Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
changedetection.io is Vulnerable to SSRF via Watch URLs CVE-2026-27696, GHSA-3c45-4pj5-ch7m, PYSEC-2026-2126 | High | 0.5% | 25 Feb, 2026 | PyPI changedetection-io PyPI changedetection.io |
Parse Dashboard Has a Cache Key Collision that Leaks Master Key to Read-Only Sessions CVE-2026-27610, GHSA-jhp4-jvq3-w5xr | High | 0.4% | 25 Feb, 2026 | npm parse-dashboard |
Parse Dashboard is Missing CSRF Protection for its Agent Endpoint CVE-2026-27609, GHSA-3534-xp88-25rc | High | 0.2% | 25 Feb, 2026 | npm parse-dashboard |
Rollup 4 has Arbitrary File Write via Path Traversal CVE-2026-27606, GHSA-mw96-cpmx-2vgc | High | 1.7% | 25 Feb, 2026 | npm rollup |
Fickling: OBJ opcode call invisibility bypasses all safety checks GHSA-mxhj-88fx-4pcv | High | Not scored | 24 Feb, 2026 | PyPI fickling |
Mautic is Vulnerable to SQL Injection through Contact Activity API Sorting CVE-2026-3105, GHSA-r5j5-q42h-fc93 | High | 0.3% | 24 Feb, 2026 | Packagist mautic/core |
AVideo has Authenticated Server-Side Request Forgery via downloadURL in aVideoEncoder.json.php CVE-2026-27732, GHSA-h39h-7cvg-q7j6 | High | 0.3% | 24 Feb, 2026 | Packagist wwbn/avideo |
MindsDB: Path Traversal in /api/files Leading to Remote Code Execution CVE-2026-27483, GHSA-4894-xqv6-vrfq, PYSEC-2026-2205 | High | 11.0% | 24 Feb, 2026 | PyPI mindsdb |
Apache Superset: Read-Only Bypass via Improper Input Validation on PostgreSQL Connections BIT-superset-2026-23984, CVE-2026-23984, GHSA-mwf2-qr4v-94h2, PYSEC-2026-2376 | High | 0.4% | 24 Feb, 2026 | PyPI apache-superset |
Apache Superset Improper Authorization allows low-privileged users to bypass access controls BIT-superset-2026-23982, CVE-2026-23982, GHSA-3m2g-v7jf-7fxc, PYSEC-2026-2372 | High | 0.5% | 24 Feb, 2026 | PyPI apache-superset |
Apache Airflow vulnerable to Code Injection in the web-server context via LogTemplate table BIT-airflow-2024-56373, CVE-2024-56373, GHSA-r837-hpv7-pc2f, PYSEC-2026-2355 | High | 1.2% | 24 Feb, 2026 | PyPI apache-airflow |
Astro has memory exhaustion DoS due to missing request body size limit in Server Actions CVE-2026-27729, GHSA-jm64-8m5q-4qh8 | High | 0.5% | 24 Feb, 2026 | npm @astrojs/node |
Craft CMS has Cloud Metadata SSRF Protection Bypass via DNS Rebinding CVE-2026-27127, GHSA-gp2f-7wcm-5fhx | High | 0.5% | 23 Feb, 2026 | Packagist craftcms/cms |
yt-dlp: Arbitrary Command Injection when using the `--netrc-cmd` option CVE-2026-26331, GHSA-g3gw-q23r-pgqm, PYSEC-2026-3432 | High | 1.8% | 23 Feb, 2026 | PyPI yt-dlp |
yapi disables TLS/SSL certificate validation via rejectUnauthorized: false in Axios HTTPS agent CVE-2025-70058, GHSA-663h-2vr3-ghrj | High | 0.2% | 23 Feb, 2026 | npm yapi-vendor |
Moodle has a Remote Code Execution risk via file restore BIT-moodle-2026-26045, CVE-2026-26045, GHSA-ggxq-2mg9-8966 | High | 0.6% | 21 Feb, 2026 | Packagist moodle/moodle |
