Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Cisco Catalyst SD-WAN Manager Incorrect Use of Privileged APIs Vulnerability CVE-2026-20122 | MediumExploited | 25.8% | 25 Feb, 2026 | |
Fickling has safety check bypass via REDUCE+BUILD opcode sequence GHSA-mhc9-48gj-9gp3 | Medium | Not scored | 25 Feb, 2026 | PyPI fickling |
zae-limiter: DynamoDB hot partition throttling enables per-entity Denial of Service CVE-2026-27695, GHSA-76rv-2r9v-c5m6, PYSEC-2026-3434 | Medium | 0.3% | 25 Feb, 2026 | PyPI zae-limiter |
changedetection.io Vulnerable to Reflected XSS in RSS Single Watch Error Response CVE-2026-27645, GHSA-mw8m-398g-h89w, PYSEC-2026-2125 | Medium | 0.5% | 25 Feb, 2026 | PyPI changedetection-io PyPI changedetection.io |
TypiCMS Core has Stored Cross-Site Scripting (XSS) via SVG File Upload CVE-2026-27621, GHSA-xfvg-8v67-j7wp | Medium | 0.2% | 25 Feb, 2026 | Packagist typicms/core |
repostat: Reflected Cross-Site Scripting (XSS) via repo prop in RepoCard CVE-2026-27612, GHSA-fm8c-6m29-rp6j | Medium | 0.2% | 25 Feb, 2026 | npm repostat |
NiceGUI vulnerable to XSS via Code Injection during client-side element function execution CVE-2026-27156, GHSA-78qv-3mpx-9cqq, PYSEC-2026-2232 | Medium | 0.2% | 24 Feb, 2026 | PyPI nicegui |
Payload: Server-Side Request Forgery (SSRF) in External File URL Uploads CVE-2026-27567, GHSA-hhfx-5x8j-f5f6 | Medium | 0.3% | 24 Feb, 2026 | npm payload |
Apache Superset allows privileged users to conduct error-based SQL Injection BIT-superset-2026-23980, CVE-2026-23980, GHSA-gvxg-9hqx-f4rg, PYSEC-2026-2374 | Medium | 0.7% | 24 Feb, 2026 | PyPI apache-superset |
Apache Superset: Incomplete DISALLOWED_SQL_FUNCTIONS default list for ClickHouse engine BIT-superset-2026-23969, CVE-2026-23969, GHSA-48m2-v2r8-h23m, PYSEC-2026-2373 | Medium | 0.7% | 24 Feb, 2026 | PyPI apache-superset |
Apache Airflow exposes sensitive information in its log files BIT-airflow-2025-27555, CVE-2025-27555, GHSA-8r55-rv5w-6pfm, PYSEC-2026-2347 | Medium | 0.4% | 24 Feb, 2026 | PyPI apache-airflow |
Pimcore vulnerable to SQL injection via unsanitized filter value in Dependency Dao RLIKE clause CVE-2026-27461, GHSA-vxg3-v4p6-f3fp | Medium | 0.5% | 24 Feb, 2026 | Packagist pimcore/pimcore |
Craft CMS: Cloud Metadata SSRF Protection Bypass via IPv6 Resolution CVE-2026-27129, GHSA-v2gc-rm6g-wrw9 | Medium | 0.5% | 24 Feb, 2026 | Packagist craftcms/cms |
OpenEXR has heap-buffer-overflow via signed integer underflow in ImfContextInit.cpp CVE-2026-26981, GHSA-q6vj-wxvf-5m8c, PYSEC-2026-2849 | Medium | 0.6% | 24 Feb, 2026 | PyPI OpenEXR PyPI openexr |
Craft CMS Race condition in Token Service potentially allows for token usage greater than the token limit CVE-2026-27128, GHSA-6fx5-5cw5-4897 | Medium | 0.2% | 23 Feb, 2026 | Packagist craftcms/cms |
