.3% | 03 Mar, 2026 | npm openclaw |
OpenClaw: Zip extraction symlink traversal could write outside destination GHSA-jxrq-8fm4-9p58 | High | Not scored | 03 Mar, 2026 | npm openclaw |
OpenClaw's Synology Chat dmPolicy=allowlist failed open on empty allowedUserIds, allowing unauthorized agent dispatch CVE-2026-31998, GHSA-gw85-xp4q-5gp9 | High | 0.3% | 03 Mar, 2026 | npm openclaw |
OpenClaw hook transform path containment missed symlink-resolved escapes GHSA-659f-22xc-98f2 | High | Not scored | 03 Mar, 2026 | npm openclaw |
OpenClaw has multiple E2E/test Dockerfiles that run all processes as root GHSA-w7j5-j98m-w679 | High | Not scored | 03 Mar, 2026 | npm openclaw |
OpenClaw's browser-origin WebSocket auth hardening gap could enable loopback password brute-force chains CVE-2026-32025, GHSA-jmmg-jqc7-5qf4 | High | 0.3% | 03 Mar, 2026 | npm openclaw |
OpenClaw's non-default autoAllowSkills setting could bypass on-miss exec prompt GHSA-7ff8-xjh3-mgh6 | High | Not scored | 03 Mar, 2026 | npm openclaw |
OpenClaw's shell startup env injection bypasses system.run allowlist intent (RCE class) CVE-2026-32056, GHSA-xgf2-vxv2-rrmg | High | 0.6% | 03 Mar, 2026 | npm openclaw |
OpenClaw affected by BASH_ENV / ENV startup-file injection into spawned shell commands GHSA-w9cg-v44m-4qv8 | High | Not scored | 03 Mar, 2026 | npm openclaw |