MLflow Tracking Server Artifact Handler Directory Traversal Remote Code Execution Vulnerability CVE-2026-2033, GHSA-q2r8-vmq7-fpx2, PYSEC-2026-2658 | High | 1.8% | 20 Feb, 2026 | PyPI mlflow |
Google Cloud Vertex AI has a a vulnerability involving predictable bucket naming CVE-2026-2473, GHSA-wh2j-26j7-9728, PYSEC-2026-2500 | High | 0.5% | 20 Feb, 2026 | PyPI google-cloud-aiplatform |
Google Cloud Vertex AI SDK affected by Stored Cross-Site Scripting (XSS) CVE-2026-2472, GHSA-qv8j-hgpc-vrq8, PYSEC-2026-2499 | High | 0.6% | 20 Feb, 2026 | PyPI google-cloud-aiplatform |
Zumba Json Serializer has a potential PHP Object Injection via Unrestricted @type in unserialize() CVE-2026-27206, GHSA-v7m3-fpcr-h7m2 | High | 0.8% | 19 Feb, 2026 | Packagist zumba/json-serializer |
OpenClaw has a path traversal in apply_patch could write/delete files outside the workspace CVE-2026-32060, GHSA-r5fq-947m-xm57 | High | 0.8% | 19 Feb, 2026 | npm openclaw |
Feathers exposes internal headers via unencrypted session cookie CVE-2026-27193, GHSA-9m9c-vpv5-9g85 | High | 0.4% | 19 Feb, 2026 | npm @feathersjs/authentication-oauth |
Feathers has an origin validation bypass via prefix matching CVE-2026-27192, GHSA-mp4x-c34x-wv3x | High | 0.3% | 19 Feb, 2026 | npm @feathersjs/authentication-oauth |
Feathers has an open redirect in OAuth callback enables account takeover CVE-2026-27191, GHSA-ppf9-4ffw-hh4p | High | 0.3% | 19 Feb, 2026 | npm @feathersjs/authentication-oauth |
Formwork Improperly Managed Privileges in User creation CVE-2026-27198, GHSA-34p4-7w83-35g2 | High | 0.5% | 19 Feb, 2026 | Packagist getformwork/formwork |
Statamic affected by privilege escalation via stored cross-site scripting CVE-2026-27196, GHSA-8r7r-f4gm-wcpq | High | 0.3% | 19 Feb, 2026 | Packagist statamic/cms |
CPU exhaustion in SvelteKit remote form deserialization (experimental only) CVE-2026-82261, GHSA-88qp-p4qg-rqm6 | High | 0.5% | 19 Feb, 2026 | npm @sveltejs/kit |
Memory exhaustion in SvelteKit remote form deserialization (experimental only) CVE-2026-82260, GHSA-vrhm-gvg7-fpcf | High | 0.5% | 19 Feb, 2026 | npm @sveltejs/kit |
D-Tale affected by Remote Code Execution through the /save-column-filter endpoint CVE-2026-27194, GHSA-c87c-78rc-vmv2, PYSEC-2026-2461 | High | 0.8% | 19 Feb, 2026 | PyPI dtale |
eBay API MCP Server Affected by Environment Variable Injection CVE-2026-27203, GHSA-97rm-xj73-33jh | High | 0.4% | 19 Feb, 2026 | npm ebay-mcp |
Open WebUI vulnerable to Stored XSS via iFrame embeds in response messages CVE-2026-26193, GHSA-vjm7-m4xh-7wrc, PYSEC-2026-2760 | High | 0.2% | 19 Feb, 2026 | PyPI open-webui |
Open WebUI vulnerable to Stored XSS via iFrame in citations model CVE-2026-26192, GHSA-xc8p-9rr6-97r2, PYSEC-2026-2769 | High | 0.2% | 19 Feb, 2026 | PyPI open-webui |