Craft CMS has Stored XSS in Table Field via "HTML" Column Type CVE-2026-27126, GHSA-3jh3-prx3-w6wc | Medium | 0.2% | 23 Feb, 2026 | Packagist craftcms/cms |
Astro has Full-Read SSRF in error rendering via Host: header injection CVE-2026-25545, GHSA-qq67-mvv5-fw3g | Medium | 1.9% | 23 Feb, 2026 | npm @astrojs/node |
funadmin has Incorrect Privilege Assignment in its Configuration Handler CVE-2026-2896, GHSA-5m2g-4cf6-c3rg | Medium | 0.3% | 22 Feb, 2026 | Packagist funadmin/funadmin |
funadmin exposes sensitive information via getMember function CVE-2026-2894, GHSA-8hhx-xq9j-xwfj | Medium | 0.5% | 21 Feb, 2026 | Packagist funadmin/funadmin |
Isso affected by Stored XSS via comment website field CVE-2026-27469, GHSA-9fww-8cpr-q66r, PYSEC-2026-2527 | Medium | 0.3% | 21 Feb, 2026 | PyPI isso |
Moodle TeX formula editor is vulnerable to DoS through lack of execution time limits BIT-moodle-2026-26047, CVE-2026-26047, GHSA-cg8j-5cr2-568q | Medium | 0.5% | 21 Feb, 2026 | Packagist moodle/moodle |
Apache Airflow error reporting may expose full kwargs BIT-airflow-2025-65995, CVE-2025-65995, GHSA-gfw7-2v73-69wg, PYSEC-2026-2348 | Medium | 0.9% | 21 Feb, 2026 | PyPI apache-airflow |
OpenClaw: ACP prompt-size checks missing in local stdio bridge could reduce responsiveness with very large inputs CVE-2026-27576, GHSA-cxpw-2g23-2vgw | Medium | 0.2% | 20 Feb, 2026 | npm openclaw |
Ray dashboard DELETE endpoints allow unauthenticated browser-triggered DoS (Serve shutdown / job deletion) CVE-2026-27482, GHSA-q5fh-2hc8-f6rq, PYSEC-2026-2271 | Medium | 0.3% | 20 Feb, 2026 | PyPI ray |
AVideo has Stored Cross-Site Scripting via Markdown Comment Injection CVE-2026-27568, GHSA-rcqw-6466-3mv7 | Medium | 0.3% | 20 Feb, 2026 | Packagist wwbn/avideo |
Lettermint Node.js SDK leaks email properties to unintended recipients when client instance is reused CVE-2026-27492, GHSA-49pc-8936-wvfp | Medium | 0.2% | 20 Feb, 2026 | npm lettermint |
OpenClaw hardened cron webhook delivery against SSRF CVE-2026-27488, GHSA-w45g-5746-x9fp | Medium | 0.4% | 20 Feb, 2026 | npm openclaw |
OpenClaw: Reject symlinks in local skill packaging script CVE-2026-27485, GHSA-r6h2-5gqq-v5v6 | Medium | 0.2% | 20 Feb, 2026 | npm openclaw |
Sync-in Server has a stored cross-site scripting (XSS) vulnerability CVE-2025-67438, GHSA-9jmq-xgjm-p8c2 | Medium | 0.3% | 20 Feb, 2026 | npm @sync-in/server |
bn.js affected by an infinite loop CVE-2026-2739, GHSA-378v-28hj-76wf | Medium | 0.5% | 20 Feb, 2026 | npm bn.js |
OpenClaw safeBins file-existence oracle information disclosure CVE-2026-4040, GHSA-6c9j-x93c-rw6j | Medium | 0.1% | 19 Feb, 2026 | npm openclaw |
Pannellum has a XSS vulnerability in hot spot attributes CVE-2026-27210, GHSA-8423-w5wx-h2r6 | Medium | 0.4% | 19 Feb, 2026 | npm pannellum |
Werkzeug safe_join() allows Windows special device names CVE-2026-27199, GHSA-29vq-49wr-vm6x, PYSEC-2026-2320 | Medium | 0.6% | 19 Feb, 2026 | PyPI werkzeug |
