Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
@vue/server-renderer: XSS via missing CR in attribute-name blacklist GHSA-g2v6-rqmx-r4w6 | High | Not scored | 24 days ago | npm @vue/server-renderer |
Quart leaks raw request body (incl. plaintext passwords) to stdout via stray debug print in Body.__await__ GHSA-v853-p72q-4cfw | High | Not scored | 24 days ago | PyPI quart |
Docling: `enable_local_fetch` is not enforced in HTML browser-rendering mode CVE-2026-105750, GHSA-q43m-vhcp-mhvm, PYSEC-2026-4196, PYSEC-2026-4215 | High | 0.4% | 24 days ago | PyPI docling PyPI docling-slim |
Docling imports plugin entry points before the allow_external_plugins check CVE-2026-105745, GHSA-9jxx-vjrv-h2rq, PYSEC-2026-4192, PYSEC-2026-4210 | High | 0.1% | 24 days ago | PyPI docling PyPI docling-slim |
Docling has arbitrary file read/write (and command execution when shell-escape is enabled) when rendering untrusted TikZ with the opt-in Tectonic engine CVE-2026-105744, GHSA-x3q2-h9hx-4r4j, PYSEC-2026-4191, PYSEC-2026-4216 | High | 0.4% | 24 days ago | PyPI docling PyPI docling-slim |
Langflow: IP Spoofing Bypass via `X-Forwarded-For` Allowing Remote Configuration Write CVE-2026-105741, GHSA-4f6c-2vvp-gw82, PYSEC-2026-4229 | High | 0.2% | 24 days ago | PyPI langflow |
Langflow has Authenticated Cross-Project File Disclosure via Unscoped MCP Resource Handlers CVE-2026-105699, GHSA-4hmc-cfm3-w43c, PYSEC-2026-4230 | High | 0.3% | 24 days ago | PyPI langflow |
Ghost: Stored XSS via File Uploads on Local Storage BIT-ghost-2026-104411, BIT-ghost-2026-105679, CVE-2026-104411, CVE-2026-105679, GHSA-gfjp-2p8f-94qv | High | 0.3% | 24 days ago | npm ghost |
Ghost: Remote Code Execution via Theme Translation Files BIT-ghost-2026-104418, BIT-ghost-2026-105677, CVE-2026-104418, CVE-2026-105677, GHSA-jj74-hc2q-xrvm | High | 0.7% | 24 days ago | npm ghost |
Ghost: Invite Token Disclosure in Ghost Admin API BIT-ghost-2026-104416, BIT-ghost-2026-105675, CVE-2026-104416, CVE-2026-105675, GHSA-v6q3-xqxm-6f5v | High | 0.4% | 24 days ago | npm ghost |
Ghost: Stored XSS via Bookmark Card Images BIT-ghost-2026-104413, BIT-ghost-2026-105651, CVE-2026-104413, CVE-2026-105651, GHSA-347q-26qq-h2p6 | High | 0.3% | 24 days ago | npm ghost |
Ghost: Stored XSS via oEmbed Photo Responses BIT-ghost-2026-104414, BIT-ghost-2026-105650, CVE-2026-104414, CVE-2026-105650, GHSA-v3xr-g6p2-fvgv | High | 0.3% | 24 days ago | npm ghost |
Ghost: Stored XSS via SVG Uploads Bypassing Sanitization BIT-ghost-2026-105649, CVE-2026-105649, GHSA-8575-cr6v-7jh4 | High | 0.3% | 24 days ago | npm ghost |
Ghost: Stored XSS via Embed Card Previews BIT-ghost-2026-105643, CVE-2026-105643, GHSA-69qc-f5m6-889c | High | 0.3% | 24 days ago | npm ghost |
Ghost: Remote Code Execution via Bookmark Card Images BIT-ghost-2026-105642, CVE-2026-105642, GHSA-788w-68h3-cvxp | High | 0.3% | 24 days ago | npm ghost |