OpenClaw replaced a deprecated sandbox hash algorithm CVE-2026-28479, GHSA-fh3f-q9qw-93j9 | High | 0.2% | 19 Feb, 2026 | npm openclaw |
jsPDF has a PDF Injection in AcroForm module allows Arbitrary JavaScript Execution (RadioButton.createOption and "AS" property) CVE-2026-25940, GHSA-p5xg-68wr-hm3m | High | 0.5% | 19 Feb, 2026 | npm jspdf |
jsPDF has a PDF Object Injection via Unsanitized Input in addJS Method CVE-2026-25755, GHSA-9vjf-qc39-jprp | High | 1.0% | 19 Feb, 2026 | npm jspdf |
jsPDF Affected by Client-Side/Server-Side Denial of Service via Malicious GIF Dimensions CVE-2026-25535, GHSA-67pg-wm7f-q7fj | High | 0.8% | 19 Feb, 2026 | npm jspdf |
Fabric.js Affected by Stored XSS via SVG Export CVE-2026-27013, GHSA-hfvx-25r5-qc3w | High | 0.3% | 18 Feb, 2026 | npm fabric |
OpenClaw: Docker container escape via unvalidated bind mount config injection CVE-2026-27002, GHSA-w235-x559-36mg | High | 0.5% | 18 Feb, 2026 | npm openclaw |
OpenClaw: Unsanitized CWD path injection into LLM prompts CVE-2026-27001, GHSA-2qj5-gwg2-xwc4 | High | 0.2% | 18 Feb, 2026 | npm openclaw |
minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern CVE-2026-26996, GHSA-3ppc-4f35-3m26 | High | 0.6% | 18 Feb, 2026 | npm minimatch |
Command Injection via Unsanitized `locate` Output in `versions()` — systeminformation CVE-2026-26318, GHSA-5vv4-hvf7-2h46 | High | 1.3% | 18 Feb, 2026 | npm systeminformation |
LibreNMS has a Time-Based Blind SQL Injection in address-search.inc.php CVE-2026-26990, GHSA-79q9-wc6p-cf92 | High | 4.5% | 18 Feb, 2026 | Packagist librenms/librenms |
Systeminformation has a Command Injection via unsanitized interface parameter in wifi.js retry path CVE-2026-26280, GHSA-9c88-49p5-5ggf | High | 1.4% | 18 Feb, 2026 | npm systeminformation |
Improper Control of Generation of Code ('Code Injection') in @tygo-van-den-hurk/slyde CVE-2026-26974, GHSA-w7h5-55jg-cq2f | High | 0.6% | 18 Feb, 2026 | npm @tygo-van-den-hurk/slyde |
OpenStack Nova calls qemu-img without format restrictions for resize CVE-2026-24708, GHSA-m4f3-qp2w-gwh6, PYSEC-2026-2685 | High | 0.4% | 18 Feb, 2026 | PyPI Nova PyPI nova |
Picklescan (scan_pytorch) Bypass via dynamic eval MAGIC_NUMBER CVE-2026-53875, GHSA-97f8-7cmv-76j2, PYSEC-2026-2873 | High | 0.6% | 18 Feb, 2026 | PyPI picklescan |
OpenClaw has an authentication bypass in sandbox browser bridge server CVE-2026-28468, GHSA-h9g4-589h-68xv | High | 0.1% | 18 Feb, 2026 | npm openclaw |
OpenClaw has two SSRF via sendMediaFeishu and markdown image fetching in Feishu extension CVE-2026-28451, GHSA-x22m-j5qq-j49m | High | 0.3% | 18 Feb, 2026 | npm openclaw |
OpenClaw has a LFI in BlueBubbles media path handling CVE-2026-29611, GHSA-rwj8-p9vq-25gv | High | 0.3% | 18 Feb, 2026 | npm openclaw |
OpenClaw: Prevent shell injection in macOS keychain credential write CVE-2026-27487, GHSA-4564-pvr2-qq4h | High | 1.4% | 18 Feb, 2026 | npm openclaw |