Svelte SSR attribute spreading includes inherited properties from prototype chain CVE-2026-27125, GHSA-crpf-4hrx-3jrp | Medium | 0.4% | 19 Feb, 2026 | npm svelte |
Hono added timing comparison hardening in basicAuth and bearerAuth CVE-2026-56764, GHSA-gq3j-xvxp-8hrf | Medium | 0.3% | 19 Feb, 2026 | npm hono |
OpenClaw has a Web Fetch DoS via unbounded response parsing CVE-2026-28394, GHSA-p536-vvpp-9mc8 | Medium | 0.4% | 19 Feb, 2026 | npm openclaw |
Svelte SSR does not validate dynamic element tag names in `<svelte:element>` CVE-2026-27122, GHSA-m56q-vw4c-c2cp | Medium | 0.2% | 19 Feb, 2026 | npm svelte |
Svelte affected by cross-site scripting via spread attributes in Svelte SSR CVE-2026-27121, GHSA-f7gr-6p89-r883 | Medium | 0.2% | 19 Feb, 2026 | npm svelte |
Svelte affected by XSS in SSR `<option>` element CVE-2026-27119, GHSA-h7h7-mm68-gmrc | Medium | 0.2% | 19 Feb, 2026 | npm svelte |
Cache poisoning in @sveltejs/adapter-vercel CVE-2026-27118, GHSA-9pq4-5hcf-288c | Medium | 0.3% | 19 Feb, 2026 | npm @sveltejs/adapter-vercel |
changedetection.io is vulnerable to unauthenticated static path traversal CVE-2026-25527, GHSA-9jj8-v89v-xjvw, PYSEC-2026-2124 | Medium | 1.0% | 19 Feb, 2026 | PyPI changedetection-io PyPI changedetection.io |
OpenClaw affected by Stored XSS in Control UI via unsanitized assistant name/avatar in inline script injection CVE-2026-27009, GHSA-37gc-85xm-2ww6 | Medium | 0.3% | 18 Feb, 2026 | npm openclaw |
OpenClaw hardened the skill download target directory validation CVE-2026-27008, GHSA-h7f7-89mm-pqh6 | Medium | 0.2% | 18 Feb, 2026 | npm openclaw |
OpenClaw's sandbox config hash sorted primitive arrays and suppressed needed container recreation CVE-2026-27007, GHSA-xxvh-5hwj-42pp | Medium | 0.2% | 18 Feb, 2026 | npm openclaw |
OpenClaw session tool visibility hardening and Telegram webhook secret fallback CVE-2026-27004, GHSA-6hf3-mhgc-cm65 | Medium | 0.1% | 18 Feb, 2026 | npm openclaw |
OpenClaw: Telegram bot token exposure via logs CVE-2026-27003, GHSA-chf7-jq6g-qrwv | Medium | 0.2% | 18 Feb, 2026 | npm openclaw |
pypdf possibly has long runtimes for malformed FlateDecode streams CVE-2026-27026, GHSA-9mvc-8737-8j8h, PYSEC-2026-3015 | Medium | 0.2% | 18 Feb, 2026 | PyPI pypdf |
pypdf has possible long runtimes/large memory usage for large /ToUnicode streams CVE-2026-27025, GHSA-wgvp-vg3v-2xq3, PYSEC-2026-3024 | Medium | 0.2% | 18 Feb, 2026 | PyPI pypdf |
pypdf has a possible infinite loop when processing TreeObject CVE-2026-27024, GHSA-996q-pr4m-cvgq, PYSEC-2026-3013 | Medium | 0.2% | 18 Feb, 2026 | PyPI pypdf |
RediSearch Query Injection in @langchain/langgraph-checkpoint-redis CVE-2026-27022, GHSA-5mx2-w598-339m | Medium | 4.0% | 18 Feb, 2026 | npm @langchain/langgraph-checkpoint-redis |