mppx-condition-gate: Free-access path grants on a self-declared wallet without proving control CVE-2026-104891, GHSA-jg6q-3qfh-r9f8 | High | 0.3% | 24 days ago | npm @insumermodel/mppx-condition-gate npm @insumermodel/mppx-token-gate |
Kunstmaan CMS: MediaBundle extension blacklist bypass allows authenticated administrators to upload executable PHP files leading to remote code execution CVE-2026-104890, GHSA-p279-5wcv-45vq | High | 0.4% | 24 days ago | Packagist kunstmaan/bundles-cms Packagist kunstmaan/media-bundle |
Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability CVE-2026-88779 | HighExploited | 11.4% | 26 days ago | |
Vibe-Trading file-read tools expose arbitrary server-readable files CVE-2026-114106, GHSA-5rmq-chc7-m22f | High | 0.4% | 27 days ago | PyPI vibe-trading-ai |
Trigger.dev: Cross-tenant SQL injection in the TSQL query compiler (POST /api/v1/query) via unsanitized window-function name CVE-2026-114081, GHSA-9q4r-4842-93vw | High | 0.4% | 27 days ago | npm trigger.dev |
Trigger.dev: Missing Authentication in Run Replay Action Allows Cross-Organization Task Execution (IDOR) GHSA-pp95-gc86-jq6q | High | Not scored | 27 days ago | npm trigger.dev |
LangGraph SDK custom auth silently ignores actions= on resource decorators CVE-2026-104873, GHSA-fvww-7h3r-vfhp, PYSEC-2026-4240 | High | 0.3% | 27 days ago | PyPI langgraph-sdk |
Dulwich: Arbitrary File Write (RCE) on Windows via Unvalidated Drive Letters in Tree Paths CVE-2026-114094, GHSA-8mcx-5rqc-vhmf | High | 0.9% | 27 days ago | PyPI dulwich |
Dulwich: Infinite Loop Denial of Service (DoS) in Packfile Object Resolution CVE-2026-114095, GHSA-35mr-4567-66vg | High | 0.3% | 27 days ago | PyPI dulwich |
Dulwich: Symlink write-through in checkout(paths=[]) via raw os.open bypasses all symlink protections CVE-2026-114096, GHSA-8w8g-wq8h-fq33 | High | 0.2% | 27 days ago | PyPI dulwich |
Dulwich: Symlink directory traversal in filter-branch index_filter via cross-commit state persistence CVE-2026-114097, GHSA-5fqc-mrg8-w798 | High | 0.2% | 27 days ago | PyPI dulwich |
Dulwich: Symlink directory traversal in stash pop allows arbitrary file write via intermediate directory symlinks CVE-2026-114098, GHSA-cm62-gvxx-vmxx | High | 0.2% | 27 days ago | PyPI dulwich |
probe-image-size: Quadratic-time Denial of Service in the SVG Parser CVE-2026-104861, GHSA-gjj5-9665-rwrc | High | 0.4% | 27 days ago | npm probe-image-size |
@nx/docker: OS command injection in the @nx/docker release pipeline CVE-2026-104859, GHSA-6vc5-vf29-ffr2 | High | 0.1% | 27 days ago | npm @nx/docker |
Nx daemon and plugin worker sockets are accessible to other local users CVE-2026-104854, GHSA-w3vv-58gj-gw77 | High | 0.1% | 27 days ago | npm nx |
fsspec: Server-Side Template Injection in ReferenceFileSystem leads to Remote Code Execution CVE-2026-104851, GHSA-27vj-qcqg-25rc, PYSEC-2026-4217 | High | 0.5% | 27 days ago | PyPI fsspec |
Next.js has Server-Side Request Forgery in Image Optimization CVE-2026-94483, GHSA-cjq9-62q9-8jv4 | High | 0.3% | 27 days ago | npm next |
ProseMirror has a XSS vulnerability in prosemirror-view's paste handling CVE-2026-104847, GHSA-c8x8-7fp4-3x9w | High | 0.3% | 27 days ago | npm prosemirror-view |
Seroval: Memory exhaustion via unchecked TypedArray length in JSON deserialization CVE-2026-104845, GHSA-jp82-f5mq-hwhp | High | 0.4% | 27 days ago | npm seroval |
figlet is vulnerable to denial of service via unbounded loop when whitespaceBreak is used with a small width CVE-2026-96780, GHSA-62ch-8vmq-8xm7 | High | 0.5% | 28 days ago | npm figlet |
Zod can exhaust memory while validating oversized constrained collections CVE-2023-54404, GHSA-mrhx-c7xc-m3w5 | High | 0.3% | 28 days ago | npm zod |
GraphQL Tools: TLS Certificate Validation Disabled in Legacy GraphQL WebSocket Executor CVE-2026-103921, GHSA-6fw5-9hq8-w87g | High | 0.3% | 28 days ago | npm @graphql-tools/executor-legacy-ws |
devalue: Repeated primitive strings cause quadratic expansion in uneval GHSA-mcm9-63f2-9j32 | High | Not scored | 28 days ago | npm devalue |
devalue: Custom ArrayBuffer revivers can bypass typed-array allocation validation GHSA-r9w8-h9r3-54w4 | High | Not scored | 28 days ago | npm devalue |
devalue: stringifyAsync can cause an unhandled rejection despite a caught returned promise GHSA-x5rw-q4pp-hg5g | High | Not scored | 28 days ago | npm devalue |
Ghost: Authorization Bypass in Comment Like Feature BIT-ghost-2026-103288, CVE-2026-103288, GHSA-qrh6-cwg3-343x | High | 0.2% | 28 days ago | npm ghost |
tornado: CurlAsyncHTTPClient enforces no response-size limit — decompression bomb drives unbounded memory accumulation to OOM CVE-2026-103262, GHSA-chx6-46f5-w4vp | High | 0.6% | 29 days ago | PyPI tornado |
Tornado: StaticFileHandler follows symlinks outside static root (path traversal) CVE-2026-103263, GHSA-c2m8-h5v5-343r | High | 0.5% | 29 days ago | PyPI tornado |
pypdf: Possible large memory usage when retrieving alphabetical page labels CVE-2026-103000, GHSA-w23x-9jrw-r45c, PYSEC-2026-4160 | High | 0.4% | 29 days ago | PyPI pypdf |
pypdf: Possible long runtimes with large amount of embedded files CVE-2026-102999, GHSA-v247-6f48-mgcj, PYSEC-2026-4159 | High | 0.3% | 29 days ago | PyPI pypdf |
pypdf: Possible long runtimes when generating appearance streams CVE-2026-102998, GHSA-php9-fj8v-98fj, PYSEC-2026-4157 | High | 0.3% | 29 days ago | PyPI pypdf |
pypdf: Possible long runtimes for partially malformed FlateDecode streams (Follow-up) CVE-2026-102997, GHSA-jw7q-gvrg-4vj3, PYSEC-2026-4156 | High | 0.3% | 29 days ago | PyPI pypdf |
pypdf: Possible large memory usage when parsing font data CVE-2026-102996, GHSA-g9cg-prrw-2r8q, PYSEC-2026-4155 | High | 0.3% | 29 days ago | PyPI pypdf |
pypdf: Possible large memory usage for large /ToUnicode streams (Follow-up 2) CVE-2026-102995, GHSA-fp3h-c4fm-7vvf, PYSEC-2026-4154 | High | 0.3% | 29 days ago | PyPI pypdf |
pypdf: Possible long runtimes/large memory usage when parsing indirect objects CVE-2026-102994, GHSA-5jq2-8x83-x246, PYSEC-2026-4153 | High | 0.3% | 29 days ago | PyPI pypdf |